A Firewall is an application or hardware device used to inspect and filter network traffic.

learn more… | top users | synonyms

8
votes
2answers
462 views

How to configure a small network of computers within a larger university network?

I have a small computer lab (8 HP workstations, 1 HP server, 2 NAS boxes, 1 HP networked printer) where currently all the devices are connected directly to my university's network. Each device has an ...
8
votes
3answers
5k views

Rate limiting with UFW: setting limits

UFW's man page mentions that it can setup iptables rate limiting for me: ufw supports connection rate limiting, which is useful for protecting against brute-force login attacks. ufw ...
8
votes
4answers
1k views

Slow down individual connections passing through a Linux router?

We have a Linux server acting as a router/firewall for our office. Occasionally someone will upload a large file that takes up all our bandwidth. I don't want to implement any complex rules or traffic ...
8
votes
2answers
262 views

Is it reasonable to use Nagios to check that a service is NOT available?

Suppose I have a server with a private interface and a public interface. Public might have things like HTTP(S) servers, private might have MySQL and SSH. Obviously Nagios is useful to check that the ...
8
votes
3answers
1k views

OpenBSD/FreeBSD Firewall w/ GUI that is compatible with Intel 82574L Gigabit LAN NICs

I recently purchased a server to run m0n0wall or pfSense but I've learned since then that both of these firewall products are based on versions of FreeBSD which weren't yet compatible with the NICs in ...
7
votes
2answers
4k views

Virtualized firewall under Hyper-V?

We are currently considering installing an instance of pfSense on our Hyper-V R2 based server to act as a content filter, captive portal and general firewall. Although it is usually bad practice to ...
7
votes
3answers
665 views

What is the ip range of EC2

I'd like to setup a rule to block ssh request from EC2 since I've been seeing a large amount of ssh based attack from there and was wondering if anyone knew what their IP ranges are. EDIT: Thank you ...
7
votes
4answers
5k views

Where does UFW (uncomplicated firewall) save command-line rules to?

You add a rule like this: ufw allow 22/tcp The rule is saved, and is applied even after reboot. But it's not written anywhere in /etc/ufw. Where is it saved to? (Ubuntu, using ufw as ...
7
votes
4answers
12k views

Firewall blocking FTP server on Windows 2008 R2

I can access the FTP site without problems from the local machine, but it times out from the remote machine. If I turn the firewall off COMPLETELY, it works. Obviously, this isn't really a ...
7
votes
6answers
387 views

Firewall anti-patterns?

What are some of the most common and wrong ways to configure a firewall? I'll start the list with the following: Blindly blocking ICMP. This was common practice in 1998 when smurf attacks were all ...
7
votes
3answers
2k views

Running a webserver behind a firewall, is it secure?

Currently we have a Linux-based firewall which NAT-ing our public IP address to give internet access to our staff's PCs and a Windows Server 2003 for internal filesharing. I want to host Redmine/SVN ...
7
votes
2answers
3k views

pfSense Firewall or Linksys/Cisco router for small offices

I'm about to start switching some networks around for multiple small offices. Each office has about 10 to 15 users and 10 to 15 computers. Each office has a spread of generic routers and access ...
7
votes
2answers
3k views

tcp flags in iptables: What's the difference between RST SYN and RST and SYN RST ? When to use ALL?

I'm working on a firewall for a virtual dedicated server and one of the things I'm looking into is port scanners. TCP flags are used for protection. I have 2 questions. The rule: -p tcp ...
7
votes
2answers
4k views

Are EC2 security group changes effective immediately for running instances?

I have an EC2 instance running, and it belongs to a security group. If I add a new allowed connection to that security group through AWS Management Console, should that change be effective ...
7
votes
7answers
7k views

Linux equivalent of pfsync+carp for failover firewall/routing

I'm currently using a linux box to handle my firewall/NAT using iptables. It has two NICs, one link to a LAN switch, one to our egress Internet provider. I'm looking at upgrade this box to two boxes ...
7
votes
3answers
7k views

Disabling Windows Server 2008 firewall

I applied a Windows firewall rule that blocks all tcp connection and thus kicked myself out of remote desktop on a dedicated server. I managed to get into recovery via VNC, which is basically a ...
7
votes
4answers
5k views

What to do with an out-of-warranty Barracuda Spam/Web filter?

I'm working with an organization that would like to start using a old Barracuda Spam Filter 300 unit. I've sold and configured plenty of these, but was surprised to see that this unit's warranty ...
7
votes
2answers
721 views

Why are people trying to connect to my network on TCP port 445?

I was playing with my new syslog server and had my m0n0wall firewall logs forwarded as a test, I noticed a bunch of recent firewall log entries that say that it blocked other WAN IPs from my ISP (I ...
7
votes
2answers
166 views

Still worthwhile to firewall/filter ssh access except from specific IPs?

A number of years ago now, there were several remote exploits for OpenSSH which prompted many admins including myself to start filtering port 22 at the network perimeter, permitting only IP addresses ...
7
votes
2answers
2k views

Block IP on EC2. Firewall or other options?

My EC2 (Fedora AMI) based service is being heavily hit by a rogue misconfigured client. What options do I have to block the IP of this rogue client?
7
votes
1answer
608 views

Cisco FWSM -> ASA upgrade broke our mail server

We send mail with unicode asian characters to our mail server on the other side of our WAN... immediately after upgrading from a FWSM running 2.3(2) to an ASA5550 running 8.2(5), we saw failures on ...
7
votes
2answers
969 views

Linux iptables / conntrack performance issue

I have a test-setup in the lab with 4 machines: 2 old P4 machines (t1, t2) 1 Xeon 5420 DP 2.5 GHz 8 GB RAM (t3) Intel e1000 1 Xeon 5420 DP 2.5 GHz 8 GB RAM (t4) Intel e1000 to test linux firewall ...
6
votes
3answers
610 views

What's wrong with using windows firewall?

I was developing a system which requires connection between two computers. I decided to connect the two machines together via direct ethernet cable. My boss didn't like it as there is no firewall in ...
6
votes
5answers
4k views

Making iptables easier to maintain

My network is completely locked down except for a few sites which are whitelisted. This is all done through iptables, which looks something like this: # Allow traffic to google.com iptables -A ...
6
votes
2answers
391 views

For an internet-facing, all-roles-in-one Exchange server, what do I need to let through the firewall?

As the result of a recent penetration test, in which we did not fare well, it has been brought to my attention that our internet facing, all-roles-in-one, Exchange 2010 SP3 server has no firewall in ...
6
votes
9answers
21k views

block Torrent through firewall

is there a way to block users on firewall level from using torrents?
6
votes
2answers
375 views

When an IP or a block of IPs are assigned to you, do the network admins just add them to a router?

Let's say there is a router to the internet and a router separates your network from others within a data center. When the data center provided gives you IP addresses, do they just take a [set] of ...
6
votes
2answers
31k views

CentOS 7 Firewall Configuration

In CentOS 6 I could type setup from the command line and I would be presented with a set of tools, one of them being Firewall configuration. I can still do this in CentOS 7, except the list no longer ...
6
votes
3answers
305 views

Is there already a recommended IPv6 Firewall setup?

I'd like to switch from private-IPv4-subnet-behind-NAT to IPv6, but of course I have no intention of exposing my users' workstations "unprotected" to the net. Some obvious points up-front: Allow ...
6
votes
6answers
7k views

Why block outbound ICMP?

This question is slightly related to "Why Block Port 22 Outbound?". I don't see how this can be a notable security risk.
6
votes
2answers
657 views

Gigabit network with a 100 megabit firewall

We have set up all the equipment necessary to have a gigabit network. All servers + workstations are running gigabit cards, just bought a 16 port switch that can handle gigabit as well. My concern is ...
6
votes
9answers
2k views

Need prosumer router/firewall/vpn/vlan/nat advice [closed]

Looking for a recommendation on a device (or devices I guess) to do router/firewall/vpn/vlan/nat functons for my home network. Right now, I'm doing this with an IPCop box, but I'd prefer a little ...
6
votes
2answers
2k views

Running multiple services on Port 443, Tunnel SSH over HTTPS

Situation: I want to tunnel SSH sessions through HTTPS. I have a very restrictive firewall/proxy which only allows HTTP, FTP and HTTPS traffic. What works: Setting up a tunnel through the proxy to a ...
6
votes
3answers
8k views

IPTables: allow SSH access only, nothing else in or out

How do you configure IPTables so that it will only allow SSH in, and allow no other traffic in or out? Any safety precautions anyone can recommend? I have a server that I believe has been migrated ...
6
votes
5answers
10k views

How do I scan a firewall to find open outgoing ports?

I'm looking for a tool that I can use within a firewalled network to scan the firewall to find open outgoing ports. I've done some research and found Firewalk but it hasn't been maintained in 10 ...
6
votes
1answer
124 views

Tools for detecting network traffic filtering [closed]

In Iran we have an ongoing problem with the govt. blocking and manipulating various network protocols. I'm looking for a tool, framework or platform to help us analyze and report on any of these ...
6
votes
5answers
4k views

“No route to host” with ssl but not with telnet

I have a strange problem with connecting to a https site from one of my servers. When I type: telnet puppet 8140 I am presented with a standard telnet console and can talk to the Server as ...
6
votes
2answers
3k views

Is there a secure way to allow IIS 7 in a DMZ to access a DB server behind the firewall?

Our network admins are adamant that it is insecure for our web servers, which are hosted in the DMZ, to access the DB server behind our firewall. To get round the problem, we access the data via web ...
6
votes
3answers
11k views

Firewall rule to allow access to windows updates or other resources on a CDN?

What's the best way to poke a firewall hole in a border firewall to allow windows updates? As far as I can tell, the windows update sites are hosted on a content distribution network that can ...
6
votes
5answers
2k views

DDoS Protection Services - are they good enough? [duplicate]

first of all, I understand that it's better to have DDoS protections on data center level. But our DC is not ready to provide good quality of protection. So we thinking about using some external DDoS ...
6
votes
3answers
3k views

Border firewalls and routing — static vs dynamic routing

Let's say you've got an enterprise with a small internet presence in the form of a DNS server, a web server, and a VPN server, all on the DMZ (in this case, an invisible pair of switches connected ...
5
votes
9answers
3k views

Block users from Social networking websites while firewall is down

We currently have a SonicWall firewall, which does a pretty good job a blocking Social networking websites like Facebook and Bebo. The problem we are having is that sometimes we need to temporarily ...
5
votes
1answer
6k views

linux: traceroute send operation not permitted for remote server

When I try to traceroute to a remote ip, I get send: Operation not permitted When I stop iptables, traceroute works fine. So, I assume I need some ip rule for send. What would that rule be? I did ...
5
votes
8answers
6k views

Why Place Load-Balancer Behind Firewall?

I'm considering purchasing an F5 load balancing device which will proxy inbound HTTP connections to one of five web servers on my internal network. My assumption was that the F5's external interface ...
5
votes
2answers
426 views

Where does a firewall application fit into the software stack?

I'm trying to figure out where a firewall application on a server fits into the software stack, and at what point in the networking process the firewall "kicks in," from the perspective of an ...
5
votes
2answers
181 views

What is an “application firewall”?

Trying to find out more about apple's "Firewall". What exactly is it? In /usr/libexec/ApplicationFirewall there are a bunch of undocumented programs, I've wandered through the mystery maze of ...
5
votes
1answer
156 views

Techniques to implement iptables rules

Usually a limited amount of services are configured on a server and most of the not needed ones are shut down, I was wondering what would be the best approach to firewalling with iptables. Is it ...
5
votes
1answer
836 views

Cannot modify iptables on CentOS

My question: How to add a custom iptables rule to accept connection on a certain port? I'm trying to open port 3500 on my server but failed. I started by using this command: (From ...
5
votes
5answers
792 views

NAT as a firewall

Network Address Translation ( NAT ), seems to sort of act as a firewall for the hosts behind it because they are not available. Although I would never rely on this as my firewall, what are its ...
5
votes
3answers
1k views

How can I block a specific type of DDoS attack?

My site is being attacked and is using up all the RAM. I looked at the Apache logs and every malicious hit seems to simply be a POST request on /, which is never required by a normal user. So I ...