Tag Info

Hot answers tagged

4

Maybe you are thinking of: Ingress which indicates inbound flow, for instance flows coming from Internet to your LAN/DMZ, Egress which indicates outbound flow, for instance flow leaving your LAN toward the Internet. These will be handled in quite a different way regarding your firewall policy. If you are just referring to data coming to the firewall ...


2

What you're looking for is network data loss prevention. There are some costly solutions from Code Green Networks, Symantec, etc. One free and GNU GPL-licensed ones is MyDLP (specifically you'll want the MyDLP-Network product) that does this.


2

The most simple way to block traffic by IP address is to use pf (man pf.conf). Here's a simple script to help you get started. Warning Be sure to read the manual pages for more information and before running this. # enable: sudo pfctl -e -f pf.rules # disable: sudo pfctl -d set block-policy drop set fingerprints "/etc/pf.os" set ruleset-optimization basic ...


1

As a general rule of thumb, running other services on security-related devices such as firewalls should be kept to a minimum. In other words, a firewall should ideally only be a firewall, and nothing else. The more services you run, the more likely one of them will contain a vulnerability that can allow an attacker to take over the machine. If that machine ...


1

Here are some flaws I can think of: SMS spoofing is trivial (e.g. at work I use an online SMS sending service which lets me set any arbitrary alphanumeric sequence as the sending number), meaning the only security that the whitelisting step is providing is that the attacker must know which numbers are on the whitelist. In a typical scenario such ...


1

You could (should ?) also : disable ssh root login (You can still use sudo to do system administration) Disable password authentication and enable key authentication


1

You can use wireshark for sniffing packets and getting every kind of information from that. Wireshark is opensource project Check out its official page: https://www.wireshark.org/


1

First, websocket connections are initialized from javascript which gets executed by the web browser on the client. That means typical websocket connections are outbound connections, not inbound connections. Inbound websocket connections would only be possible when the host runs a websocket server. A normal browser will usually not do this. And even when the ...



Only top voted, non community-wiki answers of a minimum length are eligible