New answers tagged

3

A firewall is just some device or software which filters the network traffic. This can be done at the packet level (usually called packet filter firewall (PFL) or layer 3,4 firewall) but also at the application level (usually called application level firewall (ALG), secure web/mail gateway (SG, SWG...) or similar). You'll often find both PFL and ALG ...


0

You can whitelist Ips you want to allow and only allow approved ip addresses. It's initially painful, but doesn't depend on questionably maintained blacklists. Default deny is the most effective way to secure traffic coming into or leaving your network.


0

Yes for end-user to site many people do this you just have to figure out how to get the VPN to use a centralized authentication system which you can tie into a 2FA system. For site to site you can also do this but just keep in mind that if the link goes down for any reason you'll keep the network down until you can get the 2FA entered. One indirect ...


2

Depending on the type product you are asking about and the environment you are trying to defend there are several pluses and minuses. Some potential pluses depending on the product: Pluses: 1.) This isn't the norm but if you are talking about managed firewall services the product may have integration with larger analytic databases which allow the ...


2

If you really, really want to use only the firewall, your best bid is to copy/paste this list manually in your firewall since this is your only option of blocking adult-content from Firewall! As other may have advised, OpenDNS, is good option regarding different packages of filtration. Note, some have reported that openDNS does not always provide the best ...


1

You need to rely on someone else's judgement. If you just don't want to install 3rd party software, you can switch your DNS to OpenDNS, register an account and rely on their filtering. Refer to FamilyShield Parental Controls for more information. Other than that you can use Windows native parental controls, however there is some controversy about privacy, ...


2

Your best bet may be to head over to OpenDNS.com and setup your network interfaces to block sites by category according to your preferences. You simply replace your current DNS ips with 208.67.220.220 and 208.67.222.222. It's a free, maintenance free solution that additionally offers some protection against the DNS attacks that we are seeing frequently today....


1

First and foremost you can adopt a firewall policy of "allow what's needed, block the rest". That will only go so far because your malicious outgoing link may take advantage of a hole you have poked in the firewall. Enterprise grade products will "hook" certain functions like connect(). By hooking the function an analysis engine determines if the connection ...


1

You'd be surprised how successful something like this can be - especially for a typical user who may not have any security controls in place. Also, I would argue that if you are able to convince a user to execute code you have provided, a malicious exploit is probably not even necessary - (i.e. "Microsoft Tech Support calls" that obtain remote access to ...


2

There are a number of ways that people attempt to mitigate these attacks. External Prevent spam filter from allowing MIME types frequently associated with malware (it's highly unlikely there is a business relevant reason to send .exe or .bat files for instance) Use Anti-Virus as .exe's can be detected even after several rounds of encoding. Preferably you'...


0

Biggest issue to me in removing NAT is the reduction of privacy. With IPv6 I notice all my LAN devices have a unique public IPv6 address, which allows each device on a LAN to be identified uniquely. Which then allows easier identification of individual devices and users. Privacy implications like the ability to track your activity across domains. Ad ...


1

To be honest it is smart to filter some outbound ICMP both router level and software firewall level as a extra layer of security. It my not be pertinent to stopping a DoS or DDoS but malicious people still use ICMP to try and retrieve as much information about a network as possible before they attempt to breach it. I am not saying they ONLY use ICMP but ...


1

If an attacker has managed to install software on your PC, that software can initiate a connection to an outside system, unless you have configured your firewall to block outgoing traffic as well. This connection can carry back data to your PC, even through your firewall, the same way a web browser receives data from a web server. And if you block outgoing ...


2

set the firewall to BLOCK ALL TRAFIC... If you manage to set the firewall to block all incoming and outgoing traffic then you cut off the access for the attacker as long as the firewall is set in this mode. But note that if the attacker is already on your system he might have installed software to monitor the system and can later retrieve the collected ...


1

You can choose to encrypt internal traffic with a lower-key certificate. And it's also advised to position your load balancer as near as possible to your servers to prevent sniffing or man-in-middle attacks. SSL termination can be done at the Load Balancer to offload CPU intensive jobs away from web servers. If the LB brand you have chosen can do certain ...


1

All Linux and BSD-based firewalls are just a management UI over their respective IS kernel's firewall feature. If you want remote access and scripting functions, you can use standard remote management and scripting tools of the base OS, namely, SSH and shell scripts. The firewall products that support web administration can also be remotely accessed by ...


0

In short as long as the firewall has a port open to the outside world, you could run a web server and use it to configure the system/network. Technically, even an open SSH port could be used to manage your firewall. Technically you can add Apache or nginx to any Linux distro, and therefore have the ability to have remote management. You would have to ...


8

... because firewall does not have trusted root certificates. The firewall does have a set of trusted root certificates. They are not necessarily exactly the same as the client has in the browser but there will be overlap for the commonly used CA. And it might even be intentional to let the firewall trust less CA then the browser does.


0

Generally, the accepted best practice for management interfaces is to segregate them into their own VLAN and apply filtering so that only certain whitelisted (read jump boxes) are authorized to communicate with devices via the management interface. The security concern is that many times management interfaces have: Known vulnerabilities (e.g., HP SMH ...


0

Try only with the target ip specified: ettercap -i wlan0 -T -M arp -P dns_spoof /TARGET IP///


3

DNS does not use ICMP. It uses UDP (and rarely TCP) port 53. The firewall/router the captive portal contols either does not block that port or it is the DNS server and is responding. All other traffic are of course blocked until you log in. Response to comment: For 2), UDP has no session control, i.e. it just sends a packet without checking if it has ...


1

In the drawing below you have three networks which are connected though a firewall. The role of the firewall is to limit the traffic between these networks. Limiting the traffic means that you can decide that only traffic going to a certain port (say, 22) is allowed, how often you can connect to a given host from another one etc. There is nothing special ...


1

Is it an actual piece of hardware? (I have seen both hardware and software online). as you stated, it can be both. Windows has a built in firewall ... but there are also hardware devices that are dedicated to the task (usually for larger networks) How do firewalls work in tandem with Active Directory? Um, it doesn't? Unless I am missing something ...


0

Sadly this is a question for your IT department. Without having advanced knowledge of your system's infrastructure and if the firewall is before, after, or on the ATT router we can't say anything for certain, or even a simple guess... You need to talk to IT with your concerns and get it cleared up by them. They are the only ones who would know for certain. ...


0

Most applications should be using static ports on the servers side. In other words, one side of a connection should always be using a predictable port. Unfortunately, as you stated, living with a firewall can be a pain at first, while you build a robust policy set. You have to identify each and every service necessary and add appropriate policies to your ...



Top 50 recent answers are included