Questions tagged [firewalls]
Concerned with software or hardware firewalls
993
questions
0
votes
0answers
38 views
firewall fundamentals [closed]
If you have an enterprise or large network with a lot of firewalls that generate a large number of syslog messages consider implementing more specialized security incident management (SIM) and log ...
0
votes
1answer
53 views
Is there something like DynDNS for a DNS service?
I run a small DNS server (pihole) at home behind a firewall, with some custom filtering. It mainly filters ads and trackers, plus some top level domains I want to avoid navigating to. I have an IPv4 ...
0
votes
2answers
92 views
Firewall and VPN
Let's suppose i work in a small office and i can't use my workstation to navigate in Facebook because the external firewall forbids it. But i still can use a VPN to bypass the firewall.
I read that ...
0
votes
0answers
50 views
Method to bypass \n in WAF (\n vulnerability)
I have this application that has an input box where the data is going to be sent in a JSON format. The JSON payload might look like this
{“message”: “hello\nmy name is andi”}
But the problem is the ...
1
vote
0answers
38 views
How can access to Intel ME / AMT be disabled with firewall? [duplicate]
Short of flashing BIOS, there seems to be no way to disable the Intel ME.
So, is there a reliable way to block access to Intel ME, such using HW firewall (Firewall in front of the machine, not ...
0
votes
0answers
15 views
What is the security justification for blocking all outbound ports/protocols except HTTP over 80/443? [duplicate]
My companies IT blocks all outbound traffic except HTTP, preventing me from getting work done at the office (I often need to work on Azure SQL databases which require TCP over port 1433). I can get ...
0
votes
1answer
150 views
Thought process behind firewall design
I'm preparing for an introductory information security examination in university and this is one of the tutorial questions on Firewall design.
My concerns for the provided solution is how to define ...
0
votes
1answer
65 views
Why should I use firewall to block ports with no running services? [duplicate]
A firewall is for blocking / limiting access to specific service / port.
I know that it can be useful for allowing only certain IPs to a port (for example I don't want to have SSH open for the whole ...
0
votes
1answer
162 views
Purpose of Decrypting & Scanning HTTPS traffic
Navigating to the below URL link from the Mozilla Firefox and entering some website link and clicking on View, displays certificate Viewer
chrome://pippki/content/exceptionDialog.xul
After enabling ...
0
votes
0answers
40 views
How does the Great Firewall of China handle TLS encryption? [duplicate]
My understanding is that when a client and server are connected through TLS, only they have the key needed to encrypt and decrypt messages. My question is, given that the Great Firewall of China does ...
2
votes
0answers
32 views
Can NAT Table be vulnerable toward any poisoning attacks?
I am learning the general concept of network security, and becomes aware of two poisoning attacks on the network infrastructures, that is, DNS poisoning attacks and ARP poisoning attacks. They are ...
0
votes
1answer
115 views
Allow only YouTube videos and block other videos
I have a MikroTik router. I want to allow only Youtube videos and block all other videos. I tried to write an extended ACL but I really have no idea. Maybe allow only Youtube videos source URL and ...
1
vote
1answer
61 views
Why am I receiving hits with SPT=443 on IPv6?
I block most everything with my firewall, what I don't get is why would I constantly receive hits to connect on random ports from port 443.
[iptables] reject_ipv6: IN=eno1 OUT= MAC=...
SRC=2607:...
2
votes
1answer
87 views
Can a VPN provider or actors within its infrastructure access open ports on the client machine?
From my understanding of a VPN, it essentially creates a network between the two 'machines'. So if I have open ports (e.g. HTTP, SSH) on my client machine, those can be accessed by the VPN provider or ...
0
votes
0answers
27 views
End to End Encrypted Traffic - Web Application Firewall needed?
Background
We have a Java Spring Server, MongoDB and an Angular Frontend.
Some Application Security Configs:
TLS
Basic Authentication (Password Strength Policy)
XSS Protection (Content Security ...
0
votes
0answers
31 views
Actions after identifying exploitation attempts on servers or applications
I am seeing regular exploitation attempts (like remote code execution, sql injection, etc.) on our DMZ server or applications and these are being dropped by the firewall. However, our SIEM is raising ...
0
votes
0answers
29 views
How can I give a network load balancer (of any type) access to a port on a machine without opening that port to an entire VPC?
Is it possible to make an AWS load balancer for a non-HTTP port allowed to access a specific port on a host without opening that port open to the entire VPC's subnet? I seem to remember reading that ...
2
votes
1answer
410 views
Does blocking all ports make a machine more secure?
I have a machine that I use only to browse the Internet. What if I blocked all ports on this machine (inbound and outbound) except for port 80 and port 443, and restricted these two ports to an ...
5
votes
2answers
146 views
How does a CDN actually prevent DDoS attacks, when an origin server accepts direct connections?
I am trying to understand how a CDN (like Cloudflare e.g) does protect against a DDoS attack.
I would think that the internet traffic is routed through a CDN's reverse proxy, then filtered. This ...
0
votes
1answer
39 views
Debating between architecture options for offline updating of Linux machines in a vertically segregated network
My coworker and I are discussing the pros/cons between two potential architecture options, and I would like to gather feedback on which option is better and why.
First, a description of the ...
-1
votes
1answer
48 views
threat intelligence gateway [closed]
A TOG (threat intelligence gateway) is a hardware piece that sits between the router and the firewall. The TIG uses the threat intelligence and filters out the malicious urls and IPs before reaching ...
1
vote
4answers
165 views
Given a set of ports is there one that is more likely to bypass a firewall?
I've been trying to solve a homework question in a beginner infosec class, and I was stumped on an issue and I didn't really know of the right place to ask. If it isn't then please let me know.
Given ...
2
votes
0answers
96 views
Non-upgradable usb device against badUSB
Lot of posts about badUSB (here and there) suggest to use a PS/2 connector for mouse and keyboard or to whitelisted USB devices or even use a hardware firewall that only allows whitelisted commands.
...
0
votes
2answers
68 views
firewall behaviour
If a client connects to a server he will start listening for the response on some random high port number. The client then expects any packet destined for that port to be a valid answer. Or does he ...
1
vote
0answers
43 views
'Hard-to-guess' custom header (or similar) to whitelist via a firewall
My organisation is adding a firewall to our test stacks, using AWS WAF. We'd like to whitelist all traffic from the SDKs we've built to facilitate requests between our services.
We thought of doing ...
20
votes
3answers
3k views
Why is it called a stateful and a stateless firewall?
I'm just wondering about the naming of these firewall behaviours. My basic understanding is that stateful filtering lets inbound traffic to return the outbound response without explicitly specifying ...
0
votes
1answer
87 views
How to close port 445 (Apple Time Capsule smbd)
My default configuration of Apple Time Capsule has port 445 (Apple Time Capsule smbd) open to the world. Online port scanners (shodan/detectify.com) show me that this. What's a bit worrying is the ...
-1
votes
1answer
58 views
Would a firewall contain an explicit allow rule at the top?
Someone in an interview today told me every firewall has two rules: explicit allow at the top and explicit block at the bottom.
Form the way I've always understood things firewalls are normally set to ...
0
votes
1answer
39 views
Stateless Firewall configuration and random port number from server
When I was reading about web servers, I came to know that though servers listen to static port (say port 80 for http), immediately after the connection, they assign a different port and thread to ...
-2
votes
1answer
55 views
WAF or Firewall [closed]
I am looking into putting a Firewall in front of our web servers. But we just recently implemented new next-gen firewalls. Does it make sense to put a WAF in front of our web servers as well?
0
votes
1answer
54 views
Even though my firewall is active, is it protecting me fully given that the 'rules' are not active?
Even though my firewall is active, is it protecting me fully given that the 'rules' are not active?
Output shows:
host based firewall active, empty rules
iptables modules loaded, but no rules ...
1
vote
0answers
49 views
Inbound rules for a port is configured and disabled yet an NMap scan shows that the port is opened
I am new to Windows Defender but have read about it to understand the basics of Inbound/Outbound rules.
As mentioned on the app, Inbound connections that do not match a rule are simply blocked.
For ...
2
votes
1answer
121 views
Can a firewall recognize (and block) outbound traffic that consists of screen shots?
I recently watched this YouTube video about capturing webcam image traffic using Wireshark. Although the technique used in the video is not applicable to my question (because it is about a MITM ...
0
votes
1answer
69 views
Is it possible to DDos a http wan filterd router? [closed]
Like the service is there but it's just filterd enabled for lan access only .. what will happen ?
1
vote
0answers
50 views
Securing a SOCKS5 to SSH Tunnel on Windows
In order to gain web access from the perspective of a remote device, it is very common to use the SOCKS5 to SSH Tunnel capability built into OpenSSH Client and Putty (detailed here). Both clients ...
0
votes
0answers
37 views
How to bypass egress traffic filtering for a reverse shell? [duplicate]
Say I have access to a linux server as non-root user (gained RCE using an exploit), say I am only able to run commands via http in bash/sh but I'm unable the to make the targeted server connect back ...
0
votes
1answer
57 views
Configure Windows Firewall Inbound Rule for Program Not Installed on Server
How can I configure an inbound rule on a Windows Server 2016 firewall to allow access from a program which is not installed on the server? When searching for a program browse is only offered for ...
1
vote
0answers
49 views
apache struts 2 s2-057 does not return shell? [closed]
I do a pentest for a private server protected by Cloudflare. I bypassed the WAF and got the real IP for the server, then I scanned it with Acunetix and I found:
Apache Struts2 Remote Command Execution ...
2
votes
0answers
58 views
Secure AWS instance metadata against potential SSRF
I am running a Windows instance on AWS.
The instance has an IIS service running on it.
The IIS service has a user associated to it and it has no need to access the AWS instance metadata.
I was ...
3
votes
2answers
153 views
How do I prevent traffic on my site from a source other than Cloudflare?
I use Google Cloud Platform to serve the site I manage.
I have one load balancer there, which controls the movement to several virtual machines.
When I came across the problem of DDOS attacks on ...
-1
votes
1answer
80 views
Firewall logs with Local IP contacting local IP over the internet [closed]
I noticed some wierd behavior in our firewall logs: a computer in our subnet 192.168.1.0/24 sending UDP packets in port 161 to an IP in subnet 192.168.20.0 (we don't have a subnet like that), and the ...
0
votes
1answer
167 views
For security purposes, can I use vpn with ufw to allow traffic only from the vpn on ubuntu?
Is this possible? If not through ufw then some other software or iptables? How should I set up the ip tables?
Assuming my public ip is known (and I don't want to change it), would it provide complete ...
0
votes
0answers
33 views
Iptables ruleset changes when running a native vpn application
Is it ok for a native linux vpn application (from a famous brand among the vpn providers) changing your iptables ruleset each time the vpn activated?
Consider that one of the rules which always ...
1
vote
0answers
161 views
Reverse shell working with kali 2016, but not kali 2019.2, using Metasploit ms08_067_netapi
I have an unpatched Windows XP Home VM, a Kali 2019.2 VM and an old Kali 2016 VM. Using Metasploit's ms08_067_netapi module, I'm able to successfully get a reverse shell but only on the old Kali VM.
...
1
vote
0answers
105 views
Is Windows RPC (port 135) secure enough for domain-wide access
I have a network of approximately 150 computers that I'd like to regularly monitor. My proposed way of doing so involves running remote commands like reg query \\<ip> or systeminfo /S <ip>....
0
votes
2answers
670 views
Fortigate “WebRTC.Local.IP.Addresses.Disclosure” Event
We have a Fortigate perimeter firewall, and today I detected this event.
What should I do to improve protection?
How can someone obtain local IP address through a firewall?
The following alert was ...
0
votes
1answer
70 views
Intercept network traffic with a hub [closed]
If I plugged a hub inbetween a switch and firewall, that also had a device running wireshark or similar capture software connected, due to the way a hub operates, would I be able to read ALL of the ...
0
votes
0answers
54 views
Web Site Access - Port Whitelisting
I am able to access a certain website https://buzzlightyear.acme.com:68080 from within a corporate network (Obviously the default https port 443 has been allowed in the windows firewall of the machine ...
1
vote
1answer
216 views
How to find a website behind a Firewall? [closed]
Some context for my question: I'm currently studying Information Security, and this is for an assignment from my teacher.
For my assignment, I received two IP addresses. I did a port scan with nmap ...
-2
votes
1answer
98 views
Firewall can detect suspicious file over HTTPS [duplicate]
A firewall/router can intercept HTTPS traffic, analyse it and detect suspicious file download for example. From my understanding, it is acting as a proxy and/or a MITM device.
If it is capable of ...
