Questions tagged [firewalls]

Concerned with software or hardware firewalls

Filter by
Sorted by
Tagged with
7
votes
2answers
4k views

Getting self-signed SSL certificates for all https connections made from some premises

Context: I'm currently working as an expat for my company in a country where the Internet is notably untrustworthy. It made the headlines a few months ago for stealing facebook, twitter and gmail ...
7
votes
1answer
3k views

Is it possible to detect DPI (Deep Packet Inspection)?

If one suspects one's packets are subject to DPI, how can it be detected?
7
votes
4answers
1k views

Trying to firewall ports 1863, 5190

I'm using Debian's arno-iptables-firewall and I've configured it to only allow access on the ports I need. But nmap shows ports 1863, 5190 open. What gives? How can I interrogate those ports further? ...
7
votes
3answers
15k views

Why do I need a firewall on my router?

I just bought a new router, and as usual the router manufacturer make a big deal out of the firewall. I have never understood why the firewall is needed, sure, stopping dos attacks (such as syn-...
7
votes
2answers
814 views

What are the real world risks of opening ports for multiplayer games?

We have a multi-user enterprise training application built using the Unity game engine and are discussing the security implications of adding a Windows Defender Firewall rule globally opening an ...
7
votes
3answers
558 views

What tools are available for distributing and syncing firewall rule-sets to multiple devices?

I am looking for a solution to be able to distribute and sync firewall rule-sets to multiple devices. There are a few solutions out there such as Playbook by Matasano but it comes with an expensive ...
7
votes
2answers
1k views

I'm having a DDoS attack, my hosting company is not giving me a solution, and I need to know what is hapening

So ok, right now my windows 2003 dedicated server is under attack by some guy who's flooding UDP packets (~90.000 packets/sec) on my 100Mbps server for the last 8 hours. I'm on a shared port, so I'm ...
7
votes
2answers
5k views

Why does Windows 10 have so many open ports by default?

Looking at Windows 10's firewall settings, I see dozens of authorized applications, for most of which I can't find a good reason to allow incoming traffic. For example, I don't want Xbox, Twitter, ...
7
votes
2answers
263 views

Firewall on a VM

I know I could use a software firewall on the guest to achieve a situation similar to this, but is there a way to emulate a firewall (protecting multiple Guests) between a host and guests on a host-...
7
votes
1answer
17k views

Why are some ports reported as closed by nmap?

I was scanning a machine from inside the same LAN which is running and up to date Windows XP Home Edition which I suspect may be running some malware. The target machine has an up to date antivirus ...
7
votes
1answer
5k views

How to use NMap to portscan a SonicWall that is blocking all attemtps?

It seems that SonicWall is blocking attemtps to scan its ports. I know it has some ports open, like 443, because if I access using the browser I get a web site. But when I try to use NMap I can't see ...
7
votes
4answers
954 views

Firewall Reviews - What is in your Toolbox?

In the vein of the questions about forensics, I'd be interested to hear what tools/techniques people use on Firewall reviews, both in terms of periodic reviews as an auditor or consultant, or ...
7
votes
2answers
8k views

Windows Firewall Connection Security with Certificate

I've been fiddling with the Windows firewall configuration of some computers within a VMWare based LAN (no domain). To aid in my testing and debugging, I created a small, self-hosted console ...
7
votes
2answers
20k views

What is best practice for separation of trusted zones from a DMZ with a single firewall?

At our organization we have a single firewall sitting between our internal zones and the public internet. Currently all of our trusted zones are defined as different vlans on a layer 3 switch plugged ...
7
votes
4answers
1k views

SIP UDP request breaking through iptables

I have been investigating a few instances recently where SIP UDP traffic has been somehow evading the ruleset defined in iptables leading me to suspect that there is a hole in our rules so i'm looking ...
7
votes
2answers
319 views

Are temporary blocks sufficient response to network probes?

We have the option of using an automatic blocking feature of our firewall to temporarily block the source IPs of network probes. It is fast and automatic, and it expires after a set amount of time. ...
6
votes
4answers
1k views

Using unusual port numbers [duplicate]

Are there any security benefits to setting up the ports on your firewall to non-standard numbers? For example, using port 15 for the SQL service.
6
votes
4answers
789 views

“There's a firewall on the router into the building so you can turn the one on your computer off”

I know some people that, in regards to network security, argue that because the firewall on the router into the building is on, that makes the network secure and therefore, the firewall on Windows PC'...
6
votes
5answers
2k views

Firewall demo - iptables

I have to make a demonstration about firewalls in my class as a student(university). It should be implemented using iptables on Linux. I am reading all the theories around them but I can't figure out ...
6
votes
4answers
3k views

Security concerns from publicly visible Hudson & Jenkins servers?

A friend's start-up has implemented a number of business critical services on a Hudson/Jenkins server run on a Tomcat container. This is not an open-source project, in fact many aspects of this ...
6
votes
2answers
13k views

If a port is closed how come you can still use it?

What does it actually mean for a port to be closed or stealthed? According to tests I've run all my ports (tested) are stealthed but clearly I can still use the internet. Also are the terms "blocked" ...
6
votes
7answers
15k views

What tools exist to manage large scale firewall rulesets?

For an enterprise firewall you may have over 50 thousand rules. With typical errors in firewall rules including things like mistyped network masks you couldn't hope to manually review the release. So ...
6
votes
3answers
6k views

Security risk with using internal IP on public DNS

A web server inside the office network which is accessed by staff internally and the internal DNS resolves web.company.com to the server's LAN IP. Publicly, company.com nameservers belong to their ...
6
votes
3answers
747 views

When you make a revision of rules on a firewall, how do you add credibility/customer satisfaction to your final consideration?

When, for a vulnerability assessment, you need to report the security consideration about a firewall's configuration rule-set, after the audit on the rule-set you make a report about security concerns ...
6
votes
3answers
6k views

Why block network ports?

There was another good question here on why you should block outgoing traffic: Why block outgoing network traffic with a firewall? But I was hoping to get an answer on why it is a good idea to block ...
6
votes
2answers
2k views

Network UTM firewalls, are they really worth it?

I am currently looking at boosting the network security in my organization. (Currently we just use really basic small business network firewalls we primarily bought for IPSec VPNs). However, from ...
6
votes
3answers
6k views

Firewall Configuration Audits

I'm looking to perform policy audits against firewall configurations and/or rulesets. This should be performed independently of any configuration management systems, ideally by operating off the ...
6
votes
3answers
8k views

Which of these ports are safe to leave open, which are not?

I just ran nMap against my IP address and got the following result: PORT STATE SERVICE 21/tcp open ftp 22/tcp open ssh 23/tcp open telnet 80/tcp open http 443/tcp open https 3389/...
6
votes
2answers
3k views

I'm getting lots of unfamiliar connection attempts, what do I do?

I'm running Mac OS X and I have the system firewall enabled and I have stealth mode enabled. I opened up my system console and noticed that I'm getting tons of blocked connection attempts from places ...
6
votes
4answers
651 views

What kind of IT security applications do you guys run on your laptop/desktop? [closed]

I know a lot of people run different security applications on their laptops/desktops. I use Little Snitch on my Macbook Pro. I like to know where my applications are sending data and where I am ...
6
votes
4answers
1k views

One time password over SMS - exposing the Authentication Server to the internet

Consider a Internet Based Website which does authentication. The Web Application can do the authentication by calling an Authentication Server which is not connected to the internet. The ...
6
votes
2answers
7k views

Docker port forwarding exposure

I try docker with a simple webapp : docker run -d -v $(pwd):/app -p 8080:80 image_name I have docker listen on 8080: tcp6 0 0 :::8080 :::* LISTEN 13304/docker ...
6
votes
3answers
2k views

Network Vulnerability Scanner placement on network

We have implemented/are implementing a network vulnerability scanning process, and we have chosen to use Qualysguard. Qualys supply a scanner appliance for the internal network scanning, which ...
6
votes
2answers
188 views

Understanding an attempt to exploit a webserver

Given an attacker connects to a web server on port 80 and issues following command, what is he trying to accomplish? /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0 I already read this is related to some ...
6
votes
1answer
1k views

If all ports are closed, do I need firewall?

I often read an article which enables a firewall to secure public Wi-fi. But I think a firewall may not be needed when (like nmap said) all ports are closed. If all ports are closed, all packets ...
6
votes
2answers
2k views

How do experienced users test stateful firewall?

How do experienced users test stateful firewall with TCP/IPv6? My test case includes: echo reply without request tcp ack without syn Are there any more test cases, especially with IPv6?
6
votes
2answers
456 views

What happens if my VPN drops momentarily while using an SSL connection?

The Situation I am in an office with a connection that is routed through a BigIP firewall, with SSL interception; our computers have a root certificate to permit the intercept certs. If I browse to a ...
6
votes
3answers
14k views

How to directly connect to devices behind NAT from the internet?

We have an IP address on the global internet: "A" We only have access to "A". We have a network behind a router that does NAT: 192.168.1.0/24 There is a client behind that NAT: "B" We don't have ...
6
votes
4answers
3k views

Can websites access computers in LAN/Localhost through browser & how to block them? [duplicate]

Question 1: While browsing internet, can websites execute code through my browser that access websites or services that are hosted on Localhost or LAN? Question 2: Also, can data from intranet ...
6
votes
1answer
3k views

Great Firewall of China and simple SSL connection

I have an app that uses a SSL connection to interact with the servers placed in Europe/USA. The app uses a custom protocol built on top of TCP/IP. The app uses a self-signed certificates to check the ...
6
votes
3answers
10k views

Should I allow communication on public networks?

I apologize if this is a newb question. Reading this prompt, it appears that I should check Private Networks and uncheck Public Networks. However, Windows defaults to the opposite being checked. Am I ...
6
votes
1answer
1k views

In IPSec what is the definition & purpose of SAD and SPD?

What is a Security Application Database & Security Policy Database? What is their role in processing models for OUTBOUND and INBOUND packets?
6
votes
5answers
856 views

Does setting a default DROP policy actually improve security?

It seems that the status quo at the moment is to configure firewalls to drop any packets that aren't destined for specifically-opened ports. Many defensive port scanners (such as ShieldsUP!) seem to ...
6
votes
1answer
138 views

Do anti-XSS rules of Web Application Firewall break business logic?

I've read about Web Application Firewalls in a MOOC, and the provided example is that the WAF can filter out a request like ?user=<script to avoid potential XSS attacks. But what if a webpage of ...
6
votes
1answer
18k views

Understanding OpenWRT LuCI Firewall Routing with VPN

I'm still fairly new to networking, and I'm having a little trouble grasping some concepts of the proper firewall rules I need to implement for my desired setup. I'm setting up a router with OpenWRT ...
6
votes
4answers
4k views

What problems if any are caused by opening a port in the firewall that no program listens on?

I have a port forwarded and open in the firewall that I sometimes use to play games with friends over the internet. The game server doesn't run 24/7, only when I'm actually playing is something ...
5
votes
3answers
2k views

Can firewall stop social engineering attacks? [closed]

A colleague of mine asked "What are the configurations I need to have in the firewall to help me curb social engineering attacks?" So I want to know whether I should respond with: Firewalls are not ...
5
votes
8answers
104k views

How to block some websites in a small office?

I had a wireless connection in my office with one laptop. Now I bought two more laptops for my employees, and I give them Internet access. I want to block a few websites. My current connection is ...
5
votes
2answers
3k views

incoming packets in server

I have enabled iptables logging for packets coming from the outside -A INPUT ! -s 192.168.218.0/24 -j LOG Now i am seeing lots of incoming packets from unknown addresses Jun 5 14:54:56 localhost ...
5
votes
5answers
1k views

Can hardware firewalls be infected?

If a computer is directly connected to the internet, it is vulnerable to attacks. So we attach a hardware firewall between the computer and the internet. But doesn't this new setup mean that now our ...