Questions tagged [firewalls]

Concerned with software or hardware firewalls

Filter by
Sorted by
Tagged with
0
votes
1answer
40 views

How to stop outgoing SSH on port 443

Let us say that a small company has an internal network for employees. All employees are granted Internet access via a NAT device (not a proxy) and perimeter firewall only allows outgoing connections ...
-1
votes
1answer
71 views

Whats The Point of GeoBlocking if the Firewall Has An Implicit Deny?

What is the point of geoblocking IP addresses with cisco firepower or a similar service if the firewall would block the request anyway? For example, We only do business in the USA but see source IP's ...
0
votes
0answers
92 views

Mongo DB hacked (read_me_to_recover) without the port exposed in the firewall?

I Have recently setup parse-server on a DO vps, using 3 docker containers, one for parse-server, one for parse-server dashboard and one for mongodb. Because I am just testing this setup I left the ...
0
votes
0answers
79 views

Could I have been hacked? [closed]

So for a while I have been using this chat to talk with random people: talkwithstrangers.com. I've used it to practice conversation. Yesterday though I had a weird conversation. The person with I ...
0
votes
0answers
4 views

What is an efficient alternative to iptables for bulk usage? [migrated]

Suppose I have a list of thousands of ip addresses to block. Right now I know how to iterate through the list and for each one run: iptables -A INPUT -s XX.XX.XX.XX -j DROP But this means I will have ...
24
votes
5answers
5k views

Why is DNS-over-HTTPS such a big security nightmare compared to DNS-over-TLS?

I've heard the argument against DNS-over-HTTPS that it is supposed to be a security nightmare for network defenders because it enables encrypted DNS over port 443, compared to DNS-over-TLS which goes ...
0
votes
0answers
53 views

Security of NGFW OS and kernel [closed]

I know there are lots of different providers, but let us focus on the bigger ones and the ones running some kind of Linux. In the end they are all some kind of huge packet parsing engine and I guess ...
0
votes
2answers
81 views

Is there a bulletproof way to configure your AWS system? [closed]

I am learning how to configure a multi-region AWS system. However, everything I read says "if you want/need more security then do X". Why would anyone want less security (is what I start ...
0
votes
0answers
25 views

The IP Address of The Attacker is not Detected in the Honeypot After Being Forwarded [closed]

I have a problem with my project. My project is how to deflect the attacker to the honeypot. I tried using the IPTables to forward any IP Address that want to access the protected network to the ...
0
votes
0answers
7 views

Creating your own torrent [migrated]

I am trying to send some files to my friend which unfortunately are too big to be sent via email. So I tried creating a torrent file so he can download them as a normal torrent. However it doesn´t ...
3
votes
3answers
341 views

Web Application Firewall using web app source code analysis

I read this page: Category:OWASP Best Practices: Use of Web Application Firewalls, and I found that WAF cannot generally detect logical attacks. We know each web application has a number of input ...
0
votes
1answer
45 views

UFW does not block meterpreter

I am doing some pen testing on my wordpress server. I wanted to see what would happen if the attacker were to get a hold of my username and password for wordpress. So I used the standard exploit in ...
3
votes
1answer
109 views

In setting up a VM, does the Bridged or NAT configuration provide more separation security?

I am setting up a few VM's (assume VirtualBox w/ Linux). They will all be on the same PC host (assume Linux) and the intent is to have all the VM's handle separate functions (business, personal ...
1
vote
2answers
1k views

Is it advisable to accept STUN server connections?

My firewall reports outgoing connection attempts via com.apple.WebKit.Networking to a number of STUN servers (namely, stun.nas.net, stun.node4.co.uk, stun.voxox.com and stun.wwdl.net). This is ...
4
votes
2answers
2k views

Can firewalls decrypt SSL packets?

I was wondering if the firewall has the ability to decrypt the SSL traffic. If so, the network admin is able to read the data in clear text at transit.
1
vote
0answers
19 views

Smart Meter traffic “DLMS/COSEM” Decryption with Cisco FTD [closed]

I need to check how to inspect traffic coming from smart meters with Cisco FTD. All I know is this meter is communicating over DLMS/COSEM. Anyone with experience in similar scenarios?
6
votes
8answers
156k views

How to effectivily block torrents on my network?

As per the network policy, we have to block all torrent traffic from the network. To do this, I used to block all ports above 1024 on my firewall/proxy devices. But due to this, many other ...
-2
votes
1answer
101 views

Securing a read-only REST service for mobile access

I am writing a mobile app that uses a read only REST service that sits behind our company firewall. The actual data supplied by the REST service is not private but I am concerned with a hacker using ...
0
votes
1answer
84 views

How does Cloudflare firewall work?

How does Cloudflare web firewall work? When someone tries to enter a website, they first go through the Cloudflare server and then, if a captcha is solved, they can see the content of the website. So ...
1
vote
1answer
46 views

When does it make sense to deploy an embedded firewall on my IoT device?

I have a typical IoT set up where a set of IoT devices running embedded Linux are connected to a cloud IoT server. The underlying carrier connection to the internet is over GSM. All communication to ...
0
votes
1answer
73 views

How hardware firewall knows if its an inbound or outbound request? [closed]

Being a hardware firewall, it can only see the TCP/UDP packets, how can they know that a packet coming inside is inbound or response to an outbound request?
0
votes
1answer
79 views

What is “Your Phone” in Windows 10 Advanced Firewall?

I have an Outbound Rule in my firewall called "Your Phone". Settings: All programs. In Customize Application Package Settings, it has "Apply to app package..." set with a long ...
1
vote
1answer
64 views

In what situations / with what nodes should a node ping / not ping?

I was recently looking at a network in which the client-machines that accessed a webservice endpoint, but which could not ping the webservice endpoint. And there are other machines that can ping the ...
0
votes
0answers
46 views

Is there any Windows HIPS software that supports file and registry access control?

I Have been using COMODO Firewall and HIPS for many years, which can block writes and executes but not reads. My threat model has changed to include spyware with trusted digital signature, which by ...
1
vote
1answer
173 views

Alternative to Qubes OS network domain for a server

I know that Qubes Os is not suitable for a server use, but some of its features are quite interesting for that. In fact, all the network drivers are contained in a VM that run a different Linux based ...
0
votes
2answers
2k views

explorer.exe outbound (Unexplained TCP Connections)

I've already disabled SSDP Discovery in Windows Services. I'm also not conducting any searches. I also have file indexing disabled on my system. I noticed a number of outbound connections coming from ...
1
vote
1answer
58 views

Why does a firewall reencrypt https traffic

I have a Sophos XG firewall. I use it at home (to play around with) This firewall is capable to scan HTTPS traffic. It decrypts the traffic and re-encrypts the traffic again. For the re-encryption of ...
0
votes
1answer
51 views

What are the downsides to having PostgreSQL database available directly from public network?

When auditing a machine for one of my clients I noticed that they have PostgreSQL listening and accessible from public network. This is not necessary for their application, seems they simply neglected ...
1
vote
2answers
47 views

How to configure a port as filtered on server

With nmap you can see a live system's or server's open, closed, and filtered ports. But how do you make it show as filtered when it is currently shown as open?
3
votes
1answer
57 views

Getting numerous HEAD requests by Java user agents to resources that require authentication to view within a web application. Should I block them?

I have recently started using Cloudflare's firewall in front of a web application. This app has a limited user base of selected applicants and they must log in to view anything. There is no public ...
6
votes
4answers
1k views

Using non standard port numbers [duplicate]

Are there any security benefits to setting up the ports on your firewall to non-standard numbers? For example, using port 15 for the SQL service, or 8443 for https.
0
votes
0answers
27 views

Its there any built in protection against deceptive app names in Android or that make app listings trustable?

Some functionalities rely on app names and icons for proper use. Like firewall, installed apps list, memory usage statistics. I wonder if there is anything fobidding an app to appear with deceptive ...
0
votes
2answers
78 views

How to avoid leaking your public IP to installed applications like browsers when using a vpn?

What is the easiest setup to hide your public IP from installed applications and prevent things like WebRTC leaks on a common Linux distro?
0
votes
0answers
34 views

What security benefit is there in 2020 to block outbound Ping [duplicate]

I've researched this and found the following on StackExchange and ServerFault, but they're very old. https://serverfault.com/questions/55889/why-block-outbound-icmp Is it a bad idea for a firewall ...
1
vote
1answer
119 views

Should the Router or Firewall Come First?

Network scenario.... I have a typical enterprise network meaning ISP > Edge Router > Firewall|DMZ > Switch > LAN I know there are several debates about what device comes first, but ...
0
votes
0answers
154 views

Why does bettercap not capture any traffic and why is its web UI just a blank page?

I'm running Debian10/KDE with the nftables firewall enabled on my host machine and would like to test my phone. In the virtual machine I'm running Kali Linux with bettercap and am trying to sniff ...
1
vote
1answer
40 views

Use linux firewall rules for windows too [closed]

I'd like to improve security on my home network. I have a PC and a laptop with Microsoft Windows as well as a PC and a laptop with Linux There are a few HTTP services installed in the network. The ...
0
votes
1answer
187 views

Configure Windows Firewall Inbound Rule for Program Not Installed on Server

How can I configure an inbound rule on a Windows Server 2016 firewall to allow access from a program which is not installed on the server? When searching for a program browse is only offered for ...
1
vote
1answer
172 views

Why is Zone Alarm Blocking VMWare Virtual Network Editor?

I have version 15 of VMWare running on my Windows 10 computer. When I open the Virtual Network Editor and try to add a bridged connection, I get an error saying: Cannot change network to bridged: ...
0
votes
0answers
22 views

Circumventing inbound traffic rule by faking reply traffic

My question is about security groups/firewalls and protecting a virtual private cloud from the external world. Here is a description of VPC default policy for inbound/outbound traffic (on AWS): ...
17
votes
3answers
7k views

Setup a private VPN for family in China?

I have family in China. During the past weeks their internet connection was severely limited. VPNs such as Astrill and similar weren't working anymore. Is it possible to setup my own VPN (or ...
2
votes
1answer
181 views

Non-upgradable usb device against badUSB

Lot of posts about badUSB (here and there) suggest to use a PS/2 connector for mouse and keyboard or to whitelisted USB devices or even use a hardware firewall that only allows whitelisted commands. ...
1
vote
1answer
91 views

Why can I access the internet with all ports closed on firewall? [closed]

For the heck of it I wanted to see how much I could close down my router from the rest of the internet. I was hoping turning on the firewall, removing any port forwarding and turning off UPnP would ...
2
votes
0answers
217 views

(Public) IP address [x.x.x.x] of Synology has been blocked by SSH

For the past few months I regularly see alerts on my Synology about SSH connection being blocked. Somebody (here a nice Chinese guy from 222.186.15.158) was attempting to connect to my NAS with the ...
0
votes
2answers
62 views

Are there any examples of network-based application firewalls?

As we know, network based firewalls will filter based on information such as source IP, source port, etc. But they won't know what program on the source machine is generating that traffic. ...
0
votes
1answer
137 views

VPN from inside a company

I recently had to bypass my company policy by establishing a VPN connection from a LAN device (raspberry pi) located inside my company, to a WAN server. As devices accessible from outside must be ...
0
votes
0answers
25 views

What are the use case to host services on tier 2 firewall?

We have a tier 1 and tier 2 firewall What are the use case to host services on tier 2 firewall? e.g. is connection from field enineers/remote workers one of those? What security risks and controls ...
62
votes
11answers
121k views

Why block outgoing network traffic with a firewall?

In terms of a home network, is there any reason to set up a router firewall so that all outgoing ports are blocked, and then open specific ports for things such as HTTP, HTTPS, etc. Given that every ...
0
votes
0answers
54 views

Disable mdns-publisher on Linux?

I just installed a firewall and other security-related software on my Linux machine (Ubuntu 18.04), and after reading about them, decided to disable two services that I did't need with: sudo ...
1
vote
1answer
118 views

Types of firewalls to implement to reduce DoS attacks in POS systems

Would you need an internal, external and a host-resident firewall for each POS client?

1
2 3 4 5
22