Questions tagged [firewalls]

Concerned with software or hardware firewalls

Filter by
Sorted by
Tagged with
1
vote
2answers
623 views

Port forwarding and port blocking security concerns

I am highly concerned about RDP security and about multiple occasions of ransomware infections through RDP, so now I am inspecting possibilities for self-defense against these threats. What interests ...
2
votes
1answer
309 views

How does advanced firewall scan data (check for signature etc) if it is encrypted?

Let's say for normal web browsing, since it's using HTTPS, all the data will be encrypted. In that case, how does the firewall/IDS/IPS check for signatures to detect anomaly/virus/malware?
1
vote
1answer
753 views

Setting up Knockd issues

So i'm busy setting up a knockd service on a VM to enable SSH login when the correct sequence of ports are "knocked on" using knockd and ufw. The issue that I am currently having is that when the ...
0
votes
1answer
549 views

Can firewalls detect and block outgoing by protocol [duplicate]

Or specifically, what can be done to detect or block the following (other than closing port 443)? If this is something that can or cannot be done based on the specific hardware used, please provide ...
2
votes
1answer
504 views

MITM in “Next generation” firewalls becoming a norm? [duplicate]

So I went to a seminar lately and heard about the "SSL inspection" part of Nextgen firewalls. It was basically MITM to be able to monitor the users of the network. Is it becoming a common practice in ...
2
votes
2answers
945 views

Blocking DiagTrack outbound connection after malware infection

I was scammed and I thought those scammers were really from Microsoft so I let them remotely connected to my computer. I don’t know what they installed on it. After I realized that it was a scam, I ...
3
votes
1answer
175 views

How would an external attacker utilise universal plug and play to bypass a firewall?

I'm wondering what strategies and techniques are used to bypass firewalls which have universal plug and play. I'm aware of security issues regarding UPNP in the past but I've also heard that there ...
1
vote
2answers
117 views

Do dynamic certificates for SSL-Interception pose a security risk due to weak entropy?

When you think about typical SSL-Interception in Firewalls, depending on the number of TLS-Connections, loads of Certificates get faked "on the fly" in a very time critical environment. In my ...
5
votes
1answer
420 views

WAF logs show plaintext password and login in a POST header sent via HTTPS

Scenario I was monitoring some events from our web application firewall (WAF), Imperva SecureSphere, when a weird one appeared. Here is the client's POST request: POST some_url HTTP/1.1 Host: ...
2
votes
1answer
524 views

Connection timeout error using HTTP Status Code Checkers on a website [closed]

PROBLEM When I use online tools to test www.bestbuy.com URL's, I get a timeout connection error. By online tools I mean HTTP Status Code Checkers or Redirection Checkers. EXPECTED BEHAVIOUR I ...
2
votes
1answer
734 views

Effective blocking of SMB connections on AsusWRT

I recently was attacked by some cryptolocker (not sure if it's WannaCry) and now I am revising my network policies. For reaching this aim I want to disable all SMB-activity for infected PC. ...
2
votes
2answers
2k views

EternalBlue exploit doesn't work against windows 8

i have tried this poc: https://gist.github.com/worawit/074a27e90a3686506fc586249934a30e against a windows 8 target that i own, the code exits with an error that says: impacket.nmb.NetBIOSTimeout: ...
3
votes
2answers
2k views

Windows firewall settings to receive UDP and pings

I use a windows 10 to receive UDP packets or pings from another computer which runs Win/Mac/Linux. I default, I turn off the firewall to receive pings or packets. I prefer not to turn off the ...
1
vote
0answers
70 views

What happens if we block ICMP from accessing our internal network from the outside? [duplicate]

What are the effects if we block ICMP from outside to the inside network, and what are the impacts on the organization?
0
votes
1answer
130 views

Has there ever been a country that implemented whitelist-based internet censorship?

We hear time and time again of countries censoring internet traffic by blocking IP Ranges. Without getting into the politics of it, let's take for example China's Great Firewall. Even though it is ...
3
votes
5answers
6k views

Question about IDS and IPS

I am studying Security Fundamentals on Networks and as a part of an excercise I have the following question: Which of the following statements are true? (Select all that apply) a.- An IDS deals with ...
0
votes
1answer
130 views

How to implement child protection firewall that cannot be bypassed?

As a guardian, we wish to protect our family especially children from malicious websites. We implemented the following technologies: K9 Symantec client protection But it can be surpassed with ...
1
vote
2answers
291 views

Where am I most vulnerable when running Mac OS 10.6.8 Snow Leopard?

I have a challenge at work, one of our computers is running Mac OS 10.6.8 Snow Leopard. We have legacy software that's required to run the business, and so we have to have it online and on our network....
2
votes
1answer
690 views

Socket closed depending on data. Am I facing an active firewall? (DPI - Deep Packet Inspection)

Following my troubleshooting of making a TLS connection (See: Testing TLS with openssl), it looks like there might be an active firewall in place. The connection on that port works with nc on both ...
9
votes
1answer
303 views

Slash and dash DDOS - what are they trying to do?

I've noticed a curious flood pattern on some of my sites - bots trying to access the page ​"/-​/-​/-​/-​/-​/-​/-​/-​/-​/-​/" on the root domain - that's 11 slashes alternated by 10 dashes. The thing ...
4
votes
1answer
145 views

Using a bastion server: how to model an emergency entrance?

I have set up a bastion server (A) that acts as the only "hallway" to enter a bunch of other private VPS's (B). That is to say: the private machines only accept SSH-connections from (A) on a non-...
8
votes
1answer
2k views

Nmap - Intense vs Quick result

I inherited a small network and currently am assessing its security performance. I started port scanning a host (lets call it Weirdo) in that small network and from my perspective, it seems that that ...
1
vote
0answers
120 views

Securing a private network: how-to [closed]

I have the following setup: Net1 -> Router-net1 (w/firewall) -> Net2 -> firewall -> Internet In Net1 I have several machines I use to run experiments. I would like to minimise the risk of ...
1
vote
0answers
151 views

Bypassing Client firewall restrictions

Lets suppose we have 2 parties A(me) and B(participant). I want to communicate with B but B's firewall restrictions are not allowing me to communicate with him. Is there any way that I can bypass B's ...
1
vote
3answers
376 views

How to secure my network and system setup? [closed]

I have 2 severs and 12 systems (All having UBUNTU) connected to each other over LAN. The 12 systems use multiple databases (Redis/Postgres etc.) hosted on the 2 servers using LAN. Now, I need to ...
6
votes
2answers
12k views

How to directly connect to devices behind NAT from the internet?

We have an IP address on the global internet: "A" We only have access to "A". We have a network behind a router that does NAT: 192.168.1.0/24 There is a client behind that NAT: "B" We don't have ...
3
votes
1answer
401 views

Protecting web site with nginx 301 redirect and HTTP firewall

I am setting up a hobby web site and trying to make it as secure as possible. The backend is nginx + uwsgi. I have set up the HTTPS connection. For non-SSL requests, I have the following rules in ...
2
votes
2answers
498 views

On the days of stateless firewalls, was there any reason for using firewall in the place of router?

The first generation of firewalls was only simple layer 3 device with multiple interfaces and access list applied in/out direction on the interface, during the same era the routers was supporting also ...
1
vote
0answers
46 views

Firewall rulebase analysis offline/vendor agnostic a thing for FISMA/NIST

During design-time before a build-out, I currently create an excel file version of a firewall rulebase (policy) representing source/target/port/protocol/etc definitions before being pushed to the ...
1
vote
1answer
797 views

Can I control network traffic or bandwidth using router? [closed]

That's the question I have access to the Arris router of a lan there are several options like DMZ, UPNP, Firewall and others. I want get a more large bandwidth of my internet for faster download on my ...
1
vote
0answers
207 views

UFW behind modem does not block remote IP

I have a small linux server with fail2ban and UFW installed and configured behind internet gateway modem which ssh port is forwarded to server. The attackers are discovering by fail2ban and added to ...
2
votes
1answer
147 views

Which set of rules is more restrictive when allowing SSH in iptables?

I have seen two set of rules to allow SSH communication: Set A: iptables -A INPUT -p tcp --dport 22 -j ACCEPT iptables -A OUTPUT -p tcp --dport 22 -j ACCEPT Set B: iptables -A INPUT -m state --...
1
vote
3answers
132 views

How to prevent DDoS to cause stored data inconveniences?

Let's assume there are no vulnerabilities in the application layer, one disk, and no physical firewall (just iptables rules in the server itself), hence in this case all the DDoS attack does is to ...
2
votes
1answer
204 views

Fixing an OpenSSL vulnerability at the firewall

We did a Qualys test on two of our URLs earlier today. The URLs are of two similar applications (same versions) hosted on identical servers located at two different datacenters. The test returned 'A-' ...
2
votes
2answers
3k views

MAC filtering the internet traffic?

I was trying to build a firewall where in the access to my LAN from internet should be allowed only if it matches the predefined MAC address of the device i.e,. MAC filtering, but later i found out ...
1
vote
1answer
147 views

nmap - protocol discovery doesn't work with fragmented packets

Using nmap to do a protocol discovery (nmap myhost -sO) identifies the following on my target. Note reason switch is also used. PROTOCOL STATE SERVICE REASON 1 open icmp echo-reply ttl ...
1
vote
1answer
121 views

Can any web proxies differentiate between JScript and Javascript files?

Its a relatively common best practice to filter executables and scripts from a standard user at the proxy/gateway level in corporate environment. While EXE/BAT/CMD files are easy enough, and arguably ....
2
votes
1answer
272 views

What is UDP port 56183

We seen suspicious probing from source port 53 to destination port 56183. May I know what services use port 56183 (udp)?
0
votes
2answers
466 views

Are there any PCI compliant firewalls that can be installed on Linux through normal means and not through an ISO? [closed]

We are trying to install a PCI compliant firewall on our Azure Vnet. The problem is, that ones like opnsense can only be installed through an iso, having to install it on a local VM and then having to ...
2
votes
2answers
103 views

What methods could be used to host on an infected machine?

Assuming the following: a computer is compromised and connected to a network where a simple wireless router or modem is the only form of firewall security all incoming connections are blocked by ...
2
votes
0answers
64 views

WiFi access points blocking VPN [duplicate]

I've been travelling for awhile and used a lot of Wifi access point lately. Several times my attempts to connect with VPN has been blocked (especially when using a "famous" one), and I've also noticed ...
0
votes
1answer
4k views

Difference between stateful and stateless firewall filters

Stateful filters keep a "list" of already established connections, and if the connection is being established, what step of the TCP handshake we are on (SYN, SYN ACK etc.). Stateful is supposed better ...
1
vote
1answer
327 views

How application-level stateful firewall impacts network performance

For the "application-level stateful firewall", I mean: the firewall inspects the application-layer payload (e.g. deep packet inspection), memorize the status using some parameters, and store it in ...
1
vote
3answers
665 views

Windows firewall blocking of a dynamically generated .exe

If I block application A.exe on my firewall, but it dynamically generates B.exe and runs it automatically. Would B.exe also be blocked on my firewall?
1
vote
0answers
1k views

Different filtering techniques with internal and external firewall?

First of all, lets get the basic information sorted out. Just in case I have it mixed up. There is an external Firewall - Router (or some such device), and there is an internal Firewall (an ...
0
votes
2answers
864 views

Firewall is blocking invalid URLs, what is the danger?

My Fortinet firewall seems to be blocking invalid URLs (for example, URLs that it considers invalid, which means that underscores are not accepted, even though some sites use them). This causes some ...
1
vote
3answers
485 views

boundary firewall cyber essentials question

I have been going through the cyber essentials questionnaire and this one question is confusing me and I wondered if you could provide any insight into it for me. in one of the 5 sections 'Boundary ...
3
votes
2answers
4k views

Block outgoing network traffic from “Smart” TV

The FTC has just settled a case with Vizio, saying that the company has been quietly capturing pixels from their smart TVs, matching those pixels to databases of content, and selling that information (...
1
vote
1answer
154 views

What security issues are there with remote access for firewalls, routers, etc.?

I am currently looking into cybersecurity for small businesses and it is something I have become very interested in. One of the questions in the questionnaire is: Confirm that any remote ...
1
vote
2answers
2k views

Are there risks to allowing cURL from my machine?

I currently have several update scripts that I run periodically, which use curl to pull and install updates from various places. In my current configuration however, I have curl blocked by my firewall,...