Questions tagged [firewalls]
Concerned with software or hardware firewalls
1,020
questions
-1
votes
2answers
97 views
How to block VPNs using tcp port 443?
I have a firewall (pfsense) acting as a gateway for my network users. All user traffic is going through this firewall.
I need to block HotspotShield VPN traffic on this firewall. As known, this VPN ...
-1
votes
1answer
19 views
When are the stateful table entries for the stateful firewall created? [closed]
We know the TCP 3-way handshake:
C->SYN->S
C<-SYN-ACK<-S
C->ACK->S
we also know stateful firewall.
When a stateful filter entry(source ip, source port, dest ip, dest port) create? ...
0
votes
0answers
52 views
Is it a Bad Idea™ to open all IPv6 ports for devices in an isolated guest network?
At home I have a dual-stack IPv4/IPv6 broadband connection, and I also have a wireless access point. The access point currently bridges all traffic into my LAN, which is not segmented in any way, so ...
0
votes
0answers
4 views
Does having only the Public firewal turned on in Windows 7 while using the Home/Private Network mode mean no firewall is active? [migrated]
My Windows 7 computer uses the Home/Private network profile and has only the Public firewall turned on. I am wondering if the fact that the firewall profile and the network profile aren't the same ...
0
votes
0answers
50 views
Is it possible to gather information about a destination-nat host?
Let's say that I'm connected to a network where the ISP has setup a dst-nat from an IP they don't control to an IP that they control,like so:
1- Their DNS server resolves example.xyz to 1.1.1.1 (the ...
1
vote
1answer
86 views
How to disable/block Microsoft Store on Windows 10 Pro by firewall?
I want to block Microsoft Store on Windows 10 pro in a corporate environment. Having read relevant articles about this matter and tested on my machine, I see that Windows 10 Pro does not support this ...
1
vote
1answer
74 views
What is the difference between a bastion host and a dual homed host?
From what I read, I understood that both the bastion host and the dual homed host are special computers that act as a link between the local network and the internet, so what is the difference between ...
0
votes
1answer
46 views
Whats The Point of GeoBlocking if the Firewall Has An Implicit Deny?
What is the point of geoblocking IP addresses with cisco firepower or a similar service if the firewall would block the request anyway? For example, We only do business in the USA but see source IP's ...
1
vote
1answer
40 views
firewalking output rules
Scenario is as follows:
In a vulnhub lab, I got limited shell. By means of
attacker> nc -lvp 1234
victim> nc _attacker_ip 1234
I found out that ubuntu's ufw is limiting outgoing traffic.
...
0
votes
0answers
45 views
Insecurity through all the security. (Questions on infrastructure set up)
I've got an issue with a proposed infrastructure set up so I come to you for some enlightenment.
The flow is: client --> fw--> waf--> api gw--> applications.
Clients will communicate with us using ...
1
vote
1answer
57 views
Best Firewall Zone Settings for Security Gli-net Routers
I believe many will benefit from this as there is not clear answer online and I keep making my policies too strong and locking myself out from accessing the LAN admin panel.
What would be the ...
0
votes
0answers
48 views
Changing the default forward policy to accept (VPN/NAT)
I came across something that seems counter-intuitive while reading a tutorial associated with a very popular hosting provider showing people how to install their own Debian-based OpenVPN server. ...
0
votes
1answer
83 views
Should the Router or Firewall Come First?
Network scenario.... I have a typical enterprise network meaning ISP>>>>Edge Router>>>>>Firewall|DMZ>>>>Switch>>>LAN.
I know there are several debates on the internet about what device comes first ...
1
vote
1answer
115 views
Block WireGuard clients' access to specific websites
I have installed a WireGuard VPN server on a Raspberry Pi (running Raspbian) using PiVPN and I would like to
either block the VPN clients to access specific websites (i.e. block them access https://...
-1
votes
1answer
87 views
Does this iptables entry indicate someone's trying to break in?
Two days ago I built a Debian 10 server in the United States for use as a file server for my web application. When I created the server, I installed the fail2ban package and configured a basic, ...
1
vote
1answer
64 views
Looking to take a hotspot that is shared and create my own hotspot that can be firewalled
What is the best way to take a wireless hotspot that is owned by someone else, create my own hotspot or VLAN to be able to Firewall / Not allow my devices to view the other individuals' devices?
I ...
0
votes
1answer
65 views
What's the point of using a firewall to filter ports if they are closed by default? [duplicate]
I'm just learning most of this stuff so bare with me;
Using a firewall service such as iptables, is there a point in filtering/blocking a port that is not in use meaning it's closed by default?
1
vote
0answers
57 views
Is it possible to bypass .htacess protection?
So, I was involving in one of projects where client site and admin panel/dashboard was hosted on different sites. Not like a lot of CRM`s do or 90% of common sites (just in /admin or other URL ...
1
vote
1answer
91 views
Pfsense security issues?
I have used pfsense before as the main gateway, load balancer, traffic shaping, proxy, firewall, virus/malware protection, enterprise wifi solution for an entire office of 50+ users. Yet I have ...
2
votes
3answers
130 views
Does it make sense to put a firewall within a LAN to protect sensitive information from the rest of the LAN & Internet?
I may not be using the appropriate jargon, but I'll try to explain in my own words.
My understanding is that usually a firewall is facing the internet, but my question is about a differnet setup. I'm ...
1
vote
0answers
75 views
Left port 80 exposed, several IPs accessed phpmyadmin
A few days ago while messing around with a web server, I put my server into a DMZ via my router and forgot to disable it. I opened port 80 and 3306 on the server's firewall (Windows Server) to access ...
1
vote
1answer
88 views
Why is a bind shell sometimes blocked when a reverse shell is not?
I understood the difference between them. The problem is I am not sure when to use each. I mean, if a firewall will block my connection to the target when I use bind shell, why the connection will not ...
6
votes
3answers
285 views
Safely use old windows XP machine in business network
I have a client that has a couple of machines that are build to cut kitchen tables. These machines still run on Windows XP and are connected to the internet.
Now I need to find a way that these ...
0
votes
1answer
76 views
How to make VPS more secure with UFW?
I have 3 VPS based on Ubuntu 18.04 server OS and would like to open particular ports on each servers.
The ports, that I would like to open are:
Then let's take a look on the environment:
As you ...
1
vote
3answers
126 views
Understanding firewalls [duplicate]
I would like to understand how firewalls work in details, and understand the attack surface.
TCP and UDP
I understand that TCP and UDP are easy to filter. Programs on a computer need to ask the OS ...
0
votes
2answers
88 views
Is a firewall needed on a small office that simply needs internet access?
I'm planning on porting all of my office's software needs to cloud services that I can access via internet. It's a simple LAN that has a NAT gateway pointing to the open internet.
Would a firewall ...
0
votes
4answers
92 views
Disable Encrypted Protocols Through Firewall
In my company, we have two internal domains with a firewall between them. When requesting firewall rules for an application with components on domain A and domain B, I was told that encrypted ...
0
votes
1answer
64 views
Modifying host file versus firewall
I am trying to protect a macOS computer. Specifically, I want to prevent the machine from making unwanted connections over the internet.
I am aware of firewalls of course. But I stumbled upon the idea ...
1
vote
0answers
55 views
Avoiding WAF with DirBuster
I am curious as to how bug hunters / pen testers use DirBuster and GoBuster without getting their IPs banned all the time (which is why I am asking)?
1
vote
0answers
56 views
Is a VPN + Firewall + Authorization Redundant?
I am creating a simple application so a distributed team can access sensitive data. This application will have a database that will be inaccessible to the public internet inside a VPC with my cloud ...
1
vote
1answer
132 views
Alternative to Qubes OS network domain for a server
I know that Qubes Os is not suitable for a server use, but some of its features are quite interesting for that. In fact, all the network drivers are contained in a VM that run a different Linux based ...
1
vote
1answer
55 views
Prevent an application from making any network access on macOS
I want to run an application on macOS, but preventing it from making any type of network access, or any type of internet access.
I have seen the following possibilities:
Use the built-in firewall. ...
0
votes
1answer
61 views
Is there something like DynDNS for a DNS service?
I run a small DNS server (pihole) at home behind a firewall, with some custom filtering. It mainly filters ads and trackers, plus some top level domains I want to avoid navigating to. I have an IPv4 ...
0
votes
2answers
155 views
Firewall and VPN
Let's suppose i work in a small office and i can't use my workstation to navigate in Facebook because the external firewall forbids it. But i still can use a VPN to bypass the firewall.
I read that ...
0
votes
0answers
63 views
Method to bypass \n in WAF (\n vulnerability)
I have this application that has an input box where the data is going to be sent in a JSON format. The JSON payload might look like this
{“message”: “hello\nmy name is andi”}
But the problem is the ...
1
vote
0answers
43 views
How can access to Intel ME / AMT be disabled with firewall? [duplicate]
Short of flashing BIOS, there seems to be no way to disable the Intel ME.
So, is there a reliable way to block access to Intel ME, such using HW firewall (Firewall in front of the machine, not ...
0
votes
0answers
16 views
What is the security justification for blocking all outbound ports/protocols except HTTP over 80/443? [duplicate]
My companies IT blocks all outbound traffic except HTTP, preventing me from getting work done at the office (I often need to work on Azure SQL databases which require TCP over port 1433). I can get ...
0
votes
1answer
185 views
Thought process behind firewall design
I'm preparing for an introductory information security examination in university and this is one of the tutorial questions on Firewall design.
My concerns for the provided solution is how to define ...
0
votes
1answer
89 views
Why should I use firewall to block ports with no running services? [duplicate]
A firewall is for blocking / limiting access to specific service / port.
I know that it can be useful for allowing only certain IPs to a port (for example I don't want to have SSH open for the whole ...
0
votes
1answer
216 views
Purpose of Decrypting & Scanning HTTPS traffic
Navigating to the below URL link from the Mozilla Firefox and entering some website link and clicking on View, displays certificate Viewer
chrome://pippki/content/exceptionDialog.xul
After enabling ...
0
votes
0answers
42 views
How does the Great Firewall of China handle TLS encryption? [duplicate]
My understanding is that when a client and server are connected through TLS, only they have the key needed to encrypt and decrypt messages. My question is, given that the Great Firewall of China does ...
2
votes
0answers
42 views
Can NAT Table be vulnerable toward any poisoning attacks?
I am learning the general concept of network security, and becomes aware of two poisoning attacks on the network infrastructures, that is, DNS poisoning attacks and ARP poisoning attacks. They are ...
0
votes
1answer
211 views
Allow only YouTube videos and block other videos
I have a MikroTik router. I want to allow only Youtube videos and block all other videos. I tried to write an extended ACL but I really have no idea. Maybe allow only Youtube videos source URL and ...
1
vote
1answer
70 views
Why am I receiving hits with SPT=443 on IPv6?
I block most everything with my firewall, what I don't get is why would I constantly receive hits to connect on random ports from port 443.
[iptables] reject_ipv6: IN=eno1 OUT= MAC=...
SRC=2607:...
2
votes
1answer
91 views
Can a VPN provider or actors within its infrastructure access open ports on the client machine?
From my understanding of a VPN, it essentially creates a network between the two 'machines'. So if I have open ports (e.g. HTTP, SSH) on my client machine, those can be accessed by the VPN provider or ...
0
votes
0answers
42 views
End to End Encrypted Traffic - Web Application Firewall needed?
Background
We have a Java Spring Server, MongoDB and an Angular Frontend.
Some Application Security Configs:
TLS
Basic Authentication (Password Strength Policy)
XSS Protection (Content Security ...
0
votes
0answers
38 views
Actions after identifying exploitation attempts on servers or applications
I am seeing regular exploitation attempts (like remote code execution, sql injection, etc.) on our DMZ server or applications and these are being dropped by the firewall. However, our SIEM is raising ...
0
votes
0answers
31 views
How can I give a network load balancer (of any type) access to a port on a machine without opening that port to an entire VPC?
Is it possible to make an AWS load balancer for a non-HTTP port allowed to access a specific port on a host without opening that port open to the entire VPC's subnet? I seem to remember reading that ...
2
votes
1answer
435 views
Does blocking all ports make a machine more secure?
I have a machine that I use only to browse the Internet. What if I blocked all ports on this machine (inbound and outbound) except for port 80 and port 443, and restricted these two ports to an ...
6
votes
2answers
202 views
How does a CDN actually prevent DDoS attacks, when an origin server accepts direct connections?
I am trying to understand how a CDN (like Cloudflare e.g) does protect against a DDoS attack.
I would think that the internet traffic is routed through a CDN's reverse proxy, then filtered. This ...
