Questions tagged [firewalls]

Concerned with software or hardware firewalls

Filter by
Sorted by
Tagged with
0
votes
1answer
615 views

Can iptables be hacked / circumvented

We currently have a server that blocks all connections using iptables, and we have to whitelist an IP expressly in order to be able to access the server remotely. Essentially, the first rule allows ...
6
votes
2answers
453 views

What happens if my VPN drops momentarily while using an SSL connection?

The Situation I am in an office with a connection that is routed through a BigIP firewall, with SSL interception; our computers have a root certificate to permit the intercept certs. If I browse to a ...
0
votes
1answer
395 views

Are there open by default ports with Centos 7's firewalld?

My Centos7 firewalld has TCP ports 8083, 8086, and 5000 open. I don't recall opening them, except for maybe 5000 when first learning about firewalld. Are there any ports that might come out of the ...
0
votes
1answer
303 views

Would an RP3 do well as a firewall appliance?

I have seen this post about the Raspberry Pi for use as an IDS. But how well would it do as a firewall appliance in a residential setting? I will soon be setting up a new network and want to exercise ...
1
vote
1answer
77 views

Could point to point firewall connection rules prevent MiTM

I have a linux run as firewall between my PC and the Internet router. Now, if my Windows PC is infected with Banking Trojan that will eavesdropping any online banking activities and redirect ...
1
vote
1answer
409 views

have opened HTTPS port but still no response [closed]

I have watchguard firewall and server behind it configured with NAT. I was told to open port https for 1 of the server. I have create a rule from any to the NAT server to allow port 443, the ...
4
votes
1answer
2k views

The Shadow Server Foundation constantly trying to get access to mDNSResponder

Update September 2018: The events described below still happen to this day though less often from servers of The Shadow Server Foundation. By now I have denied access to most of their IP addresses, ...
2
votes
1answer
268 views

Iptables DROPS SSH after port knock rules, but nmap shows it as OPEN

I setup port knocking rules on CentOS 7, iptables as follow: -I INPUT -p tcp --dport 1 -m recent --set --rsource --name KNOCK1 -m limit --limit 5/min -j LOG --log-prefix "knock 1" --log-level 7 -I ...
2
votes
3answers
581 views

How to prevent users from downloading executable files or portable apps?

Is it possible to prevent executables or portable apps from being downloaded in a corporate environment on the network layer? (i.e not some agent on a host preventing it) Would this require MITM SSL ...
3
votes
3answers
2k views

How can someone access my computer (“hack me”) when my firewall is off?

Why do people go crazy when the firewall if off? Most sites on the internet say its very dangerous to turn off your firewall and I want to understand why. For example Microsoft says this: You ...
0
votes
1answer
82 views

Are there any open source firewalls for a VPN server? [closed]

I provide free VPN access to a lot of people and often times have troubles dealing with abuse reports from stupid stuff like network scanning. I have been researching for hours now, but I am ...
0
votes
1answer
663 views

Communicating routed interfaces for Cisco ASA 5506-X [closed]

Recently our organisation has been supplied a new ASA 5506-X to replace the old good PIX506e for a project. We have encountered a problem on routed interface on ASA 5506, which is very different from ...
0
votes
1answer
352 views

How to Determine Malware Outbound Traffic?

My aim is to tighten the firewall on my AD domain PC running Windows 10. Even though Windows firewall is already turned ON - I am not confident that it is blocking malware outbound traffic What is an ...
1
vote
2answers
186 views

How to detect long lived SSH sessioned

I am trying to figure out a way to detect ssh sessions that have been established over a long period of time. I seem to recall that there were ways to detect tcp connections that have been connected ...
0
votes
1answer
75 views

Using an android non-rooted as a wifi adapter

I want to use an android phone as a wifi adapter, and I was wondering if it added security to my connection. The phone has a complicated long password, it also have an app store firewall (noroot ...
8
votes
1answer
27k views

How do I access a firewall log (Windows 10 w. Windows Defender)

I am going through some event logs (in event viewer), and noticed I can't seem to find any firewall logs. Windows Defender provides the firewall. How do I get to the firewall logs that should be ...
0
votes
1answer
2k views

How to block local ip with Windows Firewall?

I want to block a local ip-adress in my network but it doesn't work. My System is Windows 7 and I have a Webserver running on port 8080. Let's say I want to block 192.168.178.10. Not just for port ...
1
vote
1answer
285 views

IDP Explicit FTPS False-Positive - “FTP Cmd Telnet Opcode Evasion”

Having just upgraded our FTP server to enforce Explicit FTP over TLS (on the standard port 21), we are experiencing connections failing sporadically, probably around 50% of the time. It's important to ...
0
votes
1answer
790 views

IPv6 and NAT firewall effect

It seems that people still argue on whether to use NAT with IPv6 for its side-role as a firewall hiding inner network from the outside (providing user anonymity and security as well). I am wondering ...
3
votes
2answers
112 views

Is it safe to log into a virtual private server not owned by me?

What are the dangers of using a virtual private server (VPS) that I do not own? Someone on a mail list offered to let me host my website on his Linux VPS for free, and gave me non-root ssh access ...
2
votes
3answers
766 views

Improve RDP security: router with VPN or IP whitelist on firewall

I am considering to improve the security setting on our workstation shared within the university lab. We are sharing the workstation among lab members with RDP and got compromised recently. I highly ...
1
vote
2answers
540 views

REJECT Nikto Scans With Snort Rules

Hoping someone on here knows a way to reject Nikto traffic with Snort rules. I've been having zero luck for days finding this anywhere online. Thanks. Peace.
0
votes
2answers
288 views

What is an actual hardware firewall? [duplicate]

I have to do a piece of college homework about firewalls and I came across this question, What makes a hardware firewall different from a software one? If I have a corporate network, and I configure ...
0
votes
1answer
497 views

Circuit level gateway vs Dynamic packet filter

What is the difference between a Dynamic (or stateful) packet filter and a Circuit level gateway? Both monitor TCP handshaking between packets to determine whether a requested session is legitimate or ...
1
vote
2answers
841 views

Email Security Gateway vs Firewall [closed]

An email security gateway is an edge device such a router that serves for relaying the external network with the private network. It helps with detecting and blocking spams and phishing emails. That ...
1
vote
0answers
393 views

How secure is my MLab Shared Cluster MongoDB database?

I have deployed a Meteor application to Meteor Galaxy. I've also created an Mlab.com Shared Cluster MongoDB. Link to the plan features. My application has an SSL certificate installed on the domain. ...
1
vote
1answer
601 views

Can a device accidentally transmit a Teardrop attack?

On reviewing the firewall log on my router (supplied by my fibre provider), I noticed a few curious entries. Several teardrop or derivative attacks, I'd expect to see things like this in the log from ...
0
votes
1answer
321 views

How to block an application with iptable which use random port

Scenario: My goal was to allow TeamViewer to connect to my home workstation from my laptop only. So I have tried to bind my laptop's MAC with an IPtables rule as following, [arif@arif:~]$ sudo ...
3
votes
2answers
4k views

Why the Windows Firewall has so many exception rules by default?

Consider the default firewall configuration for Windows 10 Pro (Creators Update). So, in a nutshell: Block inbound connections. Allow oubound connections. 223 inbound exception rules (some of which ...
1
vote
0answers
188 views

Security risks introduced when moving from a three tier to a two tier architecture

I host several .net web applications using a standard three tier architecture with web servers located in a demilitarised zone. I have been asked to host a two tier .net web application where the web ...
0
votes
1answer
3k views

Good Default TCP Connection Timeout Time

I am trying to configure the firewall at our company and I was wondering what a good default TCP connection timeout would be. We currently have it set for 10 minutes but I feel like this is too long ...
1
vote
2answers
675 views

Port forwarding and port blocking security concerns

I am highly concerned about RDP security and about multiple occasions of ransomware infections through RDP, so now I am inspecting possibilities for self-defense against these threats. What interests ...
2
votes
1answer
325 views

How does advanced firewall scan data (check for signature etc) if it is encrypted?

Let's say for normal web browsing, since it's using HTTPS, all the data will be encrypted. In that case, how does the firewall/IDS/IPS check for signatures to detect anomaly/virus/malware?
1
vote
1answer
799 views

Setting up Knockd issues

So i'm busy setting up a knockd service on a VM to enable SSH login when the correct sequence of ports are "knocked on" using knockd and ufw. The issue that I am currently having is that when the ...
0
votes
1answer
596 views

Can firewalls detect and block outgoing by protocol [duplicate]

Or specifically, what can be done to detect or block the following (other than closing port 443)? If this is something that can or cannot be done based on the specific hardware used, please provide ...
2
votes
1answer
531 views

MITM in “Next generation” firewalls becoming a norm? [duplicate]

So I went to a seminar lately and heard about the "SSL inspection" part of Nextgen firewalls. It was basically MITM to be able to monitor the users of the network. Is it becoming a common practice in ...
2
votes
2answers
1k views

Blocking DiagTrack outbound connection after malware infection

I was scammed and I thought those scammers were really from Microsoft so I let them remotely connected to my computer. I don’t know what they installed on it. After I realized that it was a scam, I ...
3
votes
1answer
185 views

How would an external attacker utilise universal plug and play to bypass a firewall?

I'm wondering what strategies and techniques are used to bypass firewalls which have universal plug and play. I'm aware of security issues regarding UPNP in the past but I've also heard that there ...
1
vote
2answers
122 views

Do dynamic certificates for SSL-Interception pose a security risk due to weak entropy?

When you think about typical SSL-Interception in Firewalls, depending on the number of TLS-Connections, loads of Certificates get faked "on the fly" in a very time critical environment. In my ...
5
votes
1answer
460 views

WAF logs show plaintext password and login in a POST header sent via HTTPS

Scenario I was monitoring some events from our web application firewall (WAF), Imperva SecureSphere, when a weird one appeared. Here is the client's POST request: POST some_url HTTP/1.1 Host: ...
2
votes
1answer
547 views

Connection timeout error using HTTP Status Code Checkers on a website [closed]

PROBLEM When I use online tools to test www.bestbuy.com URL's, I get a timeout connection error. By online tools I mean HTTP Status Code Checkers or Redirection Checkers. EXPECTED BEHAVIOUR I ...
2
votes
1answer
773 views

Effective blocking of SMB connections on AsusWRT

I recently was attacked by some cryptolocker (not sure if it's WannaCry) and now I am revising my network policies. For reaching this aim I want to disable all SMB-activity for infected PC. ...
2
votes
2answers
2k views

EternalBlue exploit doesn't work against windows 8

i have tried this poc: https://gist.github.com/worawit/074a27e90a3686506fc586249934a30e against a windows 8 target that i own, the code exits with an error that says: impacket.nmb.NetBIOSTimeout: ...
3
votes
2answers
2k views

Windows firewall settings to receive UDP and pings

I use a windows 10 to receive UDP packets or pings from another computer which runs Win/Mac/Linux. I default, I turn off the firewall to receive pings or packets. I prefer not to turn off the ...
1
vote
0answers
72 views

What happens if we block ICMP from accessing our internal network from the outside? [duplicate]

What are the effects if we block ICMP from outside to the inside network, and what are the impacts on the organization?
0
votes
1answer
138 views

Has there ever been a country that implemented whitelist-based internet censorship?

We hear time and time again of countries censoring internet traffic by blocking IP Ranges. Without getting into the politics of it, let's take for example China's Great Firewall. Even though it is ...
3
votes
5answers
6k views

Question about IDS and IPS

I am studying Security Fundamentals on Networks and as a part of an excercise I have the following question: Which of the following statements are true? (Select all that apply) a.- An IDS deals with ...
0
votes
1answer
135 views

How to implement child protection firewall that cannot be bypassed?

As a guardian, we wish to protect our family especially children from malicious websites. We implemented the following technologies: K9 Symantec client protection But it can be surpassed with ...
1
vote
2answers
313 views

Where am I most vulnerable when running Mac OS 10.6.8 Snow Leopard?

I have a challenge at work, one of our computers is running Mac OS 10.6.8 Snow Leopard. We have legacy software that's required to run the business, and so we have to have it online and on our network....
3
votes
1answer
809 views

Socket closed depending on data. Am I facing an active firewall? (DPI - Deep Packet Inspection)

Following my troubleshooting of making a TLS connection (See: Testing TLS with openssl), it looks like there might be an active firewall in place. The connection on that port works with nc on both ...