Questions tagged [firewalls]
Concerned with software or hardware firewalls
1,161
questions
1
vote
1
answer
1k
views
MacOS Firewall Needed or Unnecessary?
Coming from Windows to macOS, I was surprised that the firewall was off by default. I immediately turned this feature on. Would this be necessary? Are there some cons to having the firewall on that I ...
0
votes
1
answer
229
views
Are firewalls based on linux secure?
I recently set up a local server on my home network to host some files and personal webapps. In an attempt to improve security, I bought a pfsense-based firewall. I know some basics of networking but ...
0
votes
0
answers
121
views
The incoming traffic was allowed on my home network for two days. How to assess the damage?
My router's firewall was set to accept incoming traffic for about 48 hours. Misconfiguration from a user, apparently.
I have few devices on the network (two Windows PC, Freenas, printer, chromecast TV)...
2
votes
1
answer
583
views
Custom response for Web Application Firewall (WAF)
What should be the custom response code when WAF blocks a request due to matched rules or policy violation.
We should kept the response code as 403 or 200 when WAF returns a response against a blocked ...
0
votes
1
answer
243
views
How to monitor and manage ALL internet network activity [closed]
Is there a way to monitor and manage (block, unblock, log) all internet activity (mainly outoing traffic) from my computer?
For example, in my android phone I've installed a VPN tool called "...
1
vote
2
answers
135
views
Which firewalls filters should I consider applying to my company's website?
Context
The company I work in is starting to have a more dynamic website, which can process sensitive user information. With so, we want to improve our security. We are a healthcare company from ...
5
votes
1
answer
808
views
Can DPI block websites with ESNI?
I live in a country with censorship and was wondering if it's possible to bypass DPI by just enabling ESNI, DNS over HTTPS and Always HTTPS? If not, what else should I enable to bypass DPI firewall ...
3
votes
1
answer
6k
views
Logging into remote server via SSH using VPN (Wireguard). Is it foolproof?
I have a remote server into which I login via ssh. On this server I have setup a Wireguard VPN to which my host connects. The ssh server (ssh daemon) listens on a private IP interface (the server's ...
0
votes
1
answer
484
views
How to know if the response is from the CDN and not the origin?
I am doing some bug hunting. I inserted a malicious payload into a request. But I am not sure if the response is from CloudFlare or the origin. Are there special headers which help me to distinguish ...
1
vote
2
answers
338
views
I found an unknown UFW rule on my ubuntu server - have I been compromised?
The server is running the Kubuntu Desktop variant of Ubuntu (I transformed it into a server, I had things configured that would have been a pain to transfer to another installation.).
One day I ...
2
votes
1
answer
1k
views
scan forwarded ports with OpenVAS/GVM?
I'm currently learning about network security and came across a problem, maybe I'm just missing something obvious but I'll try to explain my environment:
I have a Kali Linux VM connected to the WAN ...
23
votes
5
answers
7k
views
Unidirectional continuous data transfer to an air-gapped computer
What would be a way to transfer files in one direction from internet-facing computerA => air-gapped computerB to protect the files on computerB from unauthorised disclosure, short of using an ...
0
votes
2
answers
136
views
Securely Connect Employee PC to Business Private Network
I've recently become the "tech guy" at a startup, and am tasked with standardizing our hardware infrastructure. Further more, I choose how employees working from home will connect to ...
0
votes
1
answer
280
views
Windows Firewall allows the connection to more than one user who shares the same external IP address
I wrote a stand-alone anticheat. When the client anticheat connects to its server, the server creates a firewall rule allowing the game client to gain access to the server.
The problem is the firewall ...
1
vote
1
answer
388
views
Is opening all ports on a router safe if it is simply redirection to a VPN server at 192.168.1.2:51820?
The motive for doing this is that I want to open other ports so that I can evade firewalls which block VPN connections. Instead of redirecting eg. port 53 or 123, I could simply set up a destination ...
0
votes
1
answer
221
views
Possible ways to intrigue IP blockage on practical websites
Assume that I share the same IP address with others. Then if I can do something bad to intrigue practical websites, such as Google, Amazon, or jQuery to block me, then all other users will also be ...
-1
votes
1
answer
321
views
Whitelisting only domain not IP [closed]
Is it possible to whitelist only 1 domain name but not IP?
For example:
On some "Doogle" hosting is IP 1.1.1.1 and have multiple domain resolution for this IP: dog.com, cat.com
cat.com ...
1
vote
0
answers
158
views
How to Prevent Attacker from Abusing IPv4-embedded IPv6 to Bypass Security Mechanism?
Section 5.3 of RFC6052 explained how an attacker could abuse the NAT64 translation mechanism to bypass security mechanism such as firewall or IDS/IPS if those devices only have an IPv4 blacklist. The ...
2
votes
2
answers
2k
views
How can I block hits to Youtube using iptables?
I want to prevent my daughter from accessing YouTube while she's attending school. So I was thinking to add protections in iptables. Unfortunately, when she goes to YouTube, the DNS resolves to IP ...
-1
votes
1
answer
314
views
What makes firewall pop up?
I am creating a file that uses Socket for exchanging data. When I use Python I have a firewall pop up where I am asked to accept the use of the application, but when my C++ program tries to do the ...
0
votes
1
answer
1k
views
Textbook uses terminology like Double/Single Bastion Inline/T to describe firewall architectures. Are these terms used in professional environments?
I apologize for the weird wording of the question title, I was hitting the character count.
I am taking a network security course in college and the textbook we use, Network Security Essentials: ...
1
vote
0
answers
120
views
Secure Implementation of Network Discovery Tool in Corporate Network [closed]
I would like to implement a network discovery tool, which automatically detects all devices in a network including OS information. I would like to do a very secure implementation. The biggest threat ...
1
vote
1
answer
143
views
Getting an abnormal amount of firewall warnings on web server
I just had a look at the firewall status and saw it had blocked over 300 requests from TOR, Python Urllib, and some script called aabbccdd.xss.ht/pigeonburger.xyz (pigeonburger.xyz being my website).
...
0
votes
2
answers
239
views
Best practices for firewall exceptions
My company has a firewall set up which, among other things, scans incoming files for malware. The scanner alerted about a malicious file that was downloaded to one of our machines. After some ...
0
votes
1
answer
958
views
How to stop outgoing SSH on port 443
Let us say that a small company has an internal network for employees. All employees are granted Internet access via a NAT device (not a proxy) and perimeter firewall only allows outgoing connections ...
1
vote
1
answer
5k
views
Mongo DB hacked (read_me_to_recover) without the port exposed in the firewall?
I have recently set up parse-server on a DO VPS using 3 docker containers; one for parse-server, one for parse-server dashboard and one for mongodb. Because I am just testing this setup I left the ...
26
votes
5
answers
11k
views
Why is DNS-over-HTTPS such a big security nightmare compared to DNS-over-TLS?
I've heard the argument against DNS-over-HTTPS that it is supposed to be a security nightmare for network defenders because it enables encrypted DNS over port 443, compared to DNS-over-TLS which goes ...
0
votes
2
answers
308
views
UFW does not block meterpreter
I am doing some pen testing on my wordpress server. I wanted to see what would happen if the attacker were to get a hold of my username and password for wordpress.
So I used the standard exploit in ...
0
votes
2
answers
146
views
Is there a bulletproof way to configure your AWS system? [closed]
I am learning how to configure a multi-region AWS system. However, everything I read says "if you want/need more security then do X". Why would anyone want less security (is what I start ...
3
votes
1
answer
310
views
In setting up a VM, does the Bridged or NAT configuration provide more separation security?
I am setting up a few VM's (assume VirtualBox w/ Linux). They will all be on the same PC host (assume Linux) and the intent is to have all the VM's handle separate functions (business, personal ...
-2
votes
1
answer
167
views
Securing a read-only REST service for mobile access
I am writing a mobile app that uses a read only REST service that sits behind our company firewall. The actual data supplied by the REST service is not private but I am concerned with a hacker using ...
1
vote
1
answer
233
views
When does it make sense to deploy an embedded firewall on my IoT device?
I have a typical IoT set up where a set of IoT devices running embedded Linux are connected to a cloud IoT server. The underlying carrier connection to the internet is over GSM. All communication to ...
0
votes
1
answer
456
views
How hardware firewall knows if its an inbound or outbound request? [closed]
Being a hardware firewall, it can only see the TCP/UDP packets, how can they know that a packet coming inside is inbound or response to an outbound request?
0
votes
1
answer
1k
views
What is "Your Phone" in Windows 10 Advanced Firewall?
I have an Outbound Rule in my firewall called "Your Phone".
Settings:
All programs.
In Customize Application Package Settings, it has "Apply to app package..." set with a long ...
2
votes
1
answer
369
views
Why does a firewall reencrypt https traffic
I have a Sophos XG firewall. I use it at home (to play around with) This firewall is capable to scan HTTPS traffic.
It decrypts the traffic and re-encrypts the traffic again. For the re-encryption of ...
0
votes
1
answer
258
views
What are the downsides to having PostgreSQL database available directly from public network?
When auditing a machine for one of my clients I noticed that they have PostgreSQL listening and accessible from public network. This is not necessary for their application, seems they simply neglected ...
1
vote
2
answers
1k
views
How to configure a port as filtered on server
With nmap you can see a live system's or server's open, closed, and filtered ports.
But how do you make it show as filtered when it is currently shown as open?
2
votes
1
answer
622
views
Getting numerous HEAD requests by Java user agents to resources that require authentication to view within a web application. Should I block them?
I have recently started using Cloudflare's firewall in front of a web application. This app has a limited user base of selected applicants and they must log in to view anything. There is no public ...
0
votes
0
answers
65
views
What security benefit is there in 2020 to block outbound Ping [duplicate]
I've researched this and found the following on StackExchange and ServerFault, but they're very old.
https://serverfault.com/questions/55889/why-block-outbound-icmp
Is it a bad idea for a firewall ...
1
vote
1
answer
144
views
Use linux firewall rules for windows too [closed]
I'd like to improve security on my home network.
I have a PC and a laptop with Microsoft Windows as well as a PC and a laptop with Linux
There are a few HTTP services installed in the network. The ...
1
vote
1
answer
3k
views
Why can I access the internet with all ports closed on firewall? [closed]
For the heck of it I wanted to see how much I could close down my router from the rest of the internet. I was hoping turning on the firewall, removing any port forwarding and turning off UPnP would ...
3
votes
1
answer
2k
views
(Public) IP address [x.x.x.x] of Synology has been blocked by SSH
For the past few months I regularly see alerts on my Synology about SSH connection being blocked. Somebody (here a nice Chinese guy from 222.186.15.158) was attempting to connect to my NAS with the ...
0
votes
1
answer
218
views
VPN from inside a company
I recently had to bypass my company policy by establishing a VPN connection from a LAN device (raspberry pi) located inside my company, to a WAN server.
As devices accessible from outside must be ...
0
votes
2
answers
255
views
Are there any examples of network-based application firewalls?
As we know, network based firewalls will filter based on information such as source IP, source port, etc. But they won't know what program on the source machine is generating that traffic.
...
1
vote
4
answers
467
views
How to avoid leaking your public IP to installed applications like browsers when using a vpn?
What is the easiest setup to hide your public IP from installed applications and prevent things like WebRTC leaks on a common Linux distro?
6
votes
1
answer
942
views
Why does the Windows Security Alert dialog default to to the "not recommended" option?
When I launch a program that wants network communication for the first time, I get this dialog:
It's been a part of Windows for a while now (this is running on Windows 10, but note the Vista/7 design ...
0
votes
1
answer
558
views
iptables: force clients to use proxy
My network: 192.168.0.1 server. (enp0s3 NAT, enp0s8 internal) 192.168.0.10-15 clients (enp0s3 internal).
I have a proxysquid for blocking websites,and so on.
My clients can navigate and browse any ...
1
vote
1
answer
132
views
Security team making the firewall opening, good pratice? [closed]
I'm currently requested in my enterprise to do myself (security team) the firewall overtures requests in TUFIN (firewall workflow), instead of our local IT team. it's for simplicity and saving costs.
...
0
votes
1
answer
259
views
How does Cloudflare firewall work?
How does Cloudflare web firewall work? When someone tries to enter a website, they first go through the Cloudflare server and then, if a captcha is solved, they can see the content of the website.
So ...
1
vote
2
answers
9k
views
Block SYN,ACK response with iptables
I have a virtual environment and I am making a SYN flood attack to a Ubuntu Server's port 53 using Kali 2020.
I realized that a countermeasure for this attack is to limit or block the responses to ...