Questions tagged [firewalls]

Concerned with software or hardware firewalls

Filter by
Sorted by
Tagged with
74
votes
5answers
35k views

What techniques do advanced firewalls use to protect againt DoS/DDoS?

It is hard to protect a server against Denial of Service attacks, DoS/DDoS. The two simple ways I can think of is to use a server with much resources (e.g. CPU and memory), and to build the server ...
24
votes
9answers
27k views

How important is NAT as a security layer?

I've signed on to help a department move buildings and upgrade their dated infrastructure. This department has about 40 employees, 25 desktops, an old Novell server, and a handful of laboratory ...
85
votes
5answers
92k views

Should SSL be terminated at a load balancer?

When hosting a cluster of web application servers it’s common to have a reverse proxy (HAProxy, Nginx, F5, etc.) in between the cluster and the public internet to load balance traffic among app ...
98
votes
4answers
151k views

Is it a bad idea for a firewall to block ICMP?

This question was inspired by this answer which states in part: The generic firewall manifest file finishes off by dropping everything I didn't otherwise allow (besides ICMP. Don't turn off ICMP). ...
81
votes
10answers
104k views

Why do people tell me not to use VLANs for security?

I have a network, where a have a couple of VLANS. There is a firewall between the 2 VLANs. I am using HP Procurve switches and have made sure that switch-to-switch links accept tagged frames only and ...
39
votes
7answers
14k views

Port Knocking is it a good idea?

Normally for a server I like to lock down SSH and other non-public service to only be accessible by certain IP addresses. However this is not always practical if the business doesn’t have static IP ...
58
votes
10answers
112k views

Why block outgoing network traffic with a firewall?

In terms of a home network, is there any reason to set up a router firewall so that all outgoing ports are blocked, and then open specific ports for things such as HTTP, HTTPS, etc. Given that every ...
43
votes
5answers
53k views

With IPv6 do we need to use NAT any more?

I'm wondering how to use NAT with IPv6. Seems that you don't even need it any more. So what exactly is the concept behind firewall configurations in IPv6 environments?
37
votes
6answers
229k views

Difference between IDS and IPS and Firewall

The differences between an IDS and a firewall are that the latter prevents malicious traffic, whereas the IDS: Passive IDS: the IDS only reports that there was an intrusion. Active IDS: the IDS also ...
23
votes
2answers
10k views

Reject IP packets with an ICMP error, or just drop them?

Consider an internet-facing host (the outer firewall). What should be done with undesired traffic: just drop it, or send back an ICMP error such as port unreachable? (In Linux terms: iptables -P DROP ...
14
votes
5answers
14k views

What kind of attacks against home router's NAT do exist?

I always thought NAT was some kind of a security feature and I still think it is, because if it didn't existed the internet, respectively the clients behind NATs, would be even more insecure, since ...
3
votes
3answers
18k views

What, specifically, does the Windows Firewall do?

My understanding of the situation is that, when the Windows firewall is off, every port on the computer (all 65535 of them) is fully open. This means that any application running on the computer can ...
8
votes
1answer
2k views

Vulnerabilities of pure NAT without firewall

Following some of the comments on this question, I was curious about the security vulnerabilities of NAT. There are similar threads here and here but they discuss router vulnerabilities rather than ...
7
votes
2answers
20k views

What is best practice for separation of trusted zones from a DMZ with a single firewall?

At our organization we have a single firewall sitting between our internal zones and the public internet. Currently all of our trusted zones are defined as different vlans on a layer 3 switch plugged ...
5
votes
3answers
1k views

Open ports with no services bound to them

I have been wondering: if a port is open for inbound connections on the firewall yet there is no service bound to it, would that be considered a security vulnerability?
6
votes
4answers
4k views

What problems if any are caused by opening a port in the firewall that no program listens on?

I have a port forwarded and open in the firewall that I sometimes use to play games with friends over the internet. The game server doesn't run 24/7, only when I'm actually playing is something ...
4
votes
3answers
4k views

IP Spoofing a threat?

We have an internal intranet system which is only accessible from a few internal VLANs. Our main external firewall blocks all access to the internal webserver – or rather, has no rules to allow access!...
20
votes
6answers
39k views

What is the best practice for placing database servers in secure network topologies

I have a classic DMZ architecture: My webserver is placed in the DMZ. The webserver needs to communicate with a database server. This database server is the most critical component of my network as ...
40
votes
7answers
30k views

Are two firewalls better than one?

Let's say that our first firewall has some vulnerability and a malicious person is able to exploit it. If there's a second firewall after it, he/she should be able to stop the attack, right? Also, ...
25
votes
12answers
64k views

Public DMZ network architecture

Years ago, when I was a student, a network security professor taught me in a class what a DMZ is. The architecture he used in his slides was similar to this one: Now that I got employed, my boss, a ...
23
votes
5answers
4k views

To firewall or not to firewall?

There's recently been some discussion (to be generous) about the pros and cons of having a firewall deployed in front of servers. The con mainly being that it's a point of failure in case of a DDoS. ...
29
votes
4answers
19k views

Dangers of opening up a wide range of ports? (mosh)

Why do we generally configure firewalls to filter out all traffic that we don't specifically allow? Is this just an extra layer of security for defense-in-depth that buys us nothing if we are not ...
19
votes
2answers
37k views

Wireless client isolation - how does it work, and can it be bypassed?

Many SOHO routers these days support a feature called "wireless client isolation", or similar. What this is supposed to do, in principle, is to limit the connectivity between wireless clients ...
10
votes
3answers
2k views

Evasion techiques for WAFs

Are there any documented techniques for evading Web application firewall for testing WAF rule configurations?
11
votes
3answers
19k views

How to protect myself against paid DDoS services?

I am domestic user and I am getting attacked regularly by a guy that hates me. Here is the background story: that guy uses Skype resolvers (tools offered by paid DDoS services) to find out my IP ...
4
votes
6answers
145k views

How to effectivily block torrents on my network?

As per the network policy, we have to block all torrent traffic from the network. To do this, I used to block all ports above 1024 on my firewall/proxy devices. But due to this, many other ...
6
votes
7answers
15k views

What tools exist to manage large scale firewall rulesets?

For an enterprise firewall you may have over 50 thousand rules. With typical errors in firewall rules including things like mistyped network masks you couldn't hope to manually review the release. So ...
10
votes
4answers
2k views

Software vs Hardware Firewalls

I read an article (can't find link) recently that advocated dumping software firewalls if you had a hardware firewall. I was just curious as to the take on Firewalls in general for a small-medium ...
4
votes
2answers
3k views

Blacklisting IP addresses — when should we take action?

I am responsible for securing an AWS environment and am noticing various recon attacks against the environment. We have the option of blocking the IP addresses in our firewall, but the environment is ...
4
votes
3answers
1k views

Is there any method to prevent/trace DDoS attack?

I have a Debian Linux server which runs a few online game services. I have some competitors in this area and I think one of them is behind the DDoS attacks. I have full access to the router, so I set ...
1
vote
2answers
4k views

How to check if a port can be accessed from the outside

I want to be sure that the firewall protecting the intranet is effectively rejecting/granting access to a port. I have no access to the firewall nor any other external machine. Is that possible at ...
4
votes
3answers
540 views

The safest way to circumventing Iran's Internet censorship

We usually buy services like VPN, SOCKS, Kerio [Kerio Connect?]... to circumvent Iran's Internet censorship policy. Recently, one of the shops started selling [one of] Kerio's products, for which I do ...
3
votes
5answers
5k views

Question about IDS and IPS

I am studying Security Fundamentals on Networks and as a part of an excercise I have the following question: Which of the following statements are true? (Select all that apply) a.- An IDS deals with ...
2
votes
1answer
173 views

Could encryption become a security breach?

So, I was skimming though this SANS research about skype . Long story short, it says : Skype uses standard cryptographic primitives to achieve strong end-to-end encryption (Berson, 2005).........
97
votes
5answers
30k views

Someone is trying to brute-force(?) my private mail server… very… slowly… and with changing IPs

This has been going on for about 1-2 days now: heinzi@guybrush:~$ less /var/log/mail.log | grep '^Nov 27 .* postfix/submission.* warning' [...] Nov 27 03:36:16 guybrush postfix/submission/smtpd[7523]:...
26
votes
8answers
6k views

How to respond to a SSH brute force attack on a single VPS?

I logged onto my VPS this morning to find millions of failed login attempts for the root user and other users that don't even exist. I took the below measures to try and obfuscate the attackers ...
19
votes
2answers
336k views

What are the TCP/UDP ports used by torrent applications?

I want to block torrent traffic on my network because it is utilizing too much bandwidth and disrupted my network traffic. What port range should I use and what protocol TCP or UDP?
23
votes
7answers
4k views

How can I publish data from a private network without adding a bidirectional link to another network

I was just wondering how I could build a private network where it is physically impossible to gain access from outside but still have the option to publish data to some remote server. As an example: ...
22
votes
1answer
6k views

What is a Web Application Firewall?

What is a Web Application Firewall (WAF) and what are some of the things to look for in an effective one? Why would you deploy a WAF instead of just an IPS?
22
votes
5answers
5k views

Neural networks & anomaly detection

Neural networks, with their ability to learn behavioural patterns from arbitrary data, seem like a natural way to deal with intrusion detection. There are many academic papers on the topic which ...
17
votes
6answers
10k views

How does a network admin block the reverse SSH in company?

Given firewall inbound: all are blocked outbound: allow port 80, 443 Problem colleagues are still able to ssh to home device by port 80/443, and establish a reverse ssh tunnel from company to home, ...
16
votes
2answers
14k views

Kerberos authentication over the public internet

What are the threats to having the KDC accessible via the internet for remote clients? It's my understanding that the authentication is a challenge/response protocol and that the password is never ...
68
votes
5answers
10k views

Advised to block all traffic to/from specific IP addresses

My CFO received an email from a director at a financial institution advising that all traffic (inbound and outbound) from certain IP addresses should be blocked at the firewall. The director at the ...
28
votes
3answers
8k views

Is it practical to pre-blacklist certain GeoIP regions?

In recent events, a server I've been managing with has been under a few attacks, a risk you take when hosting a web-server. The firewall has been set up properly to only allow connections through the ...
12
votes
5answers
6k views

How can encrypted traffic bypass the Great Firewall of China when it is being blocked?

The Great Firewall of China is controlled by the government and has put in place a "learning algorithm" to block unapproved encrypted traffic. The only way to get encrypted traffic through the ...
14
votes
2answers
5k views

What's the diff between blocking a port with a firewall and not starting a service on that port in the first place?

I was considering setting up a software firewall (pf) on my web server and did some research on them. Were I to do it, it'd involve basically blocking connections to all ports except 80, 443, and the ...
19
votes
4answers
4k views

Detect non HTTP packets using port 80

We are currently doing port whitelisting on our firewalls which is working well but this of course does not prevent the implementation of side channels or the misuse of these ports for other purposes. ...
17
votes
3answers
26k views

Proxy vs. Firewall

I understand that very simply put a proxy is a sort of 'man in the middle' allowing/denying access to certain services/resources. Strictly in terms of security (I mean here privacy, parental control ...
13
votes
7answers
4k views

Egress filtering on an office network?

With an office network most companies will use ingress filtering to add a level of security, however few take advantage of egress filtering to protect their networks. The use of egress filtering will ...
11
votes
4answers
1k views

External Vulnerability Scan of DMZ

We currently have an internal and external vulnerability scanner setup in my organization. This morning our external scanner was going through a new external DDoS protection service instead of ...