Questions tagged [firewalls]

Concerned with software or hardware firewalls

Filter by
Sorted by
Tagged with
14
votes
5answers
15k views

What kind of attacks against home router's NAT do exist?

I always thought NAT was some kind of a security feature and I still think it is, because if it didn't existed the internet, respectively the clients behind NATs, would be even more insecure, since ...
14
votes
2answers
6k views

What's the diff between blocking a port with a firewall and not starting a service on that port in the first place?

I was considering setting up a software firewall (pf) on my web server and did some research on them. Were I to do it, it'd involve basically blocking connections to all ports except 80, 443, and the ...
13
votes
4answers
14k views

How to listen to all ports (UDP and TCP) or make them all appear open (linux)

I got an external Debian server. The problem is that my university campus doesn't allow connections to go outside when the port is different than TCP port 22, 80, 443, or UDP port 123. I tested them ...
13
votes
7answers
4k views

Egress filtering on an office network?

With an office network most companies will use ingress filtering to add a level of security, however few take advantage of egress filtering to protect their networks. The use of egress filtering will ...
12
votes
5answers
6k views

How can encrypted traffic bypass the Great Firewall of China when it is being blocked?

The Great Firewall of China is controlled by the government and has put in place a "learning algorithm" to block unapproved encrypted traffic. The only way to get encrypted traffic through the ...
12
votes
2answers
9k views

Firewall on smartphones

PCs communicate with the help of ports,eg. HTTP communication takes place over port 80. Due to the nature of these ports, an open port is an avenue for an attack. That's where firewalls come in. The ...
12
votes
1answer
24k views

Is it safe to disable connection tracking in iptables?

While reading about NOTRACK target of raw table in iptables, I encountered an article suggesting that for certain traffic you could (or even should) disable connection tracking. The two examples were: ...
12
votes
2answers
6k views

Is server hardening with grsecurity really necessary on the CentOS 6.3 environment?

I consider myself to be reasonably good with IT, however I am relatively fresh at server and system administration. I am a web developer for my company and I have been charged with setting up and ...
11
votes
3answers
19k views

How to protect myself against paid DDoS services?

I am domestic user and I am getting attacked regularly by a guy that hates me. Here is the background story: that guy uses Skype resolvers (tools offered by paid DDoS services) to find out my IP ...
11
votes
4answers
2k views

What firewall settings on a Macintosh are the most restrictive, while still permitting casual internet use?

I don't want this to be subjective, so I'll try to make the requirements as clear as possible. On a Mac with Snow Leopard, how can I set up the firewall rulesets that allow ONLY: Using the internet ...
11
votes
3answers
13k views

TCP Sequence Prediction and it's prominence in modern systems/networks

I have a question regarding your experience of TCP Sequence Prediction that I am hoping someone could help with. I am aware of how TCP Sequence Prediction works and how the connection can be hijacked ...
11
votes
7answers
7k views

What security implications are there for allowing outbound SSH traffic?

My school currently blocks outbound SSH traffic. Users inside the network cannot use Port 22, and attempting to make an SSH connection over another port is also blocked. (I'm assuming the firewall ...
11
votes
5answers
381 views

What are the areas to focus on to protect users and devices?

What are the areas or technologies to focus on to protect users and devices? Are patching, antivirus and firewalls still the main areas? How do you defend against attacks against vulnerabilities ...
11
votes
1answer
34k views

Firewall defined Akamai IP Range [closed]

With obvious dangers of opening up a wide range of ips, does anyone know how I can get a source of IP ranges for Akamai? When talking to Akamai they say 'not possible' which I find surprising. I ...
11
votes
4answers
2k views

External Vulnerability Scan of DMZ

We currently have an internal and external vulnerability scanner setup in my organization. This morning our external scanner was going through a new external DDoS protection service instead of ...
10
votes
3answers
2k views

Evasion techiques for WAFs

Are there any documented techniques for evading Web application firewall for testing WAF rule configurations?
10
votes
4answers
2k views

Software vs Hardware Firewalls

I read an article (can't find link) recently that advocated dumping software firewalls if you had a hardware firewall. I was just curious as to the take on Firewalls in general for a small-medium ...
10
votes
5answers
2k views

How can a company reduce exposure to packet spoofing? What solution should exist, but doesn't?

I'd like to understand what anti-packet-spoofing technology exists (or should exist) to verify an inbound packet. Maybe this is as simple as a Cisco ACL, Firewall Rule, implemented at the network ...
10
votes
2answers
18k views

Is opening both TCP/UDP less secured than just TCP or UDP when needed and why?

If application needs opened port X UDP, or X TCP combination. Is there any potential risk by opening both UDP/TCP as I usually am not sure which one the application uses?
10
votes
6answers
5k views

Can a web server be secured with just a firewall?

I'm about to go online with my first web site, it is a small project hosted on a regular home PC running Windows 7. I want to keep the software footprint at minimum, so it only contains the operating ...
10
votes
1answer
10k views

How to whitelist an Amazon ELB in a(ny) firewall?

We have a customer with a very locked-down network. Any outbound connections require whitelisting of the port and IP address. However, we are running our system behind an Amazon Elastic Load Balancer ...
10
votes
1answer
3k views

ports blocked by firewall and not the server

I was asked this question at an interview and i wasn't sure about the answer. The question was "suppose you were checking the open ports on a particular webserver which was behind a firewall, how ...
9
votes
6answers
19k views

Is blocking UDP and TCP sufficient to prevent unwanted network activity?

I want to be 100% sure that my machine only connects where and when I want it to. If I use a firewall that blocks all UDP and TCP packets but those that I explicitly allow to pass, can I be 100% sure ...
9
votes
3answers
9k views

Block all BotNets and TOR addresses from accessing our site

I've heard that many DOS attacks and general "black hat hacking" attempts occur over the TOR network. Is it possible for me to dynamically block source IP's by their presence in a BotNet or similar ...
9
votes
1answer
8k views

Would a DMZ be safe to use with a software firewall for home networking?

If I set up a Windows 10 PC with a software firewall (TinyWall, which is a front end for Windows Firewall) and blocked all traffic except for a few applications and ports I would be using (Minecraft ...
9
votes
4answers
9k views

Is it necessary to setup a firewall in both PC and router?

If I have the router firewall enabled, is it really necessary to setup iptables in my system? Isn't it a little redundant? For example I add a rule in the router where the PC can't use the port ...
9
votes
2answers
7k views

How is tunnelling SSH through Proxytunnel/HTTPS different from doing it through SSL with Stunnel?

In an answer to What is the difference between SSL, TLS, and HTTPS, it's said that HTTPS is HTTP over SSL/TLS. That is, an SSL/TLS connection is established first, and then normal HTTP data is ...
9
votes
2answers
3k views

Firewall egress filtering by domain

In our production environment, we are connecting to a few core external service providers though their APIs, and are required to have all other services blocked (PCI DSS). We currently have a ...
9
votes
5answers
15k views

How to trace a DDOS attack on a dedicated server and block it?

I have a dedicated server and I'm hosting a game, and the web page (using Apache) for account registering. The server is being ddosed since 8 months ago till today. I've tried to talk with the server ...
9
votes
4answers
2k views

A firewall without any extra features [closed]

I have Kaspersky Internet Security (KIS) installed on my system. I always keep it disabled, yet using a few practices, I kept my system virus free for years: I disabled autorun using these tricks; I ...
9
votes
1answer
307 views

Slash and dash DDOS - what are they trying to do?

I've noticed a curious flood pattern on some of my sites - bots trying to access the page ​"/-​/-​/-​/-​/-​/-​/-​/-​/-​/-​/" on the root domain - that's 11 slashes alternated by 10 dashes. The thing ...
9
votes
1answer
3k views

Cisco ASA SYN flood detection and response not working

I have a Cisco ASA 5510 (ASA Version 8.3(2)) that has been getting a syn flood attack on it (or more accurately through it - targeting a host behind it) a couple of times a day for the past few days. ...
8
votes
4answers
57k views

How can attackers bypass firewalls? [closed]

I have read the Wikipedia article on firewalls but don't understand firewall security and how an attacker from the outside can bypass the firewall to hack target system. We all know it happens but ...
8
votes
2answers
394 views

What is secure enough for web applications?

we intend to build a network in a small health center with No Internet Access it is expected to have 30 terminal machines, all machines will use an electronic medical record web application we want ...
8
votes
4answers
6k views

Security Services on Edge Router vs. Standard Firewall

If I can run a site to site VPN, NAT & Reflexive ACLs on a edge router (plus normal routing functions), what would be the use of running a stock firewall behind it? For instance, Core Switch --> ...
8
votes
2answers
2k views

What does a Firewall mean by “connect to TCP port without your permission”?

McAfee is reporting incoming network connections blocked from IPs like 198.252.206.149 (StackExchange Inc.), 54.179.231.116 (Amazon Technologies Inc.), 74.125.68.106 (Google Inc.), etc. The ports ...
8
votes
4answers
4k views

Is Windows Firewall suitable for running in a production environment?

Is Windows Firewall suitable for running as the sole protection on a production web server? Is it hardened enough? Robust enough? and tested enough? I'm running a VPS with Rackspace on their cloud ...
8
votes
2answers
378 views

Retaining institutional knowledge of a complex infrastructure (checkpoint, juniper, etc)

In the next month my functions will be expanded to include IT security (firewalls, VPN, PKI) in a big complex infrastructure. Can I ask you for advice on how-to be well prepared for it? What sorts of ...
8
votes
2answers
4k views

Can a firewall tamper with email attachments?

I am using Thunderbird as an email client for managing my different email accounts. Yesterday my friend sent me an email with a PDF attachment. Today when I tried to open the attachment I get the ...
8
votes
3answers
1k views

Firewall says that a program that I'm developing is trying to connect to the Internet

I'm seriously confused about this, since the program is entirely developed by myself and has no means/functionality to connect to any network/the internet whatsoever. I'm a software engineer but not ...
8
votes
1answer
30k views

How do I access a firewall log (Windows 10 w. Windows Defender)

I am going through some event logs (in event viewer), and noticed I can't seem to find any firewall logs. Windows Defender provides the firewall. How do I get to the firewall logs that should be ...
8
votes
1answer
2k views

Nmap - Intense vs Quick result

I inherited a small network and currently am assessing its security performance. I started port scanning a host (lets call it Weirdo) in that small network and from my perspective, it seems that that ...
8
votes
1answer
6k views

Is rooting an Android phone to install an anti-virus firewall worth it?

Some Android anti-virus offer a firewall like Avast or Comodo anti-virus but you need to have a root access to use them. However rooting an Adroid phone is often presented as a security risk. So: ...
8
votes
1answer
906 views

Is Chinese great firewall white or black list based? [closed]

Is a new website blocked by default in China ? I just put online a new website dedicated to chinese people (a working days calculator in China, nothing subversive indeed). However a friend of a ...
8
votes
1answer
3k views

Experience with a recent DDoS attack on Apache

I originally posted a question here since I was not familiar with an actual distributed denial of service attack (DDoS) on my server. I noticed that my server is very slow in responding to HTTP ...
8
votes
1answer
612 views

Setting up own enterprise SOC

the other day I was talking with a service provider (MSSP) who have experience with operating SOC (security operations centre) 24x7. Their price was rather steep (in the millions range). I don't ...
8
votes
1answer
3k views

Vulnerabilities of pure NAT without firewall

Following some of the comments on this question, I was curious about the security vulnerabilities of NAT. There are similar threads here and here but they discuss router vulnerabilities rather than ...
7
votes
6answers
389 views

Why shouldn't I run other applications on a Firewall?

If I want to use Ubuntu 11.04 as a Firewall in SOHO environment, then I just can't figure out what is the bad thing about installing GUI on it (e.g.: XFCE)? The only opened port to the world (wan ...
7
votes
3answers
60k views

What is the difference between a Gateway and a Firewall? [closed]

What is the difference between a Gateway and a Firewall and how do they relate to one another? I am a developer trying to get a general understanding of network security.
7
votes
5answers
3k views

What are the likely threats to a public-facing DB instance?

Quick intro: Small company, VERY limited resources. I pretty much do everything including take out the trash. We've been running an instance of MySQL internally for years and it's worked OK, but I ...