Questions tagged [firewalls]

Concerned with software or hardware firewalls

Filter by
Sorted by
Tagged with
0
votes
0answers
38 views

firewall fundamentals [closed]

If you have an enterprise or large network with a lot of firewalls that generate a large number of syslog messages consider implementing more specialized security incident management (SIM) and log ...
3
votes
3answers
310 views

Web Application Firewall using web app source code analysis

I read this page: Category:OWASP Best Practices: Use of Web Application Firewalls, and I found that WAF cannot generally detect logical attacks. We know each web application has a number of input ...
0
votes
2answers
654 views

Fortigate “WebRTC.Local.IP.Addresses.Disclosure” Event

We have a Fortigate perimeter firewall, and today I detected this event. What should I do to improve protection? How can someone obtain local IP address through a firewall? The following alert was ...
2
votes
2answers
5k views

Block outgoing network traffic from “Smart” TV

The FTC has just settled a case with Vizio, saying that the company has been quietly capturing pixels from their smart TVs, matching those pixels to databases of content, and selling that information (...
0
votes
1answer
52 views

Is there something like DynDNS for a DNS service?

I run a small DNS server (pihole) at home behind a firewall, with some custom filtering. It mainly filters ads and trackers, plus some top level domains I want to avoid navigating to. I have an IPv4 ...
0
votes
2answers
92 views

Firewall and VPN

Let's suppose i work in a small office and i can't use my workstation to navigate in Facebook because the external firewall forbids it. But i still can use a VPN to bypass the firewall. I read that ...
0
votes
0answers
50 views

Method to bypass \n in WAF (\n vulnerability)

I have this application that has an input box where the data is going to be sent in a JSON format. The JSON payload might look like this {“message”: “hello\nmy name is andi”} But the problem is the ...
1
vote
0answers
38 views

How can access to Intel ME / AMT be disabled with firewall? [duplicate]

Short of flashing BIOS, there seems to be no way to disable the Intel ME. So, is there a reliable way to block access to Intel ME, such using HW firewall (Firewall in front of the machine, not ...
0
votes
1answer
115 views

Allow only YouTube videos and block other videos

I have a MikroTik router. I want to allow only Youtube videos and block all other videos. I tried to write an extended ACL but I really have no idea. Maybe allow only Youtube videos source URL and ...
2
votes
1answer
87 views

Can a VPN provider or actors within its infrastructure access open ports on the client machine?

From my understanding of a VPN, it essentially creates a network between the two 'machines'. So if I have open ports (e.g. HTTP, SSH) on my client machine, those can be accessed by the VPN provider or ...
0
votes
1answer
140 views

Thought process behind firewall design

I'm preparing for an introductory information security examination in university and this is one of the tutorial questions on Firewall design. My concerns for the provided solution is how to define ...
0
votes
0answers
15 views

What is the security justification for blocking all outbound ports/protocols except HTTP over 80/443? [duplicate]

My companies IT blocks all outbound traffic except HTTP, preventing me from getting work done at the office (I often need to work on Azure SQL databases which require TCP over port 1433). I can get ...
2
votes
3answers
1k views

How to block I2P and Freenet to my network?

I am trying to find a way to block I2P and Freenet darknets in a corporate network. Does anyone know a way to block them (on firewall)? Do I need to close particular ports or block entry nodes (like ...
0
votes
1answer
65 views

Why should I use firewall to block ports with no running services? [duplicate]

A firewall is for blocking / limiting access to specific service / port. I know that it can be useful for allowing only certain IPs to a port (for example I don't want to have SSH open for the whole ...
0
votes
1answer
162 views

Purpose of Decrypting & Scanning HTTPS traffic

Navigating to the below URL link from the Mozilla Firefox and entering some website link and clicking on View, displays certificate Viewer chrome://pippki/content/exceptionDialog.xul After enabling ...
4
votes
4answers
3k views

Can you use two hardware firewalls? [duplicate]

There's a common saying that you should not run more than one software firewalls on the same computer at the same time, for example don't use Comodo and Zonealarm firewall on a single computer because ...
0
votes
0answers
40 views

How does the Great Firewall of China handle TLS encryption? [duplicate]

My understanding is that when a client and server are connected through TLS, only they have the key needed to encrypt and decrypt messages. My question is, given that the Great Firewall of China does ...
2
votes
0answers
30 views

Can NAT Table be vulnerable toward any poisoning attacks?

I am learning the general concept of network security, and becomes aware of two poisoning attacks on the network infrastructures, that is, DNS poisoning attacks and ARP poisoning attacks. They are ...
5
votes
1answer
252 views

How can Nmap bypass Windows Server firewall rules?

I need to block all communication (inbound/outbound) from server A to server B (all ports/all protocols). Server A should communicate with every machine except server B. I can't place firewall rules ...
1
vote
1answer
43 views

In what situations / with what nodes should a node ping / not ping?

I was recently looking at a network in which the client-machines that accessed a webservice endpoint, but which could not ping the webservice endpoint. And there are other machines that can ping the ...
1
vote
1answer
61 views

Why am I receiving hits with SPT=443 on IPv6?

I block most everything with my firewall, what I don't get is why would I constantly receive hits to connect on random ports from port 443. [iptables] reject_ipv6: IN=eno1 OUT= MAC=... SRC=2607:...
0
votes
0answers
27 views

End to End Encrypted Traffic - Web Application Firewall needed?

Background We have a Java Spring Server, MongoDB and an Angular Frontend. Some Application Security Configs: TLS Basic Authentication (Password Strength Policy) XSS Protection (Content Security ...
0
votes
0answers
31 views

Actions after identifying exploitation attempts on servers or applications

I am seeing regular exploitation attempts (like remote code execution, sql injection, etc.) on our DMZ server or applications and these are being dropped by the firewall. However, our SIEM is raising ...
20
votes
3answers
3k views

Why is it called a stateful and a stateless firewall?

I'm just wondering about the naming of these firewall behaviours. My basic understanding is that stateful filtering lets inbound traffic to return the outbound response without explicitly specifying ...
0
votes
0answers
29 views

How can I give a network load balancer (of any type) access to a port on a machine without opening that port to an entire VPC?

Is it possible to make an AWS load balancer for a non-HTTP port allowed to access a specific port on a host without opening that port open to the entire VPC's subnet? I seem to remember reading that ...
2
votes
1answer
409 views

Does blocking all ports make a machine more secure?

I have a machine that I use only to browse the Internet. What if I blocked all ports on this machine (inbound and outbound) except for port 80 and port 443, and restricted these two ports to an ...
5
votes
2answers
145 views

How does a CDN actually prevent DDoS attacks, when an origin server accepts direct connections?

I am trying to understand how a CDN (like Cloudflare e.g) does protect against a DDoS attack. I would think that the internet traffic is routed through a CDN's reverse proxy, then filtered. This ...
1
vote
1answer
125 views

Fortigate Creating Millions of DNS events to standard domains

I am trying to tune our SIEM and noticed that we are receiving millions of DNS records every day from the same domains. These are: update.microsoft.com swscan.apple.com softwareupdate.vmware.com ...
0
votes
1answer
39 views

Debating between architecture options for offline updating of Linux machines in a vertically segregated network

My coworker and I are discussing the pros/cons between two potential architecture options, and I would like to gather feedback on which option is better and why. First, a description of the ...
-1
votes
1answer
48 views

threat intelligence gateway [closed]

A TOG (threat intelligence gateway) is a hardware piece that sits between the router and the firewall. The TIG uses the threat intelligence and filters out the malicious urls and IPs before reaching ...
1
vote
4answers
165 views

Given a set of ports is there one that is more likely to bypass a firewall?

I've been trying to solve a homework question in a beginner infosec class, and I was stumped on an issue and I didn't really know of the right place to ask. If it isn't then please let me know. Given ...
0
votes
1answer
57 views

Configure Windows Firewall Inbound Rule for Program Not Installed on Server

How can I configure an inbound rule on a Windows Server 2016 firewall to allow access from a program which is not installed on the server? When searching for a program browse is only offered for ...
2
votes
0answers
96 views

Non-upgradable usb device against badUSB

Lot of posts about badUSB (here and there) suggest to use a PS/2 connector for mouse and keyboard or to whitelisted USB devices or even use a hardware firewall that only allows whitelisted commands. ...
0
votes
2answers
68 views

firewall behaviour

If a client connects to a server he will start listening for the response on some random high port number. The client then expects any packet destined for that port to be a valid answer. Or does he ...
1
vote
0answers
49 views

apache struts 2 s2-057 does not return shell? [closed]

I do a pentest for a private server protected by Cloudflare. I bypassed the WAF and got the real IP for the server, then I scanned it with Acunetix and I found: Apache Struts2 Remote Command Execution ...
7
votes
1answer
3k views

Is it possible to detect DPI (Deep Packet Inspection)?

If one suspects one's packets are subject to DPI, how can it be detected?
1
vote
0answers
43 views

'Hard-to-guess' custom header (or similar) to whitelist via a firewall

My organisation is adding a firewall to our test stacks, using AWS WAF. We'd like to whitelist all traffic from the SDKs we've built to facilitate requests between our services. We thought of doing ...
4
votes
7answers
149k views

How to effectivily block torrents on my network?

As per the network policy, we have to block all torrent traffic from the network. To do this, I used to block all ports above 1024 on my firewall/proxy devices. But due to this, many other ...
0
votes
1answer
87 views

How to close port 445 (Apple Time Capsule smbd)

My default configuration of Apple Time Capsule has port 445 (Apple Time Capsule smbd) open to the world. Online port scanners (shodan/detectify.com) show me that this. What's a bit worrying is the ...
10
votes
2answers
18k views

Is opening both TCP/UDP less secured than just TCP or UDP when needed and why?

If application needs opened port X UDP, or X TCP combination. Is there any potential risk by opening both UDP/TCP as I usually am not sure which one the application uses?
0
votes
1answer
89 views

Types of firewalls to implement to reduce DoS attacks in POS systems

Would you need an internal, external and a host-resident firewall for each POS client?
-1
votes
1answer
58 views

Would a firewall contain an explicit allow rule at the top?

Someone in an interview today told me every firewall has two rules: explicit allow at the top and explicit block at the bottom. Form the way I've always understood things firewalls are normally set to ...
0
votes
1answer
39 views

Stateless Firewall configuration and random port number from server

When I was reading about web servers, I came to know that though servers listen to static port (say port 80 for http), immediately after the connection, they assign a different port and thread to ...
6
votes
3answers
14k views

How to directly connect to devices behind NAT from the internet?

We have an IP address on the global internet: "A" We only have access to "A". We have a network behind a router that does NAT: 192.168.1.0/24 There is a client behind that NAT: "B" We don't have ...
-2
votes
1answer
55 views

WAF or Firewall [closed]

I am looking into putting a Firewall in front of our web servers. But we just recently implemented new next-gen firewalls. Does it make sense to put a WAF in front of our web servers as well?
1
vote
1answer
460 views

Why won't ossec block SSH connections when it seems to be configured correctly?

Why won't ossec block connections from another server? I installed ossec version 2.9.3 on Ubuntu 16.04. In the ossec.conf file I have these lines where x.x.x.x is the IP address of a second Linux ...
0
votes
1answer
344 views

Differentiating between IKEv2 and OpenVPN Traffic

There is a WiFi network that I regularly use, and it seems to be blocking all VPN traffic other than IKEv2. I tested this by downloading many of the free/freemium VPN apps from the Google Play Store ...
0
votes
1answer
54 views

Even though my firewall is active, is it protecting me fully given that the 'rules' are not active?

Even though my firewall is active, is it protecting me fully given that the 'rules' are not active? Output shows: host based firewall active, empty rules iptables modules loaded, but no rules ...
4
votes
2answers
9k views

Is it dangerous to disable the IPv6 firewall built into many home routers?

The router that my ISP has delivered contains an IPv6 firewall. The only configuration option is whether it is on or off. Apparently, this firewall simply denies all incoming connections. I ...
4
votes
2answers
133 views

Is there such thing as an OS “internal firewall”

I was wondering if there is such thing as an OS "internal firewall". If it exists, it must be under a different name. I am looking for a way to control which applications can talk to which other ...