Questions tagged [firewalls]

Concerned with software or hardware firewalls

Filter by
Sorted by
Tagged with
2
votes
2answers
245 views

How are stateless firewalls useful in public cloud platforms?

I'm trying to understand the value of stateless firewalls in public cloud platforms like Network Access Control Lists (NACL) in Amazon Web Services (AWS). I think I know a few ways I can use them, but ...
3
votes
2answers
473 views

How IDS and Firewall Logs are aggregated and feed aggregated log to SIEM?

I am studying SIEM tools. Firewall logs will be different from IDS logs and even from Antivirus logs. How can log aggregation take place?
1
vote
2answers
136 views

Can an ISP limit what security software (firewall) that will work?

My ISP (JCOM) says that McAfee is the only security software that will work with them. Is that true? The system is running Windows 7 Home Premium Japanese Version. The McAfee system is provided by ...
1
vote
1answer
258 views

Being connected to a trusted VPN, do I still need personal firewall, and if so, why?

Background Hardware: Dell Inspiron 15 Gaming 7577-92774 with recent BIOS (16-Aug-2018) Operating System: Windows 10 Pro, version 1803 (Build 17134.285) Antivirus / Firewall: ESET Smart Security ...
0
votes
2answers
108 views

Have firewall and VPN already, should I buy a mini router to protect my laptop?

I often travel for business and use hotel wifi. I have installed Little Snitch and VPN-Outline for internet security. Should I buy a mini router? Will it keep my computer safer? Otherwise,with or ...
67
votes
5answers
10k views

Advised to block all traffic to/from specific IP addresses

My CFO received an email from a director at a financial institution advising that all traffic (inbound and outbound) from certain IP addresses should be blocked at the firewall. The director at the ...
-1
votes
1answer
343 views

What are the Pros & Cons of VPN server behind or in front of firewall? [closed]

What are the pros and cons of a VPN server behind or in front of the firewall? There seems to be no right or wrong in either option. An example of the VPN server in front of the firewall:
0
votes
1answer
827 views

Is it advisable to accept STUN server connections?

My firewall reports outgoing connection attempts via com.apple.WebKit.Networking to a number of STUN servers (namely, stun.nas.net, stun.node4.co.uk, stun.voxox.com and stun.wwdl.net). This is ...
-2
votes
2answers
252 views

Why is DDOS is one of the most common Cyber-Attack? [closed]

Based on some articles and some research DDOS is one of the most common cyber-attack. There are tonnes of articles out there about the DDOS subject, including describing, mitigating, the question "...
1
vote
2answers
80 views

Do I need Gateway Firewall for IoT network? [closed]

Do I need a gateway firewall to prevent attacks like DoS, if my IoT network can only talk to cloud using IPsec? Even if there is need that can be implemented at cloud. Is there any need for it to ...
1
vote
2answers
144 views

Am I being Hacked? So many defferent ip's in router firewall logs [duplicate]

My router dsl light was not stable; It keept disconnecting and connecting..So I logged into Router Homepage to check whats wrong and found there were so many different ip's in Router firewall logs I ...
0
votes
3answers
612 views

Is It More Secure to Use Firewalls from Two Different Vendors?

The topic is "Is It More Secure to Use Firewalls from Two Different Vendors " Is not much safer using a multi-vendor firewall because "More than 95% of firewall breaches are caused by firewall ...
1
vote
1answer
202 views

The role of Machine Learning In Cybersecurity Defense [closed]

Hackers and malware are one step ahead of cybersecurity experts, and every time technology is released to the market, vulnerabilities will be quickly discovered and exploited. How effective can ...
0
votes
1answer
702 views

Root CA or Intermediate CA in firewall trust store

I am implementing a PKI for a test environment and have everything just about configured. The architecture consists of a Root CA, two issuing (intermediate CAs), and clients. Client certificates and ...
2
votes
2answers
92 views

Network provider blocking URL, even though connection made to IP

I came across an interesting case today, which with my limited knowledge I'm unable to understand the working of. I was trying to access a bit.ly link, but it is blocked by my University. Knowing ...
0
votes
1answer
72 views

Telling the difference between firewall block or external problem with Page Cannot be Displayed (IE) [closed]

In our organization, when users run up against the firewall in Internet Explorer, this is what they see: The classic IE "Page Cannot Be Displayed". Of course, this is also what you see when it's ...
1
vote
0answers
40 views

Are parts of my system susceptible to IP based malicious attack even with effective IPtables rules?

Yesterday I installed Cent OS 6 and had to flush the default IPtables rules (IPtables -F) in order to access a web app via my browser. Having very little experience with Linux/Network security this ...
0
votes
1answer
344 views

Differentiating between IKEv2 and OpenVPN Traffic

There is a WiFi network that I regularly use, and it seems to be blocking all VPN traffic other than IKEv2. I tested this by downloading many of the free/freemium VPN apps from the Google Play Store ...
0
votes
1answer
73 views

Would it be possible for a malicious user to change the LAN IP address of an uncompromised device?

I have a local network and an IPCam (with its own storage) in it. Due to some practical limitations, I cannot use technologies such as AP isolation or VLAN to isolate low-integrity and high-integrity ...
1
vote
1answer
523 views

Could an attacker spoof a whitelisted IP to access the network?

There is a network that is protected with a firewall and only one IP is whitelisted. Assuming the attacker knows the whitelisted IP, what would prevent an attacker from sending traffic via a spoofed ...
0
votes
2answers
607 views

Is an ACL Sufficient for business firewall?

I am a relatively new IT specialist for a small company (about 30 employees, 100 more seasonal.) Most of our systems have been outsourced to an IT company long ago, that handles licensing, VDI, PBX, ...
1
vote
1answer
86 views

Refusal to 'open' up corporate network?

I am working a project which requires access to a service running on a remote server, over a single TCP port (>1024). This service runs on a machine located within an existing network, and the project ...
2
votes
3answers
128 views

Whitelisting DNS vs. Packet filtering Firewall

I am an information security intern for a MSP. The company is set up to work remotely a few days a week. As I was gathering information for the assessment, I found out that one of the employees does ...
2
votes
2answers
12k views

Can a hacker hack into port 80?

We normally say port 80 is firewall friendly. But can a hacker just hack into port 80 via TCP or UDP? Or is Port 80 by default not always open? It waits for the host to initiate a connection via ...
5
votes
3answers
10k views

Should I allow communication on public networks?

I apologize if this is a newb question. Reading this prompt, it appears that I should check Private Networks and uncheck Public Networks. However, Windows defaults to the opposite being checked. Am I ...
4
votes
2answers
9k views

Is it dangerous to disable the IPv6 firewall built into many home routers?

The router that my ISP has delivered contains an IPv6 firewall. The only configuration option is whether it is on or off. Apparently, this firewall simply denies all incoming connections. I ...
0
votes
1answer
2k views

Comparison between WAF and IPS/IDS

I would like to know the difference between WAF and IPS/IDS? Can IPS/IDS handle an attack on a web application? If there are differences functionally between the two applications, how they work ...
0
votes
3answers
2k views

How did EternalBlue bypass firewalls?

I've tried recently to run the EternalBlue exploit via metasploit (on VirtualBox lan), and I've spotted that if the victim PC uses the most naive windows-firewall than the attack would fail. That got ...
0
votes
3answers
1k views

Are there any feasible ways to block the stunnel utility at the network level?

The stunnel utility written by Michał Trojnara allows, if I understand correctly, to "wrap" non-SSL protocols (such as ssh) in an SSL connection. For example, imagine that all network ports on a ...
5
votes
1answer
194 views

How to eradicate and recover a compromised network

I have a somewhat broad question related to a specific, ongoing threat that I am trying to define and defend against. Right now, I need to rebuild a secure access point for my mobile devices and ...
4
votes
3answers
230 views

Should network firewall rules be secret?

At my workplace only the security team have access to see the rules on the server network firewalls. Developers and system engineers don't have any visibility, so they just deploy applications to ...
0
votes
1answer
1k views

Firewall doesn't support TLS 1.2

I have an ASA 5550 firewall that doesn't support TLS 1.2. What impact would we have when the older protocols are disabled? Will this affect the servers at all?
0
votes
1answer
49 views

Limited remote access to a web application [closed]

I would like to set up a very simple node.js web application on raspberry pi and access it remotely, from outside the LAN. There are no other hosts in that LAN with the Raspberry. I only need to ...
1
vote
0answers
102 views

How to block all aplications from internet connection?

I would like to block all windows10 applications from internet access So I found a settings screen on the windows firewall (Windows Firewall\Allowed apps) I would like to uncheck everything from this ...
3
votes
0answers
171 views

Comodo Firewall HIPS (Paranoid Mode) Regedits

Old time lurker and odd poster here with a general question. I think this might fall more in the nature of understanding system processes. I've activated comodo HIPS on paranoid mode to firstly see ...
0
votes
3answers
152 views

Get data without Firewall detection

I was browsing through some cyber security questions and I came across a question that kept sticking in my mind so I figured maybe I just ask here. The question is: What is a way to get data from ...
0
votes
1answer
219 views

Find out the IP or hostname of the firewall? [closed]

Is there a way to find the IP of the firewall which is blocking my access to an endpoint? I tried netcat / nmap but not much luck. I need some form of a tool which does a traceroute to the subnet or ...
2
votes
1answer
156 views

UFW appears to block connections from remote address, but NAT is disabled on my router

I'd like to understand what the following line means exactly, because similar lines can by found in my system log pretty often and I would not expect any. [UFW BLOCK] IN=enp2s0 OUT= MAC=72:8a:bd:21:...
2
votes
3answers
656 views

Router Security Log Shows Many Blocked TCP Connections

When checking my router tonight I looked at its security log. I saw thousands of blocked tcp traffic. Why are these considered security events? The log shows many blocked tcp incoming request from ...
0
votes
2answers
65 views

Concept using ssh to create dynamic firewall. Good or Bad idea?

The Goal Create a secure process to open a firewall port on a server (on demand), start a listening server, and ultimately close the firewall port. This would improve security by not always having a ...
3
votes
2answers
125 views

Where do products like BlueCoat and ForcePoint get there URL categorizations from?

I recently had an issue where I released software which made use of a new URL and several of my customer sites complained that the software wasn't working within their wifi network. It turned out ...
0
votes
0answers
87 views

How should firewall be configured to allow using an image scanner over WiFi to avoid jeopardizing security?

I'm having a dilemma if I should post this here or on superuser, finally I decided it's more security related so I post it here, if it's wrong please move. The situation: There is an Epson all-in-one ...
1
vote
1answer
97 views

Social Engineering Attack awareness using .doc and spoofed email

Need advise for our company experiment. We are planning to observe the security awareness among our staff. I have an idea but lacking of knowledge on how to do it. I want to create spoofed email and ...
3
votes
1answer
1k views

What's the difference between an “application-aware firewall” and a “web application firewall”?

I'm studying for the CCSP and my training material isn't very clear on the definition between "application-aware firewall" and "web application firewall". The training material states: Early on, ...
3
votes
0answers
58 views

What is this “…ffff:ffe2” traffic being blocked?

I have a fairly simplistic pfSense setup. IPv6 is provided through a Hurricane Electric tunnel. Something on my home LAN is sending traffic from an odd-looking address, and so it's getting blocked, ...
4
votes
1answer
582 views

How to distinguish between “normal internet” Port scan and more “serious” port scan preparing attack?

In a complete network infrastructure, with firewalls, routers, servers supervised by a SIEM, LogPoint here. Of course, there is a private network and public servers. in the LogPoint there is an ...
3
votes
1answer
422 views

Meltdown and Spectre regarding Firewalls and Sandboxing [duplicate]

I don't deeply understand Meltdown and Spectre -- all I know is that they are basically keylogging-like vulnerabilities within the CPU, which bypass any application layer stuff; correct me if I'm ...
4
votes
1answer
7k views

NMAP - Closed vs Filtered

A lot of people seem to ask this question, as there are a bunch of posts about it; however I feel like none truly answer the question (that I have found). I want to understand why NMAP decides to ...
0
votes
1answer
651 views

ufw and nmap show different result in terms of open ports

I have set my firewall ufw / firewall rules as follows: Default: deny (incoming), allow (outgoing), disabled (routed) To Action From -- ...
1
vote
3answers
562 views

Is hardware firewall needed for a local network without internet access?

Is a hardware firewall needed for a local network without access to other networks? The local network only consists of a server with SQL database, workstations & PLC controllers. I am asking ...