Questions tagged [firewalls]

Concerned with software or hardware firewalls

Filter by
Sorted by
Tagged with
0 votes
1 answer
41 views

If a computer gets infected with malware, can the host firewall block the malware from communicating back to its controller on the internet?

I'm trying to figure out how secure a host firewall is, hence the question in the title. I read that many firewalls allow outbound connections to port 80 to allow browsing, would that be enough for ...
0 votes
0 answers
26 views

EternalBlue Across Networks

I am working on some research and I am trying to unpack exactly how NotPetya used the eternalblue vulnerability to spread across networks. My understanding of the SMBv1 Protocol is that it would not ...
0 votes
0 answers
23 views

Firewall necessity [duplicate]

Without a program, which accepts incoming connections, you wouldn't have an open port, even if the firewall is disabled. So why is the firewall necessary?
0 votes
1 answer
20 views

Deploy to Digital Ocean droplet from Github Action - Should I leave the SSH port open for future deployments?

I'm going to a deploy a web app (angular static frontend and node backend in docker) to digital ocean droplet. Deployment is done from Github Action by essentially loging via SSH to the droplet and ...
0 votes
0 answers
30 views

Enterprise firewall block specific brower (Firefox)

Apparently, some enterprise firewalls can block specific browsers. I have an example of one blocking all browsers except the ones based on chromium recent versions (Chrome and Edge work) but Firefox ...
0 votes
1 answer
52 views

Do I have to block IPv4-mapped IP addresses in my IPv6 firewall?

I am writing the iplock tool to help me setup my Linux firewall. For the most part, my current strategy, since I don't yet use IPv6 much, is to pretty block everything IPv6 ("simple"). I ...
0 votes
1 answer
62 views

Does the application gateway firewall function only on the application layer or on all layers of the OSI model?

This is very confusing. I am seeing 2 different things in various books and sites. A. Application gateway firewall scans layer 1 to layer 7 of the OSI model. B. Application gateway firewall only scans ...
0 votes
1 answer
21 views

Docker container can't access systemd service because of firewall

I'm in a somewhat weird situation that I don't understand: I use ufw as a firewall. It's setup to drop any input connections apart from ssh I have a service running locally (managed through systemd) ...
  • 125
0 votes
1 answer
431 views

What is Akamai Ghost? [closed]

After making requests to certain domain and their responses being either 4xx or 5xx status codes, the server response header shows Akamai Ghost. Is this response coming from Akamai's firewall or their ...
0 votes
0 answers
73 views

Nessus vulnerability 11411 in Fortigate

I have a Fortigate device and a Nessus vulnerability scan set up. When I ran the scan, it said that there was some kind of .htaccess~ file in my Fortigate device. This is the vulnerability it found. ...
0 votes
0 answers
31 views

Use a custom Metasploit exploit

Suppose there is a remote server 203.0.113.123 listening on port 1337 that is running a vulnerable application. I have engineered a sequence of inputs for that application that result in a shell. I ...
  • 402
0 votes
0 answers
97 views

Best way to protect a KVM host

I am in the process of setting up a KVM host, the machine will be directly exposed to the Internet, with no hardware firewall. I would like to know how to secure it on the network side. So far, I have ...
  • 1
1 vote
0 answers
33 views

Is the "Windows-Defender-Hardening" safe to perform? [closed]

I'm totally not a Microsoft Windows professional. When it comes to Windows, I'm just a normal user. And as this user, I'm wondering why Microsoft isn't shipping a full potential Windows Defender by ...
  • 111
0 votes
1 answer
41 views

firewalld rules that will block traffic from internet but allow internal traffic

I want to block some ports access to the internet but still allow internal hosts to access the port with firewalld. There is another firewall between the internet and the host but I want to add a ...
0 votes
1 answer
87 views

Is there any difference between circuit vs application level gateway except that one operates in layer 3 and another at layer 7 of OSI model?

Question#1 whitewinterwolf answer says the circuit level gateway CHANGES the source ip address of outgoing packet(from the internal network point of view). Two different TCP connection are formed, ...
0 votes
0 answers
48 views

I cannot make a reverse connection

I am playing with a Linux CTF server and came across a kind of reverse connection block. I uploaded a php webshell, gained control of www-data user and tried to make a reverse shell. Possible a UFW ...
0 votes
0 answers
81 views

A Continuous Flood of Kernel Warnings. Am I under attack?

I have a Linksys WRT1200AC with DD-WRT v3.0-r48865 std. It's connected to the Internet through the ISP's modem in bridge mode. My syslog reports continuously, many times per second stuff like this: ...
1 vote
3 answers
149 views

Are country IP address blocks officially standardised and can they be reliably used for access control?

I was setting up firewalld on an enterprise server and came across their concept of firewall zones. I figured I can easily use them and their source property to restrict access to SSH to only the ...
0 votes
1 answer
488 views

Are there security implications of allowing Discord through Windows Firewall?

I just installed Discord (downloaded from the official Discord website) and after the install a Windows Firewall pop-up appears asking me if I want to allow Discord through Windows Firewall. I don't ...
1 vote
1 answer
130 views

I am still receiving ssh-bruteforce on my VPS

I have a server in Oracle Cloud Infrastructure Ashburn. I am using Tailscale to SSH my servers and closed Port 22 in public. I closed Port 22 on the VCN and left Port 22 open on the server. But no one ...
0 votes
0 answers
54 views

How to detect a firewall used

I was scanning a network with Nmap. I'm looking for advanced commands for detecting firewalls.
0 votes
0 answers
29 views

Network Segmentation - Single Firewall VM vs Multiple

I am currently implementing a new network with different segments. The separation of those segments is achieved using VLANs. To enable some segments to communicate with each other and to be reached ...
2 votes
0 answers
138 views

No root firewall vs any spyware / malware

I am wondering about the effectiveness of no root firewalls as a solution against any type of spyware / malware. Particularly on an android device. No root firewalls like this one here (aptly named) ...
0 votes
0 answers
38 views

Writing effective UFW & IpTable rules

I am quite new to UFW and IpTables and I am trying to understand what kind of rules we should look to implement to keep a web-application secure. The current scenario I am testing myself in is that I ...
  • 197
0 votes
1 answer
449 views

UFW vs IpTables for web application security

I am trying to better understand measures that can be used to protect a web-application. I'm trying to determine which would be more effective, implementing a UFW or using IpTables. From my ...
  • 197
0 votes
1 answer
75 views

The router (that my PC is connected to) is continuously attempting to connect through TCP80. What would be the reasons?

I have no access to the router nor do I have any administrative access to this local network. But every 5 minutes the router attempts to connect to my PC through port 80/tcp, and it attempts exactly 4 ...
1 vote
1 answer
78 views

How much network noise is normal? [closed]

on my Ubuntu VPS I am getting a lot of requests and portscans from foreign sources. They are all blocked by UFW. However my question is, if this much "network noise" is normal or is my ...
0 votes
0 answers
913 views

Couldn't validate TLS certificate - Nord VPN

I received this notification from Nord randomly. Should I be worried? Is there something I can do? Am I being hacked? P.S. clicked Don't trust EDIT: I tried connecting from mobile data and am ...
1 vote
1 answer
226 views

How can malware or a hacker penetrate a firewall from external perimeter?

How can malware or a hacker penetrate a firewall in a router/AP or a dedicated firewall without "help from the inside" (running malicious script on a computer, forgotten open ports with port ...
  • 33
1 vote
1 answer
227 views

Decrypting WhatsApp traffic and blocking file uploads possible using a firewall ssl decryption policy?

So we want to block file uploads on WhatsApp but since it's encrypted, I doubt this can be done, however, can PANOS decrypt WhatsApp?? I ask because WhatsApp doesn't exactly use SSL right, it's more ...
1 vote
1 answer
99 views

Possible rogue admin monitoring my online activities

I teleworked for a medium-sized software company. We had a network architect who offered me a firewall to install so I could securely access on-premises resources and play around with some ...
5 votes
0 answers
210 views

Why am seeing all these Chinese proxy domains? [closed]

Through a casual Google search I came to this Stack Overflow result. I clicked it absent-mindedly, could not connect through the server and saw that he domain was some Chinese government proxy server. ...
  • 151
-2 votes
1 answer
156 views

Difference between 22 and 22/tcp rule in firewall

I have those two rules in UFW, but no idea what is the difference between [1] and [2]? To Action From -- ------ ---- [ 1] 22 ...
0 votes
1 answer
67 views

Does such kind of privacy proxy exist?

Imagine a typical web service. A client accesses it through a load balancer, which forwards the request to a backend server which will fetch data from a database, create the result and send it back to ...
  • 61
0 votes
0 answers
63 views

If all ports are closed except for port 5001 and all internet traffic is blocked except for traffic to/from 1 remote server, can we still be hacked?

We have closed all ports via our hardware firewall except for port 5001 which is open to allow our trading platform software (which does not have any publicly known software vulnerabilities) to ...
0 votes
1 answer
29 views

Recommended secure option for uploading files to web server from a dynamic IP?

I need the best way to access a webserver to upload/modify a PHP script. The website contains very sensitive information, gaining unauthorized access to this server and modifying files would lead to ...
0 votes
1 answer
71 views

If I close all ports via our firewall except for the single port used by our forex broker can I still be hacked by the broker or someone else?

We have closed all ports on our firewall except for port 5011 which is the only port that is required to be open on our server so that our server can receive price data and send buy and sell orders to ...
0 votes
3 answers
236 views

Best practices for securing SSH access? Is certificate-based VPN server a good solution?

I run a server on a hosting. I want to harden it, but ssh access is giving me a bit of concerns. I usually access from home most of the times. I have a provider subscription with the usual DHCP setup ...
0 votes
0 answers
33 views

Firewall IP-Filtered Pinhole Risks

To facilitate consulting work, a client has suggested that they allow me to connect directly to an in-house remote desktop server, via a firewall pinhole which allows connection from my IP address ...
  • 101
0 votes
0 answers
36 views

Weird Problem with Virtual Machine and Comodo

I am new to this forum and I have the following issue: Some days ago, I clicked on a pop up-window in my Linux-VM that said I need to Update some features or so ... after I clicked "Okay", ...
  • 1
0 votes
1 answer
370 views

What would be the best way to mitigate Azure Application Gateway WAF False Positive?

We have a Web API which uses the REST semantics and is protected using the Azure's Application Gateway using a Web Application Firewall. The Web App consuming this API can send in any type of data in ...
0 votes
2 answers
150 views

How does my HTTPS POST get blocked based on XML content?

There's a web application on a server which I have full access to which accepts POST requests on a REST endpoint. The request payload is expected to be an XML document. For request routing and load ...
  • 121
4 votes
1 answer
442 views

What is the need for firewall to be in "stealth mode"?

There is a firewall deployment case called "transparent mode", when the firewall does its job without routing and having IPv4 addresses, i.e. it is invisible. "Stealth mode" is ...
  • 141
0 votes
1 answer
2k views

Is enabling software flow-offloading in OpenWRT's firewall settings dangerous?

First of all, I did ask this on OpenWrt Forums already, I thought maybe someone here knows this. I noticed that my internet speed gets limited when this feature is not enabled, this feature is also ...
0 votes
1 answer
398 views

Should we enable UFW for EC2 (Ubuntu Server) instance with Nginx?

I just finished installing Nginx on my EC2 Ubuntu Server (AWS) and everything looks normal. I tested it on my browser by accessing my EC2 public IP. I can see Nginx's welcome message. It's not a big ...
0 votes
1 answer
102 views

Block inbound TCP segments with ACK=0 vs Block inbound TCP segments with SYN=1, how are they same?

Blocking inbound TCP segments with ACK=0 Blocking inbound TCP segments with SYN=1 Both prevent external clients from making TCP connections to internal clients, but allow internal clients to connect ...
  • 1
0 votes
2 answers
225 views

In a network do we need both TLS and Firewall?

I need to set up a small network as shown below. Is it really required that the "switch should also host a firewall" when all the communication between the "computers" is over TLS?
0 votes
0 answers
106 views

OCSP hosts. How to tell Malicious OCSP hosts apart

Learning abit about allowed OCSP hosts on Windows 10: I've picked up OCSP requests carried out by CryptSvc pointing towards an OCSP server in Japan. Referring to Microsoft's Win10 Non-enterprise ...
  • 41
0 votes
1 answer
117 views

Apps like Twitch asking for Firewall exceptions: are we at risk of having our computer hacked?

I am installing the Twitch app, and a firewall warning popped up asking that I give permissions to use the app via private and/or public networks. I am a security newbie but a bit paranoid and wonder ...
  • 385
0 votes
1 answer
235 views

Risks posed by a wireguard connection to a compromised server

I am trying to understand the risks posed by having a wireguard connection under a very specific and narrow set of circumstances. I have a desktop at home that is behind a router/firewall and is not ...
  • 3

1
2 3 4 5
23