Tag Info

New answers tagged

0

Another help could be simply not ping the port and scan with -sV using -Pn as the do not ping option. It gives results!!!!


0

Having assessed the risk of turning my iptables off for a few minutes, these would be my first steps: stop the iptables process to allow the open-source app to initiate a connection home (again, only if you feel safe doing this) run netstat -lntp | less. This list should tell you the destination IPs that your box is connecting to. If you find the ones you ...


1

You mention that TCP requests are (often) from randomized ports, but what about RESPONSES? An HTTP request might come from a random source port, but the reply will come from a known source port (80/443/ etc.). Sometimes you want control over the responses as well as incoming requests.


2

One example where source port with TCP is necessary is active ftp. In this case the client (inside the firewall) listens on a kind of random port on the client for the data connection and notifies the server about this addr+port using the PORT command. The server then connects from port 20 - and this is the only restriction you can set if you need to allow ...


6

Using the OSI model of layers is often a good way to spread confusion; it was not initially meant for TCP/IP, and TCP/IP always had trouble fitting in it. When data is encrypted, it can no longer be understood by whoever does not know the decryption key. However, firewalls don't look at all the data, and encryption does not encrypt everything, because the ...


1

The source port is usually randomly selected, however applications do have the option to specify a source port. It's within the realm of possibility that someone would want to filter on a specific source port, although it is extremely rare. In the past I've seen source port rules used in order to permit audio and video streaming when the firewall's H.323 ...


2

ISP will routinely do the following for their customers: Block incoming connections on some well-known ports (e.g. port 139, the classic port for Windows file sharing). Block spam, virus and other malware sent over email. "Block" some sites by removing the DNS mappings (the customer can still access them, but the ISP DNS server will not resolve the names). ...


2

Thoughts around this: There are numeral factors that matter in such an enviroment. How much are you willing to spend on 'proper' firewalls and/or IT-security in general? Some hardware for an opensource firewall is not so much compared what can be expensive if some information gets exposed. Firewalls in general does not need to be expensive, have a look at ...


1

Many routers - even in the consumer-segment - have basic network filtering capabilities based on protocol, port and IP, which means that they can also be used as a basic firewall. Dedicated firewall appliances often offer additional features, like deep-packet inspection to detect certain known threats on the protocol-level or automatic attack detection based ...


0

Blocking all originating traffic with source port 53 will not solve your issue. DNS Amplification attack is sort of a volumatric DDOS attack, no matter how good your firewall can block/handle the bad traffic, your pipeline will still be bursted. You want to block the DNS spoof traffics as close to the internet edge as possible. Try contact the ISP for ...


-3

First option is wrong because you will turn the firewall into a router, and firewalls should not be routers. Second option is good, but you can add that second firewall to the internet, but keep the DMZ on the internal Firewall. DC


1

It appears to be the name they're using for their content filtering system. I think they provide enough information to establish that, once you understand that ISPs are trying to get out ahead of legal regulation. The main indicator to me is the fact that it's on by default, which is exactly what Cameron demanded. If you know what Sky broadband had before ...


2

This is going to vary depending on your specific situation, policies you are trying to enforce, and regulatory compliance requirements. Generally, a web-app has a front-end and a back end. The front-end is responsible for handling user traffic, display/presentation of data, and authentication. The back-end is usually a database of some sort that handles ...


1

what about running virtualbox on your windows machine, and in a new virtual machine you run something more secure like debian linux, and run apache web server on that ? then you can use the iptables on linux and the general security that comes with linux. or simply install linux directly on the host. I am sorry but if you want a secure system, running a ...


1

Right now my main concern is privacy, so I may ignore advice on other security issues. You are exposing at the very least your IP address, which can be mapped to a specific location, so that sounds like minus points for privacy. The firewall's purpose is to limit access to services. It does not prevent "bad" traffic on port 80 which then installs ...


4

It isn't a game of magic ports used by hackers. If there isn't a service running on the port, it's unlikely in the extreme to result in a compromise, but it's nonetheless a good idea to use a strong firewall, especially on windows where lots and lots of services are running by default. That said, if someone is going to compromise your web server, they will ...


-1

i wish i knew more about computers… i try to hang, but i understand if they want to break in and break the law they will… i just want to know why isn't everyone being targeted? it seems like only a few of us are targets. most kids using TOR or downloading from the internet don't seem to be targets. anyway, i've been noticing strange stuff on all the ...


0

A firewall rule would not be reversed by a firewall later in line. It would be one block then another block. The second firewall would only be dealing with traffic the first firewall did not block. While this will not be any more dangerous, you may also not have anything to test with your test firewall. You could put your test firewall in front of the real ...


5

I applaud your desire to create your own firewall in order to understand them better. What I would suggest is creating a VM and deploy and test your firewall on that. You risk nothing this way because you are in a closed environment. As further advice, try looking at iptables (Linux) and play with custom rulesets before you create your own programs. Use ...


0

If it were me, then my first line of defence for a co-located server would be on the server itself. I don't have access to all the other devices involved in moving data around the data centre. I don't have time to test every change applied in the data centre (even if the operators told me about it). What you describe can be implemented in a few stateless ...



Top 50 recent answers are included