-1
votes
1answer
33 views

How should I properly block outgoing http traffic with iptables

I'm experimenting with iptables, and I'm trying to allow all outgoing requests for HTTPS, but to block HTTP. I have the code below; Chain INPUT (policy ACCEPT) target prot opt source ...
4
votes
3answers
70 views

ESXi hosted on public IP without firewall

So I've got an interesting problem. I currently rent a couple of servers from Hetzner (a German hosting provider). Each server has a soft firewall and does something like web hosting / database. I ...
3
votes
1answer
81 views
+50

What are the repercussions of using an EOL Cisco firewall?

I'm looking at using an ASA 5520 for the database of an ecommerce site. According to End-of-Sale and End-of-Life Announcement for the Cisco ASA 5520 Adaptive Security Appliance, this product is ...
0
votes
0answers
23 views

Restricted logins + almost all ports closed : secure? [migrated]

Context : I plan to travel. I want to make a little cloud with my personal server. I wish I could d/l some of my files and eventually upload some files which will not be executed and the whole is ...
-2
votes
0answers
27 views

Cisco ASA 5505 ver 7.4 port forwarding

I need sone help over ASA 5505 ver 7.4. This scenario is working with two site to site vpn and working fine. All inside clients able access internet only issue is that they are not able to call means ...
-2
votes
1answer
25 views

Allow outgoing connections for DNS [closed]

I'm new to IPtables, but I am trying to setup a secure server to host a website and allow SSH. This is what I have so far: #!/bin/sh i=/sbin/iptables # Flush all rules $i -F $i -X # Setup default ...
4
votes
4answers
621 views

How can I make an internet facing TFTP server secure?

I have many Cisco IP phones that operate in the following manner (oversimplified): Negotiate with DHCP for IP, DNS, TFTP, etc. Look for SEPXXXXXXXXXXXX.cnf.xml configuration file on TFTP server ...
2
votes
1answer
49 views

iptables: does a scanner knows if you DROP packets?

I know how REJECT and DROP chain works. But, as I read here REJECT vs DROP when using iptables, user Dagelf said that the server still replies with TCP SYN/ACK. Does the scanner knows that a packet ...
0
votes
0answers
67 views

Force all traffic through VPN

I am using PfSense as a firewall, with its VPN functionality. The client I use is Shrew Soft VPN client. As it is a split tunnel, is there a way I can force all traffic through the VPN connection, ...
-1
votes
3answers
217 views

Is blocking SMTP ports prevent server from sending emails?

I have a Centos server with cPanel on it. Yesterday, some hackers had successfully connected to my smpt server and sent thousand of emails from it. What I want to do is blocking every ports except ...
25
votes
8answers
5k views

Block employee access to public cloud

First of all, let me state that this is not my idea and I don't want to discuss whether such an action is reasonable. However, for a company, is there a way to prevent employees to access public ...
2
votes
2answers
103 views

What are the security issues in creating a firewall between two subnets?

As I understand it, the hosts on different subnets cannot communicate with each other unless there is a router somewhere on both subnets that forwards traffic between them. I have have two subnets ...
1
vote
0answers
203 views

Firewall/iptables rules for GlusterFS

A great pleasure would be to know which exact iptables rules to use for securing GlusterFS 3.4.2 (with Debian Wheezy) in shared environment. I'm running some dedicated servers at ISP. There are two ...
1
vote
1answer
53 views

Defending PCs against APTs

We are evaluating the security of the PCs used by people with access to high-value company documents. At the moment they are kept patched and run a virus checker, but we are concerned about zero-day ...
2
votes
2answers
146 views

With Azure, can I create a VLAN and put all my worker roles and VM's in there?

Is it possible to create a sort of VLAN or private azure LAN thingy .. where I can put any new Workers or VM's in that VLAN? one of the reasons is because I was hoping to create a SQL server on a VM ...
0
votes
3answers
54 views

Limiting the connection source in firewall

I'm new at server management, and wrote an IPTables script for firewall. I'm very concerned about the security of my server, and thus I'm wondering about something that I read often from people using ...
0
votes
1answer
64 views

Allow access to certain ports on the server, via only one of the server IP addresses

I'm trying to allow access to certain ports on the server, via only one of the server IP addresses. So for example if the server has two IP addresses: 1.1.1.1 1.1.1.2 I only want for example ports ...
0
votes
1answer
44 views

A way to only allow some ports on windows server

I have been trying to make this work the last few hours but haven't come far. I have a windows server 2008 and a set up Local Security Policy firewall yet "no" inbound rules (yet). My domains look ...
0
votes
1answer
125 views

iptables DROP all access except my dynamic IP, is it possible and how/workaround?

If not possible, is there any workaround without affecting CPU performance? iptables -A INPUT -p tcp --dport 80 -j DROP
0
votes
1answer
1k views

Open port 8009/tcp on Fortigate necessary?

A nmap scan of a Fortigate Firewall showed that TCP port 8009 open is. According to knowledge base articles this is only to download the client for ssl vpn. Is this port used for anything else, and if ...
1
vote
1answer
47 views

Outbound ports for a firewall for webserver and db server

I have an environment where there is one firewall, and there is a secure segment and a DMZ segment behind it. There is a bunch of servers in the secure segment - DB server, the QA server, etc and ...
0
votes
0answers
100 views

Shutting Down Firewall Rules for TMG 2010

Since TMG is being sunsetted next year we have decided to go with a new firewall/web filter and put the TMG 201O server off the network and used ONLY as a front-end authentication/proxy piece for our ...
0
votes
1answer
92 views

Securing database server with IPTables

I have my app (WordPress) and database (MySQL) on separate servers; they are connected on a private network provided by the hosting service provider, and I've taken all the preliminary steps (that I ...
0
votes
1answer
43 views

Is a reverse proxy useful behind a load balancer and IPS

We have a Web infrastructure with a farm of Web Servers. They are behind a loadbalancer which does SSL offload. We also have a IPS and obviously a set of firewalls. Now, for security reason we have ...
0
votes
2answers
47 views

making sure that iptables is running

Is there a tool for monitoring that iptables (or shorewall or similar) is up and running with a core set of important rules? I need something which alerts me either if the firewall goes donw ...
-1
votes
1answer
69 views

Is this CentOS 6.2 system reasonably secure as described? [closed]

This is a CentOS 6.2 system. For my login with the hosting company website, I set a 20-character mixed case, letters, numbers, symbols password and enabled two-factor authentication. In ...
-2
votes
1answer
109 views

How is my firewall making all websites look like a login page [closed]

In the morning this question came across my mind. You would notice my poor knowledge on firewalls. My office installed a new firewall. I am provided a new username and a password. And here we have a ...
0
votes
1answer
62 views

Export iptables logs to network storage in a limited storage dd-wrt router

Because some routers have very limited storage space; security logs are disabled in the micro version of dd-wrt. Is it possible to export the (iptables) logs to an external storage?
0
votes
1answer
81 views

Iptables to lock down compromised server to a single ip [duplicate]

I have a Linux server which is compromised, I can see nasty looking perl scripts executing with root privileges. I want to get some data off it before I wipe it. How can I block all inbound and ...
0
votes
1answer
61 views

why iptables giving error when using with --src-range

I am using iptables v 1.4.8 and used following command but getting one error message on terminal # iptables -A INPUT -m iprange --src-range 10.0.4.92-10.0.4.99 -j DROP modprobe: module 'ip_tables' ...
0
votes
1answer
50 views

Blocking Port 22 From Unknown IPs Security Measure

A server I'm working on has blocked all unknown addresses from accessing port 22 (via a firewall). An IP address has to be added to the firewall first via a control panel (or command line) before it ...
0
votes
1answer
407 views

Ubuntu Server DDoS protection [duplicate]

I've seen many articles on DDoS protection, but none work. I need protection for a socket server i'm running on the server. It's running on port 9876 and it's for a flash-based game. when it gets ...
3
votes
1answer
100 views

Traffic backlogged after (D)DoS attack? [closed]

About 25 hours ago, I got an e-mail from UptimeRobot (uptimerobot.com) telling me that me websites had gone down. I raced over to my server room, where my TP-Link router was completely unresponsive ...
1
vote
1answer
74 views

Given an Amazon Web Service Security Group, how can I find out what the IP's are?

I'm looking at using a cloud service which has an AWS Security group... I've got a hardware firewall and a software firewall. I have no idea how to say: Given that security group, allow any ...
0
votes
1answer
265 views

How to find which local process is sending spam on a Windows Server 2008 server

I am managing a Win Server 2008 system with a number of hosted web sites. Recently I found that something was sending spam through our SMTP server. The logs indicate that the connections were being ...
3
votes
1answer
541 views

Should I dual home our webservers (DMZ/Internal network) or just do 1-to-1 NAT?

I'm setting up a rack of servers which will have 2 webservers and 10 internal servers that provide back end application support (migrating from an AWS environment). We'll have virtual machine ...
-1
votes
1answer
92 views

Server is unable to make outgoing ftp requests. How to open this?

I have setup a new server on rackspace & have used these exact rules in iptables http://articles.slicehost.com/assets/2007/9/4/iptables.txt I don't want server to act as a ftp server but when I ...
1
vote
2answers
165 views

How to implement firewall in LAN(out of users' os) like EC2 have done?

In aws ec2, users can set up security groups which works like a firewall, usually, firewall work behind a gateway/nat server, however, I found that firewall in EC2 works in the LAN, too. For example, ...
0
votes
2answers
188 views

Webhosting on virtual sever vs physical server: Security vulnerability

In comparison to a physical server, is there any special security vulnerability in virtual servers for purpose of hosting several websites? For example, can the fact that there is not any hardware ...
-2
votes
1answer
54 views

Local development server risk: inbound connection [closed]

My local development environment is Windows with xampp/nginx. Yesterday I installed malwarebytes and today when I started my xampp server, I soon find out that there is an inbound connection blocked ...
3
votes
5answers
2k views

When would I open Port 53 for DNS?

Locking down an application server. The server hosts a web app that is served via http. There are a few other ports open as well. Port 53 is open for DNS. Why would I need this? Extra: (Do not ...
-1
votes
1answer
96 views

Firewall distribution in a campus network [closed]

In designing a campus network how would you distribute your firewalls I have designed a university network with 2 campuses. They use a leased line to link the two campuses. There is a firewall on the ...
2
votes
3answers
256 views

Firewall for VMware ESXi or vSphere

I want to protect individual VMs on a vSphere/ESXi host with firewalls rules using a solution that works directely on the hypervisor. By default vSPhere does not allow that, right? It has to support a ...
0
votes
3answers
169 views

Ubuntu Server: Attack on blocked ports leads to Ping timeout [duplicate]

I was searching for a solution a long time but cant find anything useful. My webserver is secured by a firewall (iptables with ufw userinterface). Default is deny all and only some ports are open. ...
1
vote
3answers
146 views

IPTables allow then block with active connection

I have a backup server and I was wondering if I set a cron job to allow connection from a server in IPTables then once it connects with rsync, can I use IPTables to then shut off the port to prevent ...
0
votes
1answer
2k views

iptables - Block incoming on Eth1 and Allow All from eth0

I am a bit stuck with iptables to do deal with two Ethernet ports. eth0 port for LAN use (192.168.1.50 Private IP). eth1 port is connected to the internet via cable modem (80.0.xxx.xxx public IP). ...
5
votes
1answer
1k views

iptables: building a rule set against abuse for DNS amplification attacks

I have been working on building a rule set to detect and block a DNS amplification attack. I got stuck and am hoping to find help here. I'll post here what I have (bash scripting, the portions that ...
-1
votes
3answers
826 views

Not using SSH Pubkey Authentication is really serious security flaw compare to regular Password Authentication

How would using PubkeyAuthentication would be in a single way more secure than using PasswordAuthentication, considering the fact that the server's Firewall blacklists an IP after 2 unsuccessful ...
2
votes
1answer
93 views

How does iptables determine which packets are multicast?

Are packets assumed to be multicast solely based on their ip address? I've been looking at the RFC 1112 and a quick scan doesn't appear to indicate any other flags on the ip packet.
4
votes
1answer
96 views

Managing security and firewalls in complex, distributed applications

We have a distributed application composed of several different components. For example, we have Python app servers, PostgreSQL DB servers, Redis servers, Memcached, etc. Some of these services are ...