Questions tagged [firewalls]
Concerned with software or hardware firewalls
1,152
questions
0
votes
0
answers
25
views
Network vulnerability scanner optimal positioning in network
Scenario:
There is a network infrastructure with IT and OT subnets and DMZ. I can only place 2 scanners in the whole infrastructure. Are there any recommendations or best practices for how to plan the ...
0
votes
1
answer
52
views
Port scanning but Windows firewall isn't logging the connection
We are seeing port scans coming from many of our company devices and scanning our internal network over the VPN. The events are not reproducible and are not regular.
Scans always follow the same ...
- 1
0
votes
1
answer
182
views
Can China decrypt SSL as soon as people using their ISP?
While these VPNs can work inside of China, I wonder how private and secure they are since China is known for its great firewall, like most technically advanced countries. Are these methods working? ...
- 127
0
votes
1
answer
120
views
Perfect DMZ: LDAP auth to AD
My goal is to integrate a public facing service with AD using LDAP.
While I vouch for federated approach to user authentication, the business dictates LDAP.
We run a DMZ subnet and I insist on not ...
- 281
0
votes
0
answers
19
views
pfSense not working properly on Azure VNet? What do i do?
I'm currently working on a project based on creating virtual networks and configuring a virtualized firewall (pfSense) along with access control. I was given this project idea in a cybersecurity ...
- 111
0
votes
0
answers
59
views
How to Determine if an Intrusion in the Firewall Log was Successful or Not?
Is there any way, in looking at the firewall/system log to tell? I realize these events are very common these days.
However, I want to make sure that they didn't get through the firewall and that it ...
0
votes
3
answers
106
views
How to actively monitor open ports on servers
I have several servers that must be exclusively accessible only on the internal network, for example database, which can never be accessible via internet.
And also cases that they can only be accessed ...
- 174
1
vote
0
answers
171
views
How did I get hacked? [closed]
As usual, I ordered a CentOS 7 virtual machine from my hoster. Installed a firewalld and docker on it. In docker, through docker-compose, I launched a web application that hangs on the standard port ...
- 1,015
1
vote
1
answer
107
views
How outgoing tunnels are not stopped by AV or firewalls?
How can an attacker with initial access to a server behind a firewall, which only has SSH, HTTPS, and HTTP ports open, maintain remote access to the server even after the SSH port is closed by the ...
- 1,357
21
votes
2
answers
4k
views
Which IP address would be most safe and suitable to use as a placeholder in a live system?
Is there a best practice IP address that is safe to use as a placeholder in a live public system on the Internet?
e.g. In a similar capacity, the domain name example.com is reserved and can be safely ...
- 385
25
votes
3
answers
5k
views
Is it possible to provide Internet to prisoners without risks of them contacting victims or accomplices as a matter of policy?
By securely I mean without the risk of them committing cybercrimes or contacting victims or other people to commit more crimes ? I've read that even with firewalls a way around it could be found, ...
- 351
0
votes
1
answer
188
views
Why does the windows firewall allow apps to communicate through so many different ports and to so many different addresses?
I looked at my default windows defender firewall on Windows 10 22H2, and most of the rules allow apps to communicate through any local port to any remote address and port. I have read other questions ...
1
vote
1
answer
94
views
DOS UDP port scans in firewall logs
For a few days, we are getting the following logs on our firewall (Vigor2926ac, up-to-date firmware)
The traffic suggests that it comes from Google / Microsoft datacenters, but that's a bit odd that ...
- 11
0
votes
1
answer
96
views
Can my local MySQL server be accessed without permission
I have hosted a MySQL database server on a VPS to connect to a flask web app on the same VPS. It only has users with host as local ip address. Can it be accessed by anyone else remotely, except me? If ...
0
votes
2
answers
64
views
Can a WAF transform HTTP response
I have hit a conceptual roadblock here and, to be honest, do not really have a lot of experience with WAFs or firewalls in general. (I did go through this very nice explanation to get upto speed with ...
- 1,522
0
votes
0
answers
34
views
Unable to Understand the Data Flow and Network Security Architecture
Received the attached Network Connectivity Diagram with Network Security Components Integrated in the Network
Can some body explain how the Network Security is Applied for Threat and Intrusion ...
0
votes
0
answers
369
views
Symantec Endpoint Protection "Traffic has been blocked from this application: (svchost.exe)"
I'm currently getting this notification from SEP around twice a month saying "Traffic has been blocked from this application: (svchost.exe)"
Logs:
1/3/2023 12:32 Blocked Major Incoming UDP .....
- 1
0
votes
0
answers
126
views
How strong is windows firewall on Windows Server 2019?
How strong is Windows Firewall?
I have no knowledge on Botnets or how to use them, so I have no way to test Windows firewall's strength. And I believe it would go against the contract I signed with my ...
-1
votes
1
answer
4k
views
How do firewall action types happen?
I see some firewall action types in the logs such as client-rst, server-rst etc. Are these action types valid for all firewall vendors? If so, is there a way to get firewall to create these actions?
- 105
0
votes
0
answers
66
views
Unexpected drop in UFW noise, should I be worried?
I run a bare-metal on-premises GitLab server (Ubuntu 22.04) for a very small company. While the server isn't currently in production use, it is active and accessible over the public internet.
I have ...
- 1
1
vote
1
answer
248
views
Is my website under attack?
I have a web server. I was investigting why my nginx is keep crashing. I noticed a few other issues in my logs.
Note: In the log report, I replace the name of my website with example.com and my second ...
- 11
1
vote
1
answer
292
views
Is it still recommended to block Living Off The Land Binaries (LOLBins) in Firewall?
https://lolbas-project.github.io/
Realistically, do we still need to block cmd.exe or certutil.exe in Windows firewall, on latest version of Windows? Lolbins are for Linux too but my question is only ...
user286246
1
vote
1
answer
128
views
Is blocking Autonomous Systems numbers in the firewall a good practice?
In response to low-hanging fruit attacks (accounts creation, image sending etc.) which request rates goes below our rate-limiting rules and are not blocked, we started blocking AS numbers from ...
- 21
1
vote
0
answers
164
views
What would be the security rationale for a hotel blocking only SSH traffic? [closed]
I recently stayed at a hotel where outbound SSH traffic (and seemingly only SSH traffic) was blocked on the guest WiFi network, and I'm trying to figure out what security-based rationale they might ...
- 655
0
votes
1
answer
154
views
Is there a way to identify whether "filtered" state in nmap output caused by a network or host-based firewall?
Is there a way to identify whether "filtered" state for a specific port in nmap output is caused by a network firewall or host-based firewall?
- 180
0
votes
0
answers
444
views
Block all windows system outgoing internet connections but allow LAN on Private and VPN on Public
I have several windows PC connected to my mikrotik. I use basic features: file sharing, playing games with friends on home LAN and want to connect internet only through VPN (openVPN client).
But I am ...
- 1
1
vote
2
answers
61
views
What is the better tunnel endpoint?
I'm trying to understand the consequences or implications of setting up tunneling endpoints for the below topology. The tunneling may be used for anything (encryption, VPNs, etc.) assuming the general ...
0
votes
1
answer
849
views
OpenVPN & China's Great Firewall
The company I work for has an OpenVPN server so we can access its intranet from home.
The problem is that I'm going to move to China and I'll need to connect from there, but I've heard connections ...
0
votes
0
answers
18
views
Nmap scan using default script scan and version detection fail [duplicate]
I am running the following scan using -sC -sV on a target:
sudo nmap -sC -sV XX.XX.XX.XX
PORT STATE SERVICE VERSION
53/tcp open tcpwrapped
80/tcp open tcpwrapped
443/tcp open tcpwrapped
I ...
1
vote
2
answers
149
views
How to sniff connection between web browser and 127.0.0.1:1234 running HTTP proxy on Client B's machine while taking internet from client A's machine?
Client A is connected to the public internet.
Client B gateway address is connected to the Client A's network interface.
Client B is running a Web browser which is sending requests to 127.0.0.1:1234 ...
- 111
2
votes
2
answers
266
views
If a computer gets infected with malware, can the host firewall block the malware from communicating back to its controller on the internet?
I'm trying to figure out how secure a host firewall is, hence the question in the title.
I read that many firewalls allow outbound connections to port 80 to allow browsing, would that be enough for ...
0
votes
0
answers
45
views
EternalBlue Across Networks
I am working on some research and I am trying to unpack exactly how NotPetya used the eternalblue vulnerability to spread across networks. My understanding of the SMBv1 Protocol is that it would not ...
- 235
0
votes
1
answer
171
views
Deploy to Digital Ocean droplet from Github Action - Should I leave the SSH port open for future deployments?
I'm going to a deploy a web app (angular static frontend and node backend in docker) to digital ocean droplet. Deployment is done from Github Action by essentially loging via SSH to the droplet and ...
0
votes
0
answers
41
views
Enterprise firewall block specific brower (Firefox)
Apparently, some enterprise firewalls can block specific browsers. I have an example of one blocking all browsers except the ones based on chromium recent versions (Chrome and Edge work) but Firefox ...
1
vote
1
answer
258
views
Do I have to block IPv4-mapped IP addresses in my IPv6 firewall?
I am writing the iplock tool to help me setup my Linux firewall. For the most part, my current strategy, since I don't yet use IPv6 much, is to pretty block everything IPv6 ("simple").
I ...
- 987
1
vote
1
answer
178
views
Does the application gateway firewall function only on the application layer or on all layers of the OSI model?
This is very confusing. I am seeing 2 different things in various books and sites.
A. Application gateway firewall scans layer 1 to layer 7 of the OSI model.
B. Application gateway firewall only scans ...
- 111
0
votes
1
answer
186
views
Docker container can't access systemd service because of firewall
I'm in a somewhat weird situation that I don't understand:
I use ufw as a firewall. It's setup to drop any input connections apart from ssh
I have a service running locally (managed through systemd) ...
- 135
1
vote
1
answer
6k
views
What is Akamai Ghost? [closed]
After making requests to certain domain and their responses being either 4xx or 5xx status codes, the server response header shows Akamai Ghost.
Is this response coming from Akamai's firewall or their ...
- 41
0
votes
0
answers
573
views
Nessus vulnerability 11411 in Fortigate
I have a Fortigate device and a Nessus vulnerability scan set up. When I ran the scan, it said that there was some kind of .htaccess~ file in my Fortigate device. This is the vulnerability it found.
...
1
vote
0
answers
106
views
Is the "Windows-Defender-Hardening" safe to perform? [closed]
I'm totally not a Microsoft Windows professional. When it comes to Windows, I'm just a normal user. And as this user, I'm wondering why Microsoft isn't shipping a full potential Windows Defender by ...
- 111
0
votes
1
answer
394
views
firewalld rules that will block traffic from internet but allow internal traffic
I want to block some ports access to the internet but still allow internal hosts to access the port with firewalld. There is another firewall between the internet and the host but I want to add a ...
0
votes
1
answer
268
views
Is there any difference between circuit vs application level gateway except that one operates in layer 3 and another at layer 7 of OSI model?
Question#1
whitewinterwolf answer says
the circuit level gateway CHANGES the source ip address of outgoing
packet(from the internal network point of view).
Two different TCP connection are formed, ...
0
votes
0
answers
123
views
I cannot make a reverse connection
I am playing with a Linux CTF server and came across a kind of reverse connection block. I uploaded a php webshell, gained control of www-data user and tried to make a reverse shell.
Possible a UFW ...
0
votes
0
answers
416
views
A Continuous Flood of Kernel Warnings. Am I under attack?
I have a Linksys WRT1200AC with DD-WRT v3.0-r48865 std. It's connected to the Internet through the ISP's modem in bridge mode.
My syslog reports continuously, many times per second stuff like this:
...
- 1
1
vote
3
answers
185
views
Are country IP address blocks officially standardised and can they be reliably used for access control?
I was setting up firewalld on an enterprise server and came across their concept of firewall zones. I figured I can easily use them and their source property to restrict access to SSH to only the ...
- 224
-1
votes
3
answers
149
views
Why don’t routers request permission when attempting to connect to an unknown address? (Or why do they still assume every connection is trustworthy?)
I’m imagining a system similar to UAC on Windows but implemented at the router level for IP addresses instead. (Or AS numbers, BGP numbers, Port number, etc…)
Naturally this makes router setup ...
- 99
0
votes
1
answer
4k
views
Are there security implications of allowing Discord through Windows Firewall?
I just installed Discord (downloaded from the official Discord website) and after the install a Windows Firewall pop-up appears asking me if I want to allow Discord through Windows Firewall.
I don't ...
1
vote
1
answer
252
views
I am still receiving ssh-bruteforce on my VPS
I have a server in Oracle Cloud Infrastructure Ashburn. I am using Tailscale to SSH my servers and closed Port 22 in public.
I closed Port 22 on the VCN and left Port 22 open on the server. But no one ...
- 37
0
votes
0
answers
94
views
How to detect a firewall used
I was scanning a network with Nmap.
I'm looking for advanced commands for detecting firewalls.
0
votes
0
answers
42
views
Network Segmentation - Single Firewall VM vs Multiple
I am currently implementing a new network with different segments. The separation of those segments is achieved using VLANs. To enable some segments to communicate with each other and to be reached ...
- 1