A Firewall is an application or hardware device used to inspect and filter network traffic.

learn more… | top users | synonyms

69
votes
19answers
14k views

Why should I firewall servers?

PLEASE NOTE: I'm not interested in making this into a flame war! I understand that many people have strongly-held beliefs about this subject, in no small part because they've put a lot of effort into ...
57
votes
13answers
27k views

What steps do you take to secure a Debian server?

I am installing a Debian server which is connected directly to the Internet. Obviously I want to make it as secure as possible. I would like you guys/gals to add your ideas to secure it and what ...
44
votes
8answers
3k views

Why would I need a firewall if my server is well configured?

I admin a handful of cloud-based (VPS) servers for the company I work for. The servers are minimal ubuntu installs that run bits of LAMP stacks / inbound data collection (rsync). The data is large ...
43
votes
5answers
256k views

How to check if a port is blocked on Windows?

What is the easiest way to check if port 3306 on my localhost is being blocked?
32
votes
5answers
2k views

Will everyone having Globally Accessible IP's in IPv6 be kind of a security nightmare? [duplicate]

Possible Duplicate: Switch to IPv6 and get rid of NAT? Are you kidding? I'm thinking about the way that in IPv4 most of the time you have a single point to configure a firewall on, mainly ...
30
votes
10answers
13k views

iptables Tips & Tricks

I'm sure Linux sysadmins are quite familiar with iptables, the userland interface to the netfilter packet-filtering framework. Now, this "Question" is meant to be a Community Wiki for collecting ...
29
votes
8answers
12k views

Why not block ICMP?

I think I almost have my iptables setup complete on my CentOS 5.3 system. Here is my script... # Establish a clean slate iptables -P INPUT ACCEPT iptables -P FORWARD ACCEPT iptables -P OUTPUT ACCEPT ...
29
votes
4answers
101k views

Is it possible to change an “Unidentified Network” into a “Home” or “Work” network on Windows 7

I have a problem with Windows 7 RC (7100). I frequently use a crossover network cable on WinXP with static IP addresses to connect to various industrial devices (e.g. robots, pumps, valves or even ...
25
votes
8answers
5k views

Block employee access to public cloud

First of all, let me state that this is not my idea and I don't want to discuss whether such an action is reasonable. However, for a company, is there a way to prevent employees to access public ...
24
votes
3answers
29k views

Windows equivalent of iptables?

Dumb question: Is there an equivalent of iptables on Windows? Could I install one via cygwin? The real question: how can I accomplish on Windows what I can accomplish via iptables? Just looking for ...
23
votes
6answers
3k views

Hardware Firewall Vs. Software Firewall (IP Tables, RHEL)

TL;DR My hosting company says IP Tables is useless and doesn't provide any protection. Is this BS? I have two, co-located servers. Yesterday my DC company contacted me to tell me that because I'm ...
21
votes
4answers
9k views

REJECT vs DROP when using iptables

Is there any reason why I would want to have iptables -A INPUT -j REJECT instead of iptables -A INPUT -j DROP
19
votes
8answers
2k views

How to prevent zero day attacks

Traditionally, all anti-virus programs and IPS systems work using signature-based techniques. However, this doesn't help much to prevent zero-day attacks. Therefore, what can be done to prevent ...
18
votes
4answers
19k views

How can I prevent a DDOS attack on Amazon EC2?

One of the servers I use is hosted on the Amazon EC2 cloud. Every few months we appear to have a DDOS attack on this sever. This slows the server down incredibly. After around 30 minutes, and ...
18
votes
3answers
14k views

iptables port redirect not working for localhost

I want to redirect all traffic from port 443 to the internal port 8080. I'm using this config for iptables: iptables -t nat -I PREROUTING --source 0/0 --destination 0/0 -p tcp ...
16
votes
9answers
11k views

How to setup simple firewall on Ubuntu?

Could somebody give some simple steps with configuration example how to setup simple firewall on Ubuntu (using console only)? Only ssh, http and https access should be allowed.
16
votes
2answers
7k views

Why is our firewall (Ubuntu 8.04) rejecting the final packet (FIN, ACK, PSH) with a RST

Background, for a long time we have had problems with our firewall that sometimes keep HTTP requests hanging partially loaded until TCP times out. After tracing the traffic on the firewall I noticed ...
15
votes
6answers
21k views

Enable Ping in Windows Server Firewall?

I've just installed Windows Server 2008 on a server and I'm able to connect through Remote Desktop but can't ping. Do I need to open an special port on the firewall to be able to ping a server?
14
votes
2answers
588 views

How big of a problem is it to punch a hole in the DMZ to one web server?

We currently have our web server in a DMZ. The web server cannot see anything within the internal network, but the internal network can see the web server. How safe would it be to punch a hole in the ...
14
votes
7answers
4k views

Good low power server/pc for firewall? [closed]

Does anyone know of a low power server/pc that have 2 NIC's, so it can be used for a (OpenBSD) firewall? Sandra
14
votes
3answers
661 views

What should I consider to secure SVN on Windows? [closed]

Currently I am using VisualSVN Server and it's only accessible on my home network. Eventually there will be others accessing it, but for now it's just me and I would like to be able to go down to the ...
14
votes
2answers
730 views

Is my TCP connections sabotaged by my country's government?

I am suspicious that my country's government is destroying the received ACK packet on TCP connections, somehow. When I try to establish a TCP connection to an outside host on ports other than 80 the ...
13
votes
4answers
4k views

Hardware firewall vs VMware firewall appliance

We have a debate in our office going on whether it's necessary to get a hardware firewall or set up a virtual one on our VMWare cluster. Our environment consists of 3 server nodes (16 cores w/ 64 GB ...
13
votes
6answers
73k views

What firewall ports do I need to open when using FTPS?

I need to access an ftps server (vsftpd) on a vendor's site. The vendor has a firewall in front of the ftps server and I have a firewall in front of my ftps client. I understand that ports 990, 991 ...
12
votes
1answer
21k views

What is the difference between a Source NAT, Destination NAT and Masquerading?

What is the difference between a Source NAT, Destination NAT and Masquerading? For example, I thought IP Masqurading was what they used to call it in Linux? But what confuses me is that in our Astaro ...
12
votes
5answers
1k views

Reviewing firewall rules

I need to review firewall rules of a CheckPoint firewall for a customer (with 200+ rules). I have used FWDoc in the past to extract the rules and convert them to other formats but there was some ...
11
votes
8answers
27k views

Blocking Facebook and Myspace by IP address

I'm having some trouble making a Cisco ASA device block certain social networking sites which have become time sinks in our office. This question is really in two parts: Is there a reliable way to ...
11
votes
13answers
1k views

What decent small-office level routers are there [closed]

So let's say I have a network of less than 20 computers including a server that needs to be accessed externally. What router/firewall solutions would you recommend? It can be either hardware or ...
11
votes
10answers
122k views

How can I find out if a port is opened or not?

I have installed Apache server on my Windows 7 computer. I was able to display the default index.php by typing http://localhost/ in the address line of my browser. However, I am still unable to see ...
11
votes
1answer
9k views

What does “!Z” and “!X” mean in a traceroute?

When you see "!Z" or "!X" in a traceroute, what does that mean? Where is it coming from, and how do I fix it?
11
votes
2answers
16k views

Windows Advanced Firewall: What does “Edge Traversal” mean?

this should be a really simple one: In Advanced Windows Firewall on Windows Server 2008+, Properties > Advanced, what does "Edge Traversal" mean? I Googled it, of course, and was unable to come up ...
11
votes
4answers
3k views

iptables management tools for large scale environment

The environment I'm operating in is a large-scale web hosting operation (several hundred servers under management, almost-all-public addressing, etc -- so anything that talks about managing ADSL links ...
10
votes
9answers
2k views

Why buy high end hardware firewalls?

There exist firewalls from Juniper and Cisco that cost more than a house. So I wonder: what does one get from a $10.000+ firewall compared to an 2U server with 4x 10Gbit network cards running e.g. ...
10
votes
1answer
932 views

Amplified reflected attack on DNS servers

The term Amplified reflected attack is new to me, and I have a few questions about it. I've heard it mostly happens with DNS servers - is that true? How do you protect against it? How do you know if ...
10
votes
1answer
7k views

iptables: difference between NEW, ESTABLISHED and RELATED packets

Part of a firewall on a server : iptables -A INPUT -p tcp --dport 22 -m state NEW --state -m recent --set iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 100 ...
10
votes
4answers
11k views

What firewall ports need to be open to allow access to external git repositories?

What firewall port(s) need to be open to allow access to external git repositories?
10
votes
5answers
12k views

A secure, standard iptables rule-set for a basic HTTP(s) webserver

I have been trying to put together a basic server iptables script that will work for most sites just running a basic webserver using HTTP(S) and SSH (ports 80, 443, & 22). After all, most VPS only ...
9
votes
28answers
6k views

What is the most reliable way to send a zip file via email? [closed]

I often have clients email zip files to me only to find out that their corporate firewall has stripped the attached file. What is the most straight-forward way to send a compressed file through email ...
9
votes
10answers
5k views

Basic firewall, switch, & router device? [closed]

I am a developer and haven't dealt with server admin or networking in years, so "rusty" is very generous. I am setting up a new web server cluster (starting with two 1U web servers and one DB server). ...
9
votes
5answers
14k views

How to Unban an IP properly with Fail2Ban

I'm using Fail2Ban on a server and I'm wondering how to unban an IP properly. I know I can work with IPTables directly: iptables -D fail2ban-ssh <number> But is there not a way to do it with ...
9
votes
4answers
33k views

Which ports do I need to open in the firewall to use NFS?

I'm running Ubuntu 11.10 - setting up NFS to share a directory among many other servers. Which ports are required to be opened on the firewall?
9
votes
3answers
255 views

advantages in closing a port where no services are running

Are there advantages in closing a port where no services are running? What do I gain in terminating a connection at iptables level instead of what does it next (I guess OS).
9
votes
3answers
2k views

Exposing multiple servers behind NAT using a single public IP address

This is a Canonical Question about NAT and DNS I'm currently trying to set up a network with a DMZ containing a web server and an e-mail server separated from the Internet by a network address ...
9
votes
2answers
6k views

Do I need seperate iptables rule for ipv6 address?

On my debian 5.0 server, I setup some iptables rules like below: ACCEPT tcp -- eee.fff.ggg.hhh aaa.bbb.ccc.ddd tcp dpt:80 DROP tcp -- 0.0.0.0/0 aaa.bbb.ccc.ddd ...
9
votes
1answer
319 views

Kerberos authentication, service host and access to KDC

I have a web application (hostname: service.domain.com) and I wish to use Kerberos authentication to identify users that are logged into a Windows domain. Microsoft AD (Windows Server 2008 R2) is ...
8
votes
3answers
7k views

How do you PREPEND an iptables rather than APPEND?

Pretty basic question.. How do you PREPEND an iptables rather than APPEND? I have DROP statements at the bottom of my rules. I have software to add new rules but adding rules after DROP statements ...
8
votes
4answers
2k views

Good 1U Rack Firewall [closed]

I'm trying to find a good 1U rack firewall at a reasonable price. Most pricing is completely out of space (thousands of dollars? Why?). I don't want to list all features I need/want (there are too ...
8
votes
11answers
2k views

SOHO - throttle bittorrent traffic from problem users

I manage the network in a small office (SW dev is my "real job"), and there are a couple of users who beat the hell out of our internet connection by running bittorrent. Between the almost crippling ...
8
votes
4answers
1k views

Slow down individual connections passing through a Linux router?

We have a Linux server acting as a router/firewall for our office. Occasionally someone will upload a large file that takes up all our bandwidth. I don't want to implement any complex rules or traffic ...
8
votes
3answers
5k views

How to turn iptables stateless?

I'm running a Linux server that - from time to time - faces heavy load and the conntrack table overflows. Since it's iptables firewall ruleset is very simple I'd like to turn it to stateless mode. I ...