Questions tagged [firewalls]
Concerned with software or hardware firewalls
1,130
questions
0
votes
1
answer
41
views
If a computer gets infected with malware, can the host firewall block the malware from communicating back to its controller on the internet?
I'm trying to figure out how secure a host firewall is, hence the question in the title.
I read that many firewalls allow outbound connections to port 80 to allow browsing, would that be enough for ...
0
votes
0
answers
26
views
EternalBlue Across Networks
I am working on some research and I am trying to unpack exactly how NotPetya used the eternalblue vulnerability to spread across networks. My understanding of the SMBv1 Protocol is that it would not ...
- 235
0
votes
0
answers
23
views
Firewall necessity [duplicate]
Without a program, which accepts incoming connections, you wouldn't have an open port, even if the firewall is disabled. So why is the firewall necessary?
0
votes
1
answer
20
views
Deploy to Digital Ocean droplet from Github Action - Should I leave the SSH port open for future deployments?
I'm going to a deploy a web app (angular static frontend and node backend in docker) to digital ocean droplet. Deployment is done from Github Action by essentially loging via SSH to the droplet and ...
0
votes
0
answers
30
views
Enterprise firewall block specific brower (Firefox)
Apparently, some enterprise firewalls can block specific browsers. I have an example of one blocking all browsers except the ones based on chromium recent versions (Chrome and Edge work) but Firefox ...
0
votes
1
answer
52
views
Do I have to block IPv4-mapped IP addresses in my IPv6 firewall?
I am writing the iplock tool to help me setup my Linux firewall. For the most part, my current strategy, since I don't yet use IPv6 much, is to pretty block everything IPv6 ("simple").
I ...
- 862
0
votes
1
answer
62
views
Does the application gateway firewall function only on the application layer or on all layers of the OSI model?
This is very confusing. I am seeing 2 different things in various books and sites.
A. Application gateway firewall scans layer 1 to layer 7 of the OSI model.
B. Application gateway firewall only scans ...
0
votes
1
answer
21
views
Docker container can't access systemd service because of firewall
I'm in a somewhat weird situation that I don't understand:
I use ufw as a firewall. It's setup to drop any input connections apart from ssh
I have a service running locally (managed through systemd) ...
- 125
0
votes
1
answer
431
views
What is Akamai Ghost? [closed]
After making requests to certain domain and their responses being either 4xx or 5xx status codes, the server response header shows Akamai Ghost.
Is this response coming from Akamai's firewall or their ...
0
votes
0
answers
73
views
Nessus vulnerability 11411 in Fortigate
I have a Fortigate device and a Nessus vulnerability scan set up. When I ran the scan, it said that there was some kind of .htaccess~ file in my Fortigate device. This is the vulnerability it found.
...
0
votes
0
answers
31
views
Use a custom Metasploit exploit
Suppose there is a remote server 203.0.113.123 listening on port 1337 that is running a vulnerable application. I have engineered a sequence of inputs for that application that result in a shell. I ...
- 402
0
votes
0
answers
97
views
Best way to protect a KVM host
I am in the process of setting up a KVM host, the machine will be directly exposed to the Internet, with no hardware firewall.
I would like to know how to secure it on the network side. So far, I have ...
- 1
1
vote
0
answers
33
views
Is the "Windows-Defender-Hardening" safe to perform? [closed]
I'm totally not a Microsoft Windows professional. When it comes to Windows, I'm just a normal user. And as this user, I'm wondering why Microsoft isn't shipping a full potential Windows Defender by ...
- 111
0
votes
1
answer
41
views
firewalld rules that will block traffic from internet but allow internal traffic
I want to block some ports access to the internet but still allow internal hosts to access the port with firewalld. There is another firewall between the internet and the host but I want to add a ...
0
votes
1
answer
87
views
Is there any difference between circuit vs application level gateway except that one operates in layer 3 and another at layer 7 of OSI model?
Question#1
whitewinterwolf answer says
the circuit level gateway CHANGES the source ip address of outgoing
packet(from the internal network point of view).
Two different TCP connection are formed, ...
0
votes
0
answers
48
views
I cannot make a reverse connection
I am playing with a Linux CTF server and came across a kind of reverse connection block. I uploaded a php webshell, gained control of www-data user and tried to make a reverse shell.
Possible a UFW ...
0
votes
0
answers
81
views
A Continuous Flood of Kernel Warnings. Am I under attack?
I have a Linksys WRT1200AC with DD-WRT v3.0-r48865 std. It's connected to the Internet through the ISP's modem in bridge mode.
My syslog reports continuously, many times per second stuff like this:
...
- 1
1
vote
3
answers
149
views
Are country IP address blocks officially standardised and can they be reliably used for access control?
I was setting up firewalld on an enterprise server and came across their concept of firewall zones. I figured I can easily use them and their source property to restrict access to SSH to only the ...
- 214
0
votes
1
answer
488
views
Are there security implications of allowing Discord through Windows Firewall?
I just installed Discord (downloaded from the official Discord website) and after the install a Windows Firewall pop-up appears asking me if I want to allow Discord through Windows Firewall.
I don't ...
1
vote
1
answer
130
views
I am still receiving ssh-bruteforce on my VPS
I have a server in Oracle Cloud Infrastructure Ashburn. I am using Tailscale to SSH my servers and closed Port 22 in public.
I closed Port 22 on the VCN and left Port 22 open on the server. But no one ...
- 27
0
votes
0
answers
54
views
How to detect a firewall used
I was scanning a network with Nmap.
I'm looking for advanced commands for detecting firewalls.
0
votes
0
answers
29
views
Network Segmentation - Single Firewall VM vs Multiple
I am currently implementing a new network with different segments. The separation of those segments is achieved using VLANs. To enable some segments to communicate with each other and to be reached ...
- 1
2
votes
0
answers
138
views
No root firewall vs any spyware / malware
I am wondering about the effectiveness of no root firewalls as a solution against any type of spyware / malware. Particularly on an android device.
No root firewalls like this one here (aptly named) ...
- 21
0
votes
0
answers
38
views
Writing effective UFW & IpTable rules
I am quite new to UFW and IpTables and I am trying to understand what kind of rules we should look to implement to keep a web-application secure. The current scenario I am testing myself in is that I ...
- 197
0
votes
1
answer
449
views
UFW vs IpTables for web application security
I am trying to better understand measures that can be used to protect a web-application. I'm trying to determine which would be more effective, implementing a UFW or using IpTables.
From my ...
- 197
0
votes
1
answer
75
views
The router (that my PC is connected to) is continuously attempting to connect through TCP80. What would be the reasons?
I have no access to the router nor do I have any administrative access to this local network. But every 5 minutes the router attempts to connect to my PC through port 80/tcp, and it attempts exactly 4 ...
- 1
1
vote
1
answer
78
views
How much network noise is normal? [closed]
on my Ubuntu VPS I am getting a lot of requests and portscans from foreign sources. They are all blocked by UFW. However my question is, if this much "network noise" is normal or is my ...
- 11
0
votes
0
answers
913
views
Couldn't validate TLS certificate - Nord VPN
I received this notification from Nord randomly. Should I be worried? Is there something I can do? Am I being hacked?
P.S. clicked Don't trust
EDIT: I tried connecting from mobile data and am ...
1
vote
1
answer
226
views
How can malware or a hacker penetrate a firewall from external perimeter?
How can malware or a hacker penetrate a firewall in a router/AP or a dedicated firewall without "help from the inside" (running malicious script on a computer, forgotten open ports with port ...
- 33
1
vote
1
answer
227
views
Decrypting WhatsApp traffic and blocking file uploads possible using a firewall ssl decryption policy?
So we want to block file uploads on WhatsApp but since it's encrypted, I doubt this can be done, however, can PANOS decrypt WhatsApp??
I ask because WhatsApp doesn't exactly use SSL right, it's more ...
- 11
1
vote
1
answer
99
views
Possible rogue admin monitoring my online activities
I teleworked for a medium-sized software company. We had a network architect who offered me a firewall to install so I could securely access on-premises resources and play around with some ...
- 773
5
votes
0
answers
210
views
Why am seeing all these Chinese proxy domains? [closed]
Through a casual Google search I came to this Stack Overflow result. I clicked it absent-mindedly, could not connect through the server and saw that he domain was some Chinese government proxy server. ...
- 151
-2
votes
1
answer
156
views
Difference between 22 and 22/tcp rule in firewall
I have those two rules in UFW, but no idea what is the difference between [1] and [2]?
To Action From
-- ------ ----
[ 1] 22 ...
0
votes
1
answer
67
views
Does such kind of privacy proxy exist?
Imagine a typical web service. A client accesses it through a load balancer, which forwards the request to a backend server which will fetch data from a database, create the result and send it back to ...
- 61
0
votes
0
answers
63
views
If all ports are closed except for port 5001 and all internet traffic is blocked except for traffic to/from 1 remote server, can we still be hacked?
We have closed all ports via our hardware firewall except for port 5001 which is open to allow our trading platform software (which does not have any publicly known software vulnerabilities) to ...
- 1
0
votes
1
answer
29
views
Recommended secure option for uploading files to web server from a dynamic IP?
I need the best way to access a webserver to upload/modify a PHP script. The website contains very sensitive information, gaining unauthorized access to this server and modifying files would lead to ...
- 111
0
votes
1
answer
71
views
If I close all ports via our firewall except for the single port used by our forex broker can I still be hacked by the broker or someone else?
We have closed all ports on our firewall except for port 5011 which is the only port that is required to be open on our server so that our server can receive price data and send buy and sell orders to ...
- 1
0
votes
3
answers
236
views
Best practices for securing SSH access? Is certificate-based VPN server a good solution?
I run a server on a hosting. I want to harden it, but ssh access is giving me a bit of concerns.
I usually access from home most of the times. I have a provider subscription with the usual DHCP setup ...
- 427
0
votes
0
answers
33
views
Firewall IP-Filtered Pinhole Risks
To facilitate consulting work, a client has suggested that they allow me to connect directly to an in-house remote desktop server, via a firewall pinhole which allows connection from my IP address ...
- 101
0
votes
0
answers
36
views
Weird Problem with Virtual Machine and Comodo
I am new to this forum and I have the following issue:
Some days ago, I clicked on a pop up-window in my Linux-VM that said I need to Update some features or so ... after I clicked "Okay", ...
- 1
0
votes
1
answer
370
views
What would be the best way to mitigate Azure Application Gateway WAF False Positive?
We have a Web API which uses the REST semantics and is protected using the Azure's Application Gateway using a Web Application Firewall. The Web App consuming this API can send in any type of data in ...
- 228
0
votes
2
answers
150
views
How does my HTTPS POST get blocked based on XML content?
There's a web application on a server which I have full access to which accepts POST requests on a REST endpoint. The request payload is expected to be an XML document. For request routing and load ...
- 121
4
votes
1
answer
442
views
What is the need for firewall to be in "stealth mode"?
There is a firewall deployment case called "transparent mode", when the firewall does its job without routing and having IPv4 addresses, i.e. it is invisible.
"Stealth mode" is ...
- 141
0
votes
1
answer
2k
views
Is enabling software flow-offloading in OpenWRT's firewall settings dangerous?
First of all, I did ask this on OpenWrt Forums already, I thought maybe someone here knows this.
I noticed that my internet speed gets limited when this feature is not enabled, this feature is also ...
- 1,451
0
votes
1
answer
398
views
Should we enable UFW for EC2 (Ubuntu Server) instance with Nginx?
I just finished installing Nginx on my EC2 Ubuntu Server (AWS) and everything looks normal.
I tested it on my browser by accessing my EC2 public IP. I can see Nginx's welcome message.
It's not a big ...
0
votes
1
answer
102
views
Block inbound TCP segments with ACK=0 vs Block inbound TCP segments with SYN=1, how are they same?
Blocking inbound TCP segments with ACK=0
Blocking inbound TCP segments with SYN=1
Both prevent external clients from making TCP connections to internal clients, but allow internal clients to connect ...
- 1
0
votes
2
answers
225
views
In a network do we need both TLS and Firewall?
I need to set up a small network as shown below. Is it really required that the "switch should also host a firewall" when all the communication between the "computers" is over TLS?
0
votes
0
answers
106
views
OCSP hosts. How to tell Malicious OCSP hosts apart
Learning abit about allowed OCSP hosts on Windows 10:
I've picked up OCSP requests carried out by CryptSvc pointing towards an OCSP server in Japan. Referring to Microsoft's Win10 Non-enterprise ...
- 41
0
votes
1
answer
117
views
Apps like Twitch asking for Firewall exceptions: are we at risk of having our computer hacked?
I am installing the Twitch app, and a firewall warning popped up asking that I give permissions to use the app via private and/or public networks.
I am a security newbie but a bit paranoid and wonder ...
- 385
0
votes
1
answer
235
views
Risks posed by a wireguard connection to a compromised server
I am trying to understand the risks posed by having a wireguard connection under a very specific and narrow set of circumstances.
I have a desktop at home that is behind a router/firewall and is not ...
- 3