Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [firewalls]

Concerned with software or hardware firewalls

0
votes
1answer
117 views

What is the iptables rule to block all https traffic except to a single ip?

I'm trying to configure a microservice for my web application, which is hosted at ip address X.X.X.X. The microservice should only accept https connections from this web app. I've tested the ...
5
votes
4answers
2k views

Can websites access computers in LAN/Localhost through browser & how to block them? [duplicate]

Question 1: While browsing internet, can websites execute code through my browser that access websites or services that are hosted on Localhost or LAN? Question 2: Also, can data from intranet ...
1
vote
1answer
44 views

Port filtering for Ubuntu-Nginx minimal server environment

I've established a minimal, uncustomized LEMP stack (Ubuntu 16.04). The only server I have besides Nginx is Postfix. To protect that environment I filtered all ports besides a few, this way: ufw ...
2
votes
2answers
2k views

IPv4, IPv6 and firewall

Say I have a server running some version of Linux and I give this server an IPv4 address of 10.1.1.1 Now using my network firewall I NAT this IP to some public IP address and I block all incoming ...
0
votes
1answer
281 views

Why won't ossec block SSH connections when it seems to be configured correctly?

Why won't ossec block connections from another server? I installed ossec version 2.9.3 on Ubuntu 16.04. In the ossec.conf file I have these lines where x.x.x.x is the IP address of a second Linux ...
0
votes
2answers
265 views

Should I keep incoming data UDP ports open in a minimal server environment?

I have a minimal, uncustomized Ubuntu 16.04 xenial Nginx server environment with only these incoming data TCP ports unfiltered: 22, 80, 443, 9000 When reviewing /etc/csf/csf.conf I found out that ...
0
votes
1answer
274 views

How can I disable logging for specific rule in pfsense

I would like to prevent pfsense logging of the block for the rule below: Rule: 'Block ULA networks from WAN' Source: my_router_ip:specific_port Dest: ip:1900 Protocol: UDP Even though I have ...
-1
votes
2answers
321 views

What is and how good is an ISP-provided antivirus?

Today I had my Internet provider to install Internet Fiber at my place. I've been asked whether I wanted the antivirus service. I am aware you can (and should) install an antivirus on your computer. ...
4
votes
1answer
996 views

How SSH Deep Inspection works?

I just saw an option in Fortinet NGFW regarding, SSH Deep Inspection. So my question is how Deep inspection or whatever can inspect or find any malicious activity on encrypted packets?
-2
votes
2answers
111 views

Finding websites protected by Web Application Firewalls

I've been doing research on web application firewalls. But of course, finding the firewalls is the hardest part of this so far. Is there a simple way (like a list or something) to finding a website ...
2
votes
2answers
465 views

How to stop people from bypassing firewall blocks by using Google cache?

I'm using a physical Stormshield Firewall to control connections of a private companies. There are rules to block some websites, like video games websites, Facebook, etc. However, these websites can ...
0
votes
2answers
123 views

Antivirus vs Firewall with Antivirus

I would like to know from an information security respect, is antivirus software needed to be separate from the firewall? In my company, they have a Palo Alto firewall and they mention that it is a ...
0
votes
0answers
166 views

Why allow HTTPS but not SSH?

I few companies I've worked for have allowed HTTPS, but not SSH. Why would HTTPS be considered safe, but SSH not be?
-2
votes
1answer
60 views

Trying to detect a firewall

I have some HTML that was detected by one of my scripts firewall detections, it looks like this: <!--- HTTP 1.1 Status Code: 403 HTTP Headers: {'Content-Length': '1233', 'X-Powered-By': 'ASP.NET', ...
1
vote
2answers
346 views

Why is spoofing allowed in reputed VPS services?

I just learned about IP spoofing and so I set up VMs and sent spoofed UDP packets (8.8.8.8, Facebook's IP, Twitter's IP) to myself (home PC and mobile) from well-reputed VPS providers like AWS, ...
4
votes
2answers
1k views

What is the difference between an anti-virus and an IPS?

As I understand it, an intrusion protection system (IPS) detects anomalous behavior, does detection of protocol anomalies, and does signature filtering that blocks malware, DDoS, etc. An antivirus ...
2
votes
0answers
85 views

Secure IoT device against remote access [closed]

I'm developing an IoT device (a Raspberry Pi) that will be connected to the internet. It's users won't necessarily be comfortable with deploying updates, so I plan to make it as secure as possible ...
97
votes
5answers
29k views

Someone is trying to brute-force(?) my private mail server… very… slowly… and with changing IPs

This has been going on for about 1-2 days now: heinzi@guybrush:~$ less /var/log/mail.log | grep '^Nov 27 .* postfix/submission.* warning' [...] Nov 27 03:36:16 guybrush postfix/submission/smtpd[7523]:...
1
vote
3answers
1k views

Blocking ipv6 packets with firewall, if using an ipv4 router

A router doesn't support ipv6. There is a machine connected to the router, that is assigned an ipv4 address by the router. The machine uses firewall software. Setting up the machine's firewall, all ...
17
votes
1answer
4k views

Cybersecurity “Airport model”

For the last few months, I have heard about a next generation model of Cybersecurity called the "Airport model." Does anyone have more information about it?
72
votes
8answers
12k views

If we are behind a firewall, do we still need to patch/fix vulnerabilities?

I have recently joined a security focused community in my organisation. Many of our products are deployed in the intranet (on-premise) nothing in the public cloud. So, the internal portals can be ...
1
vote
2answers
551 views

Does avira firewall need to be enabled along with comodo firewall?

I'm currently using Comodo Firewall along with Avira antivirus. The new update for Avira also includes the firewall with the free plan and its enabled by default. Do I need to enable both on my ...
1
vote
1answer
910 views

Port scans: 'traffic denied' VS 'close - age out'

I have been investigating logs from the firewall (Juniper) and I've found out that when someone is portscanning my website, the majority of the traffic through different tcp/udp ports is denied (...
0
votes
1answer
971 views

how block all subdomains for a particular domain

I want to block all traffic to and from my network to a particular domain. Apparently, this is not possible in Windows, with either a HOSTS file or using firewall rules: the HOSTS file requires every ...
-1
votes
1answer
42 views

How to connect to external address as other outgoing port number without proxy [closed]

Is it possible to (mask / define) outgoing port locally on network without using a proxy? default (outgoing protocol) [address] [port] set to (outgoing protocol) [address] [selected port] There ...
2
votes
1answer
798 views

Suspcious timing of [LAN access from remote] in router log

I read that [LAN access from remote] to UPnP ports can be an attacker looking for vulnerabilities, and is usually nothing to worry about. However I'm concerned seeing this activity in a log so close ...
1
vote
1answer
124 views

File transfer secure from a network security perspective

Let's assume a simple network with a (Windows) server and a (Windows) workstation. Turns out the question of how to securely transfer files between the two isn't obvious considering: I define secure ...
-1
votes
1answer
400 views

How can adding a line to your hosts file bypass a server side firewall?

In this SQLi blog the author says that to bypass a firewall at the server side you should add this line to your /etc/hosts file: 54.165.170.2 www.example.com But doing so will only block my ...
0
votes
1answer
251 views

Ability to get a MAC address and IPv6 through proxy servers

Now I'm pretty sure I know the answer to this question, but I am just curious to see what the security experts of the world think of this. First a little back story: I was a former member of a ...
1
vote
1answer
131 views

Cyberroam Firewall

In my University, the network is protected by Cyberroam Firewall and we are provided a login page through which we access internet and the login page isn't secured.It sends out the userid and password ...
2
votes
0answers
96 views

The way for not disabling the firewall in windows

I have been doing this for about a year without knowing the purposes of disabling. Whenever i tried to ping/connected to my host VM via guest VM, i have to disable my host VM's firewall, but does it ...
6
votes
1answer
124 views

Do anti-XSS rules of Web Application Firewall break business logic?

I've read about Web Application Firewalls in a MOOC, and the provided example is that the WAF can filter out a request like ?user=<script to avoid potential XSS attacks. But what if a webpage of ...
0
votes
2answers
43 views

device not recognized in network

On my windows 8 Computer I sometimes can see a device in the network view , which I can't identify as one of mine. See following screenshot: For me this looks like a network breach. How can I analyse ...
1
vote
1answer
657 views

nmap results after evading firewall

I've done an nmap scan on my server with an F5 firewall protecting it. I used the nmap command nmap -vvv -f -Pn -mtu 8 -sN -oN nmap-results.txt 192.168.22.102 I had this result but it seems ...
1
vote
2answers
122 views

Is it dangerous to have unused Windows 10 Defender Firewall rules active?

I recently discovered that a bunch of games I've installed in the past (from legit sources) have activated many Windows Defender firewall rules viewable from wf.msc. Some of the games I have since ...
0
votes
0answers
95 views

nmap and zone based firewall dropping probes

I am working on a project that requires me to scan some list of systems. Usually during these projects, we ask clients to allow some of the IP's where scans will originate from so we do not get issues ...
3
votes
1answer
319 views

Reverse shell on a web server behind Netscaler

How possible is it for a reverse shell to connect back to the attacker if the vulnerable web server only has Http ports open like 80 and 443 through the Netscaler behind the perimeter firewall? ...
0
votes
1answer
314 views

Can iptables be hacked / circumvented

We currently have a server that blocks all connections using iptables, and we have to whitelist an IP expressly in order to be able to access the server remotely. Essentially, the first rule allows ...
7
votes
2answers
335 views

What happens if my VPN drops momentarily while using an SSL connection?

The Situation I am in an office with a connection that is routed through a BigIP firewall, with SSL interception; our computers have a root certificate to permit the intercept certs. If I browse to a ...
0
votes
1answer
202 views

Are there open by default ports with Centos 7's firewalld?

My Centos7 firewalld has TCP ports 8083, 8086, and 5000 open. I don't recall opening them, except for maybe 5000 when first learning about firewalld. Are there any ports that might come out of the ...
0
votes
1answer
254 views

Would an RP3 do well as a firewall appliance?

I have seen this post about the Raspberry Pi for use as an IDS. But how well would it do as a firewall appliance in a residential setting? I will soon be setting up a new network and want to exercise ...
1
vote
1answer
47 views

Could point to point firewall connection rules prevent MiTM

I have a linux run as firewall between my PC and the Internet router. Now, if my Windows PC is infected with Banking Trojan that will eavesdropping any online banking activities and redirect ...
1
vote
1answer
292 views

have opened HTTPS port but still no response [closed]

I have watchguard firewall and server behind it configured with NAT. I was told to open port https for 1 of the server. I have create a rule from any to the NAT server to allow port 443, the ...
4
votes
1answer
2k views

The Shadow Server Foundation constantly trying to get access to mDNSResponder

Update September 2018: The events described below still happen to this day though less often from servers of The Shadow Server Foundation. By now I have denied access to most of their IP addresses, ...
2
votes
1answer
228 views

Iptables DROPS SSH after port knock rules, but nmap shows it as OPEN

I setup port knocking rules on CentOS 7, iptables as follow: -I INPUT -p tcp --dport 1 -m recent --set --rsource --name KNOCK1 -m limit --limit 5/min -j LOG --log-prefix "knock 1" --log-level 7 -I ...
3
votes
3answers
282 views

How to prevent users from downloading executable files or portable apps?

Is it possible to prevent executables or portable apps from being downloaded in a corporate environment on the network layer? (i.e not some agent on a host preventing it) Would this require MITM SSL ...
3
votes
3answers
1k views

How can someone access my computer (“hack me”) when my firewall is off?

Why do people go crazy when the firewall if off? Most sites on the internet say its very dangerous to turn off your firewall and I want to understand why. For example Microsoft says this: You ...
0
votes
1answer
78 views

Are there any open source firewalls for a VPN server? [closed]

I provide free VPN access to a lot of people and often times have troubles dealing with abuse reports from stupid stuff like network scanning. I have been researching for hours now, but I am ...
0
votes
1answer
393 views

Communicating routed interfaces for Cisco ASA 5506-X [closed]

Recently our organisation has been supplied a new ASA 5506-X to replace the old good PIX506e for a project. We have encountered a problem on routed interface on ASA 5506, which is very different from ...
0
votes
1answer
129 views

How to Determine Malware Outbound Traffic?

My aim is to tighten the firewall on my AD domain PC running Windows 10. Even though Windows firewall is already turned ON - I am not confident that it is blocking malware outbound traffic What is an ...