A Firewall is an application or hardware device used to inspect and filter network traffic.

learn more… | top users | synonyms

14
votes
1answer
27k views

What is the difference between a Source NAT, Destination NAT and Masquerading?

What is the difference between a Source NAT, Destination NAT and Masquerading? For example, I thought IP Masqurading was what they used to call it in Linux? But what confuses me is that in our Astaro ...
8
votes
11answers
2k views

SOHO - throttle bittorrent traffic from problem users

I manage the network in a small office (SW dev is my "real job"), and there are a couple of users who beat the hell out of our internet connection by running bittorrent. Between the almost crippling ...
8
votes
4answers
3k views

Good 1U Rack Firewall [closed]

I'm trying to find a good 1U rack firewall at a reasonable price. Most pricing is completely out of space (thousands of dollars? Why?). I don't want to list all features I need/want (there are too ...
12
votes
3answers
19k views

Windows Advanced Firewall: What does “Edge Traversal” mean?

this should be a really simple one: In Advanced Windows Firewall on Windows Server 2008+, Properties > Advanced, what does "Edge Traversal" mean? I Googled it, of course, and was unable to come up ...
11
votes
8answers
28k views

Blocking Facebook and Myspace by IP address

I'm having some trouble making a Cisco ASA device block certain social networking sites which have become time sinks in our office. This question is really in two parts: Is there a reliable way to ...
9
votes
5answers
12k views

Disable Windows Server Network Locations

I'm not sure what exactly this feature is called. But in Windows Server 2008, it has the Vista Public/Private/Domain locations. This makes sense for laptops, and none at all for servers. My problem ...
8
votes
1answer
12k views

Can I use ufw to setup a port forward?

Im currently using ufw to enforce some basic firewall rules. Is it possible to also use ufw to do port forwarding? Specifically im wanting to forward incoming traffic to my server (same machine ...
3
votes
2answers
5k views

Should I rate-limit packets with iptables?

I'm using iptables on Ubuntu Server. It's a web server on a VPS. I'd like to know if I should rate-limit packets. If so, what should I rate-limit? And should I do so globally or per IP address? ...
2
votes
13answers
9k views

What free options are available for web content filtering? [closed]

I run the IT Dept at a small high school with about 500 users on the network. We have been using SurfControl for this which has been handy because it backs into MS ActiveDirectory very well. We ...
4
votes
3answers
5k views

How to configure remote access to multiple subnets behind a SonicWALL NSA 2400

I have a client that uses a SonicWALL NSA 2400 as their firewall. I need to setup a second LAN subnet for a handful of PC. Management has decided that there should be a second subnet even though ...
3
votes
1answer
916 views

UFW/IPTables: how to securely allow authenticated git access with github

This is how I setup my iptables with UFW: sudo ufw default deny incoming (deny all incoming) sudo ufw default deny outgoing (deny all outgoing) sudo ufw allow out 53 (accept outgoing DNS traffic, ...
3
votes
1answer
3k views

How can I rate limit SSH connections with iptables?

I'm trying to limit the number of possible SSH connections to my server but it just seems to lock me out every time. I'm not very familiar with iptables but I've been reading up on the rules that I ...
2
votes
3answers
2k views

Blocking IP behind a load balancer

Is there any way to block IP address of an intruder (or any IP), when our server is behind a Load balancer. For example if my servers are behind ELB (Amazon ELB) or Rackspace Load balancer, i am ...
2
votes
2answers
1k views

socat connect-connect “proxy” two inbound TCP connections to expose a firewalled service?

I'm struggling a bit trying to see how to use socat (or a similar TCP port redirector) to expose a firewalled service on a PC. Here's the scenario: I have a server PC which will be acting as a ...
2
votes
2answers
2k views

IPFire firewall under Hyper-V. How to get synthetic devices working?

The latest version of IPFire (v2.7 core 38) uses the linux 2.6.32.15 kernel. This includes Microsoft's Hyper-V synthetic drivers. How do I get them working? When IPFire boots, it loads the hv_vmbus ...
1
vote
4answers
3k views

Linux Firewall + Loadbalancer distribution

Can anyone recommend a Linux specialized distribution (or appliance) which provides both Firewall and Load-balancer? Something similar to IPCop for example, but containing LB as well? Thanks in ...
0
votes
2answers
2k views

Linux iptables allow some ports

We have a Linux server (CentOS 6.3), where all ports seem to be accessible from inside (when tried from the server), but only SSH is accessible from outside. I would like to allow some other ports, ...
6
votes
2answers
3k views

Is there a secure way to allow IIS 7 in a DMZ to access a DB server behind the firewall?

Our network admins are adamant that it is insecure for our web servers, which are hosted in the DMZ, to access the DB server behind our firewall. To get round the problem, we access the data via web ...
5
votes
1answer
655 views

Block outgoing connections for certaing uids (root, apache, nobody)

With iptables in CentOS 5 and 6 Linux - how can you please prevent processes running as root, apache or nobody from initiating outgoing connections? On CentOS 5 Linux I've tried putting these lines ...
5
votes
2answers
2k views

Linux fails to interpret ACK, keeps resending SYN+ACK

The following is a wireshark dump of the problem occurring, IP-adresses replaced with 'client' and 'server': 4414.229553 client -> server TCP 62464 > http [SYN] Seq=0 Win=65535 Len=0 MSS=1452 ...
5
votes
4answers
500 views

iptables: change policy or use catch-all rule?

What do you do when setting up iptables: change the default policy (iptables -P INPUT DROP, for example) or add a catch-all rule at the end of the ruleset (iptables -A INPUT DROP)? If you do prefer ...
5
votes
6answers
785 views

Advice a good hardware firewall [closed]

Which firewall would you advice to use to meet following 1Gb line and most anti hacking modules. Price range 10k-15k$. 3 years warranty on site, full support online. About modules, i don't know what ...
3
votes
2answers
4k views

Reduce firewall rules by half - one iptables rule for tcp and udp

I have a number of iptables rules on my firewall that look like this: iptables -A zone_lan_forward -p tcp -d 1.2.3.0/24 -j ACCEPT iptables -A zone_lan_forward -p udp -d 1.2.3.0/24 -j ACCEPT Is ...
3
votes
1answer
777 views

iptables preroute localhost

I would like to forward all incoming traffic from a certain port to another one using iptables. The problem is that prerouting doesn't work for traffic from localhost. This topic suggests a solution: ...
3
votes
3answers
4k views

How long does it take for an iptables rule to apply?

How long does it take for an iptables rule to apply? I use a script with the code below in an attempt to block hosts, but they don't appear to take immediately. Is there some delay, is iptables not ...
3
votes
3answers
12k views

Cisco ASA logs “regular translation creation failed for icmp …” for DNS traffic, yet it works

Every few minutes our Cisco ASA 5505 firewall is logging errors that I can't figure out with my limited Cisco experience. Severity Date Time Syslog ID Source IP Destination IP ...
3
votes
5answers
3k views

connect to ssh server thru 80 via HTTP proxy?

Please help: I want to connect to my ssh server at home However, I'm behind a corporate (CORP) firewall, which blocks almost all ports (443, 22, 23 etc). But it seems that 80 is not blocked, coz I ...
3
votes
4answers
5k views

outbound ports that are always open

What are some ports that can NEVER be blocked outbound in firewalls, as doing so will stop basic internet use? Some I can think of are: port 53 udp/tcp -- dns, blocking this will prevent users ...
3
votes
8answers
41k views

How to enable sshd on Fedora 11?

I have just installed Fedora 11 on my desktop system and would like to have sshd work. These are the steps I have done: Enabled sshd as a trusted service using system-config-firewall Restarted sshd ...
2
votes
1answer
5k views

How to make iptables ALLOW rule for multicast?

I have two servers that uses ucarp as failover. On each server eth1:1 is reserved for ucarp's keepalive connection. ucarp uses the destination IP as multicast address 224.0.0.18. On ucarp master ...
2
votes
4answers
892 views

Linux router and firewall with IP accounting

I'm working on a project to replace my organisation's aging Slackware gateway/router/firewall machine, which will have several hundred users behind it. Previously we used rc.firewall but we are now ...
2
votes
4answers
620 views

How to browse to a webserver which is reachable through the SSH port only

I have a server at work which is behind a firewall (the company's firewall) so it is reachable only thrugh port 22 (SSH). I'm able to connect to the server with putty without problems. Also, that ...
2
votes
1answer
15k views

How to configure PFSense firewall with external transparent Squid proxy?

I am using PFSense 2.0 and trying to get transparent proxy to work. As the internal Squid won't work with loadbalancing and dual-wan (and it seems Squid doesn't work at all on the latest build), I ...
1
vote
3answers
673 views

Securing a guest VM to give it internet access, but block access to host LAN

I have a Linux guest VM running under a Windows host. If I set the networking mode to NAT, the guest can get internet access (which I want), but can also access the hosts LAN (which I dont). For ...
1
vote
2answers
4k views

pfsense setting up as transparent firewall - dhcp issue

I followed the directions to set up pfsense in bridged / transparent mode per the instructions at http://doc.pfsense.org/index.php/Configuring_pfSense However I can not get a dhcp address from my ...
1
vote
3answers
288 views

Network Question

I have a question about whether something is 'possible' by default or requires additional setup. Lets say I have two systems behind a firewall and they are in the same domain and subnet. System 1 has ...
1
vote
1answer
2k views

CSF firewal - how does csf.allow work?

In my csf.allow file I have (something like): 98.765.43.21 tcp:in:d=20:s=12.345.67.89 tcp:in:d=21:s=12.345.67.89 Am I right in thinking that this will 1) always allow any service for 98.765.43.21 ...
1
vote
1answer
1k views

How to stop OpenEsb Glassfish Admin console from opening connection to glassfishesb.org

I have a Glassfish v2.1 app server (OpenEsb distribution) running behind a very restrictive firewall. Some times a bottom frame will appear, trying to connect to this address: ...
1
vote
4answers
12k views

FTP/SSL in passive mode with portrange, which ports has to be open on the firewall?

We have to use FTP over SSL on our server and use a portrange with 5 ports for the data connection. A firewall is between client and server. We have to know what we have to open at the firewall: port, ...
0
votes
1answer
330 views

Can these IPv4 and IPv6 firewall rules be hardened any further? [closed]

I am running Ubuntu 10.04. Here are the IPv4 firewall rules that I've been using now for a few months: *filter #Allow all loopback (lo0) traffic and drop all traffic to 127/8 #that doesn't use lo0 ...
0
votes
2answers
645 views

ConfigServer Security and Firewall — after setup, how much daily management required?

I'm looking at using ConfigServer Security and Firewall (CSF; iptables-based). After I configure it properly, how much daily ongoing management is required of me to keep my server secure? Am I going ...
0
votes
2answers
356 views

Web server hardware firewall recommendations [closed]

I'm looking for a specific hardware firewall model solutions that best accommodate the following concerns [Cisco models are best, because our colo can get good deals on them reconditioned]: There ...
0
votes
1answer
1k views

How to relax firewall for UDP connections/ports for a specific IP address?

My server is Red Hat Enterprise Linux Server release 5. iptables version is v1.3.5. I want to allow all UDP connections / port for the IP address 192.168.0.200. This IP address is configured in my ...
0
votes
1answer
2k views

Multiple interface NAT routing

I have multiple internet connections from different ISPs and I need to route certain traffic over a particular ISP link. I am using Debian for this. The setup is as follows; eth0 (IP address is ...
-1
votes
3answers
285 views

iptables — am I doing this right?

UPDATE Boy am I glad I asked. OK, I'll try again and post another question. I'd like to set up a CentOS 5.3 host to allow only ping, ssh, httpd, and SSL connections. After reading a tutorial and ...
6
votes
3answers
302 views

Is there already a recommended IPv6 Firewall setup?

I'd like to switch from private-IPv4-subnet-behind-NAT to IPv6, but of course I have no intention of exposing my users' workstations "unprotected" to the net. Some obvious points up-front: Allow ...
5
votes
9answers
3k views

Block users from Social networking websites while firewall is down

We currently have a SonicWall firewall, which does a pretty good job a blocking Social networking websites like Facebook and Bebo. The problem we are having is that sometimes we need to temporarily ...
4
votes
3answers
2k views

Comparison of Firewall, Intrusion Prevention, Detection and Antivirus Technologies in Organizational Network Architecture

in these days i'm reading about intrusion prevention/detection systems.When reading i really confused in some points. First, the firewall and antivirus technologies are known terms for years, however ...
4
votes
2answers
7k views

Should I use TCP or UDP to run a web server

I have just installed Apache web server on my computer. I have managed to use it locally (I can open index.php from my computer using my web browser). But I would like to make my web site available ...
3
votes
1answer
289 views

Need help understanding capturing from Wireshark?

I am having issues with my FTP servers. Connecting, sending and receiving fail sometimes, and it is not consistent. I manage to capture and filter by IP the packets, I just need pointers on what can ...