Questions tagged [firewalls]

Concerned with software or hardware firewalls

Filter by
Sorted by
Tagged with
-1
votes
1answer
64 views

Firewall logs with Local IP contacting local IP over the internet

I noticed some wierd behavior in our firewall logs: a computer in our subnet 192.168.1.0/24 sending UDP packets in port 161 to an IP in subnet 192.168.20.0 (we don't have a subnet like that), and the ...
2
votes
5answers
36k views

Port Scan Detected and Blocked! - Bitdefender 2014

I have Bitdefender Total Security 2014. Recently I have been getting the message/alert "Port scan detected and blocked". I did not care about it much until I getting more especially in a specific ...
4
votes
2answers
6k views

Is it dangerous to disable the IPv6 firewall built into many home routers?

The router that my ISP has delivered contains an IPv6 firewall. The only configuration option is whether it is on or off. Apparently, this firewall simply denies all incoming connections. I ...
3
votes
3answers
6k views

Should I allow communication on public networks?

I apologize if this is a newb question. Reading this prompt, it appears that I should check Private Networks and uncheck Public Networks. However, Windows defaults to the opposite being checked. Am I ...
1
vote
1answer
130 views

WebRTC.Local.IP.Addresses.Disclosure

We have Fortigate perimeter firewall and today i detected this event. What should I do to improve protection? How can someone take local IP address' through a Firewall? The following intrusion was ...
3
votes
1answer
219 views

How can Nmap bypass Windows Server firewall rules?

I need to block all communication (inbound/outbound) from server A to server B (all ports/all protocols). Server A should communicate with every machine except server B. I can't place firewall rules ...
0
votes
0answers
35 views

ESP32 cannot bypass Firewall [migrated]

I am using ESP32 (which is Arduino based microcontroller with to connect to a Unity game I am building on my PC. I am using the PC as a WiFi Hotspot and the ESP32 is connecting to that hotspot using ...
0
votes
1answer
62 views

For security purposes, can I use vpn with ufw to allow traffic only from the vpn on ubuntu?

Is this possible? If not through ufw then some other software or iptables? How should I set up the ip tables? Assuming my public ip is known (and I don't want to change it), would it provide complete ...
0
votes
0answers
32 views

Iptables ruleset changes when running a native vpn application

Is it ok for a native linux vpn application (from a famous brand among the vpn providers) changing your iptables ruleset each time the vpn activated? Consider that one of the rules which always ...
0
votes
1answer
33 views

In what situations / with what nodes should a node ping / not ping?

I was recently looking at a network in which the client-machines that accessed a webservice endpoint, but which could not ping the webservice endpoint. And there are other machines that can ping the ...
1
vote
0answers
77 views

Reverse shell working with kali 2016, but not kali 2019.2, using Metasploit ms08_067_netapi

I have an unpatched Windows XP Home VM, a Kali 2019.2 VM and an old Kali 2016 VM. Using Metasploit's ms08_067_netapi module, I'm able to successfully get a reverse shell but only on the old Kali VM. ...
2
votes
3answers
1k views

How to block I2P and Freenet to my network?

I am trying to find a way to block I2P and Freenet darknets in a corporate network. Does anyone know a way to block them (on firewall)? Do I need to close particular ports or block entry nodes (like ...
2
votes
4answers
1k views

What is the simplest way for a Proxy/UTM to block HTTPS traffic using URL filtering?

I'm building a UTM using ubuntu, How can I block HTTPS traffic using URL filtering? (For example I want to block https://facebook.com) I'm using Squid as a transparent proxy server. Solutions I don't ...
1
vote
0answers
47 views

Is Windows RPC (port 135) secure enough for domain-wide access

I have a network of approximately 150 computers that I'd like to regularly monitor. My proposed way of doing so involves running remote commands like reg query \\<ip> or systeminfo /S <ip>....
0
votes
1answer
55 views

Intercept network traffic with a hub

If I plugged a hub inbetween a switch and firewall, that also had a device running wireshark or similar capture software connected, due to the way a hub operates, would I be able to read ALL of the ...
0
votes
0answers
43 views

Web Site Access - Port Whitelisting

I am able to access a certain website https://buzzlightyear.acme.com:68080 from within a corporate network (Obviously the default https port 443 has been allowed in the windows firewall of the machine ...
0
votes
2answers
1k views

Do any open-source firewalls support remote management? [closed]

Remote management is essential if you have to run more than three network devices, and is supported by all commercial firewall products. For example: Palo Alto Networks: In addition to control ...
0
votes
3answers
1k views

explorer.exe outbound (Unexplained TCP Connections)

So I've already disabled SSDP Discovery in Windows Services. I'm also not conducting any searches. I also have file indexing disabled on my system. I noticed a number of outbound connections coming ...
1
vote
1answer
96 views

Fortigate Creating Millions of DNS events to standard domains

I am trying to tune our SIEM and noticed that we are receiving millions of DNS records every day from the same domains. These are: update.microsoft.com swscan.apple.com softwareupdate.vmware.com ...
4
votes
2answers
5k views

NMAP - Closed vs Filtered

A lot of people seem to ask this question, as there are a bunch of posts about it; however I feel like none truly answer the question (that I have found). I want to understand why NMAP decides to ...
1
vote
1answer
154 views

How to find a website behind a Firewall? [closed]

Some context for my question: I'm currently studying Information Security, and this is for an assignment from my teacher. For my assignment, I received two IP addresses. I did a port scan with nmap ...
2
votes
1answer
229 views

How to configure NAXSI to accept JSON format in REST APIs?

For example, one of my APIs is: Post request: /api/v0/login body: { "username":"xxx@ggg.com", "password":"eeeee" } I want to secure this API with NAXSI, but I could not find anywhere to config ...
81
votes
10answers
104k views

Why do people tell me not to use VLANs for security?

I have a network, where a have a couple of VLANS. There is a firewall between the 2 VLANs. I am using HP Procurve switches and have made sure that switch-to-switch links accept tagged frames only and ...
-2
votes
1answer
73 views

Firewall can detect suspicious file over HTTPS [duplicate]

A firewall/router can intercept HTTPS traffic, analyse it and detect suspicious file download for example. From my understanding, it is acting as a proxy and/or a MITM device. If it is capable of ...
0
votes
0answers
59 views

IP Encryptor and Firewall

Firewalls implement IPsec VPN and perform packet filtering. IP Encryptor, on the other hand implements IPsec VPN and achieve security goals (confidentiality, integrity and authentication). What are ...
2
votes
3answers
523 views

Router Security Log Shows Many Blocked TCP Connections

When checking my router tonight I looked at its security log. I saw thousands of blocked tcp traffic. Why are these considered security events? The log shows many blocked tcp incoming request from ...
8
votes
2answers
16k views

Is opening both TCP/UDP less secured than just TCP or UDP when needed and why?

If application needs opened port X UDP, or X TCP combination. Is there any potential risk by opening both UDP/TCP as I usually am not sure which one the application uses?
1
vote
1answer
444 views

Creating a secure home network - Which firmware should I use and how should I configure my firewall?

I am starting to take on more and more enterprise clients while working remotely from my home office. I have a pretty secure network at the moment, but I have a lot hardware that I am not using and ...
0
votes
1answer
75 views

Types of firewalls to implement to reduce DoS attacks in POS systems

Would you need an internal, external and a host-resident firewall for each POS client?
1
vote
1answer
88 views

Separation of devices for VPN / Firewall [closed]

Our company has two separate firewall devices from different vendors (Checkpoint / Cisco) for firewall and VPN access. We're currently evaluating the possibility of migrating to a newer, clustered ...
4
votes
2answers
2k views

how can an attacker access a system through a compromised router?

Let's say an attacker gained access to the admin panel of a home router with port 21, 23 and 80 open. I mean the attacker has full control over the router, thus being able to port forward, etc... ...
1
vote
1answer
386 views

Why won't ossec block SSH connections when it seems to be configured correctly?

Why won't ossec block connections from another server? I installed ossec version 2.9.3 on Ubuntu 16.04. In the ossec.conf file I have these lines where x.x.x.x is the IP address of a second Linux ...
0
votes
1answer
75 views

Block a file from being accessed over the internet

I keep my client data in a password protected Excel file. For added security, I would like to block access to this file from potential hackers on the Internet. Is it possible to block access to a ...
0
votes
1answer
269 views

Differentiating between IKEv2 and OpenVPN Traffic

There is a WiFi network that I regularly use, and it seems to be blocking all VPN traffic other than IKEv2. I tested this by downloading many of the free/freemium VPN apps from the Google Play Store ...
0
votes
0answers
50 views

Why is Zone Alarm Blocking VMWare Virtual Network Editor?

I have version 15 of VMWare running on my Windows 10 computer. When I open the Virtual Network Editor and try to add a bridged connection, I get an error saying: Cannot change network to bridged: ...
0
votes
0answers
31 views

standards reference to perimeter security

I have the following problematic that I am currently dealing with. I have two zones/perimeters that need to be interconnected, some standards protocols have to be whitelisted such as HTTP, FTP, SSH ...
0
votes
2answers
133 views

Security measures to take upon acquiring a new laptop?

I'm planning on buying a regular HP laptop. However, I'm still a novice when it comes to information security. I'm planning on using this laptop to SOLELY login to my bank accounts and NO OTHER ...
24
votes
9answers
27k views

How important is NAT as a security layer?

I've signed on to help a department move buildings and upgrade their dated infrastructure. This department has about 40 employees, 25 desktops, an old Novell server, and a handful of laboratory ...
0
votes
4answers
349 views

Is it a bad idea using two firewalls on the same PC?

If i'm using windows default firewall and a third-party firewall, is it represents a security issue or I have to worry just with possible conflicts? And what type of conflicts could exists?
5
votes
3answers
2k views

What is the difference between an anti-virus and an IPS?

As I understand it, an intrusion protection system (IPS) detects anomalous behavior, does detection of protocol anomalies, and does signature filtering that blocks malware, DDoS, etc. An antivirus ...
4
votes
2answers
2k views

Benefits of home router behind Linux firewall?

Like a lot of people I have a simple consumer grade router at home. The setup is pretty standard: Ethernet from the cable modem --> router's WAN Given the poor track record of consumer routers ...
0
votes
2answers
100 views

Security of next generation firewall

In recent years there's been a number of IndieGoGo or KickStarter projects for smart device protection, or next-generation firewalls. Some examples are: Anonabox, Cujo, Dojo, Firewalla, Keezel, ...
1
vote
2answers
119 views

How does TLS traffic impact firewalls?

If I have an open port on a firewall it means that I can receive traffic on that port. If it's unencrypted I assume that the raw data is just allowed through. If TLS is being used, does firewall ...
5
votes
3answers
473 views

What are the security implications of allowing unlimited size cookies?

Our application firewall blocks requests if it detects a cookie is present with a value greater than 1024 characters in size. Are there any exploits involving large cookies? i.e. How much more ...
0
votes
1answer
48 views

Network diagram based on Cisco ACL and other firewall rules [closed]

Are there any tools for automated building network diagram from ACL rules or any other firewall rules?
3
votes
1answer
598 views

Ports Showing Closed/Filtered in Nmap Scans

hopefully this isn't a stupid question.. I am running some nmap scans and I get a list of ports that show closed. Why would they even show in the scan report? Can these be exploited further with other ...
1
vote
1answer
164 views

What is the difference between Anti - APT (Advanced Persistent Threat) and ATP (Advanced Threat Protection)?

Like the question says, is it the naming difference only or are they entirely different?
3
votes
3answers
269 views

Web Application Firewall using web app source code analysis

I read this page: Category:OWASP Best Practices: Use of Web Application Firewalls, and I found that WAF cannot generally detect logical attacks. We know each web application has a number of input ...
4
votes
3answers
540 views

The safest way to circumventing Iran's Internet censorship

We usually buy services like VPN, SOCKS, Kerio [Kerio Connect?]... to circumvent Iran's Internet censorship policy. Recently, one of the shops started selling [one of] Kerio's products, for which I do ...
1
vote
1answer
106 views

Why would my firewall be blocking external source and external destination IP's that I dont own? [closed]

In my Cisco ASA firewall logs I'm seeing events being blocked with an external source IP and a external destination IP. This is happening in the same event log. An example would be: TCP access ...