Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [firewalls]

Concerned with software or hardware firewalls

0
votes
2answers
36 views

Security of next generation firewall

In recent years there's been a number of IndieGoGo or KickStarter projects for smart device protection, or next-generation firewalls. Some examples are: Anonabox, Cujo, Dojo, Firewalla, Keezel, ...
1
vote
2answers
54 views

How does TLS traffic impact firewalls?

If I have an open port on a firewall it means that I can receive traffic on that port. If it's unencrypted I assume that the raw data is just allowed through. If TLS is being used, does firewall ...
0
votes
1answer
36 views

Network diagram based on Cisco ACL and other firewall rules [on hold]

Are there any tools for automated building network diagram from ACL rules or any other firewall rules?
0
votes
0answers
38 views

Is there a risk to block multicast? [on hold]

I'm thinking to block multicast traffic in my firewall, both sending to local multicast and receiving from local multicast. Is there any security risks or possible known problems for doing that? My ...
3
votes
1answer
331 views

Ports Showing Closed/Filtered in Nmap Scans

hopefully this isn't a stupid question.. I am running some nmap scans and I get a list of ports that show closed. Why would they even show in the scan report? Can these be exploited further with other ...
1
vote
1answer
86 views

What is the difference between Anti - APT (Advanced Persistent Threat) and ATP (Advanced Threat Protection)?

Like the question says, is it the naming difference only or are they entirely different?
1
vote
1answer
92 views

Why would my firewall be blocking external source and external destination IP's that I dont own?

In my Cisco ASA firewall logs I'm seeing events being blocked with an external source IP and a external destination IP. This is happening in the same event log. An example would be: TCP access ...
1
vote
2answers
111 views

Firewalls vs DMZ

What's the difference between Firewalls and DMZs? These terms seem to overlap at time and I'm not clear on the difference. Maybe a DMZ is achieved using firewalls?
0
votes
1answer
93 views

Difference(s) between an ACL and a Layer 4 (Stateful) Firewall [closed]

What is the primary difference(s) between an ACL and a Layer 4 (Stateful) Firewall? I'm looking for a basic explanation if possible as I want to build my foundation knowledge. I understand that an ...
0
votes
0answers
50 views

Stopping “phone home” applications in VM with TBB

I have a VM with Linux and the TBB installed on it. What I am trying to do is to make sure that other applications like for example operating system applications cannot "phone home" while I am using ...
-1
votes
1answer
86 views

Detecting and blocking TCP VPN connections that bypasses existing VPN detection software

I help manage a small college campus network and students are not allowed to visit certain sites and download using torrents. Currently I'm able to block UDP VPN connections, but TCP VPN connections ...
0
votes
0answers
36 views

Windows Firewall blocking local access to SQL Server?

I have an AWS virtual machine running a web application on IIS that connects to a SQL Server database (on the same machine). Recently, I have noticed that there are a plethora of failed login attempts ...
0
votes
0answers
6 views

What's wrong with this outbound iptables firewall? [migrated]

I have a mail server which I'd like to secure by only allowing OUTBOUND connections on the various ports it uses. The inbound rules are working fine - they are handled by the VM host. I've not been ...
-1
votes
0answers
46 views

Is it safe to whitelist 0.0.0.0/0 ports 4172 tcp/udp outbound?

AWS is asking the users to whitelist URLs at firewall level or an entire IP for port 4172. What are the security risks by whitelisting the entire IP range for a specific port at firewall level? What ...
0
votes
0answers
49 views

Windows Firewall - How do I know that I have completely blocked a program?

I have a specific software that I cannot let out to the internet but it is crucial that it has access to the local network. I can create an inbound and an outbound Block rule for the main application'...
1
vote
0answers
38 views

OpenAppID with Snort on pfSense [closed]

I'm using OpenAppID with Snort on pfSense, it actually work but when I view some script detector, it just detect by http pattern, which I can replace by using snort rule (with "content" option). So ...
0
votes
1answer
106 views

Difference between a behaviour-based security and traditional firewall?

Difference between a behaviour-based security and traditional firewall? As I have searched the web and honestly cannot find anything about it.
0
votes
1answer
41 views

Are there any alternative methods for reverse connections that bypass firewalls?

I'm doing a PenTest on a server. I have an RCE vulnerability on it, but when I try to do a reverse connection via netcat, the firewall blocks it. Is there any other methods used for reverse ...
2
votes
2answers
176 views

How do the CVE-2018-10562 and CVE-2018-10561 exploits work?

https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router/ Firstly, the use of 'GPON' I find misleading because this vulnerability is to do with the routers and webservers and not the access ...
1
vote
0answers
57 views

Weak ciphers in TLS VPN

We have a firewall out of our firm network and administrators connect to this firewall by VPN over TLS. Scanning this firewall, the vulnerability scanner get us some warning as the 443 port allow weak ...
3
votes
1answer
61 views

Block Outbound Connections by Country

We want to reduce the number of phishing sites that our users can get to. Would it be useful or more problematic to block outbound connections by geo IP? We already block many inbound connections by ...
0
votes
1answer
55 views

Can Snort or Suricata *edit* packet on the fly?

I know that they can detect traffic by rules, but can they modify packets on the go? For example, not only detecting HTTP GET but also adding headers to the GET packet. If they can't, is there an ...
2
votes
0answers
33 views

Beginner UFW question about destination any

I'm learning about UFW with a Raspberry Pi and I don't a couple of things when it comes to UFW rules. Can anyone help me suss a couple things out? My first question is about the destination any. If I ...
3
votes
1answer
38 views

Providing access to Git repo behind a Firewall using Certs/Keys for Authentication

We have a Git repo sitting behind a firewall. As I see it, there are two ways of authenticating/accessing the Git repo: Add a Reverse HTTP Proxy in the DMZ that communicates with the Git repo. This ...
0
votes
1answer
24 views

In what situations / with what nodes should a node ping / not ping?

I was recently looking at a network in which the client-machines that accessed a webservice endpoint, but which could not ping the webservice endpoint. And there are other machines that can ping the ...
0
votes
0answers
78 views

Filter/Block OpenVPN clients' access to a specific website

As stated in the title I would like to restrict VPN clients' access to specific websites. More specifically, I push the route for 5 websites to the clients via the server config. However, I would ...
0
votes
2answers
101 views

Why should I bother having a firewall on servers?

In the case of a server, the only applications that are running there are the ones that I've setup, so you don't just have random users downloading & running malware. The only ports that are open ...
0
votes
1answer
82 views

Country Blocking

I use a Meraki firewall and want to block outside attack attempts. Is there a list of countries that are known to be malicious? I want to load them into the system and GEO block them. I know that some ...
0
votes
0answers
92 views

PHP socks proxy with no port opening

let's say i have file apache file access on a webserver, but due to firewall rules etc, i can't connect to ssh and can't open a port. Is there a way to do this exactly this : create a socks proxy on ...
1
vote
1answer
81 views

Fortigate Creating Millions of DNS events to standard domains

I am trying to tune our SIEM and noticed that we are receiving millions of DNS records every day from the same domains. These are: update.microsoft.com swscan.apple.com softwareupdate.vmware.com ...
0
votes
1answer
111 views

Secure onion router setup [closed]

I would like to setup a Raspberry Pi as an onion router, but I have some questions about it. At home I am using a Fritz!Box to connect to the outer world (to the net of my ISP). Would it make any ...
0
votes
0answers
12 views

Why Does Windows Server Block ICMP By Default? [duplicate]

I am conducting a OpenVAS vulnerability scan on a Windows Server 2012 box and it came back empty. It turns out that the scanner checks to see if the host is alive by sending it a ping request--if it ...
0
votes
0answers
40 views

Distributed network with one host behind dmz and the other without

Context: This a question from my homework assignment. There is a company with two sites A and B. B is behind DMZ (firewall - proxy mail server - firewall) and A is just behind a firewall Network A ...
0
votes
1answer
40 views

IPsec down with unusual SNMP traffic [closed]

Time to time IPSec tunnel status become down, with unusual SNMP Traffic. when I disable and enable port manually, it become normal. I am using 200E fortigate firewall. Have you any idea or previous ...
0
votes
1answer
63 views

Types of firewalls to implement to reduce DoS attacks in POS systems

Would you need an internal, external and a host-resident firewall for each POS client?
-1
votes
1answer
116 views

How to safely expose a computer to the Internet with a public IP

Our LAN is configured behind a load balancing router, in turn connected to a modem assigning public IPs to connected devices. I am required to randomly test the connection effective throughput, ...
0
votes
1answer
73 views

How do I configure a home router to block traffic to and from specific geographic regions? [closed]

My mom keeps typing in wrong URLs with typos and getting sent to Chinese typosquatting malware or fraud sites, so I want to configure my home router to block all traffic to and from China as much as ...
1
vote
1answer
146 views

Do I need two firewalls or is one enough?

We have a bunch of company devices (servers, desktops, laptops, company-issue phones, etc). All of these devices are company devices, every employee uses them just for business. All devices should ...
1
vote
1answer
123 views

Understanding port scanning with firewall enabled

My objective is to do a port scanner in windows and find the ports which are open. Suppose, I run an application which opens up a port 8000. Now I create a new inbound rule to block all incoming ...
0
votes
2answers
272 views

Do I have to block UDP ports when I launch my own server with a public IP?

I am trying to give better security to my Raspberry sever. When I installed UFW, I allowed just port 80/tcp and my own high port for SSH communication, and by default are all others ports "deny". ...
3
votes
1answer
111 views

Firewall Showing 1,000's Of Strange GET Parameters Being Sent To Login Page?

So I woke up today, and checked my Firewall Events on CloudFlare for my website like I do normally. Most of the time I'll just see thousands of failed SQL injection attempts, but this morning I was ...
1
vote
0answers
43 views

health check to test haproxy — request deny with 200. good idea?

I have been working on a multi-provider redundant load balancing solution using HAProxy, AWS, and Cloudflare. I have a solution, and I believe it will be secure, but I am looking for further ...
0
votes
2answers
101 views

What is the thought process behind, Endpoint protection is better than firewalls?

I keep reading about, and seeing people post and recommend in the oddest places, that strong endpoint protection is better than having a in-service/supported/receiving security updates firewall. What ...
3
votes
0answers
165 views

How can Nmap bypass Windows Server firewall rules?

I need to block all communication (inbound/outbound) from server A to server B (all ports/all protocols). Server A should communicate with every machine except server B. I can't place firewall rules ...
-1
votes
1answer
42 views

Infection of malware

Lets say, My firewall is configured to block any incoming connections My browser doesnt allow any traces and scripts I have vpn on My browser always asks before downloading files My browser doesn't ...
1
vote
0answers
64 views

UFW (Uncomplicated Firewall) Question

I was wondering if there's any benefit of adding following rules to a Raspberry-Pi directly exposed to the internet: sudo ufw deny to 0.0.0.0/8 && sudo ufw deny to 169.254.0.0/16 && ...
0
votes
1answer
421 views

IDS and IPS placement in network? [duplicate]

What is the good practice for the placement of IDS (NIDS) and IPS? Before the firewall or after the firewall? and why?
2
votes
2answers
153 views

How are stateless firewalls useful in public cloud platforms?

I'm trying to understand the value of stateless firewalls in public cloud platforms like Network Access Control Lists (NACL) in Amazon Web Services (AWS). I think I know a few ways I can use them, but ...
3
votes
2answers
267 views

How IDS and Firewall Logs are aggregated and feed aggregated log to SIEM?

I am studying SIEM tools. Firewall logs will be different from IDS logs and even from Antivirus logs. How can log aggregation take place?
1
vote
2answers
118 views

Can an ISP limit what security software (firewall) that will work?

My ISP (JCOM) says that McAfee is the only security software that will work with them. Is that true? The system is running Windows 7 Home Premium Japanese Version. The McAfee system is provided by ...