Questions tagged [firewalls]
Concerned with software or hardware firewalls
1,057
questions
0
votes
0answers
23 views
I can't understand nmap's Null TCP Scan (-sN option) [closed]
nmap -sN <ip_address> sends a TCP packet to the IP with null flag values. This scan is supposed to evade firewalls.
There are several things I don't quite get about this command though:
I ...
1
vote
0answers
37 views
Unsupervised proxy - what could go wrong?
I recently finished setting up mitmproxy on a recently created DigitalOcean Ubuntu Droplet server. Almost immediately after opening the necessary ports in the server firewall and starting the proxy up,...
0
votes
0answers
18 views
Snort IPS Mode Not Completely Blocking Traffic [closed]
I'm setting Snort as IPS to block some malicious traffic, here I use ICMP as an example:
drop icmp any any -> $HOME_NET any (msg: "ICMP detected"; sid:1000001;)
But when attempting to ...
0
votes
0answers
24 views
Auto updating attack signature Firewall, WAF, IPS & IDS to secure Azure services?
We have a need to secure the Application Gateway and hundreds of APIs exposed to the Internet as part of our production environment. Using the existing built-in, Azure services, how to make it secure ...
0
votes
0answers
20 views
Using lulu on osx in home business setup. Any reason for external router base firewall?
I have Lulu setup under osx on my Mac. So say an errant program, curl, if it tries to access outside address is stopped.
Would an external router based firewall bring any extra level of protection? I ...
0
votes
2answers
95 views
Best practices for firewall exceptions
My company has a firewall set up which, among other things, scans incoming files for malware. The scanner alerted about a malicious file that was downloaded to one of our machines. After some ...
0
votes
1answer
66 views
How to stop outgoing SSH on port 443
Let us say that a small company has an internal network for employees. All employees are granted Internet access via a NAT device (not a proxy) and perimeter firewall only allows outgoing connections ...
0
votes
1answer
271 views
Mongo DB hacked (read_me_to_recover) without the port exposed in the firewall?
I have recently set up parse-server on a DO VPS using 3 docker containers; one for parse-server, one for parse-server dashboard and one for mongodb. Because I am just testing this setup I left the ...
24
votes
5answers
5k views
Why is DNS-over-HTTPS such a big security nightmare compared to DNS-over-TLS?
I've heard the argument against DNS-over-HTTPS that it is supposed to be a security nightmare for network defenders because it enables encrypted DNS over port 443, compared to DNS-over-TLS which goes ...
0
votes
1answer
48 views
UFW does not block meterpreter
I am doing some pen testing on my wordpress server. I wanted to see what would happen if the attacker were to get a hold of my username and password for wordpress.
So I used the standard exploit in ...
0
votes
2answers
84 views
Is there a bulletproof way to configure your AWS system? [closed]
I am learning how to configure a multi-region AWS system. However, everything I read says "if you want/need more security then do X". Why would anyone want less security (is what I start ...
3
votes
1answer
112 views
In setting up a VM, does the Bridged or NAT configuration provide more separation security?
I am setting up a few VM's (assume VirtualBox w/ Linux). They will all be on the same PC host (assume Linux) and the intent is to have all the VM's handle separate functions (business, personal ...
1
vote
0answers
20 views
Smart Meter traffic “DLMS/COSEM” Decryption with Cisco FTD [closed]
I need to check how to inspect traffic coming from smart meters with Cisco FTD. All I know is this meter is communicating over DLMS/COSEM.
Anyone with experience in similar scenarios?
-2
votes
1answer
101 views
Securing a read-only REST service for mobile access
I am writing a mobile app that uses a read only REST service that sits behind our company firewall. The actual data supplied by the REST service is not private but I am concerned with a hacker using ...
1
vote
1answer
46 views
When does it make sense to deploy an embedded firewall on my IoT device?
I have a typical IoT set up where a set of IoT devices running embedded Linux are connected to a cloud IoT server. The underlying carrier connection to the internet is over GSM. All communication to ...
0
votes
1answer
75 views
How hardware firewall knows if its an inbound or outbound request? [closed]
Being a hardware firewall, it can only see the TCP/UDP packets, how can they know that a packet coming inside is inbound or response to an outbound request?
0
votes
1answer
124 views
What is “Your Phone” in Windows 10 Advanced Firewall?
I have an Outbound Rule in my firewall called "Your Phone".
Settings:
All programs.
In Customize Application Package Settings, it has "Apply to app package..." set with a long ...
0
votes
0answers
52 views
Is there any Windows HIPS software that supports file and registry access control?
I Have been using COMODO Firewall and HIPS for many years, which can block writes and executes but not reads.
My threat model has changed to include spyware with trusted digital signature, which by ...
1
vote
1answer
65 views
Why does a firewall reencrypt https traffic
I have a Sophos XG firewall. I use it at home (to play around with) This firewall is capable to scan HTTPS traffic.
It decrypts the traffic and re-encrypts the traffic again. For the re-encryption of ...
0
votes
1answer
54 views
What are the downsides to having PostgreSQL database available directly from public network?
When auditing a machine for one of my clients I noticed that they have PostgreSQL listening and accessible from public network. This is not necessary for their application, seems they simply neglected ...
1
vote
2answers
52 views
How to configure a port as filtered on server
With nmap you can see a live system's or server's open, closed, and filtered ports.
But how do you make it show as filtered when it is currently shown as open?
3
votes
1answer
63 views
Getting numerous HEAD requests by Java user agents to resources that require authentication to view within a web application. Should I block them?
I have recently started using Cloudflare's firewall in front of a web application. This app has a limited user base of selected applicants and they must log in to view anything. There is no public ...
0
votes
0answers
29 views
Its there any built in protection against deceptive app names in Android or that make app listings trustable?
Some functionalities rely on app names and icons for proper use. Like firewall, installed apps list, memory usage statistics. I wonder if there is anything fobidding an app to appear with deceptive ...
0
votes
0answers
35 views
What security benefit is there in 2020 to block outbound Ping [duplicate]
I've researched this and found the following on StackExchange and ServerFault, but they're very old.
https://serverfault.com/questions/55889/why-block-outbound-icmp
Is it a bad idea for a firewall ...
1
vote
1answer
40 views
Use linux firewall rules for windows too [closed]
I'd like to improve security on my home network.
I have a PC and a laptop with Microsoft Windows as well as a PC and a laptop with Linux
There are a few HTTP services installed in the network. The ...
0
votes
0answers
23 views
Circumventing inbound traffic rule by faking reply traffic
My question is about security groups/firewalls and protecting a virtual private cloud from the external world. Here is a description of VPC default policy for inbound/outbound traffic (on AWS):
...
1
vote
1answer
138 views
Why can I access the internet with all ports closed on firewall? [closed]
For the heck of it I wanted to see how much I could close down my router from the rest of the internet. I was hoping turning on the firewall, removing any port forwarding and turning off UPnP would ...
2
votes
0answers
329 views
(Public) IP address [x.x.x.x] of Synology has been blocked by SSH
For the past few months I regularly see alerts on my Synology about SSH connection being blocked. Somebody (here a nice Chinese guy from 222.186.15.158) was attempting to connect to my NAS with the ...
0
votes
1answer
137 views
VPN from inside a company
I recently had to bypass my company policy by establishing a VPN connection from a LAN device (raspberry pi) located inside my company, to a WAN server.
As devices accessible from outside must be ...
0
votes
0answers
25 views
What are the use case to host services on tier 2 firewall?
We have a tier 1 and tier 2 firewall
What are the use case to host services on tier 2 firewall? e.g. is connection from field enineers/remote workers one of those?
What security risks and controls ...
0
votes
2answers
64 views
Are there any examples of network-based application firewalls?
As we know, network based firewalls will filter based on information such as source IP, source port, etc. But they won't know what program on the source machine is generating that traffic.
...
0
votes
0answers
212 views
Why does bettercap not capture any traffic and why is its web UI just a blank page?
I'm running Debian10/KDE with the nftables firewall enabled on my host machine and would like to test my phone. In the virtual machine I'm running Kali Linux with bettercap and am trying to sniff ...
0
votes
0answers
96 views
Disable mdns-publisher on Linux?
I just installed a firewall and other security-related software on my Linux machine (Ubuntu 18.04), and after reading about them, decided to disable two services that I did't need with:
sudo ...
0
votes
2answers
91 views
How to avoid leaking your public IP to installed applications like browsers when using a vpn?
What is the easiest setup to hide your public IP from installed applications and prevent things like WebRTC leaks on a common Linux distro?
1
vote
0answers
43 views
Why does the Windows Security Alert dialog default to to the “not recommended” option?
When I launch a program that wants network communication for the first time, I get this dialog:
It's been a part of Windows for a while now (this is running on Windows 10, but note the Vista/7 design ...
0
votes
1answer
60 views
iptables: force clients to use proxy
My network: 192.168.0.1 server. (enp0s3 NAT, enp0s8 internal) 192.168.0.10-15 clients (enp0s3 internal).
I have a proxysquid for blocking websites,and so on.
My clients can navigate and browse any ...
1
vote
1answer
55 views
Security team making the firewall opening, good pratice? [closed]
I'm currently requested in my enterprise to do myself (security team) the firewall overtures requests in TUFIN (firewall workflow), instead of our local IT team. it's for simplicity and saving costs.
...
0
votes
1answer
88 views
How does Cloudflare firewall work?
How does Cloudflare web firewall work? When someone tries to enter a website, they first go through the Cloudflare server and then, if a captcha is solved, they can see the content of the website.
So ...
1
vote
2answers
722 views
Block SYN,ACK response with iptables
I have a virtual environment and I am making a SYN flood attack to a Ubuntu Server's port 53 using Kali 2020.
I realized that a countermeasure for this attack is to limit or block the responses to ...
0
votes
1answer
55 views
VPN as a firewall in a public network
My configuration is: allow only OpenVpn traffic and block any other (income/outcome) traffic with UFW on my ubuntu laptop.
unreal scenario: let’s say i have ubuntu with chrome version 50 [2016] on ...
-1
votes
2answers
276 views
How to block VPNs using tcp port 443?
I have a firewall (pfsense) acting as a gateway for my network users. All user traffic is going through this firewall.
I need to block HotspotShield VPN traffic on this firewall. As known, this VPN ...
-1
votes
1answer
20 views
When are the stateful table entries for the stateful firewall created? [closed]
We know the TCP 3-way handshake:
C->SYN->S
C<-SYN-ACK<-S
C->ACK->S
we also know stateful firewall.
When a stateful filter entry(source ip, source port, dest ip, dest port) create? ...
0
votes
0answers
73 views
Is it a Bad Idea™ to open all IPv6 ports for devices in an isolated guest network?
At home I have a dual-stack IPv4/IPv6 broadband connection, and I also have a wireless access point. The access point currently bridges all traffic into my LAN, which is not segmented in any way, so ...
0
votes
0answers
59 views
Is it possible to gather information about a destination-nat host?
Let's say that I'm connected to a network where the ISP has setup a dst-nat from an IP they don't control to an IP that they control,like so:
1- Their DNS server resolves example.xyz to 1.1.1.1 (the ...
1
vote
1answer
499 views
How to disable/block Microsoft Store on Windows 10 Pro by firewall?
I want to block Microsoft Store on Windows 10 pro in a corporate environment. Having read relevant articles about this matter and tested on my machine, I see that Windows 10 Pro does not support this ...
1
vote
1answer
105 views
What is the difference between a bastion host and a dual homed host?
From what I read, I understood that both the bastion host and the dual homed host are special computers that act as a link between the local network and the internet, so what is the difference between ...
-1
votes
1answer
72 views
Whats The Point of GeoBlocking if the Firewall Has An Implicit Deny?
What is the point of geoblocking IP addresses with cisco firepower or a similar service if the firewall would block the request anyway? For example, We only do business in the USA but see source IP's ...
1
vote
1answer
42 views
firewalking output rules
Scenario is as follows:
In a vulnhub lab, I got limited shell. By means of
attacker> nc -lvp 1234
victim> nc _attacker_ip 1234
I found out that ubuntu's ufw is limiting outgoing traffic.
...
0
votes
0answers
47 views
Insecurity through all the security. (Questions on infrastructure set up)
I've got an issue with a proposed infrastructure set up so I come to you for some enlightenment.
The flow is: client --> fw--> waf--> api gw--> applications.
Clients will communicate with us using ...
1
vote
1answer
82 views
Best Firewall Zone Settings for Security Gli-net Routers
I believe many will benefit from this as there is not clear answer online and I keep making my policies too strong and locking myself out from accessing the LAN admin panel.
What would be the ...
