Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [firewalls]

Concerned with software or hardware firewalls

1
vote
2answers
165 views

How to detect long lived SSH sessioned

I am trying to figure out a way to detect ssh sessions that have been established over a long period of time. I seem to recall that there were ways to detect tcp connections that have been connected ...
0
votes
1answer
69 views

Using an android non-rooted as a wifi adapter

I want to use an android phone as a wifi adapter, and I was wondering if it added security to my connection. The phone has a complicated long password, it also have an app store firewall (noroot ...
5
votes
1answer
15k views

How do I access a firewall log (Windows 10 w. Windows Defender)

I am going through some event logs (in event viewer), and noticed I can't seem to find any firewall logs. Windows Defender provides the firewall. How do I get to the firewall logs that should be ...
0
votes
1answer
1k views

How to block local ip with Windows Firewall?

I want to block a local ip-adress in my network but it doesn't work. My System is Windows 7 and I have a Webserver running on port 8080. Let's say I want to block 192.168.178.10. Not just for port ...
1
vote
1answer
164 views

IDP Explicit FTPS False-Positive - “FTP Cmd Telnet Opcode Evasion”

Having just upgraded our FTP server to enforce Explicit FTP over TLS (on the standard port 21), we are experiencing connections failing sporadically, probably around 50% of the time. It's important to ...
0
votes
1answer
535 views

IPv6 and NAT firewall effect

It seems that people still argue on whether to use NAT with IPv6 for its side-role as a firewall hiding inner network from the outside (providing user anonymity and security as well). I am wondering ...
3
votes
2answers
102 views

Is it safe to log into a virtual private server not owned by me?

What are the dangers of using a virtual private server (VPS) that I do not own? Someone on a mail list offered to let me host my website on his Linux VPS for free, and gave me non-root ssh access ...
3
votes
3answers
559 views

Improve RDP security: router with VPN or IP whitelist on firewall

I am considering to improve the security setting on our workstation shared within the university lab. We are sharing the workstation among lab members with RDP and got compromised recently. I highly ...
1
vote
2answers
356 views

REJECT Nikto Scans With Snort Rules

Hoping someone on here knows a way to reject Nikto traffic with Snort rules. I've been having zero luck for days finding this anywhere online. Thanks. Peace.
0
votes
2answers
223 views

What is an actual hardware firewall? [duplicate]

I have to do a piece of college homework about firewalls and I came across this question, What makes a hardware firewall different from a software one? If I have a corporate network, and I configure ...
0
votes
1answer
338 views

Circuit level gateway vs Dynamic packet filter

What is the difference between a Dynamic (or stateful) packet filter and a Circuit level gateway? Both monitor TCP handshaking between packets to determine whether a requested session is legitimate or ...
1
vote
2answers
599 views

Email Security Gateway vs Firewall [closed]

An email security gateway is an edge device such a router that serves for relaying the external network with the private network. It helps with detecting and blocking spams and phishing emails. That ...
1
vote
0answers
319 views

How secure is my MLab Shared Cluster MongoDB database?

I have deployed a Meteor application to Meteor Galaxy. I've also created an Mlab.com Shared Cluster MongoDB. Link to the plan features. My application has an SSL certificate installed on the domain. ...
1
vote
1answer
419 views

Can a device accidentally transmit a Teardrop attack?

On reviewing the firewall log on my router (supplied by my fibre provider), I noticed a few curious entries. Several teardrop or derivative attacks, I'd expect to see things like this in the log from ...
0
votes
1answer
279 views

How to block an application with iptable which use random port

Scenario: My goal was to allow TeamViewer to connect to my home workstation from my laptop only. So I have tried to bind my laptop's MAC with an IPtables rule as following, [arif@arif:~]$ sudo ...
2
votes
2answers
2k views

Why the Windows Firewall has so many exception rules by default?

Consider the default firewall configuration for Windows 10 Pro (Creators Update). So, in a nutshell: Block inbound connections. Allow oubound connections. 223 inbound exception rules (some of which ...
1
vote
0answers
152 views

Security risks introduced when moving from a three tier to a two tier architecture

I host several .net web applications using a standard three tier architecture with web servers located in a demilitarised zone. I have been asked to host a two tier .net web application where the web ...
0
votes
1answer
3k views

Good Default TCP Connection Timeout Time

I am trying to configure the firewall at our company and I was wondering what a good default TCP connection timeout would be. We currently have it set for 10 minutes but I feel like this is too long ...
1
vote
2answers
538 views

Port forwarding and port blocking security concerns

I am highly concerned about RDP security and about multiple occasions of ransomware infections through RDP, so now I am inspecting possibilities for self-defense against these threats. What interests ...
2
votes
1answer
266 views

How does advanced firewall scan data (check for signature etc) if it is encrypted?

Let's say for normal web browsing, since it's using HTTPS, all the data will be encrypted. In that case, how does the firewall/IDS/IPS check for signatures to detect anomaly/virus/malware?
1
vote
1answer
620 views

Setting up Knockd issues

So i'm busy setting up a knockd service on a VM to enable SSH login when the correct sequence of ports are "knocked on" using knockd and ufw. The issue that I am currently having is that when the ...
0
votes
1answer
408 views

Can firewalls detect and block outgoing by protocol [duplicate]

Or specifically, what can be done to detect or block the following (other than closing port 443)? If this is something that can or cannot be done based on the specific hardware used, please provide ...
2
votes
1answer
363 views

MITM in “Next generation” firewalls becoming a norm? [duplicate]

So I went to a seminar lately and heard about the "SSL inspection" part of Nextgen firewalls. It was basically MITM to be able to monitor the users of the network. Is it becoming a common practice in ...
3
votes
2answers
759 views

Blocking DiagTrack outbound connection after malware infection

I was scammed and I thought those scammers were really from Microsoft so I let them remotely connected to my computer. I don’t know what they installed on it. After I realized that it was a scam, I ...
3
votes
1answer
150 views

How would an external attacker utilise universal plug and play to bypass a firewall?

I'm wondering what strategies and techniques are used to bypass firewalls which have universal plug and play. I'm aware of security issues regarding UPNP in the past but I've also heard that there ...
1
vote
2answers
109 views

Do dynamic certificates for SSL-Interception pose a security risk due to weak entropy?

When you think about typical SSL-Interception in Firewalls, depending on the number of TLS-Connections, loads of Certificates get faked "on the fly" in a very time critical environment. In my ...
5
votes
1answer
327 views

WAF logs show plaintext password and login in a POST header sent via HTTPS

Scenario I was monitoring some events from our web application firewall (WAF), Imperva SecureSphere, when a weird one appeared. Here is the client's POST request: POST some_url HTTP/1.1 Host: ...
2
votes
1answer
477 views

Connection timeout error using HTTP Status Code Checkers on a website [closed]

PROBLEM When I use online tools to test www.bestbuy.com URL's, I get a timeout connection error. By online tools I mean HTTP Status Code Checkers or Redirection Checkers. EXPECTED BEHAVIOUR I ...
2
votes
1answer
611 views

Effective blocking of SMB connections on AsusWRT

I recently was attacked by some cryptolocker (not sure if it's WannaCry) and now I am revising my network policies. For reaching this aim I want to disable all SMB-activity for infected PC. ...
2
votes
2answers
1k views

EternalBlue exploit doesn't work against windows 8

i have tried this poc: https://gist.github.com/worawit/074a27e90a3686506fc586249934a30e against a windows 8 target that i own, the code exits with an error that says: impacket.nmb.NetBIOSTimeout: ...
3
votes
2answers
604 views

Windows firewall settings to receive UDP and pings

I use a windows 10 to receive UDP packets or pings from another computer which runs Win/Mac/Linux. I default, I turn off the firewall to receive pings or packets. I prefer not to turn off the ...
1
vote
0answers
64 views

What happens if we block ICMP from accessing our internal network from the outside? [duplicate]

What are the effects if we block ICMP from outside to the inside network, and what are the impacts on the organization?
0
votes
1answer
120 views

Has there ever been a country that implemented whitelist-based internet censorship?

We hear time and time again of countries censoring internet traffic by blocking IP Ranges. Without getting into the politics of it, let's take for example China's Great Firewall. Even though it is ...
3
votes
5answers
3k views

Question about IDS and IPS

I am studying Security Fundamentals on Networks and as a part of an excercise I have the following question: Which of the following statements are true? (Select all that apply) a.- An IDS deals with ...
0
votes
1answer
113 views

How to implement child protection firewall that cannot be bypassed?

As a guardian, we wish to protect our family especially children from malicious websites. We implemented the following technologies: K9 Symantec client protection But it can be surpassed with ...
1
vote
2answers
250 views

Where am I most vulnerable when running Mac OS 10.6.8 Snow Leopard?

I have a challenge at work, one of our computers is running Mac OS 10.6.8 Snow Leopard. We have legacy software that's required to run the business, and so we have to have it online and on our network....
2
votes
1answer
395 views

Socket closed depending on data. Am I facing an active firewall? (DPI - Deep Packet Inspection)

Following my troubleshooting of making a TLS connection (See: Testing TLS with openssl), it looks like there might be an active firewall in place. The connection on that port works with nc on both ...
9
votes
1answer
299 views

Slash and dash DDOS - what are they trying to do?

I've noticed a curious flood pattern on some of my sites - bots trying to access the page ​"/-​/-​/-​/-​/-​/-​/-​/-​/-​/-​/" on the root domain - that's 11 slashes alternated by 10 dashes. The thing ...
4
votes
1answer
126 views

Using a bastion server: how to model an emergency entrance?

I have set up a bastion server (A) that acts as the only "hallway" to enter a bunch of other private VPS's (B). That is to say: the private machines only accept SSH-connections from (A) on a non-...
9
votes
1answer
1k views

Nmap - Intense vs Quick result

I inherited a small network and currently am assessing its security performance. I started port scanning a host (lets call it Weirdo) in that small network and from my perspective, it seems that that ...
1
vote
0answers
116 views

Securing a private network: how-to [closed]

I have the following setup: Net1 -> Router-net1 (w/firewall) -> Net2 -> firewall -> Internet In Net1 I have several machines I use to run experiments. I would like to minimise the risk of ...
1
vote
0answers
136 views

Bypassing Client firewall restrictions

Lets suppose we have 2 parties A(me) and B(participant). I want to communicate with B but B's firewall restrictions are not allowing me to communicate with him. Is there any way that I can bypass B's ...
1
vote
3answers
369 views

How to secure my network and system setup? [closed]

I have 2 severs and 12 systems (All having UBUNTU) connected to each other over LAN. The 12 systems use multiple databases (Redis/Postgres etc.) hosted on the 2 servers using LAN. Now, I need to ...
5
votes
2answers
8k views

How to directly connect to devices behind NAT from the internet?

We have an IP address on the global internet: "A" We only have access to "A". We have a network behind a router that does NAT: 192.168.1.0/24 There is a client behind that NAT: "B" We don't have ...
3
votes
1answer
340 views

Protecting web site with nginx 301 redirect and HTTP firewall

I am setting up a hobby web site and trying to make it as secure as possible. The backend is nginx + uwsgi. I have set up the HTTPS connection. For non-SSL requests, I have the following rules in ...
2
votes
2answers
390 views

On the days of stateless firewalls, was there any reason for using firewall in the place of router?

The first generation of firewalls was only simple layer 3 device with multiple interfaces and access list applied in/out direction on the interface, during the same era the routers was supporting also ...
1
vote
0answers
46 views

Firewall rulebase analysis offline/vendor agnostic a thing for FISMA/NIST

During design-time before a build-out, I currently create an excel file version of a firewall rulebase (policy) representing source/target/port/protocol/etc definitions before being pushed to the ...
1
vote
1answer
661 views

Can I control network traffic or bandwidth using router? [closed]

That's the question I have access to the Arris router of a lan there are several options like DMZ, UPNP, Firewall and others. I want get a more large bandwidth of my internet for faster download on my ...
1
vote
0answers
162 views

UFW behind modem does not block remote IP

I have a small linux server with fail2ban and UFW installed and configured behind internet gateway modem which ssh port is forwarded to server. The attackers are discovering by fail2ban and added to ...
2
votes
1answer
123 views

Which set of rules is more restrictive when allowing SSH in iptables?

I have seen two set of rules to allow SSH communication: Set A: iptables -A INPUT -p tcp --dport 22 -j ACCEPT iptables -A OUTPUT -p tcp --dport 22 -j ACCEPT Set B: iptables -A INPUT -m state --...