Tag Info

New answers tagged

0

Windows Firewall if is enabled blocks unsolicited connections to your computer. So any programs can connect to internet if user's actions make that happent but no connection can inbound whitout a previously demand. In conclusion: no IN without OUT and vice versa no OUT denies IN.


0

FWbuilder might be of interest to you http://www.fwbuilder.org/ This is a GUI tool to help you configure and distribute (i.e. push) firewall configurations for various firewall implementations. It 'compiles' network access rules and firewall configuration options into version specific syntax and can push it through SSH to many firewall implementations like ...


0

Technically, the list of treatments is a bit longer (event if we consider only RFCs) - there's ICMP type 3, code 2 (protocol unreachable). There's ICMP type 3, code 4 (unreachable, fragmentation needed) when doing MTU path discovery. There's ICMP redirect (a bit esoteric, eh?). Keep in mind that these days you'll be dealing with multi-layer firewalls/NGN ...


2

The difference is in the amount of information you provide to the sender of the packet. says, essentially: "No-one here. Your SYN packet went to nirvana." It provides the least amount of information to the other end. It also slows down attackers because they have to wait for a timeout. says: "Forbidden. There's someone here but they don't want to talk to ...


0

Off the top of my head, one obvious reason is that it forces the scanner to take longer to determine whether a service is present on a given port or not. It doesn't know whether packets were dropped on the path, or the path to the server it's accessing just has a long RTT, or there's a default DROP firewall policy. And anything that slows down attackers, and ...


0

You understand the situation correctly; there is minimal benefit in dropping traffic to closed ports. However, it is still considered "best practice". I think the reason ShieldsUP would report this is that is could indicate a configuration error. If a firewall admin intends to block all the closed ports, and misses one for some reason, this is something ...


0

I would put it down to defence in depth. Yes, you could configure your services to listen to only localhost or your internal network. Even when properly configured, there is still a possibility that due to a bug in the code, it mistakenly accepts all traffic. Services which accept UDP packets may also be vulnerable to an IP spoofing attack. TCP is resistant ...


0

There's a couple of different spins that can be put on your question, but I'm going to address Is it better to DROP for non-allowed ports than to REJECT? Dropping packets - silently, no TCP RST or ICMP Prohibited - is preferable for at least two reasons. It slows down scanners that are trying to hit a large number of your ports, because they don't get ...


2

Employing a default DROP rule for all ports except the ones originally intended(for a website these are 80/443) reduces the attack surface of the given stations on the network. It's much more convenient(and cheaper) to drop packets instead of configuring a service so that it is secure with regards to a given policy.


1

I think the question you are really asking here is if the two devices can be used to provide effective layers of security. Yes they can but the degree of security will depend on the configuration and capabilities of each device. I recently took a SANS course in which the instructor suggested having a router in front of a firewall doing basic packet ...


1

How to diagnose if you are under a brute scan or a targeted attack? If you have the possibility to do so, keep free a specific public @IP within your network. Register it correctly on the DNS as a typical name for a web server. But don't attribute this @IP to any real machine within your network. I mean don't go as far as to create a honey pot, just create ...


0

It is difficult to know whether you are being targeted specifically. It is very likely that you are getting hit with automated scans that can be ignored as long as you have configured your firewall to block all incoming traffic. Phishing attacks and outbound connections to malicious sites are much more serious as they are more likely to succeed. Here is a ...


5

Being hit hundreds or thousands of times per day is completely normal, and I wouldn't worry about it at all. There are a few major sources of suspicious traffic: Automated scanners. A number of organizations "map" the Internet and produce a ton of traffic. They do so more or less randomly. I've gotten a lot of traffic on ports 80 and 443 despite not ...


0

Can't we, as a web owner, resolve issue by ourselves? No, simply because you have less bandwidth than your upstream provider... who may have less than a DDoS mitigation service. The attackers throw lots of bandwidth-consuming traffic at you - if you're paying for a 100 Mbps Internet connection, and they throw 1 Gbps traffic at you, you'll be overloaded ...


-3

You can mitigate 99% of the DDOS attacks yourself with a front end load balancer


2

CloudFlare works very well. You can learn more about what they actually do to protect your site from this talk: https://www.youtube.com/watch?v=w04ZAXftQ_Y It's not really possible to deal with such attacks on your own. Maybe in the earlier times, when such attacks were not very sophisticated, you could block off some traffic with your firewall, but now ...


3

Distributed Denial of Service attacks work because they use multiple (sometimes thousands) of hosts sending traffic to your site to overwhelm your resources. This is not something you, as the target, can remedy. Cloud services, like the ones you mentioned, modify and limit the traffic to your site, and to do that, they need access along the path between your ...


-3

Yes, they work. No you cannot generally solve this yourself, but there are things you can do to mitigate SOME of the problem.


1

But it is only about making channels unidirectional. It suggests that security for bidirectional channels has already been solved, but I cannot find more information. It suggests that a bi-directional channel is simply a pair of uni-directional channels. Btw, they hardly "solve" the problem of uni-directional channels, due to the "back channels" ...


0

Are there firewalls we can use that have domain based rules, instead of IP based so our API requests continue to arrive un-interrupted yet we continue to block all other outbound connections? Yes, although usually through a proxy functionality rather than a traditional firewall rule sense. For example, the Check Point URL Filtering Software Blade ...


1

A web proxy is the part of an Application Layer Firewall which does Content Inspection for connections from client (i.e. browser) to the web server. It resides on the side of the client and its task is to protect the client against malware etc. A Web Application Firewall (WAF) is a different part of an Application Layer Firewall which also does Content ...


0

I note that you've gotten your answer from the comments, but I will chime in and create a proper answer to this question. a CDN works just like a regular hosting company. You pay for diskspace, and the CDN makes sure the content you upload is available to you, and often distributed around the globe for faster access. Anyone who has the cash can register and ...


0

Requirements vary per organization (EX. Lockheed Martin probably wouldn't want their code for fighter jets accessed from outside the development environment ). While the CompTIA context is extremely broad, remember firewalls don't just prevent access between outside forces and your internal network. The are also used internally in larger organizations to ...


1

The only real reason to prevent a network from being routable through a firewall is to make sure it's isolated both from external and internal unauthorized access. It's impossible for someone to hack into a system if there is no physical path for electrons to travel from their position to the target system's position. By unplugging any cables linking the ...


2

DPI threats against OpenVPN is pretty hard, unless the attacker somehow grabs the random, freshly generated session keys which is transmitted over an SSL connection. The SSL connection, in turn, is secured using a pre-shared certificate and a secret server certificate. So an attacker would need to compromise the server itself. Usually, said attackers would ...



Top 50 recent answers are included