Questions tagged [firewalls]

Concerned with software or hardware firewalls

Filter by
Sorted by
Tagged with
0 votes
0 answers
25 views

Network vulnerability scanner optimal positioning in network

Scenario: There is a network infrastructure with IT and OT subnets and DMZ. I can only place 2 scanners in the whole infrastructure. Are there any recommendations or best practices for how to plan the ...
spaceMerc's user avatar
0 votes
1 answer
52 views

Port scanning but Windows firewall isn't logging the connection

We are seeing port scans coming from many of our company devices and scanning our internal network over the VPN. The events are not reproducible and are not regular. Scans always follow the same ...
H3GE's user avatar
  • 1
0 votes
1 answer
182 views

Can China decrypt SSL as soon as people using their ISP?

While these VPNs can work inside of China, I wonder how private and secure they are since China is known for its great firewall, like most technically advanced countries. Are these methods working? ...
Maxfield's user avatar
  • 127
0 votes
1 answer
120 views

Perfect DMZ: LDAP auth to AD

My goal is to integrate a public facing service with AD using LDAP. While I vouch for federated approach to user authentication, the business dictates LDAP. We run a DMZ subnet and I insist on not ...
Grigory Sergeev's user avatar
0 votes
0 answers
19 views

pfSense not working properly on Azure VNet? What do i do?

I'm currently working on a project based on creating virtual networks and configuring a virtualized firewall (pfSense) along with access control. I was given this project idea in a cybersecurity ...
Thanos's user avatar
  • 111
0 votes
0 answers
59 views

How to Determine if an Intrusion in the Firewall Log was Successful or Not?

Is there any way, in looking at the firewall/system log to tell? I realize these events are very common these days. However, I want to make sure that they didn't get through the firewall and that it ...
Forward_Always's user avatar
0 votes
3 answers
106 views

How to actively monitor open ports on servers

I have several servers that must be exclusively accessible only on the internal network, for example database, which can never be accessible via internet. And also cases that they can only be accessed ...
Tom's user avatar
  • 174
1 vote
0 answers
171 views

How did I get hacked? [closed]

As usual, I ordered a CentOS 7 virtual machine from my hoster. Installed a firewalld and docker on it. In docker, through docker-compose, I launched a web application that hangs on the standard port ...
RoyalGoose's user avatar
  • 1,015
1 vote
1 answer
107 views

How outgoing tunnels are not stopped by AV or firewalls?

How can an attacker with initial access to a server behind a firewall, which only has SSH, HTTPS, and HTTP ports open, maintain remote access to the server even after the SSH port is closed by the ...
Akam's user avatar
  • 1,357
21 votes
2 answers
4k views

Which IP address would be most safe and suitable to use as a placeholder in a live system?

Is there a best practice IP address that is safe to use as a placeholder in a live public system on the Internet? e.g. In a similar capacity, the domain name example.com is reserved and can be safely ...
BadHorsie's user avatar
  • 385
25 votes
3 answers
5k views

Is it possible to provide Internet to prisoners without risks of them contacting victims or accomplices as a matter of policy?

By securely I mean without the risk of them committing cybercrimes or contacting victims or other people to commit more crimes ? I've read that even with firewalls a way around it could be found, ...
swarahan's user avatar
  • 351
0 votes
1 answer
188 views

Why does the windows firewall allow apps to communicate through so many different ports and to so many different addresses?

I looked at my default windows defender firewall on Windows 10 22H2, and most of the rules allow apps to communicate through any local port to any remote address and port. I have read other questions ...
Cybsechuman's user avatar
1 vote
1 answer
94 views

DOS UDP port scans in firewall logs

For a few days, we are getting the following logs on our firewall (Vigor2926ac, up-to-date firmware) The traffic suggests that it comes from Google / Microsoft datacenters, but that's a bit odd that ...
Gino's user avatar
  • 11
0 votes
1 answer
96 views

Can my local MySQL server be accessed without permission

I have hosted a MySQL database server on a VPS to connect to a flask web app on the same VPS. It only has users with host as local ip address. Can it be accessed by anyone else remotely, except me? If ...
Prog Techs's user avatar
0 votes
2 answers
64 views

Can a WAF transform HTTP response

I have hit a conceptual roadblock here and, to be honest, do not really have a lot of experience with WAFs or firewalls in general. (I did go through this very nice explanation to get upto speed with ...
qre0ct's user avatar
  • 1,522
0 votes
0 answers
34 views

Unable to Understand the Data Flow and Network Security Architecture

Received the attached Network Connectivity Diagram with Network Security Components Integrated in the Network Can some body explain how the Network Security is Applied for Threat and Intrusion ...
user1092345's user avatar
0 votes
0 answers
369 views

Symantec Endpoint Protection "Traffic has been blocked from this application: (svchost.exe)"

I'm currently getting this notification from SEP around twice a month saying "Traffic has been blocked from this application: (svchost.exe)" Logs: 1/3/2023 12:32 Blocked Major Incoming UDP .....
Theirry's user avatar
0 votes
0 answers
126 views

How strong is windows firewall on Windows Server 2019?

How strong is Windows Firewall? I have no knowledge on Botnets or how to use them, so I have no way to test Windows firewall's strength. And I believe it would go against the contract I signed with my ...
Azriel Elijay's user avatar
-1 votes
1 answer
4k views

How do firewall action types happen?

I see some firewall action types in the logs such as client-rst, server-rst etc. Are these action types valid for all firewall vendors? If so, is there a way to get firewall to create these actions?
hakkican's user avatar
  • 105
0 votes
0 answers
66 views

Unexpected drop in UFW noise, should I be worried?

I run a bare-metal on-premises GitLab server (Ubuntu 22.04) for a very small company. While the server isn't currently in production use, it is active and accessible over the public internet. I have ...
rdi_pck's user avatar
1 vote
1 answer
248 views

Is my website under attack?

I have a web server. I was investigting why my nginx is keep crashing. I noticed a few other issues in my logs. Note: In the log report, I replace the name of my website with example.com and my second ...
martiz's user avatar
  • 11
1 vote
1 answer
292 views

Is it still recommended to block Living Off The Land Binaries (LOLBins) in Firewall?

https://lolbas-project.github.io/ Realistically, do we still need to block cmd.exe or certutil.exe in Windows firewall, on latest version of Windows? Lolbins are for Linux too but my question is only ...
user avatar
1 vote
1 answer
128 views

Is blocking Autonomous Systems numbers in the firewall a good practice?

In response to low-hanging fruit attacks (accounts creation, image sending etc.) which request rates goes below our rate-limiting rules and are not blocked, we started blocking AS numbers from ...
hacb's user avatar
  • 21
1 vote
0 answers
164 views

What would be the security rationale for a hotel blocking only SSH traffic? [closed]

I recently stayed at a hotel where outbound SSH traffic (and seemingly only SSH traffic) was blocked on the guest WiFi network, and I'm trying to figure out what security-based rationale they might ...
Psychonaut's user avatar
0 votes
1 answer
154 views

Is there a way to identify whether "filtered" state in nmap output caused by a network or host-based firewall?

Is there a way to identify whether "filtered" state for a specific port in nmap output is caused by a network firewall or host-based firewall?
Manjula's user avatar
  • 180
0 votes
0 answers
444 views

Block all windows system outgoing internet connections but allow LAN on Private and VPN on Public

I have several windows PC connected to my mikrotik. I use basic features: file sharing, playing games with friends on home LAN and want to connect internet only through VPN (openVPN client). But I am ...
owaiera's user avatar
1 vote
2 answers
61 views

What is the better tunnel endpoint?

I'm trying to understand the consequences or implications of setting up tunneling endpoints for the below topology. The tunneling may be used for anything (encryption, VPNs, etc.) assuming the general ...
Watchdogs1499's user avatar
0 votes
1 answer
849 views

OpenVPN & China's Great Firewall

The company I work for has an OpenVPN server so we can access its intranet from home. The problem is that I'm going to move to China and I'll need to connect from there, but I've heard connections ...
anonymous's user avatar
0 votes
0 answers
18 views

Nmap scan using default script scan and version detection fail [duplicate]

I am running the following scan using -sC -sV on a target: sudo nmap -sC -sV XX.XX.XX.XX PORT STATE SERVICE VERSION 53/tcp open tcpwrapped 80/tcp open tcpwrapped 443/tcp open tcpwrapped I ...
project_2501's user avatar
1 vote
2 answers
149 views

How to sniff connection between web browser and 127.0.0.1:1234 running HTTP proxy on Client B's machine while taking internet from client A's machine?

Client A is connected to the public internet. Client B gateway address is connected to the Client A's network interface. Client B is running a Web browser which is sending requests to 127.0.0.1:1234 ...
A P's user avatar
  • 111
2 votes
2 answers
266 views

If a computer gets infected with malware, can the host firewall block the malware from communicating back to its controller on the internet?

I'm trying to figure out how secure a host firewall is, hence the question in the title. I read that many firewalls allow outbound connections to port 80 to allow browsing, would that be enough for ...
ninjarubberband's user avatar
0 votes
0 answers
45 views

EternalBlue Across Networks

I am working on some research and I am trying to unpack exactly how NotPetya used the eternalblue vulnerability to spread across networks. My understanding of the SMBv1 Protocol is that it would not ...
ford prefect's user avatar
0 votes
1 answer
171 views

Deploy to Digital Ocean droplet from Github Action - Should I leave the SSH port open for future deployments?

I'm going to a deploy a web app (angular static frontend and node backend in docker) to digital ocean droplet. Deployment is done from Github Action by essentially loging via SSH to the droplet and ...
Mike Strutter's user avatar
0 votes
0 answers
41 views

Enterprise firewall block specific brower (Firefox)

Apparently, some enterprise firewalls can block specific browsers. I have an example of one blocking all browsers except the ones based on chromium recent versions (Chrome and Edge work) but Firefox ...
theboss1er's user avatar
1 vote
1 answer
258 views

Do I have to block IPv4-mapped IP addresses in my IPv6 firewall?

I am writing the iplock tool to help me setup my Linux firewall. For the most part, my current strategy, since I don't yet use IPv6 much, is to pretty block everything IPv6 ("simple"). I ...
Alexis Wilke's user avatar
1 vote
1 answer
178 views

Does the application gateway firewall function only on the application layer or on all layers of the OSI model?

This is very confusing. I am seeing 2 different things in various books and sites. A. Application gateway firewall scans layer 1 to layer 7 of the OSI model. B. Application gateway firewall only scans ...
zeeshanseikh's user avatar
0 votes
1 answer
186 views

Docker container can't access systemd service because of firewall

I'm in a somewhat weird situation that I don't understand: I use ufw as a firewall. It's setup to drop any input connections apart from ssh I have a service running locally (managed through systemd) ...
Rififi's user avatar
  • 135
1 vote
1 answer
6k views

What is Akamai Ghost? [closed]

After making requests to certain domain and their responses being either 4xx or 5xx status codes, the server response header shows Akamai Ghost. Is this response coming from Akamai's firewall or their ...
Just.a.tech's user avatar
0 votes
0 answers
573 views

Nessus vulnerability 11411 in Fortigate

I have a Fortigate device and a Nessus vulnerability scan set up. When I ran the scan, it said that there was some kind of .htaccess~ file in my Fortigate device. This is the vulnerability it found. ...
Skybellina's user avatar
1 vote
0 answers
106 views

Is the "Windows-Defender-Hardening" safe to perform? [closed]

I'm totally not a Microsoft Windows professional. When it comes to Windows, I'm just a normal user. And as this user, I'm wondering why Microsoft isn't shipping a full potential Windows Defender by ...
bastey's user avatar
  • 111
0 votes
1 answer
394 views

firewalld rules that will block traffic from internet but allow internal traffic

I want to block some ports access to the internet but still allow internal hosts to access the port with firewalld. There is another firewall between the internet and the host but I want to add a ...
Danie de Jager's user avatar
0 votes
1 answer
268 views

Is there any difference between circuit vs application level gateway except that one operates in layer 3 and another at layer 7 of OSI model?

Question#1 whitewinterwolf answer says the circuit level gateway CHANGES the source ip address of outgoing packet(from the internal network point of view). Two different TCP connection are formed, ...
el_waleou's user avatar
0 votes
0 answers
123 views

I cannot make a reverse connection

I am playing with a Linux CTF server and came across a kind of reverse connection block. I uploaded a php webshell, gained control of www-data user and tried to make a reverse shell. Possible a UFW ...
Shinomoto Asakura's user avatar
0 votes
0 answers
416 views

A Continuous Flood of Kernel Warnings. Am I under attack?

I have a Linksys WRT1200AC with DD-WRT v3.0-r48865 std. It's connected to the Internet through the ISP's modem in bridge mode. My syslog reports continuously, many times per second stuff like this: ...
Jerry_D's user avatar
1 vote
3 answers
185 views

Are country IP address blocks officially standardised and can they be reliably used for access control?

I was setting up firewalld on an enterprise server and came across their concept of firewall zones. I figured I can easily use them and their source property to restrict access to SSH to only the ...
Marty Cagas's user avatar
-1 votes
3 answers
149 views

Why don’t routers request permission when attempting to connect to an unknown address? (Or why do they still assume every connection is trustworthy?)

I’m imagining a system similar to UAC on Windows but implemented at the router level for IP addresses instead. (Or AS numbers, BGP numbers, Port number, etc…) Naturally this makes router setup ...
M. Y. Zuo's user avatar
0 votes
1 answer
4k views

Are there security implications of allowing Discord through Windows Firewall?

I just installed Discord (downloaded from the official Discord website) and after the install a Windows Firewall pop-up appears asking me if I want to allow Discord through Windows Firewall. I don't ...
em1l10200's user avatar
1 vote
1 answer
252 views

I am still receiving ssh-bruteforce on my VPS

I have a server in Oracle Cloud Infrastructure Ashburn. I am using Tailscale to SSH my servers and closed Port 22 in public. I closed Port 22 on the VCN and left Port 22 open on the server. But no one ...
Hanson Deck's user avatar
0 votes
0 answers
94 views

How to detect a firewall used

I was scanning a network with Nmap. I'm looking for advanced commands for detecting firewalls.
Imran Niaz's user avatar
0 votes
0 answers
42 views

Network Segmentation - Single Firewall VM vs Multiple

I am currently implementing a new network with different segments. The separation of those segments is achieved using VLANs. To enable some segments to communicate with each other and to be reached ...
valkyrie's user avatar

1
2 3 4 5
24