Questions tagged [firewalls]

Concerned with software or hardware firewalls

Filter by
Sorted by
Tagged with
0
votes
0answers
19 views

Meraki Firewall ip_flow_start and ip_flow_end [closed]

Can any one explain me here what is ip_flow_start and ip_flow_end does mean in Meraki firewall logs?
0
votes
0answers
34 views

Need Help for Outbound Communication [closed]

Do we need to raise an alert for outbound communication if traffic is deny or blocked at firewall level?
1
vote
0answers
51 views

Is it possible to bypass .htacess protection?

So, I was involving in one of projects where client site and admin panel/dashboard was hosted on different sites. Not like a lot of CRM`s do or 90% of common sites (just in /admin or other URL ...
1
vote
1answer
66 views

Pfsense security issues?

I have used pfsense before as the main gateway, load balancer, traffic shaping, proxy, firewall, virus/malware protection, enterprise wifi solution for an entire office of 50+ users. Yet I have ...
0
votes
3answers
88 views

Does it make sense to put a firewall within a LAN to protect sensitive information from the rest of the LAN & Internet?

I may not be using the appropriate jargon, but I'll try to explain in my own words. My understanding is that usually a firewall is facing the internet, but my question is about a differnet setup. I'm ...
1
vote
0answers
74 views

Left port 80 exposed, several IPs accessed phpmyadmin

A few days ago while messing around with a web server, I put my server into a DMZ via my router and forgot to disable it. I opened port 80 and 3306 on the server's firewall (Windows Server) to access ...
0
votes
0answers
39 views

Can a firewall duplicate denied traffic onto a TAP/SPAN port? [closed]

We have quite a number of Palo Alto firewalls at various points in our infrastructure, for east-west, north-south, and DMZ traffic, all managed with Panorama. These firewalls have TAP ports which are ...
1
vote
1answer
63 views

Why is a bind shell sometimes blocked when a reverse shell is not?

I understood the difference between them. The problem is I am not sure when to use each. I mean, if a firewall will block my connection to the target when I use bind shell, why the connection will not ...
6
votes
3answers
246 views

Safely use old windows XP machine in business network

I have a client that has a couple of machines that are build to cut kitchen tables. These machines still run on Windows XP and are connected to the internet. Now I need to find a way that these ...
-1
votes
0answers
72 views

Minimum (safest) firewall holes to create to connect to public WiFi networks and use a web browser?

What are the minimum (safest) Windows Firewall holes to make to permit Windows 7-10 computers to connect to public (secured or open) WiFi networks and browse the web with any modern web browser? ...
0
votes
1answer
67 views

How to make VPS more secure with UFW?

I have 3 VPS based on Ubuntu 18.04 server OS and would like to open particular ports on each servers. The ports, that I would like to open are: Then let's take a look on the environment: As you ...
1
vote
3answers
121 views

Understanding firewalls [duplicate]

I would like to understand how firewalls work in details, and understand the attack surface. TCP and UDP I understand that TCP and UDP are easy to filter. Programs on a computer need to ask the OS ...
0
votes
2answers
87 views

Is a firewall needed on a small office that simply needs internet access?

I'm planning on porting all of my office's software needs to cloud services that I can access via internet. It's a simple LAN that has a NAT gateway pointing to the open internet. Would a firewall ...
0
votes
4answers
88 views

Disable Encrypted Protocols Through Firewall

In my company, we have two internal domains with a firewall between them. When requesting firewall rules for an application with components on domain A and domain B, I was told that encrypted ...
0
votes
1answer
53 views

Modifying host file versus firewall

I am trying to protect a macOS computer. Specifically, I want to prevent the machine from making unwanted connections over the internet. I am aware of firewalls of course. But I stumbled upon the idea ...
1
vote
0answers
46 views

Avoiding WAF with DirBuster

I am curious as to how bug hunters / pen testers use DirBuster and GoBuster without getting their IPs banned all the time (which is why I am asking)?
1
vote
0answers
55 views

Is a VPN + Firewall + Authorization Redundant?

I am creating a simple application so a distributed team can access sensitive data. This application will have a database that will be inaccessible to the public internet inside a VPC with my cloud ...
1
vote
1answer
92 views

Alternative to Qubes OS network domain for a server

I know that Qubes Os is not suitable for a server use, but some of its features are quite interesting for that. In fact, all the network drivers are contained in a VM that run a different Linux based ...
1
vote
1answer
52 views

Prevent an application from making any network access on macOS

I want to run an application on macOS, but preventing it from making any type of network access, or any type of internet access. I have seen the following possibilities: Use the built-in firewall. ...
0
votes
1answer
58 views

Is there something like DynDNS for a DNS service?

I run a small DNS server (pihole) at home behind a firewall, with some custom filtering. It mainly filters ads and trackers, plus some top level domains I want to avoid navigating to. I have an IPv4 ...
0
votes
2answers
134 views

Firewall and VPN

Let's suppose i work in a small office and i can't use my workstation to navigate in Facebook because the external firewall forbids it. But i still can use a VPN to bypass the firewall. I read that ...
0
votes
0answers
53 views

Method to bypass \n in WAF (\n vulnerability)

I have this application that has an input box where the data is going to be sent in a JSON format. The JSON payload might look like this {“message”: “hello\nmy name is andi”} But the problem is the ...
1
vote
0answers
40 views

How can access to Intel ME / AMT be disabled with firewall? [duplicate]

Short of flashing BIOS, there seems to be no way to disable the Intel ME. So, is there a reliable way to block access to Intel ME, such using HW firewall (Firewall in front of the machine, not ...
0
votes
0answers
16 views

What is the security justification for blocking all outbound ports/protocols except HTTP over 80/443? [duplicate]

My companies IT blocks all outbound traffic except HTTP, preventing me from getting work done at the office (I often need to work on Azure SQL databases which require TCP over port 1433). I can get ...
0
votes
1answer
182 views

Thought process behind firewall design

I'm preparing for an introductory information security examination in university and this is one of the tutorial questions on Firewall design. My concerns for the provided solution is how to define ...
0
votes
1answer
75 views

Why should I use firewall to block ports with no running services? [duplicate]

A firewall is for blocking / limiting access to specific service / port. I know that it can be useful for allowing only certain IPs to a port (for example I don't want to have SSH open for the whole ...
0
votes
1answer
196 views

Purpose of Decrypting & Scanning HTTPS traffic

Navigating to the below URL link from the Mozilla Firefox and entering some website link and clicking on View, displays certificate Viewer chrome://pippki/content/exceptionDialog.xul After enabling ...
0
votes
0answers
42 views

How does the Great Firewall of China handle TLS encryption? [duplicate]

My understanding is that when a client and server are connected through TLS, only they have the key needed to encrypt and decrypt messages. My question is, given that the Great Firewall of China does ...
2
votes
0answers
38 views

Can NAT Table be vulnerable toward any poisoning attacks?

I am learning the general concept of network security, and becomes aware of two poisoning attacks on the network infrastructures, that is, DNS poisoning attacks and ARP poisoning attacks. They are ...
0
votes
1answer
160 views

Allow only YouTube videos and block other videos

I have a MikroTik router. I want to allow only Youtube videos and block all other videos. I tried to write an extended ACL but I really have no idea. Maybe allow only Youtube videos source URL and ...
1
vote
1answer
65 views

Why am I receiving hits with SPT=443 on IPv6?

I block most everything with my firewall, what I don't get is why would I constantly receive hits to connect on random ports from port 443. [iptables] reject_ipv6: IN=eno1 OUT= MAC=... SRC=2607:...
2
votes
1answer
91 views

Can a VPN provider or actors within its infrastructure access open ports on the client machine?

From my understanding of a VPN, it essentially creates a network between the two 'machines'. So if I have open ports (e.g. HTTP, SSH) on my client machine, those can be accessed by the VPN provider or ...
0
votes
0answers
38 views

End to End Encrypted Traffic - Web Application Firewall needed?

Background We have a Java Spring Server, MongoDB and an Angular Frontend. Some Application Security Configs: TLS Basic Authentication (Password Strength Policy) XSS Protection (Content Security ...
0
votes
0answers
38 views

Actions after identifying exploitation attempts on servers or applications

I am seeing regular exploitation attempts (like remote code execution, sql injection, etc.) on our DMZ server or applications and these are being dropped by the firewall. However, our SIEM is raising ...
0
votes
0answers
31 views

How can I give a network load balancer (of any type) access to a port on a machine without opening that port to an entire VPC?

Is it possible to make an AWS load balancer for a non-HTTP port allowed to access a specific port on a host without opening that port open to the entire VPC's subnet? I seem to remember reading that ...
2
votes
1answer
417 views

Does blocking all ports make a machine more secure?

I have a machine that I use only to browse the Internet. What if I blocked all ports on this machine (inbound and outbound) except for port 80 and port 443, and restricted these two ports to an ...
6
votes
2answers
194 views

How does a CDN actually prevent DDoS attacks, when an origin server accepts direct connections?

I am trying to understand how a CDN (like Cloudflare e.g) does protect against a DDoS attack. I would think that the internet traffic is routed through a CDN's reverse proxy, then filtered. This ...
0
votes
1answer
39 views

Debating between architecture options for offline updating of Linux machines in a vertically segregated network

My coworker and I are discussing the pros/cons between two potential architecture options, and I would like to gather feedback on which option is better and why. First, a description of the ...
-1
votes
1answer
52 views

threat intelligence gateway [closed]

A TOG (threat intelligence gateway) is a hardware piece that sits between the router and the firewall. The TIG uses the threat intelligence and filters out the malicious urls and IPs before reaching ...
1
vote
4answers
175 views

Given a set of ports is there one that is more likely to bypass a firewall?

I've been trying to solve a homework question in a beginner infosec class, and I was stumped on an issue and I didn't really know of the right place to ask. If it isn't then please let me know. Given ...
2
votes
1answer
147 views

Non-upgradable usb device against badUSB

Lot of posts about badUSB (here and there) suggest to use a PS/2 connector for mouse and keyboard or to whitelisted USB devices or even use a hardware firewall that only allows whitelisted commands. ...
0
votes
2answers
70 views

firewall behaviour

If a client connects to a server he will start listening for the response on some random high port number. The client then expects any packet destined for that port to be a valid answer. Or does he ...
1
vote
0answers
43 views

'Hard-to-guess' custom header (or similar) to whitelist via a firewall

My organisation is adding a firewall to our test stacks, using AWS WAF. We'd like to whitelist all traffic from the SDKs we've built to facilitate requests between our services. We thought of doing ...
20
votes
3answers
4k views

Why is it called a stateful and a stateless firewall?

I'm just wondering about the naming of these firewall behaviours. My basic understanding is that stateful filtering lets inbound traffic to return the outbound response without explicitly specifying ...
0
votes
1answer
98 views

How to close port 445 (Apple Time Capsule smbd)

My default configuration of Apple Time Capsule has port 445 (Apple Time Capsule smbd) open to the world. Online port scanners (shodan/detectify.com) show me that this. What's a bit worrying is the ...
-1
votes
1answer
85 views

Would a firewall contain an explicit allow rule at the top?

Someone in an interview today told me every firewall has two rules: explicit allow at the top and explicit block at the bottom. Form the way I've always understood things firewalls are normally set to ...
0
votes
1answer
42 views

Stateless Firewall configuration and random port number from server

When I was reading about web servers, I came to know that though servers listen to static port (say port 80 for http), immediately after the connection, they assign a different port and thread to ...
-2
votes
1answer
56 views

WAF or Firewall [closed]

I am looking into putting a Firewall in front of our web servers. But we just recently implemented new next-gen firewalls. Does it make sense to put a WAF in front of our web servers as well?
0
votes
1answer
59 views

Even though my firewall is active, is it protecting me fully given that the 'rules' are not active?

Even though my firewall is active, is it protecting me fully given that the 'rules' are not active? Output shows: host based firewall active, empty rules iptables modules loaded, but no rules ...
1
vote
0answers
56 views

Inbound rules for a port is configured and disabled yet an NMap scan shows that the port is opened

I am new to Windows Defender but have read about it to understand the basics of Inbound/Outbound rules. As mentioned on the app, Inbound connections that do not match a rule are simply blocked. For ...

1 2 3 4 5 21