A Firewall is an application or hardware device used to inspect and filter network traffic.

learn more… | top users | synonyms

9
votes
3answers
5k views

Rate limiting with UFW: setting limits

UFW's man page mentions that it can setup iptables rate limiting for me: ufw supports connection rate limiting, which is useful for protecting against brute-force login attacks. ufw ...
9
votes
5answers
4k views

Managing parallel rules for ipv4 and ipv6 iptables?

We've recently started experimenting with IPv6, and one of the first issues we're having to contend with is dealing with a completely separate set of firewall (Linux iptables/ip6ables) rules for the ...
9
votes
1answer
483 views

Kerberos authentication, service host and access to KDC

I have a web application (hostname: service.domain.com) and I wish to use Kerberos authentication to identify users that are logged into a Windows domain. Microsoft AD (Windows Server 2008 R2) is ...
8
votes
3answers
3k views

What are the named ports for iptables?

When setting up iptables you can name the port ssh which will use port 22. Is there a list of all the named ports? Specifically I need ssh, http, https and mysql.
8
votes
3answers
15k views

Linux/iptables: best way to clear all rules, leaving anything open

Currently have this snippet: iptables -F // flush all chains iptables -t nat -F iptables -t mangle -F iptables -X // delete all chains Is there a possibility that some impervious rule will stay ...
8
votes
11answers
3k views

SOHO - throttle bittorrent traffic from problem users

I manage the network in a small office (SW dev is my "real job"), and there are a couple of users who beat the hell out of our internet connection by running bittorrent. Between the almost crippling ...
8
votes
2answers
475 views

How to configure a small network of computers within a larger university network?

I have a small computer lab (8 HP workstations, 1 HP server, 2 NAS boxes, 1 HP networked printer) where currently all the devices are connected directly to my university's network. Each device has an ...
8
votes
4answers
1k views

Slow down individual connections passing through a Linux router?

We have a Linux server acting as a router/firewall for our office. Occasionally someone will upload a large file that takes up all our bandwidth. I don't want to implement any complex rules or traffic ...
8
votes
2answers
307 views

Is it reasonable to use Nagios to check that a service is NOT available?

Suppose I have a server with a private interface and a public interface. Public might have things like HTTP(S) servers, private might have MySQL and SSH. Obviously Nagios is useful to check that the ...
8
votes
4answers
1k views

OpenBSD/FreeBSD Firewall w/ GUI that is compatible with Intel 82574L Gigabit LAN NICs

I recently purchased a server to run m0n0wall or pfSense but I've learned since then that both of these firewall products are based on versions of FreeBSD which weren't yet compatible with the NICs in ...
8
votes
2answers
1k views

Linux iptables / conntrack performance issue

I have a test-setup in the lab with 4 machines: 2 old P4 machines (t1, t2) 1 Xeon 5420 DP 2.5 GHz 8 GB RAM (t3) Intel e1000 1 Xeon 5420 DP 2.5 GHz 8 GB RAM (t4) Intel e1000 to test linux firewall ...
7
votes
2answers
5k views

Virtualized firewall under Hyper-V?

We are currently considering installing an instance of pfSense on our Hyper-V R2 based server to act as a content filter, captive portal and general firewall. Although it is usually bad practice to ...
7
votes
4answers
14k views

Firewall blocking FTP server on Windows 2008 R2

I can access the FTP site without problems from the local machine, but it times out from the remote machine. If I turn the firewall off COMPLETELY, it works. Obviously, this isn't really a ...
7
votes
3answers
671 views

What is the ip range of EC2

I'd like to setup a rule to block ssh request from EC2 since I've been seeing a large amount of ssh based attack from there and was wondering if anyone knew what their IP ranges are. EDIT: Thank you ...
7
votes
6answers
387 views

Firewall anti-patterns?

What are some of the most common and wrong ways to configure a firewall? I'll start the list with the following: Blindly blocking ICMP. This was common practice in 1998 when smurf attacks were all ...
7
votes
2answers
4k views

tcp flags in iptables: What's the difference between RST SYN and RST and SYN RST ? When to use ALL?

I'm working on a firewall for a virtual dedicated server and one of the things I'm looking into is port scanners. TCP flags are used for protection. I have 2 questions. The rule: -p tcp ...
7
votes
3answers
2k views

Running a webserver behind a firewall, is it secure?

Currently we have a Linux-based firewall which NAT-ing our public IP address to give internet access to our staff's PCs and a Windows Server 2003 for internal filesharing. I want to host Redmine/SVN ...
7
votes
2answers
3k views

pfSense Firewall or Linksys/Cisco router for small offices

I'm about to start switching some networks around for multiple small offices. Each office has about 10 to 15 users and 10 to 15 computers. Each office has a spread of generic routers and access ...
7
votes
7answers
7k views

Linux equivalent of pfsync+carp for failover firewall/routing

I'm currently using a linux box to handle my firewall/NAT using iptables. It has two NICs, one link to a LAN switch, one to our egress Internet provider. I'm looking at upgrade this box to two boxes ...
7
votes
3answers
9k views

Disabling Windows Server 2008 firewall

I applied a Windows firewall rule that blocks all tcp connection and thus kicked myself out of remote desktop on a dedicated server. I managed to get into recovery via VNC, which is basically a ...
7
votes
4answers
5k views

What to do with an out-of-warranty Barracuda Spam/Web filter?

I'm working with an organization that would like to start using a old Barracuda Spam Filter 300 unit. I've sold and configured plenty of these, but was surprised to see that this unit's warranty ...
7
votes
2answers
736 views

Why are people trying to connect to my network on TCP port 445?

I was playing with my new syslog server and had my m0n0wall firewall logs forwarded as a test, I noticed a bunch of recent firewall log entries that say that it blocked other WAN IPs from my ISP (I ...
7
votes
2answers
167 views

Still worthwhile to firewall/filter ssh access except from specific IPs?

A number of years ago now, there were several remote exploits for OpenSSH which prompted many admins including myself to start filtering port 22 at the network perimeter, permitting only IP addresses ...
7
votes
2answers
2k views

Block IP on EC2. Firewall or other options?

My EC2 (Fedora AMI) based service is being heavily hit by a rogue misconfigured client. What options do I have to block the IP of this rogue client?
7
votes
1answer
695 views

Cisco FWSM -> ASA upgrade broke our mail server

We send mail with unicode asian characters to our mail server on the other side of our WAN... immediately after upgrading from a FWSM running 2.3(2) to an ASA5550 running 8.2(5), we saw failures on ...
6
votes
3answers
616 views

What's wrong with using windows firewall?

I was developing a system which requires connection between two computers. I decided to connect the two machines together via direct ethernet cable. My boss didn't like it as there is no firewall in ...
6
votes
5answers
5k views

Making iptables easier to maintain

My network is completely locked down except for a few sites which are whitelisted. This is all done through iptables, which looks something like this: # Allow traffic to google.com iptables -A ...
6
votes
2answers
473 views

For an internet-facing, all-roles-in-one Exchange server, what do I need to let through the firewall?

As the result of a recent penetration test, in which we did not fare well, it has been brought to my attention that our internet facing, all-roles-in-one, Exchange 2010 SP3 server has no firewall in ...
6
votes
9answers
21k views

block Torrent through firewall

is there a way to block users on firewall level from using torrents?
6
votes
2answers
385 views

When an IP or a block of IPs are assigned to you, do the network admins just add them to a router?

Let's say there is a router to the internet and a router separates your network from others within a data center. When the data center provided gives you IP addresses, do they just take a [set] of ...
6
votes
3answers
306 views

Is there already a recommended IPv6 Firewall setup?

I'd like to switch from private-IPv4-subnet-behind-NAT to IPv6, but of course I have no intention of exposing my users' workstations "unprotected" to the net. Some obvious points up-front: Allow ...
6
votes
6answers
7k views

Why block outbound ICMP?

This question is slightly related to "Why Block Port 22 Outbound?". I don't see how this can be a notable security risk.
6
votes
2answers
701 views

Gigabit network with a 100 megabit firewall

We have set up all the equipment necessary to have a gigabit network. All servers + workstations are running gigabit cards, just bought a 16 port switch that can handle gigabit as well. My concern is ...
6
votes
9answers
2k views

Need prosumer router/firewall/vpn/vlan/nat advice [closed]

Looking for a recommendation on a device (or devices I guess) to do router/firewall/vpn/vlan/nat functons for my home network. Right now, I'm doing this with an IPCop box, but I'd prefer a little ...
6
votes
2answers
2k views

Running multiple services on Port 443, Tunnel SSH over HTTPS

Situation: I want to tunnel SSH sessions through HTTPS. I have a very restrictive firewall/proxy which only allows HTTP, FTP and HTTPS traffic. What works: Setting up a tunnel through the proxy to a ...
6
votes
3answers
9k views

IPTables: allow SSH access only, nothing else in or out

How do you configure IPTables so that it will only allow SSH in, and allow no other traffic in or out? Any safety precautions anyone can recommend? I have a server that I believe has been migrated ...
6
votes
1answer
762 views

Block outgoing connections for certaing uids (root, apache, nobody)

With iptables in CentOS 5 and 6 Linux - how can you please prevent processes running as root, apache or nobody from initiating outgoing connections? On CentOS 5 Linux I've tried putting these lines ...
6
votes
5answers
11k views

How do I scan a firewall to find open outgoing ports?

I'm looking for a tool that I can use within a firewalled network to scan the firewall to find open outgoing ports. I've done some research and found Firewalk but it hasn't been maintained in 10 ...
6
votes
1answer
125 views

Tools for detecting network traffic filtering [closed]

In Iran we have an ongoing problem with the govt. blocking and manipulating various network protocols. I'm looking for a tool, framework or platform to help us analyze and report on any of these ...
6
votes
5answers
4k views

“No route to host” with ssl but not with telnet

I have a strange problem with connecting to a https site from one of my servers. When I type: telnet puppet 8140 I am presented with a standard telnet console and can talk to the Server as ...
6
votes
2answers
3k views

Is there a secure way to allow IIS 7 in a DMZ to access a DB server behind the firewall?

Our network admins are adamant that it is insecure for our web servers, which are hosted in the DMZ, to access the DB server behind our firewall. To get round the problem, we access the data via web ...
6
votes
3answers
12k views

Firewall rule to allow access to windows updates or other resources on a CDN?

What's the best way to poke a firewall hole in a border firewall to allow windows updates? As far as I can tell, the windows update sites are hosted on a content distribution network that can ...
6
votes
5answers
2k views

DDoS Protection Services - are they good enough? [duplicate]

first of all, I understand that it's better to have DDoS protections on data center level. But our DC is not ready to provide good quality of protection. So we thinking about using some external DDoS ...
6
votes
3answers
3k views

Border firewalls and routing — static vs dynamic routing

Let's say you've got an enterprise with a small internet presence in the form of a DNS server, a web server, and a VPN server, all on the DMZ (in this case, an invisible pair of switches connected ...
5
votes
9answers
3k views

Block users from Social networking websites while firewall is down

We currently have a SonicWall firewall, which does a pretty good job a blocking Social networking websites like Facebook and Bebo. The problem we are having is that sometimes we need to temporarily ...
5
votes
7answers
28k views

How can I block Spotify on our company network?

How can I block Spotify on our company network? Unfortunately it's killing our bandwidth and the effect is really serious.
5
votes
1answer
7k views

linux: traceroute send operation not permitted for remote server

When I try to traceroute to a remote ip, I get send: Operation not permitted When I stop iptables, traceroute works fine. So, I assume I need some ip rule for send. What would that rule be? I did ...
5
votes
8answers
7k views

Why Place Load-Balancer Behind Firewall?

I'm considering purchasing an F5 load balancing device which will proxy inbound HTTP connections to one of five web servers on my internal network. My assumption was that the F5's external interface ...
5
votes
8answers
5k views

What is the best Web Application Firewall for IIS? [closed]

What is the best Web Application Firewall(WAF) for IIS? What makes it better than the others? How useful is it at blocking attacks against poorly written code, otherwise known as an Intrusion ...
5
votes
2answers
430 views

Where does a firewall application fit into the software stack?

I'm trying to figure out where a firewall application on a server fits into the software stack, and at what point in the networking process the firewall "kicks in," from the perspective of an ...