A Firewall is an application or hardware device used to inspect and filter network traffic.

learn more… | top users | synonyms

12
votes
5answers
23k views

A secure, standard iptables rule-set for a basic HTTP(s) webserver

I have been trying to put together a basic server iptables script that will work for most sites just running a basic webserver using HTTP(S) and SSH (ports 80, 443, & 22). After all, most VPS only ...
12
votes
2answers
8k views

Do I need seperate iptables rule for ipv6 address?

On my debian 5.0 server, I setup some iptables rules like below: ACCEPT tcp -- eee.fff.ggg.hhh aaa.bbb.ccc.ddd tcp dpt:80 DROP tcp -- 0.0.0.0/0 aaa.bbb.ccc.ddd ...
12
votes
5answers
2k views

Reviewing firewall rules

I need to review firewall rules of a CheckPoint firewall for a customer (with 200+ rules). I have used FWDoc in the past to extract the rules and convert them to other formats but there was some ...
11
votes
8answers
28k views

Blocking Facebook and Myspace by IP address

I'm having some trouble making a Cisco ASA device block certain social networking sites which have become time sinks in our office. This question is really in two parts: Is there a reliable way to ...
11
votes
9answers
3k views

Why buy high end hardware firewalls?

There exist firewalls from Juniper and Cisco that cost more than a house. So I wonder: what does one get from a $10.000+ firewall compared to an 2U server with 4x 10Gbit network cards running e.g. ...
11
votes
13answers
1k views

What decent small-office level routers are there [closed]

So let's say I have a network of less than 20 computers including a server that needs to be accessed externally. What router/firewall solutions would you recommend? It can be either hardware or ...
11
votes
2answers
141k views

TCP/IP ports necessary for CIFS/SMB operation

If I want to allow Windows networked drives between two firewalled computers, do I need to open ports 137-139, or is port 445 sufficient? I have to submit a form and get approval to open firewall ...
11
votes
4answers
5k views

Good 1U Rack Firewall [closed]

I'm trying to find a good 1U rack firewall at a reasonable price. Most pricing is completely out of space (thousands of dollars? Why?). I don't want to list all features I need/want (there are too ...
10
votes
10answers
6k views

Basic firewall, switch, & router device? [closed]

I am a developer and haven't dealt with server admin or networking in years, so "rusty" is very generous. I am setting up a new web server cluster (starting with two 1U web servers and one DB server). ...
10
votes
7answers
56k views

Free Windows server anti-virus and firewall programs?

What are some free Windows server anti-virus and firewall programs that can be installed at Windows Server 2003? The primary services of my server is to host PHP websites and a few VB.NET socket ...
10
votes
1answer
2k views

Amplified reflected attack on DNS servers

The term Amplified reflected attack is new to me, and I have a few questions about it. I've heard it mostly happens with DNS servers - is that true? How do you protect against it? How do you know if ...
10
votes
5answers
5k views

Managing parallel rules for ipv4 and ipv6 iptables?

We've recently started experimenting with IPv6, and one of the first issues we're having to contend with is dealing with a completely separate set of firewall (Linux iptables/ip6ables) rules for the ...
9
votes
28answers
12k views

What is the most reliable way to send a zip file via email? [closed]

I often have clients email zip files to me only to find out that their corporate firewall has stripped the attached file. What is the most straight-forward way to send a compressed file through email ...
9
votes
4answers
23k views

Firewall blocking FTP server on Windows 2008 R2

I can access the FTP site without problems from the local machine, but it times out from the remote machine. If I turn the firewall off COMPLETELY, it works. Obviously, this isn't really a ...
9
votes
3answers
5k views

What are the named ports for iptables?

When setting up iptables you can name the port ssh which will use port 22. Is there a list of all the named ports? Specifically I need ssh, http, https and mysql.
9
votes
3answers
321 views

advantages in closing a port where no services are running

Are there advantages in closing a port where no services are running? What do I gain in terminating a connection at iptables level instead of what does it next (I guess OS).
9
votes
1answer
711 views

Kerberos authentication, service host and access to KDC

I have a web application (hostname: service.domain.com) and I wish to use Kerberos authentication to identify users that are logged into a Windows domain. Microsoft AD (Windows Server 2008 R2) is ...
8
votes
2answers
18k views

How to open port for a specific IP address with firewall-cmd on CentOS?

I would like to open port 4567 for the IP address 1.2.3.4 with the firewall-cmd command on a CentOS 7.1 server. How can I achieve this, as the documentation I could find was too specific on this?
8
votes
6answers
400 views

Firewall anti-patterns?

What are some of the most common and wrong ways to configure a firewall? I'll start the list with the following: Blindly blocking ICMP. This was common practice in 1998 when smurf attacks were all ...
8
votes
11answers
3k views

SOHO - throttle bittorrent traffic from problem users

I manage the network in a small office (SW dev is my "real job"), and there are a couple of users who beat the hell out of our internet connection by running bittorrent. Between the almost crippling ...
8
votes
1answer
4k views

Fail2ban jail.local vs jail.conf

Does jail.local file act as an override to jail.conf or as a replacement to jail.conf? When I was learning about Fail2Ban from tutorials, most of them usually say either to copy jail.conf to jail....
8
votes
2answers
526 views

How to configure a small network of computers within a larger university network?

I have a small computer lab (8 HP workstations, 1 HP server, 2 NAS boxes, 1 HP networked printer) where currently all the devices are connected directly to my university's network. Each device has an ...
8
votes
4answers
1k views

Slow down individual connections passing through a Linux router?

We have a Linux server acting as a router/firewall for our office. Occasionally someone will upload a large file that takes up all our bandwidth. I don't want to implement any complex rules or traffic ...
8
votes
2answers
473 views

Is it reasonable to use Nagios to check that a service is NOT available?

Suppose I have a server with a private interface and a public interface. Public might have things like HTTP(S) servers, private might have MySQL and SSH. Obviously Nagios is useful to check that the ...
8
votes
1answer
6k views

What is the right iptables rule to allow apt-get to download programs?

When I type something like sudo apt-get install firefox, everything work until it asks me: After this operation, 77 MB of additional disk space will be used. Do you want to continue [Y/n]? Y Then ...
8
votes
3answers
33k views

What does “incoming” and “outgoing” traffic mean?

I've seen many resources explaining how to set up a server's firewall to allow incoming and outgoing traffic on HTTP standard ports (80 and 443), but I can't figure out why I would need either of them....
8
votes
4answers
2k views

OpenBSD/FreeBSD Firewall w/ GUI that is compatible with Intel 82574L Gigabit LAN NICs

I recently purchased a server to run m0n0wall or pfSense but I've learned since then that both of these firewall products are based on versions of FreeBSD which weren't yet compatible with the NICs in ...
8
votes
2answers
3k views

Block IP on EC2. Firewall or other options?

My EC2 (Fedora AMI) based service is being heavily hit by a rogue misconfigured client. What options do I have to block the IP of this rogue client?
8
votes
1answer
1k views

Block outgoing connections for certaing uids (root, apache, nobody)

With iptables in CentOS 5 and 6 Linux - how can you please prevent processes running as root, apache or nobody from initiating outgoing connections? On CentOS 5 Linux I've tried putting these lines ...
8
votes
2answers
4k views

Is there a secure way to allow IIS 7 in a DMZ to access a DB server behind the firewall?

Our network admins are adamant that it is insecure for our web servers, which are hosted in the DMZ, to access the DB server behind our firewall. To get round the problem, we access the data via web ...
8
votes
2answers
1k views

Linux iptables / conntrack performance issue

I have a test-setup in the lab with 4 machines: 2 old P4 machines (t1, t2) 1 Xeon 5420 DP 2.5 GHz 8 GB RAM (t3) Intel e1000 1 Xeon 5420 DP 2.5 GHz 8 GB RAM (t4) Intel e1000 to test linux firewall ...
7
votes
7answers
46k views

How can I block Spotify on our company network?

How can I block Spotify on our company network? Unfortunately it's killing our bandwidth and the effect is really serious.
7
votes
5answers
10k views

Making iptables easier to maintain

My network is completely locked down except for a few sites which are whitelisted. This is all done through iptables, which looks something like this: # Allow traffic to google.com iptables -A ...
7
votes
2answers
5k views

Virtualized firewall under Hyper-V?

We are currently considering installing an instance of pfSense on our Hyper-V R2 based server to act as a content filter, captive portal and general firewall. Although it is usually bad practice to ...
7
votes
3answers
695 views

What is the ip range of EC2

I'd like to setup a rule to block ssh request from EC2 since I've been seeing a large amount of ssh based attack from there and was wondering if anyone knew what their IP ranges are. EDIT: Thank you ...
7
votes
2answers
8k views

tcp flags in iptables: What's the difference between RST SYN and RST and SYN RST ? When to use ALL?

I'm working on a firewall for a virtual dedicated server and one of the things I'm looking into is port scanners. TCP flags are used for protection. I have 2 questions. The rule: -p tcp --tcp-...
7
votes
2answers
12k views

Reduce firewall rules by half - one iptables rule for tcp and udp

I have a number of iptables rules on my firewall that look like this: iptables -A zone_lan_forward -p tcp -d 1.2.3.0/24 -j ACCEPT iptables -A zone_lan_forward -p udp -d 1.2.3.0/24 -j ACCEPT Is ...
7
votes
3answers
2k views

Running a webserver behind a firewall, is it secure?

Currently we have a Linux-based firewall which NAT-ing our public IP address to give internet access to our staff's PCs and a Windows Server 2003 for internal filesharing. I want to host Redmine/SVN (...
7
votes
2answers
4k views

pfSense Firewall or Linksys/Cisco router for small offices

I'm about to start switching some networks around for multiple small offices. Each office has about 10 to 15 users and 10 to 15 computers. Each office has a spread of generic routers and access points....
7
votes
7answers
8k views

Linux equivalent of pfsync+carp for failover firewall/routing

I'm currently using a linux box to handle my firewall/NAT using iptables. It has two NICs, one link to a LAN switch, one to our egress Internet provider. I'm looking at upgrade this box to two boxes ...
7
votes
7answers
8k views

Is there a personal firewall for Linux / Ubuntu? [closed]

I am looking for some kind of personal firewall for Linux, that will monitor all outgoing connections and show me a message asking for permission to open that connection. Like the popular personal ...
7
votes
3answers
14k views

Disabling Windows Server 2008 firewall

I applied a Windows firewall rule that blocks all tcp connection and thus kicked myself out of remote desktop on a dedicated server. I managed to get into recovery via VNC, which is basically a ...
7
votes
4answers
7k views

What to do with an out-of-warranty Barracuda Spam/Web filter?

I'm working with an organization that would like to start using a old Barracuda Spam Filter 300 unit. I've sold and configured plenty of these, but was surprised to see that this unit's warranty ...
7
votes
3answers
10k views

Why can't I ssh or ping my brand new Amazon EC2 instance?

I just created a free EC2 instance with all the defaults. It says it's running in the AWS Management Console. On the "Instance Actions" menu, I click "Connect". I copy the DNS name provided (looks ...
7
votes
9answers
3k views

Need prosumer router/firewall/vpn/vlan/nat advice [closed]

Looking for a recommendation on a device (or devices I guess) to do router/firewall/vpn/vlan/nat functons for my home network. Right now, I'm doing this with an IPCop box, but I'd prefer a little ...
7
votes
2answers
795 views

Why are people trying to connect to my network on TCP port 445?

I was playing with my new syslog server and had my m0n0wall firewall logs forwarded as a test, I noticed a bunch of recent firewall log entries that say that it blocked other WAN IPs from my ISP (I ...
7
votes
2answers
170 views

Still worthwhile to firewall/filter ssh access except from specific IPs?

A number of years ago now, there were several remote exploits for OpenSSH which prompted many admins including myself to start filtering port 22 at the network perimeter, permitting only IP addresses ...
7
votes
1answer
1k views

Will tcpdump see packets that are being dropped by iptables?

I have a firewall with these simple rules: iptables -A INPUT -p tcp -s 127.0.0.1/32 --dport 6000 -j ACCEPT iptables -A INPUT -p tcp -s 192.168.16.20/32 --dport 6000 -j ACCEPT iptables -A INPUT -p tcp ...
7
votes
3answers
16k views

IPTables: allow SSH access only, nothing else in or out

How do you configure IPTables so that it will only allow SSH in, and allow no other traffic in or out? Any safety precautions anyone can recommend? I have a server that I believe has been migrated ...
7
votes
1answer
19k views

Which firewall ports do I need to open in order for a domain trust to work?

I have two Active Directory domains in two different forests; each domain has two DCs (all of them Windows Server 2008 R2). The domains are also in different networks, with a firewall connecting them. ...