Concerned with software or hardware firewalls
0
votes
1answer
18 views
Telling the difference between firewall block or external problem with Page Cannot be Displayed (IE)
In our organization, when users run up against the firewall in Internet Explorer, this is what they see:
The classic IE Page Cannot Be Displayed. Of course, this is also what you see when it's the ...
1
vote
0answers
28 views
Are parts of my system susceptible to IP based malicious attack even with effective IPtables rules?
Yesterday I installed Cent OS 6 and had to flush the default IPtables rules (IPtables -F) in order to access a web app via my browser.
Having very little experience with Linux/Network security this ...
0
votes
0answers
34 views
was PC attached? ARP spoofing, MITM, hacking, etc?
Been wanting to post this since months. Around mid March while as usual on my work PC running Windows 7, the screen blinked for a second while everything was running normally, it did this a few times, ...
0
votes
1answer
28 views
Differentiating between IKEv2 and OpenVPN Traffic
There is a WiFi network that I regularly use, and it seems to be blocking all VPN traffic other than IKEv2. I tested this by downloading many of the free/freemium VPN apps from the Google Play Store ...
0
votes
1answer
57 views
Would it be possible for a malicious user to change the LAN IP address of an uncompromised device?
I have a local network and an IPCam (with its own storage) in it. Due to some practical limitations, I cannot use technologies such as AP isolation or VLAN to isolate low-integrity and high-integrity ...
1
vote
1answer
55 views
Could an attacker spoof a whitelisted IP to access the network?
There is a network that is protected with a firewall and only one IP is whitelisted.
Assuming the attacker knows the whitelisted IP, what would prevent an attacker from sending traffic via a spoofed ...
0
votes
2answers
77 views
Is an ACL Sufficient for business firewall?
I am a relatively new IT specialist for a small company (about 30 employees, 100 more seasonal.) Most of our systems have been outsourced to an IT company long ago, that handles licensing, VDI, PBX, ...
1
vote
1answer
80 views
Refusal to 'open' up corporate network?
I am working a project which requires access to a service running on a remote server, over a single TCP port (>1024). This service runs on a machine located within an existing network, and the project ...
0
votes
0answers
14 views
How to open port 8080 on windows 10, configure firewall and any other settings? [migrated]
I have a Windows 10 computer. I am attempting to get my WAMP web server on the web but have been and continue to be unsuccessful. I believe I narrowed it down to windows though. My Motorola Cable ...
2
votes
3answers
76 views
Whitelisting DNS vs. Packet filtering Firewall
I am an information security intern for a MSP.
The company is set up to work remotely a few days a week. As I was gathering information for the assessment, I found out that one of the employees does ...
0
votes
2answers
177 views
Can a hacker hack into port 80?
We normally say port 80 is firewall friendly.
But can a hacker just hack into port 80 via TCP or UDP?
Or is Port 80 by default not always open?
It waits for the host to initiate a connection via ...
1
vote
2answers
91 views
Should I allow communication on public networks?
I apologize if this is a newb question. Reading this prompt, it appears that I should check Private Networks and uncheck Public Networks. However, Windows defaults to the opposite being checked.
Am I ...
2
votes
1answer
163 views
Is it dangerous to disable the IPv6 firewall built into many home routers?
The router that my ISP has delivered contains an IPv6 firewall. The only configuration option is whether it is on or off. Apparently, this firewall simply denies all incoming connections.
I ...
0
votes
1answer
94 views
Comparison between WAF and IPS/IDS
I would like to know the difference between WAF and IPS/IDS?
Can IPS/IDS handle an attack on a web application?
If there are differences functionally between the two applications, how they work ...
0
votes
3answers
161 views
How did EternalBlue bypass firewalls?
I've tried recently to run the EternalBlue exploit via metasploit (on VirtualBox lan), and I've spotted that if the victim PC uses the most naive windows-firewall than the attack would fail. That got ...
0
votes
3answers
112 views
Are there any feasible ways to block the stunnel utility at the network level?
The stunnel utility written by Michał Trojnara allows, if I understand correctly, to "wrap" non-SSL protocols (such as ssh) in an SSL connection.
For example, imagine that all network ports on a ...
5
votes
1answer
154 views
How to eradicate and recover a compromised network
I have a somewhat broad question related to a specific, ongoing threat that I am trying to define and defend against.
Right now, I need to rebuild a secure access point for my mobile devices and ...
4
votes
3answers
175 views
Should network firewall rules be secret?
At my workplace only the security team have access to see the rules on the server network firewalls.
Developers and system engineers don't have any visibility, so they just deploy applications to ...
0
votes
1answer
174 views
Firewall doesn't support TLS 1.2
I have an ASA 5550 firewall that doesn't support TLS 1.2.
What impact would we have when the older protocols are disabled? Will this affect the servers at all?
0
votes
1answer
48 views
Limited remote access to a web application [closed]
I would like to set up a very simple node.js web application on raspberry pi and access it remotely, from outside the LAN.
There are no other hosts in that LAN with the Raspberry. I only need to ...
1
vote
0answers
68 views
How to block all aplications from internet connection?
I would like to block all windows10 applications from internet access
So I found a settings screen on the windows firewall (Windows Firewall\Allowed apps) I would like to uncheck everything from this ...
1
vote
0answers
39 views
Comodo Firewall HIPS (Paranoid Mode) Regedits
Old time lurker and odd poster here with a general question. I think this might fall more in the nature of understanding system processes.
I've activated comodo HIPS on paranoid mode to firstly see ...
0
votes
3answers
110 views
Get data without Firewall detection
I was browsing through some cyber security questions and I came across a question that kept sticking in my mind so I figured maybe I just ask here.
The question is:
What is a way to get data from ...
0
votes
1answer
154 views
Find out the IP or hostname of the firewall? [closed]
Is there a way to find the IP of the firewall which is blocking my access to an endpoint?
I tried netcat / nmap but not much luck.
I need some form of a tool which does a traceroute to the subnet or ...
2
votes
1answer
66 views
UFW appears to block connections from remote address, but NAT is disabled on my router
I'd like to understand what the following line means exactly, because similar lines can by found in my system log pretty often and I would not expect any.
[UFW BLOCK] IN=enp2s0 OUT= MAC=72:8a:bd:21:...
1
vote
2answers
120 views
Router Security Log Shows Many Blocked TCP Connections
When checking my router tonight I looked at its security log. I saw thousands of blocked tcp traffic. Why are these considered security events? The log shows many blocked tcp incoming request from ...
0
votes
2answers
54 views
Concept using ssh to create dynamic firewall. Good or Bad idea?
The Goal
Create a secure process to open a firewall port on a server (on demand), start a listening server, and ultimately close the firewall port. This would improve security by not always having a ...
3
votes
2answers
81 views
Where do products like BlueCoat and ForcePoint get there URL categorizations from?
I recently had an issue where I released software which made use of a new URL and several of my customer sites complained that the software wasn't working within their wifi network. It turned out ...
0
votes
0answers
50 views
How should firewall be configured to allow using an image scanner over WiFi to avoid jeopardizing security?
I'm having a dilemma if I should post this here or on superuser, finally I decided it's more security related so I post it here, if it's wrong please move.
The situation: There is an Epson all-in-one ...
1
vote
1answer
90 views
Social Engineering Attack awareness using .doc and spoofed email
Need advise for our company experiment. We are planning to observe the security awareness among our staff. I have an idea but lacking of knowledge on how to do it. I want to create spoofed email and ...
3
votes
1answer
159 views
What's the difference between an “application-aware firewall” and a “web application firewall”?
I'm studying for the CCSP and my training material isn't very clear on the definition between "application-aware firewall" and "web application firewall".
The training material states:
Early on, ...
2
votes
0answers
39 views
What is this “…ffff:ffe2” traffic being blocked?
I have a fairly simplistic pfSense setup. IPv6 is provided through a Hurricane Electric tunnel.
Something on my home LAN is sending traffic from an odd-looking address, and so it's getting blocked, ...
0
votes
0answers
31 views
Windows 10 disable most networking
Is it possible to disable all networking besides the web browser on Windows 10, especially including Microsoft-specific services? This should help with privacy concerns.
0
votes
0answers
35 views
SSH Tunneling Issue with Plink
so I'm trying to follow this tutorial to bypass firewalls and IDS by routing traffic through an SSH pipe and receiving a Meterpreter reverse shell (reverse_tcp) from a Windows computer across the ...
4
votes
1answer
102 views
How to distinguish between “normal internet” Port scan and more “serious” port scan preparing attack?
In a complete network infrastructure, with firewalls, routers, servers supervised by a SIEM, LogPoint here. Of course, there is a private network and public servers.
in the LogPoint there is an ...
4
votes
1answer
186 views
Meltdown and Spectre regarding Firewalls and Sandboxing [duplicate]
I don't deeply understand Meltdown and Spectre -- all I know is that they are basically keylogging-like vulnerabilities within the CPU, which bypass any application layer stuff; correct me if I'm ...
4
votes
1answer
431 views
NMAP - Closed vs Filtered
A lot of people seem to ask this question, as there are a bunch of posts about it; however I feel like none truly answer the question (that I have found).
I want to understand why NMAP decides to ...
0
votes
1answer
151 views
ufw and nmap show different result in terms of open ports
I have set my firewall ufw / firewall rules as follows:
Default: deny (incoming), allow (outgoing), disabled (routed)
To Action From
-- ...
1
vote
3answers
174 views
Is hardware firewall needed for a local network without internet access?
Is a hardware firewall needed for a local network without access to other networks?
The local network only consists of a server with SQL database, workstations & PLC controllers.
I am asking ...
0
votes
1answer
87 views
With an IPS in place, do we really need firewalls?
I was reading the article "Do you need an IDS or IPS, or both?"
on TechTarget. While reading the author's explanation of IPS this question hit me.
If an IPS is a control tool that uses a set of ...
0
votes
0answers
128 views
How to determine DoS protection rates for firewall
I am looking to enable my Firewall's DoS protection, and when searching for values to put in the rate fields, am finding that the answer is usually "it depends". While there is almost always room for ...
-1
votes
2answers
80 views
Secure access to an aplication from internet [closed]
I have an application wich needs to connect to the main database. I want this application to be accessible from outside the enterprise network. I think that the best way is to install the app in a SQL ...
3
votes
1answer
53 views
how to check what process connects to my squid
I found today, that I have open proxy (squid on Debian). I fixed the firewall rule, and now I'm not. But someone still uses this proxy - it looks like it is proxying from inside my machine. I try to ...
0
votes
0answers
444 views
connections to AkamaiGhost
I've seen two computers on a network are initiating connections to AkamaiGhost server on the Internet on port 80. Is this a security violation? Firewall is blocking them, and no one is actually doing ...
0
votes
0answers
28 views
I have a question on hardening my windows 8 host firewall rules
I use the following setup for my internet connection.
MyPC/RDP -> RDS server -> Internet
(this is over a paid public WiFi access point).
What I want is to strengthen my Win 8 firewall rules (...
3
votes
2answers
612 views
Should I allow incoming traffic from source port 443?
I am hosting a web server, both standard and SSL. Both work fine currently.
In my logs, I've noticed what seems like a distributed port-scan: 10-15 port queries from random hosts occuring within ...
0
votes
0answers
209 views
Deny a plugin (.dll file) access to the Internet (windows)
I want to deny a VST plugin access to the internet, but when I try to block it in Windows Defender, the file doesn't show up. The file/program is being opened only in other programs (in this case a ...
-1
votes
1answer
46 views
What is the meaning of “me” in ipfw rules?
ipfw is an IP firewall and traffic shaper control program.
The term "me" appears on ipfw statements like below:
ipfw add 02050 allow tcp from me to any out
I would like to know exactly what "me" ...
7
votes
3answers
649 views
SIP UDP request breaking through iptables
I have been investigating a few instances recently where SIP UDP traffic has been somehow evading the ruleset defined in iptables leading me to suspect that there is a hole in our rules so i'm looking ...
0
votes
1answer
267 views
Are there risks in not having a edge firewall? [duplicate]
I am currently working with a client that has all their external traffic going through the core switch and then is being passed to the router and back through the core switch and then to the rest of ...
