Questions tagged [firewalls]

Concerned with software or hardware firewalls

Filter by
Sorted by
Tagged with
-1
votes
1answer
97 views

What is the meaning of “me” in ipfw rules?

ipfw is an IP firewall and traffic shaper control program. The term "me" appears on ipfw statements like below: ipfw add 02050 allow tcp from me to any out I would like to know exactly what "me" ...
7
votes
4answers
1k views

SIP UDP request breaking through iptables

I have been investigating a few instances recently where SIP UDP traffic has been somehow evading the ruleset defined in iptables leading me to suspect that there is a hole in our rules so i'm looking ...
0
votes
1answer
987 views

Are there risks in not having a edge firewall? [duplicate]

I am currently working with a client that has all their external traffic going through the core switch and then is being passed to the router and back through the core switch and then to the rest of ...
0
votes
1answer
65 views

Is a firewall required for a SOHO network? [duplicate]

Would a firewall router be required on a SOHO network ? The network has a LAN to LAN VPN (no end user in). There is no server / services on the network other than some consumer IOT devices, the ...
7
votes
2answers
800 views

What are the real world risks of opening ports for multiplayer games?

We have a multi-user enterprise training application built using the Unity game engine and are discussing the security implications of adding a Windows Defender Firewall rule globally opening an ...
5
votes
3answers
886 views

Does blocking an IP with IP Tables protect you from a DOS (not DDOS) attack?

I am fairly new to network security, and I just learned about the Fail2Ban framework you can use for automated exploit detection/prevention. It says that you can protect yourself from DOS attacks by ...
1
vote
0answers
98 views

I am looking for a new firewall [closed]

I am looking for help on purchasing a firewall and some information on firewall recommendation. I am not really technically savvy but, I understand a bit about networking so bear with me. I have been ...
0
votes
1answer
58 views

Historical IP reputation data

I have a firewall log with events from 2 years ago. I want to examine that log as if I was investigating at the time of collection (2 years ago). However, I would like to use IP address reputation ...
2
votes
1answer
528 views

How to perform a port scan against a target with a software-based firewall?

I use NMAP to perform port scanning, e.g., TCP SYN scan: nmap -sS 192.168.0.12. I've two virtual machines running Windows XP and Windows 7, respetively. These have several services running, e.g., ...
3
votes
3answers
296 views

Web Application Firewall using web app source code analysis

I read this page: Category:OWASP Best Practices: Use of Web Application Firewalls, and I found that WAF cannot generally detect logical attacks. We know each web application has a number of input ...
0
votes
1answer
190 views

What is the iptables rule to block all https traffic except to a single ip?

I'm trying to configure a microservice for my web application, which is hosted at ip address X.X.X.X. The microservice should only accept https connections from this web app. I've tested the ...
5
votes
4answers
3k views

Can websites access computers in LAN/Localhost through browser & how to block them? [duplicate]

Question 1: While browsing internet, can websites execute code through my browser that access websites or services that are hosted on Localhost or LAN? Question 2: Also, can data from intranet ...
1
vote
1answer
48 views

Port filtering for Ubuntu-Nginx minimal server environment

I've established a minimal, uncustomized LEMP stack (Ubuntu 16.04). The only server I have besides Nginx is Postfix. To protect that environment I filtered all ports besides a few, this way: ufw ...
2
votes
2answers
3k views

IPv4, IPv6 and firewall

Say I have a server running some version of Linux and I give this server an IPv4 address of 10.1.1.1 Now using my network firewall I NAT this IP to some public IP address and I block all incoming ...
1
vote
1answer
442 views

Why won't ossec block SSH connections when it seems to be configured correctly?

Why won't ossec block connections from another server? I installed ossec version 2.9.3 on Ubuntu 16.04. In the ossec.conf file I have these lines where x.x.x.x is the IP address of a second Linux ...
0
votes
2answers
393 views

Should I keep incoming data UDP ports open in a minimal server environment?

I have a minimal, uncustomized Ubuntu 16.04 xenial Nginx server environment with only these incoming data TCP ports unfiltered: 22, 80, 443, 9000 When reviewing /etc/csf/csf.conf I found out that ...
0
votes
1answer
490 views

How can I disable logging for specific rule in pfsense

I would like to prevent pfsense logging of the block for the rule below: Rule: 'Block ULA networks from WAN' Source: my_router_ip:specific_port Dest: ip:1900 Protocol: UDP Even though I have ...
-1
votes
2answers
492 views

What is and how good is an ISP-provided antivirus?

Today I had my Internet provider to install Internet Fiber at my place. I've been asked whether I wanted the antivirus service. I am aware you can (and should) install an antivirus on your computer. ...
4
votes
1answer
2k views

How SSH Deep Inspection works?

I just saw an option in Fortinet NGFW regarding, SSH Deep Inspection. So my question is how Deep inspection or whatever can inspect or find any malicious activity on encrypted packets?
-2
votes
2answers
121 views

Finding websites protected by Web Application Firewalls

I've been doing research on web application firewalls. But of course, finding the firewalls is the hardest part of this so far. Is there a simple way (like a list or something) to finding a website ...
2
votes
2answers
669 views

How to stop people from bypassing firewall blocks by using Google cache?

I'm using a physical Stormshield Firewall to control connections of a private companies. There are rules to block some websites, like video games websites, Facebook, etc. However, these websites can ...
0
votes
2answers
141 views

Antivirus vs Firewall with Antivirus

I would like to know from an information security respect, is antivirus software needed to be separate from the firewall? In my company, they have a Palo Alto firewall and they mention that it is a ...
-2
votes
1answer
80 views

Trying to detect a firewall

I have some HTML that was detected by one of my scripts firewall detections, it looks like this: <!--- HTTP 1.1 Status Code: 403 HTTP Headers: {'Content-Length': '1233', 'X-Powered-By': 'ASP.NET', ...
1
vote
2answers
515 views

Why is spoofing allowed in reputed VPS services?

I just learned about IP spoofing and so I set up VMs and sent spoofed UDP packets (8.8.8.8, Facebook's IP, Twitter's IP) to myself (home PC and mobile) from well-reputed VPS providers like AWS, ...
5
votes
3answers
2k views

What is the difference between an anti-virus and an IPS?

As I understand it, an intrusion protection system (IPS) detects anomalous behavior, does detection of protocol anomalies, and does signature filtering that blocks malware, DDoS, etc. An antivirus ...
2
votes
0answers
89 views

Secure IoT device against remote access [closed]

I'm developing an IoT device (a Raspberry Pi) that will be connected to the internet. It's users won't necessarily be comfortable with deploying updates, so I plan to make it as secure as possible ...
98
votes
5answers
30k views

Someone is trying to brute-force(?) my private mail server… very… slowly… and with changing IPs

This has been going on for about 1-2 days now: heinzi@guybrush:~$ less /var/log/mail.log | grep '^Nov 27 .* postfix/submission.* warning' [...] Nov 27 03:36:16 guybrush postfix/submission/smtpd[7523]:...
1
vote
3answers
2k views

Blocking ipv6 packets with firewall, if using an ipv4 router

A router doesn't support ipv6. There is a machine connected to the router, that is assigned an ipv4 address by the router. The machine uses firewall software. Setting up the machine's firewall, all ...
17
votes
1answer
4k views

Cybersecurity “Airport model”

For the last few months, I have heard about a next generation model of Cybersecurity called the "Airport model." Does anyone have more information about it?
72
votes
8answers
13k views

If we are behind a firewall, do we still need to patch/fix vulnerabilities?

I have recently joined a security focused community in my organisation. Many of our products are deployed in the intranet (on-premise) nothing in the public cloud. So, the internal portals can be ...
1
vote
2answers
734 views

Does avira firewall need to be enabled along with comodo firewall?

I'm currently using Comodo Firewall along with Avira antivirus. The new update for Avira also includes the firewall with the free plan and its enabled by default. Do I need to enable both on my ...
1
vote
1answer
2k views

Port scans: 'traffic denied' VS 'close - age out'

I have been investigating logs from the firewall (Juniper) and I've found out that when someone is portscanning my website, the majority of the traffic through different tcp/udp ports is denied (...
0
votes
1answer
1k views

how block all subdomains for a particular domain

I want to block all traffic to and from my network to a particular domain. Apparently, this is not possible in Windows, with either a HOSTS file or using firewall rules: the HOSTS file requires every ...
-1
votes
1answer
42 views

How to connect to external address as other outgoing port number without proxy [closed]

Is it possible to (mask / define) outgoing port locally on network without using a proxy? default (outgoing protocol) [address] [port] set to (outgoing protocol) [address] [selected port] There ...
2
votes
1answer
1k views

Suspcious timing of [LAN access from remote] in router log

I read that [LAN access from remote] to UPnP ports can be an attacker looking for vulnerabilities, and is usually nothing to worry about. However I'm concerned seeing this activity in a log so close ...
1
vote
1answer
134 views

File transfer secure from a network security perspective

Let's assume a simple network with a (Windows) server and a (Windows) workstation. Turns out the question of how to securely transfer files between the two isn't obvious considering: I define secure ...
-1
votes
1answer
557 views

How can adding a line to your hosts file bypass a server side firewall?

In this SQLi blog the author says that to bypass a firewall at the server side you should add this line to your /etc/hosts file: 54.165.170.2 www.example.com But doing so will only block my ...
0
votes
1answer
370 views

Ability to get a MAC address and IPv6 through proxy servers

Now I'm pretty sure I know the answer to this question, but I am just curious to see what the security experts of the world think of this. First a little back story: I was a former member of a ...
1
vote
1answer
155 views

Cyberroam Firewall

In my University, the network is protected by Cyberroam Firewall and we are provided a login page through which we access internet and the login page isn't secured.It sends out the userid and password ...
2
votes
0answers
104 views

The way for not disabling the firewall in windows

I have been doing this for about a year without knowing the purposes of disabling. Whenever i tried to ping/connected to my host VM via guest VM, i have to disable my host VM's firewall, but does it ...
6
votes
1answer
137 views

Do anti-XSS rules of Web Application Firewall break business logic?

I've read about Web Application Firewalls in a MOOC, and the provided example is that the WAF can filter out a request like ?user=<script to avoid potential XSS attacks. But what if a webpage of ...
0
votes
2answers
49 views

device not recognized in network

On my windows 8 Computer I sometimes can see a device in the network view , which I can't identify as one of mine. See following screenshot: For me this looks like a network breach. How can I analyse ...
2
votes
1answer
975 views

nmap results after evading firewall

I've done an nmap scan on my server with an F5 firewall protecting it. I used the nmap command nmap -vvv -f -Pn -mtu 8 -sN -oN nmap-results.txt 192.168.22.102 I had this result but it seems ...
1
vote
2answers
178 views

Is it dangerous to have unused Windows 10 Defender Firewall rules active?

I recently discovered that a bunch of games I've installed in the past (from legit sources) have activated many Windows Defender firewall rules viewable from wf.msc. Some of the games I have since ...
3
votes
1answer
417 views

Reverse shell on a web server behind Netscaler

How possible is it for a reverse shell to connect back to the attacker if the vulnerable web server only has Http ports open like 80 and 443 through the Netscaler behind the perimeter firewall? ...
0
votes
1answer
608 views

Can iptables be hacked / circumvented

We currently have a server that blocks all connections using iptables, and we have to whitelist an IP expressly in order to be able to access the server remotely. Essentially, the first rule allows ...
6
votes
2answers
450 views

What happens if my VPN drops momentarily while using an SSL connection?

The Situation I am in an office with a connection that is routed through a BigIP firewall, with SSL interception; our computers have a root certificate to permit the intercept certs. If I browse to a ...
0
votes
1answer
391 views

Are there open by default ports with Centos 7's firewalld?

My Centos7 firewalld has TCP ports 8083, 8086, and 5000 open. I don't recall opening them, except for maybe 5000 when first learning about firewalld. Are there any ports that might come out of the ...
0
votes
1answer
302 views

Would an RP3 do well as a firewall appliance?

I have seen this post about the Raspberry Pi for use as an IDS. But how well would it do as a firewall appliance in a residential setting? I will soon be setting up a new network and want to exercise ...
1
vote
1answer
77 views

Could point to point firewall connection rules prevent MiTM

I have a linux run as firewall between my PC and the Internet router. Now, if my Windows PC is infected with Banking Trojan that will eavesdropping any online banking activities and redirect ...