Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [firewalls]

Concerned with software or hardware firewalls

Filter by
Sorted by
Tagged with
0 votes
1 answer
33 views

Whitelist at network level, application level, or both?

I have a public-facing SFTP instance. When applying the whitelist/allow-list of IP addresses that are allowed to connect to this instance, should I enforce the list on the network/firewall level, the ...
PorLosTacos's user avatar
0 votes
1 answer
86 views

Our server in a our client's network - What possible attacks are there?

I apologise in advance for this question being very sparse in details and sounding rather hypothetical, reasons for this are hopefully explained below. I am not a security expert, but I am in a ...
Aukksi's user avatar
  • 1
0 votes
2 answers
131 views

Is it possible to make whitelisted software do custom, malicious things?

Let's say there's a keylogger secretly installed in an employee's computer. The keylogger recorded a bunch of information, but the well-configured firewall blocked the keylogger from sending that ...
No Name's user avatar
  • 217
0 votes
1 answer
191 views

How to block 192.168.0.1 for connected clients?

I installed Raspberry Pi OS on a RPi 3B, then I installed NetworkManager, set the Ethernet connection to "Shared to other computers" and connected an ethernet cable between the RPi and a ...
Dzenis Zigo's user avatar
0 votes
1 answer
94 views

Can a Reverse Proxy be used instead of port filtering?

I want to limit access from the Internet to my Web server but the clients will have a dynamic IP address so the best I can do is to whitelist all addresses belonging to that specific mobile carrier ...
mfloris's user avatar
  • 101
0 votes
0 answers
80 views

Perimeter IP Address Blocking

Currently we have a Palo Alto FW that serves as our perimeter devices for our network. We are required by our contract to block certain IP addresses. Over time this list has grown to almost 150k ...
Jon19992's user avatar
1 vote
1 answer
180 views

Network security in Docker containers

I am currently involved in enhancing the security of a Docker-based web application.The application follows a traditional three-tier architecture, comprising a web app, an application layer, and a ...
apostolescus's user avatar
1 vote
1 answer
160 views

ThreatFox alert on Cloudflare IP

On our company network, suricata just raised the following (single) alert: { "timestamp": "2024-01-05T12:42:28.511703+0100", "flow_id": 1276412390854359, &...
Heinzi's user avatar
  • 3,488
1 vote
2 answers
223 views

Random High Ports - Firewall Config

I'm from a digital forensics background and it has been a while since I studied networking and so am a little rusty on a few aspects. I am looking to implement a remote forensics solution within an ...
forensicsguy0506's user avatar
0 votes
0 answers
98 views

W-Firewall blocks Port 135 if using IPsec Kerberos V5 User Authentication

i am about to implement IPsec to achive a zero trust environment, in order to do so i am using the Windows Firewall with IPsec Rules (Allow the Connection if it is secure). Everything works fine, but ...
Proxolin's user avatar
2 votes
2 answers
167 views

Firewall to allow responses but block new connections

I wonder if a firewall can support this case. There are two servers: A and B. A can send a request via an open port to B and B must respond to A during this connection. B cannot send a request on its ...
Bằng Rikimaru's user avatar
0 votes
0 answers
92 views

Could a public IP with blocked public inbound/outbound traffic be a risk?

If we have a device that for some reason needs a public IP address and if at the same time the device should only be accessible from within a private network: Could the fact that the public IP of the ...
Moritz Loritz's user avatar
0 votes
0 answers
81 views

Network vulnerability scanner optimal positioning in network

Scenario: There is a network infrastructure with IT and OT subnets and DMZ. I can only place 2 scanners in the whole infrastructure. Are there any recommendations or best practices for how to plan the ...
spaceMerc's user avatar
0 votes
1 answer
150 views

Port scanning but Windows firewall isn't logging the connection

We are seeing port scans coming from many of our company devices and scanning our internal network over the VPN. The events are not reproducible and are not regular. Scans always follow the same ...
H3GE's user avatar
  • 1
0 votes
1 answer
475 views

Can China decrypt SSL as soon as people using their ISP?

While these VPNs can work inside of China, I wonder how private and secure they are since China is known for its great firewall, like most technically advanced countries. Are these methods working? ...
Maxfield's user avatar
  • 157
0 votes
1 answer
970 views

Perfect DMZ: LDAP auth to AD

My goal is to integrate a public facing service with AD using LDAP. While I vouch for federated approach to user authentication, the business dictates LDAP. We run a DMZ subnet and I insist on not ...
Grigory Sergeev's user avatar
0 votes
0 answers
76 views

pfSense not working properly on Azure VNet? What do i do?

I'm currently working on a project based on creating virtual networks and configuring a virtualized firewall (pfSense) along with access control. I was given this project idea in a cybersecurity ...
Thanos's user avatar
  • 111
0 votes
0 answers
125 views

How to Determine if an Intrusion in the Firewall Log was Successful or Not?

Is there any way, in looking at the firewall/system log to tell? I realize these events are very common these days. However, I want to make sure that they didn't get through the firewall and that it ...
Forward_Always's user avatar
0 votes
3 answers
478 views

How to actively monitor open ports on servers

I have several servers that must be exclusively accessible only on the internal network, for example database, which can never be accessible via internet. And also cases that they can only be accessed ...
Tom's user avatar
  • 174
1 vote
0 answers
250 views

How did I get hacked? [closed]

As usual, I ordered a CentOS 7 virtual machine from my hoster. Installed a firewalld and docker on it. In docker, through docker-compose, I launched a web application that hangs on the standard port ...
RoyalGoose's user avatar
  • 1,045
1 vote
1 answer
207 views

How outgoing tunnels are not stopped by AV or firewalls?

How can an attacker with initial access to a server behind a firewall, which only has SSH, HTTPS, and HTTP ports open, maintain remote access to the server even after the SSH port is closed by the ...
Akam's user avatar
  • 1,357
21 votes
2 answers
5k views

Which IP address would be most safe and suitable to use as a placeholder in a live system?

Is there a best practice IP address that is safe to use as a placeholder in a live public system on the Internet? e.g. In a similar capacity, the domain name example.com is reserved and can be safely ...
BadHorsie's user avatar
  • 385
25 votes
3 answers
5k views

Is it possible to provide Internet to prisoners without risks of them contacting victims or accomplices as a matter of policy?

By securely I mean without the risk of them committing cybercrimes or contacting victims or other people to commit more crimes ? I've read that even with firewalls a way around it could be found, ...
swarahan's user avatar
  • 351
0 votes
1 answer
461 views

Why does the windows firewall allow apps to communicate through so many different ports and to so many different addresses?

I looked at my default windows defender firewall on Windows 10 22H2, and most of the rules allow apps to communicate through any local port to any remote address and port. I have read other questions ...
Cybsechuman's user avatar
1 vote
1 answer
204 views

DOS UDP port scans in firewall logs

For a few days, we are getting the following logs on our firewall (Vigor2926ac, up-to-date firmware) The traffic suggests that it comes from Google / Microsoft datacenters, but that's a bit odd that ...
Gino's user avatar
  • 11
1 vote
2 answers
184 views

Can my local MySQL server be accessed without permission

I have hosted a MySQL database server on a VPS to connect to a flask web app on the same VPS. It only has users with host as local ip address. Can it be accessed by anyone else remotely, except me? If ...
Prog Techs's user avatar
0 votes
2 answers
185 views

Can a WAF transform HTTP response

I have hit a conceptual roadblock here and, to be honest, do not really have a lot of experience with WAFs or firewalls in general. (I did go through this very nice explanation to get upto speed with ...
qre0ct's user avatar
  • 1,522
0 votes
0 answers
83 views

Unable to Understand the Data Flow and Network Security Architecture

Received the attached Network Connectivity Diagram with Network Security Components Integrated in the Network Can some body explain how the Network Security is Applied for Threat and Intrusion ...
user1092345's user avatar
0 votes
0 answers
257 views

How strong is windows firewall on Windows Server 2019?

How strong is Windows Firewall? I have no knowledge on Botnets or how to use them, so I have no way to test Windows firewall's strength. And I believe it would go against the contract I signed with my ...
Azriel Elijay's user avatar
-1 votes
1 answer
8k views

How do firewall action types happen?

I see some firewall action types in the logs such as client-rst, server-rst etc. Are these action types valid for all firewall vendors? If so, is there a way to get firewall to create these actions?
hakkican's user avatar
  • 105
0 votes
0 answers
117 views

Unexpected drop in UFW noise, should I be worried?

I run a bare-metal on-premises GitLab server (Ubuntu 22.04) for a very small company. While the server isn't currently in production use, it is active and accessible over the public internet. I have ...
rdi_pck's user avatar
1 vote
1 answer
369 views

Is my website under attack?

I have a web server. I was investigting why my nginx is keep crashing. I noticed a few other issues in my logs. Note: In the log report, I replace the name of my website with example.com and my second ...
martiz's user avatar
  • 11
1 vote
1 answer
530 views

Is it still recommended to block Living Off The Land Binaries (LOLBins) in Firewall?

https://lolbas-project.github.io/ Realistically, do we still need to block cmd.exe or certutil.exe in Windows firewall, on latest version of Windows? Lolbins are for Linux too but my question is only ...
user avatar
1 vote
1 answer
287 views

Is blocking Autonomous Systems numbers in the firewall a good practice?

In response to low-hanging fruit attacks (accounts creation, image sending etc.) which request rates goes below our rate-limiting rules and are not blocked, we started blocking AS numbers from ...
hacb's user avatar
  • 21
1 vote
0 answers
315 views

What would be the security rationale for a hotel blocking only SSH traffic? [closed]

I recently stayed at a hotel where outbound SSH traffic (and seemingly only SSH traffic) was blocked on the guest WiFi network, and I'm trying to figure out what security-based rationale they might ...
Psychonaut's user avatar
0 votes
1 answer
373 views

Is there a way to identify whether "filtered" state in nmap output caused by a network or host-based firewall?

Is there a way to identify whether "filtered" state for a specific port in nmap output is caused by a network firewall or host-based firewall?
Manjula's user avatar
  • 180
0 votes
0 answers
839 views

Block all windows system outgoing internet connections but allow LAN on Private and VPN on Public

I have several windows PC connected to my mikrotik. I use basic features: file sharing, playing games with friends on home LAN and want to connect internet only through VPN (openVPN client). But I am ...
owaiera's user avatar
1 vote
2 answers
116 views

What is the better tunnel endpoint?

I'm trying to understand the consequences or implications of setting up tunneling endpoints for the below topology. The tunneling may be used for anything (encryption, VPNs, etc.) assuming the general ...
Watchdogs1499's user avatar
0 votes
1 answer
2k views

OpenVPN & China's Great Firewall

The company I work for has an OpenVPN server so we can access its intranet from home. The problem is that I'm going to move to China and I'll need to connect from there, but I've heard connections ...
anonymous's user avatar
1 vote
2 answers
275 views

How to sniff connection between web browser and 127.0.0.1:1234 running HTTP proxy on Client B's machine while taking internet from client A's machine?

Client A is connected to the public internet. Client B gateway address is connected to the Client A's network interface. Client B is running a Web browser which is sending requests to 127.0.0.1:1234 ...
A P's user avatar
  • 111
3 votes
2 answers
489 views

If a computer gets infected with malware, can the host firewall block the malware from communicating back to its controller on the internet?

I'm trying to figure out how secure a host firewall is, hence the question in the title. I read that many firewalls allow outbound connections to port 80 to allow browsing, would that be enough for ...
ninjarubberband's user avatar
0 votes
0 answers
88 views

EternalBlue Across Networks

I am working on some research and I am trying to unpack exactly how NotPetya used the eternalblue vulnerability to spread across networks. My understanding of the SMBv1 Protocol is that it would not ...
ford prefect's user avatar
0 votes
1 answer
247 views

Deploy to Digital Ocean droplet from Github Action - Should I leave the SSH port open for future deployments?

I'm going to a deploy a web app (angular static frontend and node backend in docker) to digital ocean droplet. Deployment is done from Github Action by essentially loging via SSH to the droplet and ...
Mike Strutter's user avatar
0 votes
0 answers
83 views

Enterprise firewall block specific brower (Firefox)

Apparently, some enterprise firewalls can block specific browsers. I have an example of one blocking all browsers except the ones based on chromium recent versions (Chrome and Edge work) but Firefox ...
theboss1er's user avatar
1 vote
1 answer
519 views

Do I have to block IPv4-mapped IP addresses in my IPv6 firewall?

I am writing the iplock tool to help me setup my Linux firewall. For the most part, my current strategy, since I don't yet use IPv6 much, is to pretty block everything IPv6 ("simple"). I ...
Alexis Wilke's user avatar
  • 1,017
1 vote
1 answer
302 views

Does the application gateway firewall function only on the application layer or on all layers of the OSI model?

This is very confusing. I am seeing 2 different things in various books and sites. A. Application gateway firewall scans layer 1 to layer 7 of the OSI model. B. Application gateway firewall only scans ...
zeeshanseikh's user avatar
0 votes
1 answer
285 views

Docker container can't access systemd service because of firewall

I'm in a somewhat weird situation that I don't understand: I use ufw as a firewall. It's setup to drop any input connections apart from ssh I have a service running locally (managed through systemd) ...
Rififi's user avatar
  • 157
1 vote
1 answer
11k views

What is Akamai Ghost? [closed]

After making requests to certain domain and their responses being either 4xx or 5xx status codes, the server response header shows Akamai Ghost. Is this response coming from Akamai's firewall or their ...
Just.a.tech's user avatar
1 vote
0 answers
213 views

Is the "Windows-Defender-Hardening" safe to perform? [closed]

I'm totally not a Microsoft Windows professional. When it comes to Windows, I'm just a normal user. And as this user, I'm wondering why Microsoft isn't shipping a full potential Windows Defender by ...
bastey's user avatar
  • 111
0 votes
1 answer
739 views

firewalld rules that will block traffic from internet but allow internal traffic

I want to block some ports access to the internet but still allow internal hosts to access the port with firewalld. There is another firewall between the internet and the host but I want to add a ...
Danie de Jager's user avatar

1
2 3 4 5
24