Questions tagged [firewalls]
Concerned with software or hardware firewalls
1,047
questions
3
votes
1answer
107 views
In setting up a VM, does the Bridged or NAT configuration provide more separation security?
I am setting up a few VM's (assume VirtualBox w/ Linux). They will all be on the same PC host (assume Linux) and the intent is to have all the VM's handle separate functions (business, personal ...
1
vote
0answers
19 views
Smart Meter traffic “DLMS/COSEM” Decryption with Cisco FTD [closed]
I need to check how to inspect traffic coming from smart meters with Cisco FTD. All I know is this meter is communicating over DLMS/COSEM.
Anyone with experience in similar scenarios?
-2
votes
1answer
101 views
Securing a read-only REST service for mobile access
I am writing a mobile app that uses a read only REST service that sits behind our company firewall. The actual data supplied by the REST service is not private but I am concerned with a hacker using ...
1
vote
1answer
45 views
When does it make sense to deploy an embedded firewall on my IoT device?
I have a typical IoT set up where a set of IoT devices running embedded Linux are connected to a cloud IoT server. The underlying carrier connection to the internet is over GSM. All communication to ...
0
votes
1answer
72 views
How hardware firewall knows if its an inbound or outbound request? [closed]
Being a hardware firewall, it can only see the TCP/UDP packets, how can they know that a packet coming inside is inbound or response to an outbound request?
0
votes
1answer
73 views
What is “Your Phone” in Windows 10 Advanced Firewall?
I have an Outbound Rule in my firewall called "Your Phone".
Settings:
All programs.
In Customize Application Package Settings, it has "Apply to app package..." set with a long ...
0
votes
0answers
46 views
Is there any Windows HIPS software that supports file and registry access control?
I Have been using COMODO Firewall and HIPS for many years, which can block writes and executes but not reads.
My threat model has changed to include spyware with trusted digital signature, which by ...
1
vote
1answer
57 views
Why does a firewall reencrypt https traffic
I have a Sophos XG firewall. I use it at home (to play around with) This firewall is capable to scan HTTPS traffic.
It decrypts the traffic and re-encrypts the traffic again. For the re-encryption of ...
0
votes
1answer
51 views
What are the downsides to having PostgreSQL database available directly from public network?
When auditing a machine for one of my clients I noticed that they have PostgreSQL listening and accessible from public network. This is not necessary for their application, seems they simply neglected ...
1
vote
2answers
47 views
How to configure a port as filtered on server
With nmap you can see a live system's or server's open, closed, and filtered ports.
But how do you make it show as filtered when it is currently shown as open?
3
votes
1answer
57 views
Getting numerous HEAD requests by Java user agents to resources that require authentication to view within a web application. Should I block them?
I have recently started using Cloudflare's firewall in front of a web application. This app has a limited user base of selected applicants and they must log in to view anything. There is no public ...
0
votes
0answers
27 views
Its there any built in protection against deceptive app names in Android or that make app listings trustable?
Some functionalities rely on app names and icons for proper use. Like firewall, installed apps list, memory usage statistics. I wonder if there is anything fobidding an app to appear with deceptive ...
0
votes
0answers
34 views
What security benefit is there in 2020 to block outbound Ping [duplicate]
I've researched this and found the following on StackExchange and ServerFault, but they're very old.
https://serverfault.com/questions/55889/why-block-outbound-icmp
Is it a bad idea for a firewall ...
1
vote
1answer
40 views
Use linux firewall rules for windows too [closed]
I'd like to improve security on my home network.
I have a PC and a laptop with Microsoft Windows as well as a PC and a laptop with Linux
There are a few HTTP services installed in the network. The ...
0
votes
0answers
22 views
Circumventing inbound traffic rule by faking reply traffic
My question is about security groups/firewalls and protecting a virtual private cloud from the external world. Here is a description of VPC default policy for inbound/outbound traffic (on AWS):
...
1
vote
1answer
86 views
Why can I access the internet with all ports closed on firewall? [closed]
For the heck of it I wanted to see how much I could close down my router from the rest of the internet. I was hoping turning on the firewall, removing any port forwarding and turning off UPnP would ...
2
votes
0answers
209 views
(Public) IP address [x.x.x.x] of Synology has been blocked by SSH
For the past few months I regularly see alerts on my Synology about SSH connection being blocked. Somebody (here a nice Chinese guy from 222.186.15.158) was attempting to connect to my NAS with the ...
0
votes
1answer
137 views
VPN from inside a company
I recently had to bypass my company policy by establishing a VPN connection from a LAN device (raspberry pi) located inside my company, to a WAN server.
As devices accessible from outside must be ...
0
votes
0answers
25 views
What are the use case to host services on tier 2 firewall?
We have a tier 1 and tier 2 firewall
What are the use case to host services on tier 2 firewall? e.g. is connection from field enineers/remote workers one of those?
What security risks and controls ...
0
votes
2answers
61 views
Are there any examples of network-based application firewalls?
As we know, network based firewalls will filter based on information such as source IP, source port, etc. But they won't know what program on the source machine is generating that traffic.
...
0
votes
0answers
147 views
Why does bettercap not capture any traffic and why is its web UI just a blank page?
I'm running Debian10/KDE with the nftables firewall enabled on my host machine and would like to test my phone. In the virtual machine I'm running Kali Linux with bettercap and am trying to sniff ...
0
votes
0answers
51 views
Disable mdns-publisher on Linux?
I just installed a firewall and other security-related software on my Linux machine (Ubuntu 18.04), and after reading about them, decided to disable two services that I did't need with:
sudo ...
0
votes
2answers
77 views
How to avoid leaking your public IP to installed applications like browsers when using a vpn?
What is the easiest setup to hide your public IP from installed applications and prevent things like WebRTC leaks on a common Linux distro?
1
vote
0answers
34 views
Why does the Windows Security Alert dialog default to to the “not recommended” option?
When I launch a program that wants network communication for the first time, I get this dialog:
It's been a part of Windows for a while now (this is running on Windows 10, but note the Vista/7 design ...
0
votes
1answer
56 views
iptables: force clients to use proxy
My network: 192.168.0.1 server. (enp0s3 NAT, enp0s8 internal) 192.168.0.10-15 clients (enp0s3 internal).
I have a proxysquid for blocking websites,and so on.
My clients can navigate and browse any ...
1
vote
1answer
55 views
Security team making the firewall opening, good pratice? [closed]
I'm currently requested in my enterprise to do myself (security team) the firewall overtures requests in TUFIN (firewall workflow), instead of our local IT team. it's for simplicity and saving costs.
...
0
votes
1answer
84 views
How does Cloudflare firewall work?
How does Cloudflare web firewall work? When someone tries to enter a website, they first go through the Cloudflare server and then, if a captcha is solved, they can see the content of the website.
So ...
1
vote
2answers
336 views
Block SYN,ACK response with iptables
I have a virtual environment and I am making a SYN flood attack to a Ubuntu Server's port 53 using Kali 2020.
I realized that a countermeasure for this attack is to limit or block the responses to ...
0
votes
1answer
53 views
VPN as a firewall in a public network
My configuration is: allow only OpenVpn traffic and block any other (income/outcome) traffic with UFW on my ubuntu laptop.
unreal scenario: let’s say i have ubuntu with chrome version 50 [2016] on ...
-1
votes
2answers
185 views
How to block VPNs using tcp port 443?
I have a firewall (pfsense) acting as a gateway for my network users. All user traffic is going through this firewall.
I need to block HotspotShield VPN traffic on this firewall. As known, this VPN ...
-1
votes
1answer
20 views
When are the stateful table entries for the stateful firewall created? [closed]
We know the TCP 3-way handshake:
C->SYN->S
C<-SYN-ACK<-S
C->ACK->S
we also know stateful firewall.
When a stateful filter entry(source ip, source port, dest ip, dest port) create? ...
0
votes
0answers
70 views
Is it a Bad Idea™ to open all IPv6 ports for devices in an isolated guest network?
At home I have a dual-stack IPv4/IPv6 broadband connection, and I also have a wireless access point. The access point currently bridges all traffic into my LAN, which is not segmented in any way, so ...
0
votes
0answers
58 views
Is it possible to gather information about a destination-nat host?
Let's say that I'm connected to a network where the ISP has setup a dst-nat from an IP they don't control to an IP that they control,like so:
1- Their DNS server resolves example.xyz to 1.1.1.1 (the ...
1
vote
1answer
346 views
How to disable/block Microsoft Store on Windows 10 Pro by firewall?
I want to block Microsoft Store on Windows 10 pro in a corporate environment. Having read relevant articles about this matter and tested on my machine, I see that Windows 10 Pro does not support this ...
1
vote
1answer
84 views
What is the difference between a bastion host and a dual homed host?
From what I read, I understood that both the bastion host and the dual homed host are special computers that act as a link between the local network and the internet, so what is the difference between ...
0
votes
1answer
64 views
Whats The Point of GeoBlocking if the Firewall Has An Implicit Deny?
What is the point of geoblocking IP addresses with cisco firepower or a similar service if the firewall would block the request anyway? For example, We only do business in the USA but see source IP's ...
1
vote
1answer
41 views
firewalking output rules
Scenario is as follows:
In a vulnhub lab, I got limited shell. By means of
attacker> nc -lvp 1234
victim> nc _attacker_ip 1234
I found out that ubuntu's ufw is limiting outgoing traffic.
...
0
votes
0answers
46 views
Insecurity through all the security. (Questions on infrastructure set up)
I've got an issue with a proposed infrastructure set up so I come to you for some enlightenment.
The flow is: client --> fw--> waf--> api gw--> applications.
Clients will communicate with us using ...
1
vote
1answer
73 views
Best Firewall Zone Settings for Security Gli-net Routers
I believe many will benefit from this as there is not clear answer online and I keep making my policies too strong and locking myself out from accessing the LAN admin panel.
What would be the ...
0
votes
0answers
66 views
Changing the default forward policy to accept (VPN/NAT)
I came across something that seems counter-intuitive while reading a tutorial associated with a very popular hosting provider showing people how to install their own Debian-based OpenVPN server. ...
1
vote
1answer
117 views
Should the Router or Firewall Come First?
Network scenario.... I have a typical enterprise network meaning
ISP > Edge Router > Firewall|DMZ > Switch > LAN
I know there are several debates about what device comes first, but ...
1
vote
1answer
339 views
Block WireGuard clients' access to specific websites
I have installed a WireGuard VPN server on a Raspberry Pi (running Raspbian) using PiVPN and I would like to
either block the VPN clients to access specific websites (i.e. block them access https://...
-1
votes
1answer
93 views
Does this iptables entry indicate someone's trying to break in?
Two days ago I built a Debian 10 server in the United States for use as a file server for my web application. When I created the server, I installed the fail2ban package and configured a basic, ...
1
vote
1answer
69 views
Looking to take a hotspot that is shared and create my own hotspot that can be firewalled
What is the best way to take a wireless hotspot that is owned by someone else, create my own hotspot or VLAN to be able to Firewall / Not allow my devices to view the other individuals' devices?
I ...
0
votes
1answer
70 views
What's the point of using a firewall to filter ports if they are closed by default? [duplicate]
I'm just learning most of this stuff so bare with me;
Using a firewall service such as iptables, is there a point in filtering/blocking a port that is not in use meaning it's closed by default?
1
vote
0answers
77 views
Is it possible to bypass .htacess protection?
So, I was involving in one of projects where client site and admin panel/dashboard was hosted on different sites. Not like a lot of CRM`s do or 90% of common sites (just in /admin or other URL ...
1
vote
1answer
250 views
Pfsense security issues?
I have used pfsense before as the main gateway, load balancer, traffic shaping, proxy, firewall, virus/malware protection, enterprise wifi solution for an entire office of 50+ users. Yet I have ...
2
votes
3answers
139 views
Does it make sense to put a firewall within a LAN to protect sensitive information from the rest of the LAN & Internet?
I may not be using the appropriate jargon, but I'll try to explain in my own words.
My understanding is that usually a firewall is facing the internet, but my question is about a differnet setup. I'm ...
1
vote
0answers
76 views
Left port 80 exposed, several IPs accessed phpmyadmin
A few days ago while messing around with a web server, I put my server into a DMZ via my router and forgot to disable it. I opened port 80 and 3306 on the server's firewall (Windows Server) to access ...
1
vote
1answer
142 views
Why is a bind shell sometimes blocked when a reverse shell is not?
I understood the difference between them. The problem is I am not sure when to use each. I mean, if a firewall will block my connection to the target when I use bind shell, why the connection will not ...
