Questions tagged [firewalls]

Concerned with software or hardware firewalls

Filter by
Sorted by
Tagged with
4
votes
2answers
106 views

How does a CDN actually prevent DDoS attacks, when an origin server accepts direct connections?

I am trying to understand how a CDN (like Cloudflare e.g) does protect against a DDoS attack. I would think that the internet traffic is routed through a CDN's reverse proxy, then filtered. This ...
0
votes
1answer
39 views

Debating between architecture options for offline updating of Linux machines in a vertically segregated network

My coworker and I are discussing the pros/cons between two potential architecture options, and I would like to gather feedback on which option is better and why. First, a description of the ...
-1
votes
1answer
46 views

threat intelligence gateway [on hold]

A TOG (threat intelligence gateway) is a hardware piece that sits between the router and the firewall. The TIG uses the threat intelligence and filters out the malicious urls and IPs before reaching ...
1
vote
4answers
155 views

Given a set of ports is there one that is more likely to bypass a firewall?

I've been trying to solve a homework question in a beginner infosec class, and I was stumped on an issue and I didn't really know of the right place to ask. If it isn't then please let me know. Given ...
2
votes
0answers
84 views

Non-upgradable usb device against badUSB

Lot of posts about badUSB (here and there) suggest to use a PS/2 connector for mouse and keyboard or to whitelisted USB devices or even use a hardware firewall that only allows whitelisted commands. ...
0
votes
2answers
61 views

firewall behaviour

If a client connects to a server he will start listening for the response on some random high port number. The client then expects any packet destined for that port to be a valid answer. Or does he ...
1
vote
0answers
41 views

'Hard-to-guess' custom header (or similar) to whitelist via a firewall

My organisation is adding a firewall to our test stacks, using AWS WAF. We'd like to whitelist all traffic from the SDKs we've built to facilitate requests between our services. We thought of doing ...
19
votes
3answers
3k views

Why is it called a stateful and a stateless firewall?

I'm just wondering about the naming of these firewall behaviours. My basic understanding is that stateful filtering lets inbound traffic to return the outbound response without explicitly specifying ...
0
votes
1answer
65 views

How to close port 445 (Apple Time Capsule smbd)

My default configuration of Apple Time Capsule has port 445 (Apple Time Capsule smbd) open to the world. Online port scanners (shodan/detectify.com) show me that this. What's a bit worrying is the ...
0
votes
1answer
51 views

Would a firewall contain an explicit allow rule at the top?

Someone in an interview today told me every firewall has two rules: explicit allow at the top and explicit block at the bottom. Form the way I've always understood things firewalls are normally set to ...
0
votes
1answer
35 views

Stateless Firewall configuration and random port number from server

When I was reading about web servers, I came to know that though servers listen to static port (say port 80 for http), immediately after the connection, they assign a different port and thread to ...
-2
votes
1answer
54 views

WAF or Firewall [closed]

I am looking into putting a Firewall in front of our web servers. But we just recently implemented new next-gen firewalls. Does it make sense to put a WAF in front of our web servers as well?
0
votes
1answer
51 views

Even though my firewall is active, is it protecting me fully given that the 'rules' are not active?

Even though my firewall is active, is it protecting me fully given that the 'rules' are not active? Output shows: host based firewall active, empty rules iptables modules loaded, but no rules ...
1
vote
0answers
46 views

Inbound rules for a port is configured and disabled yet an NMap scan shows that the port is opened

I am new to Windows Defender but have read about it to understand the basics of Inbound/Outbound rules. As mentioned on the app, Inbound connections that do not match a rule are simply blocked. For ...
2
votes
1answer
118 views

Can a firewall recognize (and block) outbound traffic that consists of screen shots?

I recently watched this YouTube video about capturing webcam image traffic using Wireshark. Although the technique used in the video is not applicable to my question (because it is about a MITM ...
0
votes
1answer
68 views

Is it possible to DDos a http wan filterd router? [closed]

Like the service is there but it's just filterd enabled for lan access only .. what will happen ?
1
vote
0answers
46 views

Securing a SOCKS5 to SSH Tunnel on Windows

In order to gain web access from the perspective of a remote device, it is very common to use the SOCKS5 to SSH Tunnel capability built into OpenSSH Client and Putty (detailed here). Both clients ...
0
votes
0answers
21 views

How to bypass egress traffic filtering for a reverse shell? [duplicate]

Say I have access to a linux server as non-root user (gained RCE using an exploit), say I am only able to run commands via http in bash/sh but I'm unable the to make the targeted server connect back ...
0
votes
1answer
49 views

Configure Windows Firewall Inbound Rule for Program Not Installed on Server

How can I configure an inbound rule on a Windows Server 2016 firewall to allow access from a program which is not installed on the server? When searching for a program browse is only offered for ...
1
vote
0answers
48 views

apache struts 2 s2-057 does not return shell? [closed]

I do a pentest for a private server protected by Cloudflare. I bypassed the WAF and got the real IP for the server, then I scanned it with Acunetix and I found: Apache Struts2 Remote Command Execution ...
2
votes
0answers
55 views

Secure AWS instance metadata against potential SSRF

I am running a Windows instance on AWS. The instance has an IIS service running on it. The IIS service has a user associated to it and it has no need to access the AWS instance metadata. I was ...
3
votes
2answers
133 views

How do I prevent traffic on my site from a source other than Cloudflare?

I use Google Cloud Platform to serve the site I manage. I have one load balancer there, which controls the movement to several virtual machines. When I came across the problem of DDOS attacks on ...
-1
votes
1answer
75 views

Firewall logs with Local IP contacting local IP over the internet [closed]

I noticed some wierd behavior in our firewall logs: a computer in our subnet 192.168.1.0/24 sending UDP packets in port 161 to an IP in subnet 192.168.20.0 (we don't have a subnet like that), and the ...
0
votes
1answer
116 views

For security purposes, can I use vpn with ufw to allow traffic only from the vpn on ubuntu?

Is this possible? If not through ufw then some other software or iptables? How should I set up the ip tables? Assuming my public ip is known (and I don't want to change it), would it provide complete ...
0
votes
0answers
33 views

Iptables ruleset changes when running a native vpn application

Is it ok for a native linux vpn application (from a famous brand among the vpn providers) changing your iptables ruleset each time the vpn activated? Consider that one of the rules which always ...
1
vote
0answers
114 views

Reverse shell working with kali 2016, but not kali 2019.2, using Metasploit ms08_067_netapi

I have an unpatched Windows XP Home VM, a Kali 2019.2 VM and an old Kali 2016 VM. Using Metasploit's ms08_067_netapi module, I'm able to successfully get a reverse shell but only on the old Kali VM. ...
1
vote
0answers
72 views

Is Windows RPC (port 135) secure enough for domain-wide access

I have a network of approximately 150 computers that I'd like to regularly monitor. My proposed way of doing so involves running remote commands like reg query \\<ip> or systeminfo /S <ip>....
1
vote
1answer
443 views

WebRTC.Local.IP.Addresses.Disclosure

We have Fortigate perimeter firewall and today i detected this event. What should I do to improve protection? How can someone take local IP address' through a Firewall? The following intrusion was ...
0
votes
1answer
65 views

Intercept network traffic with a hub [closed]

If I plugged a hub inbetween a switch and firewall, that also had a device running wireshark or similar capture software connected, due to the way a hub operates, would I be able to read ALL of the ...
0
votes
0answers
52 views

Web Site Access - Port Whitelisting

I am able to access a certain website https://buzzlightyear.acme.com:68080 from within a corporate network (Obviously the default https port 443 has been allowed in the windows firewall of the machine ...
1
vote
1answer
180 views

How to find a website behind a Firewall? [closed]

Some context for my question: I'm currently studying Information Security, and this is for an assignment from my teacher. For my assignment, I received two IP addresses. I did a port scan with nmap ...
-2
votes
1answer
93 views

Firewall can detect suspicious file over HTTPS [duplicate]

A firewall/router can intercept HTTPS traffic, analyse it and detect suspicious file download for example. From my understanding, it is acting as a proxy and/or a MITM device. If it is capable of ...
0
votes
0answers
62 views

IP Encryptor and Firewall

Firewalls implement IPsec VPN and perform packet filtering. IP Encryptor, on the other hand implements IPsec VPN and achieve security goals (confidentiality, integrity and authentication). What are ...
1
vote
1answer
113 views

Separation of devices for VPN / Firewall [closed]

Our company has two separate firewall devices from different vendors (Checkpoint / Cisco) for firewall and VPN access. We're currently evaluating the possibility of migrating to a newer, clustered ...
0
votes
1answer
76 views

Block a file from being accessed over the internet

I keep my client data in a password protected Excel file. For added security, I would like to block access to this file from potential hackers on the Internet. Is it possible to block access to a ...
0
votes
0answers
68 views

Why is Zone Alarm Blocking VMWare Virtual Network Editor?

I have version 15 of VMWare running on my Windows 10 computer. When I open the Virtual Network Editor and try to add a bridged connection, I get an error saying: Cannot change network to bridged: ...
0
votes
0answers
34 views

standards reference to perimeter security

I have the following problematic that I am currently dealing with. I have two zones/perimeters that need to be interconnected, some standards protocols have to be whitelisted such as HTTP, FTP, SSH ...
0
votes
2answers
137 views

Security measures to take upon acquiring a new laptop?

I'm planning on buying a regular HP laptop. However, I'm still a novice when it comes to information security. I'm planning on using this laptop to SOLELY login to my bank accounts and NO OTHER ...
0
votes
4answers
447 views

Is it a bad idea using two firewalls on the same PC?

If i'm using windows default firewall and a third-party firewall, is it represents a security issue or I have to worry just with possible conflicts? And what type of conflicts could exists?
0
votes
2answers
120 views

Security of next generation firewall

In recent years there's been a number of IndieGoGo or KickStarter projects for smart device protection, or next-generation firewalls. Some examples are: Anonabox, Cujo, Dojo, Firewalla, Keezel, ...
1
vote
2answers
184 views

How does TLS traffic impact firewalls?

If I have an open port on a firewall it means that I can receive traffic on that port. If it's unencrypted I assume that the raw data is just allowed through. If TLS is being used, does firewall ...
0
votes
1answer
56 views

Network diagram based on Cisco ACL and other firewall rules [closed]

Are there any tools for automated building network diagram from ACL rules or any other firewall rules?
3
votes
1answer
783 views

Ports Showing Closed/Filtered in Nmap Scans

hopefully this isn't a stupid question.. I am running some nmap scans and I get a list of ports that show closed. Why would they even show in the scan report? Can these be exploited further with other ...
1
vote
1answer
300 views

What is the difference between Anti - APT (Advanced Persistent Threat) and ATP (Advanced Threat Protection)?

Like the question says, is it the naming difference only or are they entirely different?
1
vote
1answer
126 views

Why would my firewall be blocking external source and external destination IP's that I dont own? [closed]

In my Cisco ASA firewall logs I'm seeing events being blocked with an external source IP and a external destination IP. This is happening in the same event log. An example would be: TCP access ...
1
vote
2answers
633 views

Firewalls vs DMZ

What's the difference between Firewalls and DMZs? These terms seem to overlap at time and I'm not clear on the difference. Maybe a DMZ is achieved using firewalls?
0
votes
0answers
62 views

Stopping “phone home” applications in VM with TBB

I have a VM with Linux and the TBB installed on it. What I am trying to do is to make sure that other applications like for example operating system applications cannot "phone home" while I am using ...
-1
votes
1answer
147 views

Detecting and blocking TCP VPN connections that bypasses existing VPN detection software

I help manage a small college campus network and students are not allowed to visit certain sites and download using torrents. Currently I'm able to block UDP VPN connections, but TCP VPN connections ...
0
votes
0answers
205 views

Windows Firewall blocking local access to SQL Server?

I have an AWS virtual machine running a web application on IIS that connects to a SQL Server database (on the same machine). Recently, I have noticed that there are a plethora of failed login attempts ...
0
votes
0answers
71 views

Windows Firewall - How do I know that I have completely blocked a program?

I have a specific software that I cannot let out to the internet but it is crucial that it has access to the local network. I can create an inbound and an outbound Block rule for the main application'...