Questions tagged [firewalls]
Concerned with software or hardware firewalls
1,162
questions
0
votes
1
answer
705
views
firewalld rules that will block traffic from internet but allow internal traffic
I want to block some ports access to the internet but still allow internal hosts to access the port with firewalld. There is another firewall between the internet and the host but I want to add a ...
0
votes
1
answer
516
views
Is there any difference between circuit vs application level gateway except that one operates in layer 3 and another at layer 7 of OSI model?
Question#1
whitewinterwolf answer says
the circuit level gateway CHANGES the source ip address of outgoing
packet(from the internal network point of view).
Two different TCP connection are formed, ...
0
votes
0
answers
231
views
I cannot make a reverse connection
I am playing with a Linux CTF server and came across a kind of reverse connection block. I uploaded a php webshell, gained control of www-data user and tried to make a reverse shell.
Possible a UFW ...
0
votes
0
answers
673
views
A Continuous Flood of Kernel Warnings. Am I under attack?
I have a Linksys WRT1200AC with DD-WRT v3.0-r48865 std. It's connected to the Internet through the ISP's modem in bridge mode.
My syslog reports continuously, many times per second stuff like this:
...
- 101
1
vote
3
answers
253
views
Are country IP address blocks officially standardised and can they be reliably used for access control?
I was setting up firewalld on an enterprise server and came across their concept of firewall zones. I figured I can easily use them and their source property to restrict access to SSH to only the ...
- 224
-1
votes
3
answers
179
views
Why don’t routers request permission when attempting to connect to an unknown address? (Or why do they still assume every connection is trustworthy?)
I’m imagining a system similar to UAC on Windows but implemented at the router level for IP addresses instead. (Or AS numbers, BGP numbers, Port number, etc…)
Naturally this makes router setup ...
- 99
0
votes
1
answer
5k
views
Are there security implications of allowing Discord through Windows Firewall?
I just installed Discord (downloaded from the official Discord website) and after the install a Windows Firewall pop-up appears asking me if I want to allow Discord through Windows Firewall.
I don't ...
1
vote
1
answer
344
views
I am still receiving ssh-bruteforce on my VPS
I have a server in Oracle Cloud Infrastructure Ashburn. I am using Tailscale to SSH my servers and closed Port 22 in public.
I closed Port 22 on the VCN and left Port 22 open on the server. But no one ...
- 37
0
votes
0
answers
169
views
How to detect a firewall used
I was scanning a network with Nmap.
I'm looking for advanced commands for detecting firewalls.
0
votes
0
answers
76
views
Network Segmentation - Single Firewall VM vs Multiple
I am currently implementing a new network with different segments. The separation of those segments is achieved using VLANs. To enable some segments to communicate with each other and to be reached ...
- 1
2
votes
0
answers
778
views
No root firewall vs any spyware / malware
I am wondering about the effectiveness of no root firewalls as a solution against any type of spyware / malware. Particularly on an android device.
No root firewalls like this one here (aptly named) ...
- 21
0
votes
1
answer
2k
views
UFW vs IpTables for web application security
I am trying to better understand measures that can be used to protect a web-application. I'm trying to determine which would be more effective, implementing a UFW or using IpTables.
From my ...
- 197
0
votes
1
answer
197
views
The router (that my PC is connected to) is continuously attempting to connect through TCP80. What would be the reasons?
I have no access to the router nor do I have any administrative access to this local network. But every 5 minutes the router attempts to connect to my PC through port 80/tcp, and it attempts exactly 4 ...
- 1
1
vote
1
answer
129
views
How much network noise is normal? [closed]
on my Ubuntu VPS I am getting a lot of requests and portscans from foreign sources. They are all blocked by UFW. However my question is, if this much "network noise" is normal or is my ...
- 11
0
votes
0
answers
5k
views
Couldn't validate TLS certificate - Nord VPN
I received this notification from Nord randomly. Should I be worried? Is there something I can do? Am I being hacked?
P.S. clicked Don't trust
EDIT: I tried connecting from mobile data and am ...
1
vote
1
answer
551
views
How can malware or a hacker penetrate a firewall from external perimeter?
How can malware or a hacker penetrate a firewall in a router/AP or a dedicated firewall without "help from the inside" (running malicious script on a computer, forgotten open ports with port ...
- 33
1
vote
1
answer
1k
views
Decrypting WhatsApp traffic and blocking file uploads possible using a firewall ssl decryption policy?
So we want to block file uploads on WhatsApp but since it's encrypted, I doubt this can be done, however, can PANOS decrypt WhatsApp??
I ask because WhatsApp doesn't exactly use SSL right, it's more ...
- 11
1
vote
1
answer
206
views
Possible rogue admin monitoring my online activities
I teleworked for a medium-sized software company. We had a network architect who offered me a firewall to install so I could securely access on-premises resources and play around with some ...
- 801
5
votes
0
answers
306
views
Why am seeing all these Chinese proxy domains? [closed]
Through a casual Google search I came to this Stack Overflow result. I clicked it absent-mindedly, could not connect through the server and saw that he domain was some Chinese government proxy server. ...
- 151
-2
votes
1
answer
804
views
Difference between 22 and 22/tcp rule in firewall [closed]
I have those two rules in UFW, but no idea what is the difference between [1] and [2]?
To Action From
-- ------ ----
[ 1] 22 ...
0
votes
0
answers
231
views
If all ports are closed except for port 5001 and all internet traffic is blocked except for traffic to/from 1 remote server, can we still be hacked?
We have closed all ports via our hardware firewall except for port 5001 which is open to allow our trading platform software (which does not have any publicly known software vulnerabilities) to ...
- 1
0
votes
1
answer
66
views
Recommended secure option for uploading files to web server from a dynamic IP?
I need the best way to access a webserver to upload/modify a PHP script. The website contains very sensitive information, gaining unauthorized access to this server and modifying files would lead to ...
- 111
0
votes
1
answer
200
views
If I close all ports via our firewall except for the single port used by our forex broker can I still be hacked by the broker or someone else?
We have closed all ports on our firewall except for port 5011 which is the only port that is required to be open on our server so that our server can receive price data and send buy and sell orders to ...
- 1
0
votes
3
answers
1k
views
Best practices for securing SSH access? Is certificate-based VPN server a good solution?
I run a server on a hosting. I want to harden it, but ssh access is giving me a bit of concerns.
I usually access from home most of the times. I have a provider subscription with the usual DHCP setup ...
0
votes
0
answers
119
views
Firewall IP-Filtered Pinhole Risks
To facilitate consulting work, a client has suggested that they allow me to connect directly to an in-house remote desktop server, via a firewall pinhole which allows connection from my IP address ...
- 101
2
votes
1
answer
2k
views
What would be the best way to mitigate Azure Application Gateway WAF False Positive?
We have a Web API which uses the REST semantics and is protected using the Azure's Application Gateway using a Web Application Firewall. The Web App consuming this API can send in any type of data in ...
- 258
0
votes
2
answers
655
views
How does my HTTPS POST get blocked based on XML content?
There's a web application on a server which I have full access to which accepts POST requests on a REST endpoint. The request payload is expected to be an XML document. For request routing and load ...
- 121
4
votes
1
answer
1k
views
What is the need for firewall to be in "stealth mode"?
There is a firewall deployment case called "transparent mode", when the firewall does its job without routing and having IPv4 addresses, i.e. it is invisible.
"Stealth mode" is ...
- 141
0
votes
1
answer
5k
views
Is enabling software flow-offloading in OpenWRT's firewall settings dangerous?
First of all, I did ask this on OpenWrt Forums already, I thought maybe someone here knows this.
I noticed that my internet speed gets limited when this feature is not enabled, this feature is also ...
- 1,611
1
vote
1
answer
2k
views
Should we enable UFW for EC2 (Ubuntu Server) instance with Nginx?
I just finished installing Nginx on my EC2 Ubuntu Server (AWS) and everything looks normal.
I tested it on my browser by accessing my EC2 public IP. I can see Nginx's welcome message.
It's not a big ...
- 13
1
vote
1
answer
479
views
Block inbound TCP segments with ACK=0 vs Block inbound TCP segments with SYN=1, how are they same?
Blocking inbound TCP segments with ACK=0
Blocking inbound TCP segments with SYN=1
Both prevent external clients from making TCP connections to internal clients, but allow internal clients to connect ...
- 11
0
votes
2
answers
777
views
In a network do we need both TLS and Firewall?
I need to set up a small network as shown below. Is it really required that the "switch should also host a firewall" when all the communication between the "computers" is over TLS?
0
votes
1
answer
230
views
Apps like Twitch asking for Firewall exceptions: are we at risk of having our computer hacked?
I am installing the Twitch app, and a firewall warning popped up asking that I give permissions to use the app via private and/or public networks.
I am a security newbie but a bit paranoid and wonder ...
- 387
0
votes
1
answer
724
views
Risks posed by a wireguard connection to a compromised server
I am trying to understand the risks posed by having a wireguard connection under a very specific and narrow set of circumstances.
I have a desktop at home that is behind a router/firewall and is not ...
- 3
0
votes
3
answers
788
views
Why would a legitimate application run on a non-standard port?
Among the many "threats", I see on my SIEM, a non-standard port is a top one. It's always been a false positive, but I don't understand why this happens frequently?
1
vote
1
answer
1k
views
Firewall is blocking OCSP (Online Certificate Status Protocol) check
I have a certificate issued by lets encrypt and one of the certificate in the path has this information:
[1]CRL Distribution Point
Distribution Point Name:
Full Name:
URL=...
- 2,287
22
votes
6
answers
5k
views
Do machines without any listening services need a firewall to block incoming connections?
Let's assume we have an example machine connected to the internet. This machine is typically a client one, and it has no services like ssh running on. Does this kind of machines need any firewall to ...
- 583
0
votes
1
answer
325
views
Is an IP based whitelist practical for controlling internet use?
I have to set up internet controls for our schools study hall/testing center. The idea is that computers on that network should only be able to access the school's webportal and learning platform ...
- 113
0
votes
1
answer
3k
views
Using Github's Public IP Address as Remote URL
My company distributes software that runs on locally installed Ubuntu Virtual Machines. To update the software, we pull our latest code down from Github.
Some IT departments have github blocked on ...
- 111
0
votes
0
answers
123
views
CIS MDBR blocking major libraries (jQuery, gstatic)
The organization I work for uses Malicious Domain Blocking and Reporting (MDBR), which is a service provided by Center for Internet Security (CIS). MDBR technology prevents IT systems from connecting ...
- 101
1
vote
1
answer
563
views
Getting reverse shell from firewalled target
Suppose this scenario:
You are already inside a corporate network. Suppose to find out a RCE in a X service. The machine that hosts that service is behind a network-based firewall, ingress rules and ...
- 13
0
votes
1
answer
170
views
Why is the -L (list) option of iptables not available to non-root users?
Many tools in Linux allow for checking things as a non-root user. For example, at any time, I can check whether a service is running:
$ systemctl status ntp
However, the iptables needs to be used as ...
- 1,007
0
votes
1
answer
141
views
From a modular development standpoint, should a "firewall" do anything else than filtering ports?
From a modular development standpoint, should a "firewall" do anything else than filtering ports?
This leads me to further ask, have there been attempts to reform the terminology from "...
0
votes
1
answer
286
views
Should you set up firewall rules with a vpn?
I am using a vpn and trying different firewall rules to keep as secure as possible. But the VPN company itself tells me not to use a firewall. Does that seem reasonable?
They write:
"As we've ...
- 1
4
votes
4
answers
1k
views
Is it good practice to disable firewall rules for vulnerability scanners?
I've been asked to ensure that our vulnerability scanning tools (like Qualys, Nexpose) are able to reach all of our AWS EC2 instances, on all ports and protocols.
Today they are limited by the current ...
0
votes
1
answer
224
views
Suspicious visits to one URL from same user-agent but from unique IPs
For the past few weeks, I am observing a lots of visits from a specific user-agent - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36 ...
- 107
1
vote
1
answer
3k
views
Can a firewall appliance block http requests? [closed]
Is it possible to use a firewall appliance as WAF? To make it more clear, lets think of a model like this:
Internet > router > Firewall > webserver
Can the firewall act as a WAF and block ...
- 21
0
votes
0
answers
132
views
Whitelisting our app to prevent connection blocking?
We publish a Windows desktop app, and while I've run VirusTotal on all of our files with no hits, some security software blocks incoming connections on ports we use, leading to frequent user support ...
- 101
0
votes
0
answers
3k
views
Only allowing WhatsApp traffic through firewalls
Problem:
On our client's ship, we have an expensive backup internet connection. We want the backup connection to only allow WhatsApp traffic. This way we won't be greeted with an extreme bill because ...
- 1
0
votes
0
answers
18
views
A bastion host is a firewall? [duplicate]
I don't understand the difference between a bastion host and a firewall. I think it could be related to the different level of ISO/OSI they work on: a bastion host works on application level (with ...
- 13