New answers tagged firewalls
2
There are two main types of firewalls. The first type is the network kind where it simply blocks a port in general. It does this by simply not allowing a connection on that port, typically unless an outgoing connection is made on the port first. The other is an application firewall which runs on a client and restricts which applications specifically can ...
2
A couple of things you can look at for this.
From the host that you're protecting try
sudo netstat -tunap
which should show all network connections. Up the top there should be a set of listening TCP ports and the corresponding process which is making use of them.
from the network try
sudo nmap -sS -sV -sC -v -n [target]
to see if nmap can figure out ...
1
A perhaps crude but rather effective way of finding a potential offending application is to use lsof.
For example: lsof -i | grep LISTEN
Look for services matching the port numbers NMAP claims are open.
Update: Guess I should mention that the command should be run as root to ensure that all open file-handles are listed!
4
In your example it looks like you're trying to config iptables which is different than Arno IPTables. Check out this link for more info on the different types of firewalls.
To see the iptables rules you're running you can type (which you're already doing):
iptables -L
To block the ports you've listed specifically in iptables, since they're both typically ...
1
Your iptables rules look generally fine to me, although I cannot spot how you are enforcing 22 from the VPN only (unless you have configured sshd to only listen on the VPN IP, which should be ok).
Also you can use POLICY (-P) rather than your bottom two rules, but either should be fine.
2
Those logs are all created in standard syslog format so any log aggregation solution will allow you to view and search the logs. There are plenty of options such as you mentioned but also proprietary like LogRhythm, ArcSight, LogLogic and others or open source like Alienware (OSSIM), OSSEC, Snare etc
There's also a GUI using BASE for Snort.
-3
you can use the concept of bandwidth throttling and capping depends upon you, how you are going to manage.
Bandwidth throttling means you are going to restrict the server how much data it will accept. there is one project on google
http://ultramegabit.com/file/details/-XskwK704PI
this concept used by isp's to overcome from server crash or overloading
...
0
network/circuit based firewalls look no further than Layer 3 of OSI model, and therefore enforce security for TCP/UDP protocls only (e.g. it can only check that say TCP packet flags are legal according to the TCP standard)
application gateways , on the other hand, look up to and including Layer 7 of OSI model and have the understanding of protocols used by ...
3
Typical corporate firewalls will almost universally block or sandbox various types of email attachments. Typically they do it based on a combination of:
Simple type matching rules (.exe, .pdf...)
Some heuristic checking such as sourcing or destination based on feedback of subscribed blacklists.
Complete virus checking.
Note, it is not always the ...
3
When you send an email, it doesn't go directly from the sender to the receiver. It is sent via a mail protocol (e.g. SMTP) to a mail server, which then routes it to the mail server responsible for the target address, or just stores it if the sender and receiver servers are the same. From there the target asks their mail server (via another mail protocol, ...
1
Good question. Let's think about it this way:
You're going to take a basic maths exam and the sign on the door says
"No Masters-level students. No calculators allowed."
A normal inspector (firewall) would ask you for a student ID to make sure you're not an Masters student, then they'd let you in. A Masters student who looks just like you comes to the ...
3
The general rule with firewall configurations is that you should allow as little access through the firewall as possible.
In the ruleset you've listed you're allowing access to 5 services from anywhere, so if you're on the Internet and there's no NAT device or other firewall between you an the general 'net then anyone can access and attack those services.
...
1
This seems like a stupid question, but how do I set up a firewall rule
to allow HTTPS on a basic packet filter firewall?
There are generally no stupid questions and this is a fairly legitimate question to ask, so no need to apologise. Let me try and explain this as plainly as possible, without necessarily sacrificing clarity and correctness.
Note: ...
5
Assuming that you're setting up the firewall to allow you to access SSL websites, then how you configure the firewall depends on whether the firewall is stateful or not.
as @TerryChia says the ports on your local machine are ephemeral so the connection is
yourPC-[highport] --> SSLserver:443
and the return path is SSLServer:443 -->YourPC-[highport]
So if ...
2
Are you setting up this firewall on your server or your client? Your rules (outbound only, destination restricted) suggest client settings [and looks correct BTW], but you question and comment suggest server settings.
I know very little about firewalls, and some time ago asked this question on SF to address an elementary doubt of mine. From the answers I ...
1
The arbitrary ports you are seeing in your logs are known as Ephemeral ports.
This isn't a situation specific to HTTPS. Any communications with a server will involve your client using an ephemeral port to communicate with a defined port on the server side.
If you want to restrict access to web servers listening on port 443, simply direct your firewall to ...
2
There are different types firewall in place each have its own purpose we have
Packet Filter Firewall: Packet-filtering firewalls are the simplest firewall that validate packets based on protocol, source and/or destination IP addresses, source and/or destination port numbers, time range. They have no visibility to the packet payload.
Stateful Packet ...
9
A firewall allows you to limit access to ports you specify, and you can specify sources as well. For example, you can prevent non-root users from creating services that accept connections, so an attacker can't create a new shell backdoor. You can even limit outbound connections to reduce the possibility of reverse shells. A not uncommon practice is to ...
1
The answers will be protocol/application dependent. Basically, if you can use a secure tunnel or a VPN solution, you will have pretty good security. Someone might be able to knock on the port, but they won't be able to connect without credentials (and certificates if you can).
You could try to setup a simple VPN using something like Hamachi, TeamViewer, or ...
0
I would use Duplicati (http://www.duplicati.com/) to SFTP the files to the NAS. You could set up a separate share for each backup to isolate the risk of compromise if the password was leaked. Set up your NAS with dynamic DNS and have the clients push the data to the NAS, so that you only have to worry about your IP address, not theirs. Duplicati can also do ...
0
Your network diagram was not attached.
I would download No-Ip on each of the remote workstations you want to back up. Assign them all a hostname and then use the hostname for your firewall rules to allow access. Setting up the firewall rules for the ISP network is not recommended at all.
The port the service is running on is irrelevant. The port ...
0
Ask your provider to make sure they are using modsecurity 2.7.3 or higher, and that they have enabled this option:
--enable-htaccess-config
When they compiled the Apache modsecurity DSO.
This will let you disable this rule, and other rules, using .htaccess. The format to disable a rule in .htaccess, provided this is enabled, is documented at the URL ...
3
A gateway is a machine through which data packets flow. It is responsible for linking together two networks (e.g. an internal network, and the Internet).
A firewall is a filtering system through which data packets are sent; the firewall decides to let some of the packets pass through, while it blocks or divert others.
To be effective, the firewall must be ...
3
GATEWAY
A very simple answer would be, a gateway is a node on your network that acts like an interface to other networks. Typically this is the machine that the desktops and workstations connect through to access the internet.
A better answer would be that it allows disparate networks to communicate with each other. At its heart a gateway is a machine ...
6
A gateway is simply a device that joins together two different networks. In the most common scenario, an internal network with the internet. A router is an example of a gateway device. A router is a device that does routing, deciding where packets are sent to based on its IP address.
A firewall is a filter that examines packets against a set of defined ...
0
I use the RobTex swiss army knife. Example:
http://ip.robtex.com/173.194.38.167.html#blacklists
2
Even if Kerio makes products that are secure, you cannot be sure that the product you would buy is the genuine product from Kerio and not one where the seller has added a backdoor.
Furthermore, even if you do find a reliable product, the fact that you are using that product can still be detected. At a minimum, your Internet service provider can see that ...
3
In a simple answer, yes. If the reseller has a local installation of the server you are connecting to then it is possible that they can sniff the network traffic using Snort or Wireshark and extract your data. Additionally, there may be logging installed on the servers that the reseller may be able to view and see what you are doing.
However, if you are ...
4
The Onion Router (tor) was designed specifically for this purpose.
This is a program that you run locally that provides a socks proxy, which allows you to access an unfiltered, and anonymous connection to the open internet. It is very difficult for governments to prevent you from accessing tor.
0
Are these your videos or someone elses? If they are your videos, then I would try some form of internal hosting. If they are not, perhaps you can ask for permission from the owner to use them for your internal purposes (unless they are already on some open form of license). It is relatively easy with browser plugins, websites, etc. to extract the specific ...
1
You can't, not without doing some specialized configuration in the proxy server (which doesn't seem possible here).
The easiest thing to do would be to download the youtube videos (or find the originals), convert to a format which most computers recognize (.avi or .mp4), store locally on your hosting server, and embed in your webpage via <video>.
1
If the customer is as security aware as the question imply's then they will understand that the only reliable way to perform the task would be to whitelist traffic to the IP address range for Amazon ELB service.
If the worry is that this would allow other websites using the same service external access then a proxy server or secondary firewall would be ...
1
I am assuming your hosts are using the Atomicorp mod_security rule set. The error "Remote File Injection attempt in ARGS" is documented here; you can see the code here.
This rule disallows input that looks like a URL from all fields, on the assumption that any mention of a URL is an attempt to get the application to fetch and execute the content at that ...
1
Like most such solutions, the Barracuda Antispam offers directory lookup (LDAP/LDAPS), SMTP "look-ahead" where each recipient is validated on the next SMTP hop before being accepted, and a manual recipient list -- see Solution #00003521. Only the directory lookup approach requires an additional port, you would need to permit LDAP/LDAPS (389/636) or more ...
3
As far as I know, nmap in Stealth Scan mode issues a normal SYN packet, which should elicit a SYN/ACK response no matter what. The "stealthiness" comes later, when nmap receives the SYN/ACK and instead of acknowledging, tears down the connection with a RST, which prevents the connection being logged on some systems, and ensures it being logged and a We're ...
0
Neither of those will help you on this one - Windows Firewall is not known to log anything of value unless you were already expecting something to happen, and McAfee is completely out of its depths in this case (hint: virus scan, not firewall).
Checking WF logs is done by going into it from the control panel and clicking Advanced settings on the left. From ...
-1
All the computers in the network are trusted but what about the humans. Some one may plug in an infected usb (may be unknowingly) to one of the systems and you have a malware infected pc (even after blocking all the unused incoming ports ) .
In this case the malware may be able to communicate with the server and may be your data is being sent outside.it is ...
Top 50 recent answers are included
