Questions tagged [firewalls]

Concerned with software or hardware firewalls

88 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
5
votes
0answers
899 views

Firewall in virtual machine

I'm putting my server to use as a file server and a firewall. I'm looking at KVM or Xen VM setup, where file server and firewall get their own VMs and host is just supplying the hardware (so Xen way, ...
4
votes
1answer
3k views

I want to restrict access to Nextcloud using OpenVPN

Is it a good idea to restrict access to my Nextcloud server by using OpenVPN, so every user (this is for small group of people), will get their own VPN account and after that they will be able to ...
3
votes
0answers
195 views

Comodo Firewall HIPS (Paranoid Mode) Regedits

Old time lurker and odd poster here with a general question. I think this might fall more in the nature of understanding system processes. I've activated comodo HIPS on paranoid mode to firstly see ...
3
votes
0answers
67 views

What is this “…ffff:ffe2” traffic being blocked?

I have a fairly simplistic pfSense setup. IPv6 is provided through a Hurricane Electric tunnel. Something on my home LAN is sending traffic from an odd-looking address, and so it's getting blocked, ...
3
votes
3answers
341 views

Web Application Firewall using web app source code analysis

I read this page: Category:OWASP Best Practices: Use of Web Application Firewalls, and I found that WAF cannot generally detect logical attacks. We know each web application has a number of input ...
3
votes
0answers
551 views

Configure icefloor to prevent leaks when VPN connected

I am trying to configure the icefloor firewall on OS X 10.9 so as to make sure all traffic will go through VPN. I recently notified that even with "Route all traffic through VPN" option in ...
2
votes
0answers
213 views

(Public) IP address [x.x.x.x] of Synology has been blocked by SSH

For the past few months I regularly see alerts on my Synology about SSH connection being blocked. Somebody (here a nice Chinese guy from 222.186.15.158) was attempting to connect to my NAS with the ...
2
votes
0answers
52 views

Can NAT Table be vulnerable toward any poisoning attacks?

I am learning the general concept of network security, and becomes aware of two poisoning attacks on the network infrastructures, that is, DNS poisoning attacks and ARP poisoning attacks. They are ...
2
votes
1answer
179 views

Non-upgradable usb device against badUSB

Lot of posts about badUSB (here and there) suggest to use a PS/2 connector for mouse and keyboard or to whitelisted USB devices or even use a hardware firewall that only allows whitelisted commands. ...
2
votes
0answers
45 views

Beginner UFW question about destination any

I'm learning about UFW with a Raspberry Pi and I don't a couple of things when it comes to UFW rules. Can anyone help me suss a couple things out? My first question is about the destination any. If I ...
2
votes
0answers
106 views

The way for not disabling the firewall in windows

I have been doing this for about a year without knowing the purposes of disabling. Whenever i tried to ping/connected to my host VM via guest VM, i have to disable my host VM's firewall, but does it ...
2
votes
0answers
2k views

Anyone can identify tool used to perform this attack?

recently I've identified that some hack attempt was performed at one of my servers. I have dumped nginx logs to github, please take a look and try to identify which tool was used to perform this ...
2
votes
0answers
1k views

Isolating Computer on Home Network Using Multiple Routers

My goal is to isolate a computer on my home network. This computer (a rapsberry pi) should be considered untrusted and is accessible from the internet (port 22). I need a solution that will prevent ...
2
votes
0answers
381 views

What is the security of Powershell “TrustedHosts”? (is it just a name match)?

Powershell has a TrustedHost section that is configured like this: winrm s winrm/config/client '@{TrustedHosts="CorpServer56"}' What security is implied for CorpServer56? Is it just an ASCII name ...
2
votes
0answers
239 views

Why my proxy is still having some connections blocked

I am behind a firewall in France. I connect to proxy A, in Ireland with Dante via SSH port 22 and make a tunnel forwarding port 1080. The proxy works as expected but still having a port range blocked....
2
votes
0answers
230 views

Shorewall stopped policies - routeback

Here goes a very specific question about the insides of Shorewall and Iptables in general. Shorewall supports configuration of "Stopped Policies" using the file routestopped, which defines the ...
2
votes
1answer
757 views

Could an attacker spoof a whitelisted IP to access the network?

There is a network that is protected with a firewall and only one IP is whitelisted. Assuming the attacker knows the whitelisted IP, what would prevent an attacker from sending traffic via a spoofed ...
1
vote
0answers
34 views

Why does the Windows Security Alert dialog default to to the “not recommended” option?

When I launch a program that wants network communication for the first time, I get this dialog: It's been a part of Windows for a while now (this is running on Windows 10, but note the Vista/7 design ...
1
vote
0answers
79 views

Is it possible to bypass .htacess protection?

So, I was involving in one of projects where client site and admin panel/dashboard was hosted on different sites. Not like a lot of CRM`s do or 90% of common sites (just in /admin or other URL ...
1
vote
0answers
76 views

Left port 80 exposed, several IPs accessed phpmyadmin

A few days ago while messing around with a web server, I put my server into a DMZ via my router and forgot to disable it. I opened port 80 and 3306 on the server's firewall (Windows Server) to access ...
1
vote
0answers
83 views

Avoiding WAF with DirBuster

I am curious as to how bug hunters / pen testers use DirBuster and GoBuster without getting their IPs banned all the time (which is why I am asking)?
1
vote
0answers
56 views

Is a VPN + Firewall + Authorization Redundant?

I am creating a simple application so a distributed team can access sensitive data. This application will have a database that will be inaccessible to the public internet inside a VPC with my cloud ...
1
vote
1answer
173 views

Alternative to Qubes OS network domain for a server

I know that Qubes Os is not suitable for a server use, but some of its features are quite interesting for that. In fact, all the network drivers are contained in a VM that run a different Linux based ...
1
vote
0answers
43 views

'Hard-to-guess' custom header (or similar) to whitelist via a firewall

My organisation is adding a firewall to our test stacks, using AWS WAF. We'd like to whitelist all traffic from the SDKs we've built to facilitate requests between our services. We thought of doing ...
1
vote
0answers
60 views

Inbound rules for a port is configured and disabled yet an NMap scan shows that the port is opened

I am new to Windows Defender but have read about it to understand the basics of Inbound/Outbound rules. As mentioned on the app, Inbound connections that do not match a rule are simply blocked. For ...
1
vote
0answers
81 views

Securing a SOCKS5 to SSH Tunnel on Windows

In order to gain web access from the perspective of a remote device, it is very common to use the SOCKS5 to SSH Tunnel capability built into OpenSSH Client and Putty (detailed here). Both clients ...
1
vote
0answers
404 views

Reverse shell working with kali 2016, but not kali 2019.2, using Metasploit ms08_067_netapi

I have an unpatched Windows XP Home VM, a Kali 2019.2 VM and an old Kali 2016 VM. Using Metasploit's ms08_067_netapi module, I'm able to successfully get a reverse shell but only on the old Kali VM. ...
1
vote
0answers
174 views

Is Windows RPC (port 135) secure enough for domain-wide access

I have a network of approximately 150 computers that I'd like to regularly monitor. My proposed way of doing so involves running remote commands like reg query \\<ip> or systeminfo /S <ip>....
1
vote
1answer
172 views

Why is Zone Alarm Blocking VMWare Virtual Network Editor?

I have version 15 of VMWare running on my Windows 10 computer. When I open the Virtual Network Editor and try to add a bridged connection, I get an error saying: Cannot change network to bridged: ...
1
vote
0answers
160 views

Weak ciphers in TLS VPN

We have a firewall out of our firm network and administrators connect to this firewall by VPN over TLS. Scanning this firewall, the vulnerability scanner get us some warning as the 443 port allow weak ...
1
vote
1answer
64 views

In what situations / with what nodes should a node ping / not ping?

I was recently looking at a network in which the client-machines that accessed a webservice endpoint, but which could not ping the webservice endpoint. And there are other machines that can ping the ...
1
vote
0answers
119 views

health check to test haproxy — request deny with 200. good idea?

I have been working on a multi-provider redundant load balancing solution using HAProxy, AWS, and Cloudflare. I have a solution, and I believe it will be secure, but I am looking for further ...
1
vote
0answers
144 views

UFW (Uncomplicated Firewall) Question

I was wondering if there's any benefit of adding following rules to a Raspberry-Pi directly exposed to the internet: sudo ufw deny to 0.0.0.0/8 && sudo ufw deny to 169.254.0.0/16 && ...
1
vote
0answers
43 views

Are parts of my system susceptible to IP based malicious attack even with effective IPtables rules?

Yesterday I installed Cent OS 6 and had to flush the default IPtables rules (IPtables -F) in order to access a web app via my browser. Having very little experience with Linux/Network security this ...
1
vote
0answers
108 views

How to block all aplications from internet connection?

I would like to block all windows10 applications from internet access So I found a settings screen on the windows firewall (Windows Firewall\Allowed apps) I would like to uncheck everything from this ...
1
vote
0answers
435 views

How secure is my MLab Shared Cluster MongoDB database?

I have deployed a Meteor application to Meteor Galaxy. I've also created an Mlab.com Shared Cluster MongoDB. Link to the plan features. My application has an SSL certificate installed on the domain. ...
1
vote
0answers
221 views

Security risks introduced when moving from a three tier to a two tier architecture

I host several .net web applications using a standard three tier architecture with web servers located in a demilitarised zone. I have been asked to host a two tier .net web application where the web ...
1
vote
0answers
157 views

Bypassing Client firewall restrictions

Lets suppose we have 2 parties A(me) and B(participant). I want to communicate with B but B's firewall restrictions are not allowing me to communicate with him. Is there any way that I can bypass B's ...
1
vote
0answers
49 views

Firewall rulebase analysis offline/vendor agnostic a thing for FISMA/NIST

During design-time before a build-out, I currently create an excel file version of a firewall rulebase (policy) representing source/target/port/protocol/etc definitions before being pushed to the ...
1
vote
0answers
238 views

UFW behind modem does not block remote IP

I have a small linux server with fail2ban and UFW installed and configured behind internet gateway modem which ssh port is forwarded to server. The attackers are discovering by fail2ban and added to ...
1
vote
0answers
1k views

Different filtering techniques with internal and external firewall?

First of all, lets get the basic information sorted out. Just in case I have it mixed up. There is an external Firewall - Router (or some such device), and there is an internal Firewall (an ...
1
vote
0answers
396 views

Blocking Multiple Failed Postfix AUTH Attempts with CSF

I am using CSF/LFD on my CentOS 7 server, and would like to use it to temporarily block IP addresses that have multiple failed Postfix AUTH attempts. You know the one, I get line after line of: lost ...
1
vote
0answers
87 views

Simple DMZ Question Regarding Physical Hardware

So when talking about at setting up a DMZ, if you are currently running a web server, app server, and a database server on the same physical host, you need to migrate them to separate physical hosts ...
1
vote
0answers
120 views

Clustered Juniper devices using public DoD IP addresses for communication?

Ok, so I have to admit I am not an expert in how Juniper networked devices work, so this entire issue might be why I am having issues understanding something I am seeing on a pair of clustered SRX210H'...
1
vote
0answers
271 views

Filter multicast on a LAN

In my dd-wrt firewall, I see the option: filter multicast I searched a lot about filtering multicast, but I could not find a comprehensive reply about this. Should I filter multicast on my LAN?
1
vote
0answers
1k views

Gargoyle (OpenWRT) firewall routing for VPN

At present I have Gargoyle setup on my WNDR3700 to connection to a VPN provider in order to provide a little privacy. However this prevents me from connecting remotely to my home network. Previously I ...
1
vote
0answers
145 views

Why does Windows realtime protection block specific URLs?

I have observed this strange behaviour with Windows (7 to 10). When active realtime protection is enabled, it blocks my own website. The page has nothing special (PHP and JavaScript), just good old ...
1
vote
0answers
189 views

Fortigate monitoring with SNMP and Devmon template

I'm trying to monitor some aspects from our Fortigate firewall (like how many traffic goes through each tunnel) through a combination of Xymon, Devmon and SNMP. I downloaded the MIB files from the ...
1
vote
0answers
45 views

Is it possible to block a debugger from connecting locally?

I work at an enterprise with enterprise-type software on my machine regarding firewalls, virus scanning, and vpns. I'm also a developer. If I'm not connected to the internet I'm not able to debug my ...
1
vote
0answers
85 views

iptable ip_conntrack_max testing

I was trying to understand how ip_conntrack_max works so i have created two VM and set ip_conntrack_max to 10000 I used hping to open 10000 udp connection on VM using following command hping --udp -...