Questions tagged [firewalls]

Concerned with software or hardware firewalls

Filter by
Sorted by
Tagged with
1
vote
0answers
37 views

Inbound rules for a port is configured and disabled yet an NMap scan shows that the port is opened

I am new to Windows Defender but have read about it to understand the basics of Inbound/Outbound rules. As mentioned on the app, Inbound connections that do not match a rule are simply blocked. For ...
1
vote
1answer
91 views

Can a firewall recognize (and block) outbound traffic that consists of screen shots?

I recently watched this YouTube video about capturing webcam image traffic using Wireshark. Although the technique used in the video is not applicable to my question (because it is about a MITM ...
1
vote
0answers
45 views

Securing a SOCKS5 to SSH Tunnel on Windows

In order to gain web access from the perspective of a remote device, it is very common to use the SOCKS5 to SSH Tunnel capability built into OpenSSH Client and Putty (detailed here). Both clients ...
0
votes
1answer
64 views

Is it possible to DDos a http wan filterd router? [on hold]

Like the service is there but it's just filterd enabled for lan access only .. what will happen ?
0
votes
0answers
15 views

How to bypass egress traffic filtering for a reverse shell? [duplicate]

Say I have access to a linux server as non-root user (gained RCE using an exploit), say I am only able to run commands via http in bash/sh but I'm unable the to make the targeted server connect back ...
0
votes
0answers
26 views

Configure Windows Firewall Inbound Rule for Program Not Installed on Server

How can I configure an inbound rule on a Windows Server 2016 firewall to allow access from a program which is not installed on the server? When searching for a program browse is only offered for ...
49
votes
7answers
54k views

With IPv6 do we need to use NAT any more?

I'm wondering how to use NAT with IPv6. Seems that you don't even need it any more. So what exactly is the concept behind firewall configurations in IPv6 environments?
1
vote
0answers
36 views

apache struts 2 s2-057 does not return shell?

i do a pentest for a private server protected by cloudflare .. i already bypass WAF and got the real ip for the server then i scan it by acunetix and i found a : Apache Struts2 Remote Command ...
3
votes
3answers
288 views

Web Application Firewall using web app source code analysis

I read this page: Category:OWASP Best Practices: Use of Web Application Firewalls, and I found that WAF cannot generally detect logical attacks. We know each web application has a number of input ...
1
vote
1answer
255 views

WebRTC.Local.IP.Addresses.Disclosure

We have Fortigate perimeter firewall and today i detected this event. What should I do to improve protection? How can someone take local IP address' through a Firewall? The following intrusion was ...
3
votes
2answers
125 views

How do I prevent traffic on my site from a source other than Cloudflare?

I use Google Cloud Platform to serve the site I manage. I have one load balancer there, which controls the movement to several virtual machines. When I came across the problem of DDOS attacks on ...
2
votes
0answers
42 views

Secure AWS instance metadata against potential SSRF

I am running a Windows instance on AWS. The instance has an IIS service running on it. The IIS service has a user associated to it and it has no need to access the AWS instance metadata. I was ...
0
votes
3answers
1k views

explorer.exe outbound (Unexplained TCP Connections)

So I've already disabled SSDP Discovery in Windows Services. I'm also not conducting any searches. I also have file indexing disabled on my system. I noticed a number of outbound connections coming ...
0
votes
1answer
52 views

Are there any alternative methods for reverse connections that bypass firewalls?

I'm doing a PenTest on a server. I have an RCE vulnerability on it, but when I try to do a reverse connection via netcat, the firewall blocks it. Is there any other methods used for reverse ...
6
votes
3answers
6k views

Firewall Configuration Audits

I'm looking to perform policy audits against firewall configurations and/or rulesets. This should be performed independently of any configuration management systems, ideally by operating off the ...
-1
votes
0answers
20 views

How to see see/configure Windows Defender Firewall logs in non-domain private Windows 10 Computer? [migrated]

How to see see/configure Windows Defender Firewall logs in non-domain private Windows 10 Computer? Of course - I am aware of the answer How do I access a firewall log (Windows 10 w. Windows Defender) ...
-1
votes
1answer
73 views

Firewall logs with Local IP contacting local IP over the internet [closed]

I noticed some wierd behavior in our firewall logs: a computer in our subnet 192.168.1.0/24 sending UDP packets in port 161 to an IP in subnet 192.168.20.0 (we don't have a subnet like that), and the ...
2
votes
5answers
36k views

Port Scan Detected and Blocked! - Bitdefender 2014

I have Bitdefender Total Security 2014. Recently I have been getting the message/alert "Port scan detected and blocked". I did not care about it much until I getting more especially in a specific ...
4
votes
2answers
7k views

Is it dangerous to disable the IPv6 firewall built into many home routers?

The router that my ISP has delivered contains an IPv6 firewall. The only configuration option is whether it is on or off. Apparently, this firewall simply denies all incoming connections. I ...
4
votes
3answers
7k views

Should I allow communication on public networks?

I apologize if this is a newb question. Reading this prompt, it appears that I should check Private Networks and uncheck Public Networks. However, Windows defaults to the opposite being checked. Am I ...
3
votes
1answer
223 views

How can Nmap bypass Windows Server firewall rules?

I need to block all communication (inbound/outbound) from server A to server B (all ports/all protocols). Server A should communicate with every machine except server B. I can't place firewall rules ...
0
votes
1answer
73 views

For security purposes, can I use vpn with ufw to allow traffic only from the vpn on ubuntu?

Is this possible? If not through ufw then some other software or iptables? How should I set up the ip tables? Assuming my public ip is known (and I don't want to change it), would it provide complete ...
0
votes
0answers
32 views

Iptables ruleset changes when running a native vpn application

Is it ok for a native linux vpn application (from a famous brand among the vpn providers) changing your iptables ruleset each time the vpn activated? Consider that one of the rules which always ...
0
votes
1answer
33 views

In what situations / with what nodes should a node ping / not ping?

I was recently looking at a network in which the client-machines that accessed a webservice endpoint, but which could not ping the webservice endpoint. And there are other machines that can ping the ...
1
vote
0answers
94 views

Reverse shell working with kali 2016, but not kali 2019.2, using Metasploit ms08_067_netapi

I have an unpatched Windows XP Home VM, a Kali 2019.2 VM and an old Kali 2016 VM. Using Metasploit's ms08_067_netapi module, I'm able to successfully get a reverse shell but only on the old Kali VM. ...
2
votes
3answers
1k views

How to block I2P and Freenet to my network?

I am trying to find a way to block I2P and Freenet darknets in a corporate network. Does anyone know a way to block them (on firewall)? Do I need to close particular ports or block entry nodes (like ...
2
votes
4answers
1k views

What is the simplest way for a Proxy/UTM to block HTTPS traffic using URL filtering?

I'm building a UTM using ubuntu, How can I block HTTPS traffic using URL filtering? (For example I want to block https://facebook.com) I'm using Squid as a transparent proxy server. Solutions I don't ...
1
vote
0answers
54 views

Is Windows RPC (port 135) secure enough for domain-wide access

I have a network of approximately 150 computers that I'd like to regularly monitor. My proposed way of doing so involves running remote commands like reg query \\<ip> or systeminfo /S <ip>....
0
votes
1answer
61 views

Intercept network traffic with a hub [on hold]

If I plugged a hub inbetween a switch and firewall, that also had a device running wireshark or similar capture software connected, due to the way a hub operates, would I be able to read ALL of the ...
0
votes
0answers
45 views

Web Site Access - Port Whitelisting

I am able to access a certain website https://buzzlightyear.acme.com:68080 from within a corporate network (Obviously the default https port 443 has been allowed in the windows firewall of the machine ...
0
votes
2answers
1k views

Do any open-source firewalls support remote management? [closed]

Remote management is essential if you have to run more than three network devices, and is supported by all commercial firewall products. For example: Palo Alto Networks: In addition to control ...
1
vote
1answer
104 views

Fortigate Creating Millions of DNS events to standard domains

I am trying to tune our SIEM and noticed that we are receiving millions of DNS records every day from the same domains. These are: update.microsoft.com swscan.apple.com softwareupdate.vmware.com ...
4
votes
2answers
6k views

NMAP - Closed vs Filtered

A lot of people seem to ask this question, as there are a bunch of posts about it; however I feel like none truly answer the question (that I have found). I want to understand why NMAP decides to ...
1
vote
1answer
159 views

How to find a website behind a Firewall? [closed]

Some context for my question: I'm currently studying Information Security, and this is for an assignment from my teacher. For my assignment, I received two IP addresses. I did a port scan with nmap ...
2
votes
1answer
237 views

How to configure NAXSI to accept JSON format in REST APIs?

For example, one of my APIs is: Post request: /api/v0/login body: { "username":"xxx@ggg.com", "password":"eeeee" } I want to secure this API with NAXSI, but I could not find anywhere to config ...
81
votes
10answers
106k views

Why do people tell me not to use VLANs for security?

I have a network, where a have a couple of VLANS. There is a firewall between the 2 VLANs. I am using HP Procurve switches and have made sure that switch-to-switch links accept tagged frames only and ...
-2
votes
1answer
90 views

Firewall can detect suspicious file over HTTPS [duplicate]

A firewall/router can intercept HTTPS traffic, analyse it and detect suspicious file download for example. From my understanding, it is acting as a proxy and/or a MITM device. If it is capable of ...
0
votes
0answers
61 views

IP Encryptor and Firewall

Firewalls implement IPsec VPN and perform packet filtering. IP Encryptor, on the other hand implements IPsec VPN and achieve security goals (confidentiality, integrity and authentication). What are ...
2
votes
3answers
554 views

Router Security Log Shows Many Blocked TCP Connections

When checking my router tonight I looked at its security log. I saw thousands of blocked tcp traffic. Why are these considered security events? The log shows many blocked tcp incoming request from ...
8
votes
2answers
16k views

Is opening both TCP/UDP less secured than just TCP or UDP when needed and why?

If application needs opened port X UDP, or X TCP combination. Is there any potential risk by opening both UDP/TCP as I usually am not sure which one the application uses?
1
vote
1answer
446 views

Creating a secure home network - Which firmware should I use and how should I configure my firewall?

I am starting to take on more and more enterprise clients while working remotely from my home office. I have a pretty secure network at the moment, but I have a lot hardware that I am not using and ...
0
votes
1answer
75 views

Types of firewalls to implement to reduce DoS attacks in POS systems

Would you need an internal, external and a host-resident firewall for each POS client?
1
vote
1answer
94 views

Separation of devices for VPN / Firewall [closed]

Our company has two separate firewall devices from different vendors (Checkpoint / Cisco) for firewall and VPN access. We're currently evaluating the possibility of migrating to a newer, clustered ...
4
votes
2answers
2k views

how can an attacker access a system through a compromised router?

Let's say an attacker gained access to the admin panel of a home router with port 21, 23 and 80 open. I mean the attacker has full control over the router, thus being able to port forward, etc... ...
1
vote
1answer
403 views

Why won't ossec block SSH connections when it seems to be configured correctly?

Why won't ossec block connections from another server? I installed ossec version 2.9.3 on Ubuntu 16.04. In the ossec.conf file I have these lines where x.x.x.x is the IP address of a second Linux ...
0
votes
1answer
76 views

Block a file from being accessed over the internet

I keep my client data in a password protected Excel file. For added security, I would like to block access to this file from potential hackers on the Internet. Is it possible to block access to a ...
0
votes
1answer
277 views

Differentiating between IKEv2 and OpenVPN Traffic

There is a WiFi network that I regularly use, and it seems to be blocking all VPN traffic other than IKEv2. I tested this by downloading many of the free/freemium VPN apps from the Google Play Store ...
0
votes
0answers
61 views

Why is Zone Alarm Blocking VMWare Virtual Network Editor?

I have version 15 of VMWare running on my Windows 10 computer. When I open the Virtual Network Editor and try to add a bridged connection, I get an error saying: Cannot change network to bridged: ...
0
votes
0answers
32 views

standards reference to perimeter security

I have the following problematic that I am currently dealing with. I have two zones/perimeters that need to be interconnected, some standards protocols have to be whitelisted such as HTTP, FTP, SSH ...
0
votes
2answers
135 views

Security measures to take upon acquiring a new laptop?

I'm planning on buying a regular HP laptop. However, I'm still a novice when it comes to information security. I'm planning on using this laptop to SOLELY login to my bank accounts and NO OTHER ...