Questions tagged [firewalls]
Concerned with software or hardware firewalls
1,084
questions
0
votes
0answers
17 views
Block `pip install` but not pypi search/documentation [migrated]
I have configured a proxy for PyPI (which uses a security service to vet module requests). I want to block direct access to downloads at the network firewall without affecting pypi.org's usefulness as ...
0
votes
0answers
90 views
Sending traffic to cloud proxy with GRE vs. IPSec
Taking a look at several cloud proxy/CASB vendors, they all seem to have the same recommendation of primarily using a tunnel to deliver internal traffic to them -- either GRE, or IPSec.
IPSec ...
0
votes
0answers
11 views
Windows firewall: How to change existing rules using netsh [migrated]
I can create new rules using
netsh advfirewall firewall add rule...
and Delete them using
netsh advfirewall firewall delete rule...
But I am not able to find a way to change existing rules.
Right ...
0
votes
1answer
49 views
Why is the -L (list) option of iptables not available to non-root users?
Many tools in Linux allow for checking things as a non-root user. For example, at any time, I can check whether a service is running:
$ systemctl status ntp
However, the iptables needs to be used as ...
0
votes
1answer
69 views
From a modular development standpoint, should a “firewall” do anything else than filtering ports?
From a modular development standpoint, should a "firewall" do anything else than filtering ports?
This leads me to further ask, have there been attempts to reform the terminology from "...
0
votes
1answer
76 views
Should you set up firewall rules with a vpn?
I am using a vpn and trying different firewall rules to keep as secure as possible. But the VPN company itself tells me not to use a firewall. Does that seem reasonable?
They write:
"As we've ...
4
votes
4answers
215 views
Is it good practice to disable firewall rules for vulnerability scanners?
I've been asked to ensure that our vulnerability scanning tools (like Qualys, Nexpose) are able to reach all of our AWS EC2 instances, on all ports and protocols.
Today they are limited by the current ...
0
votes
1answer
108 views
Suspicious visits to one URL from same user-agent but from unique IPs
For the past few weeks, I am observing a lots of visits from a specific user-agent - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36 ...
0
votes
1answer
86 views
Can a firewall appliance block http requests? [closed]
Is it possible to use a firewall appliance as WAF? To make it more clear, lets think of a model like this:
Internet > router > Firewall > webserver
Can the firewall act as a WAF and block ...
0
votes
0answers
47 views
Whitelisting our app to prevent connection blocking?
We publish a Windows desktop app, and while I've run VirusTotal on all of our files with no hits, some security software blocks incoming connections on ports we use, leading to frequent user support ...
0
votes
0answers
40 views
Management Network Architecture
I've recently taken a job that has me more involved in network architecture than I ever have been, so please offer me some patience.
I am standing up a network at a new office location. So far I have ...
0
votes
0answers
130 views
Only allowing WhatsApp traffic through firewalls
Problem:
On our client's ship, we have an expensive backup internet connection. We want the backup connection to only allow WhatsApp traffic. This way we won't be greeted with an extreme bill because ...
0
votes
0answers
18 views
A bastion host is a firewall? [duplicate]
I don't understand the difference between a bastion host and a firewall. I think it could be related to the different level of ISO/OSI they work on: a bastion host works on application level (with ...
2
votes
1answer
215 views
Is it safe to set up your firewall to allow localhost to accept incoming connections?
I have set up a VPN client and I'm using iptables to block all connections not tunneled through the VPN. An example of the iptables rules I am using can be found here.
Unfortunately with this ...
1
vote
1answer
89 views
MacOS Firewall Needed or Unnecessary?
Coming from Windows to macOS, I was surprised that the firewall was off by default. I immediately turned this feature on. Would this be necessary? Are there some cons to having the firewall on that I ...
0
votes
1answer
80 views
Are firewalls based on linux secure?
I recently set up a local server on my home network to host some files and personal webapps. In an attempt to improve security, I bought a pfsense-based firewall. I know some basics of networking but ...
0
votes
0answers
55 views
The incoming traffic was allowed on my home network for two days. How to assess the damage?
My router's firewall was set to accept incoming traffic for about 48 hours. Misconfiguration from a user, apparently.
I have few devices on the network (two Windows PC, Freenas, printer, chromecast TV)...
0
votes
0answers
157 views
OpenWrt firewall mystery
I have my home network divided into multiple VLANs, with a main router running OpenWrt forwarding between VLANs, where each VLAN equals a firewall zone. Zone wan hosts the Internet router.
Firewall ...
1
vote
1answer
54 views
Custom response for Web Application Firewall (WAF)
What should be the custom response code when WAF blocks a request due to matched rules or policy violation.
We should kept the response code as 403 or 200 when WAF returns a response against a blocked ...
0
votes
1answer
104 views
How to monitor and manage ALL internet network activity [closed]
Is there a way to monitor and manage (block, unblock, log) all internet activity (mainly outoing traffic) from my computer?
For example, in my android phone I've installed a VPN tool called "...
1
vote
2answers
77 views
Which firewalls filters should I consider applying to my company's website?
Context
The company I work in is starting to have a more dynamic website, which can process sensitive user information. With so, we want to improve our security. We are a healthcare company from ...
5
votes
1answer
433 views
Can DPI block websites with ESNI?
I live in a country with censorship and was wondering if it's possible to bypass DPI by just enabling ESNI, DNS over HTTPS and Always HTTPS? If not, what else should I enable to bypass DPI firewall ...
1
vote
1answer
925 views
Logging into remote server via SSH using VPN (Wireguard). Is it foolproof?
I have a remote server into which I login via ssh. On this server I have setup a Wireguard VPN to which my host connects. The ssh server (ssh daemon) listens on a private IP interface (the server's ...
0
votes
1answer
68 views
How to know if the response is from the CDN and not the origin?
I am doing some bug hunting. I inserted a malicious payload into a request. But I am not sure if the response is from CloudFlare or the origin. Are there special headers which help me to distinguish ...
1
vote
2answers
197 views
I found an unknown UFW rule on my ubuntu server - have I been compromised?
The server is running the Kubuntu Desktop variant of Ubuntu (I transformed it into a server, I had things configured that would have been a pain to transfer to another installation.).
One day I ...
2
votes
1answer
291 views
scan forwarded ports with OpenVAS/GVM?
I'm currently learning about network security and came across a problem, maybe I'm just missing something obvious but I'll try to explain my environment:
I have a Kali Linux VM connected to the WAN ...
22
votes
5answers
5k views
Unidirectional continuous data transfer to an air-gapped computer
What would be a way to transfer files in one direction from internet-facing computerA => air-gapped computerB to protect the files on computerB from unauthorised disclosure, short of using an ...
0
votes
2answers
51 views
Securely Connect Employee PC to Business Private Network
I've recently become the "tech guy" at a startup, and am tasked with standardizing our hardware infrastructure. Further more, I choose how employees working from home will connect to ...
0
votes
0answers
31 views
Firewall rule such that I can only acess a website with VPN
I want to create a firewall rule such that I can only access a Website with VPN enabled. But I can't seem to find an option in windows firewall to say if my protocoll is not openvpn I can't access the ...
0
votes
1answer
59 views
Windows Firewall allows the connection to more than one user who shares the same external IP address
I wrote a stand-alone anticheat. When the client anticheat connects to its server, the server creates a firewall rule allowing the game client to gain access to the server.
The problem is the firewall ...
1
vote
1answer
82 views
Is opening all ports on a router safe if it is simply redirection to a VPN server at 192.168.1.2:51820?
The motive for doing this is that I want to open other ports so that I can evade firewalls which block VPN connections. Instead of redirecting eg. port 53 or 123, I could simply set up a destination ...
0
votes
1answer
80 views
Possible ways to intrigue IP blockage on practical websites
Assume that I share the same IP address with others. Then if I can do something bad to intrigue practical websites, such as Google, Amazon, or jQuery to block me, then all other users will also be ...
0
votes
0answers
30 views
How is it possible for a Company to block Websites when at home, using DNS over HTTPS and no Certificate issued by the Company? [duplicate]
Let's say, I am in my home office connected through a VPN with the company network with a company device.
When I am using Firefox, not controlled by the Company like Chrome or Edge, the certificates ...
-1
votes
1answer
46 views
Whitelisting only domain not IP [closed]
Is it possible to whitelist only 1 domain name but not IP?
For example:
On some "Doogle" hosting is IP 1.1.1.1 and have multiple domain resolution for this IP: dog.com, cat.com
cat.com ...
1
vote
0answers
48 views
How to Prevent Attacker from Abusing IPv4-embedded IPv6 to Bypass Security Mechanism?
Section 5.3 of RFC6052 explained how an attacker could abuse the NAT64 translation mechanism to bypass security mechanism such as firewall or IDS/IPS if those devices only have an IPv4 blacklist. The ...
0
votes
0answers
31 views
What are the best practices to configure security group in AWS web application?
I have a website hosted on AWS EC2, and I have some questions about security.
How is the best way to protect my web application in AWS?
Can I open the HTTP (80) and HTTPS (443) to the world (0.0.0.0/0)...
2
votes
2answers
688 views
How can I block hits to Youtube using iptables?
I want to prevent my daughter from accessing YouTube while she's attending school. So I was thinking to add protections in iptables. Unfortunately, when she goes to YouTube, the DNS resolves to IP ...
-1
votes
1answer
106 views
What makes firewall pop up?
I am creating a file that uses Socket for exchanging data. When I use Python I have a firewall pop up where I am asked to accept the use of the application, but when my C++ program tries to do the ...
0
votes
1answer
346 views
Textbook uses terminology like Double/Single Bastion Inline/T to describe firewall architectures. Are these terms used in professional environments?
I apologize for the weird wording of the question title, I was hitting the character count.
I am taking a network security course in college and the textbook we use, Network Security Essentials: ...
1
vote
0answers
48 views
Secure Implementation of Network Discovery Tool in Corporate Network [closed]
I would like to implement a network discovery tool, which automatically detects all devices in a network including OS information. I would like to do a very secure implementation. The biggest threat ...
1
vote
1answer
63 views
Getting an abnormal amount of firewall warnings on web server
I just had a look at the firewall status and saw it had blocked over 300 requests from TOR, Python Urllib, and some script called aabbccdd.xss.ht/pigeonburger.xyz (pigeonburger.xyz being my website).
...
1
vote
0answers
46 views
Unsupervised proxy - what could go wrong?
I recently finished setting up mitmproxy on a recently created DigitalOcean Ubuntu Droplet server. Almost immediately after opening the necessary ports in the server firewall and starting the proxy up,...
0
votes
0answers
71 views
Auto updating attack signature Firewall, WAF, IPS & IDS to secure Azure services?
We have a need to secure the Application Gateway and hundreds of APIs exposed to the Internet as part of our production environment. Using the existing built-in, Azure services, how to make it secure ...
0
votes
0answers
33 views
Using lulu on osx in home business setup. Any reason for external router base firewall?
I have Lulu setup under osx on my Mac. So say an errant program, curl, if it tries to access outside address is stopped.
Would an external router based firewall bring any extra level of protection? I ...
0
votes
2answers
118 views
Best practices for firewall exceptions
My company has a firewall set up which, among other things, scans incoming files for malware. The scanner alerted about a malicious file that was downloaded to one of our machines. After some ...
0
votes
1answer
168 views
How to stop outgoing SSH on port 443
Let us say that a small company has an internal network for employees. All employees are granted Internet access via a NAT device (not a proxy) and perimeter firewall only allows outgoing connections ...
1
vote
1answer
2k views
Mongo DB hacked (read_me_to_recover) without the port exposed in the firewall?
I have recently set up parse-server on a DO VPS using 3 docker containers; one for parse-server, one for parse-server dashboard and one for mongodb. Because I am just testing this setup I left the ...
24
votes
5answers
6k views
Why is DNS-over-HTTPS such a big security nightmare compared to DNS-over-TLS?
I've heard the argument against DNS-over-HTTPS that it is supposed to be a security nightmare for network defenders because it enables encrypted DNS over port 443, compared to DNS-over-TLS which goes ...
0
votes
1answer
61 views
UFW does not block meterpreter
I am doing some pen testing on my wordpress server. I wanted to see what would happen if the attacker were to get a hold of my username and password for wordpress.
So I used the standard exploit in ...
0
votes
2answers
88 views
Is there a bulletproof way to configure your AWS system? [closed]
I am learning how to configure a multi-region AWS system. However, everything I read says "if you want/need more security then do X". Why would anyone want less security (is what I start ...
