A Firewall is an application or hardware device used to inspect and filter network traffic.

learn more… | top users | synonyms

4
votes
7answers
2k views

Real-time traffic monitoring router / firewall device

I'm looking for a router & firewall device that will provide built-in bandwidth monitoring; meaning, I go to the web control panel for the device and I can see a real-time breakdown of how much ...
4
votes
2answers
676 views

How to block an IP using iptables

So this should be a simple issue, but for whatever reason I can't figure it out. Here are my current rules: Chain INPUT (policy ACCEPT) target prot opt source destination block ...
4
votes
2answers
6k views

Can I use pfsense as a DNS server?

If I have a pfsense based firewall in front of my servers, can I use this also for DNS? Thanks
4
votes
5answers
269 views

Requests take a really long time from certain ISP

We have an Apache server with PHP running on a virtual machine. Document roots are inside the users' home folders (/home/users/{first letter}/{username}/), and /home/users/ is mounted over NFS. It ...
4
votes
3answers
1k views

ESXi hosted on public IP without firewall

So I've got an interesting problem. I currently rent a couple of servers from Hetzner (a German hosting provider). Each server has a soft firewall and does something like web hosting / database. I ...
4
votes
5answers
1k views

Host DHCP services on server or firewall/router?

I've been debating with myself about the best place for hosting a LAN's DHCP services. I have the option of either on a sonicwall firewall or a Windows 2008 server. The two things I was looking for ...
4
votes
3answers
5k views

Placing a server in the DMZ vs opening firewall ports

When should you place a server in a DMZ vs opening ports on the firewall and keeping it within the network? I'm referring to active directory servers, IIS servers, and mostly things on a windows based ...
4
votes
6answers
952 views

Skype in a business - what's your view?

We currently don't allow Skype usage on the LAN. The reasons ultimately come down to that great cover-all of "security", though I have to admit that these days I'm not sure if Skype has turned into a ...
4
votes
3answers
381 views

Can't access Exchange OWA from Wireless Subnet - Firewall rule?

The Problem The issue is that I can't access port 80 (or 443) on the Exchange server, unless I add a blanket rule to allow all traffic from the client to the server's subnet. If I add a rule to ...
4
votes
3answers
3k views

Blocking a country (mass iP Ranges), best practice for the actual block

This question has obviously been asked many times in many different forms, but I can't find an actual answer to the specific plan I've got. We run a popular European Commercial deals site, and are ...
4
votes
5answers
401 views

recommend firewall options for a dedicated server

I'm looking for recommendations on firewalls for a dedicated server that will be hosting a few websites of average traffic (5000 uniques monthly). the hosting company has port and full hardware ...
4
votes
5answers
827 views

Is it beneficial to chain multiple firewalls at the perimeter?

I'm currently running ISA 2004 and will soon be running an Untangle box. I've always felt a tiny bit safer putting these more advanced software firewalls behind a dumb hardware firewall (like ...
4
votes
3answers
1k views

Can our firewall detect traffic sniffing inside the network?

We use Cisco ASA's firewall and NAT functions in our network (200 computers). Is there any possibility to configure Cisco ASA to detect traffic sniffering (for example wireshark) and network ...
4
votes
3answers
7k views

Denying ICMP type 3 code 4 traffic - good or bad?

Investigating a slow VPN connection (Cisco ASA IPSec) to a remote office, I noticed on our firewall a lot of access rule matches: Denied ICMP type=3, code=4 from *ip_address* on interface outside I ...
4
votes
1answer
772 views

tcpdump output with iptables REJECT policy enabled

Quick question. I have a firewall with these simple rules: iptables -A INPUT -p tcp -s 127.0.0.1/32 --dport 6000 -j ACCEPT iptables -A INPUT -p tcp -s 192.168.16.20/32 --dport 6000 -j ACCEPT ...
4
votes
1answer
3k views

What is the right iptables rule to allow apt-get to download programs?

When I type something like sudo apt-get install firefox, everything work until it asks me: After this operation, 77 MB of additional disk space will be used. Do you want to continue [Y/n]? Y Then ...
4
votes
1answer
6k views

DMZ Setup with two firewalls - Traffic from DMZ to LAN and LAN to DMZ

I am setting up a network with machines that need to be accessible from the internet. I'm planning on putting these in a DMZ. Some of the machines in the DMZ need access to machines on the private ...
4
votes
2answers
6k views

Should I rate-limit packets with iptables?

I'm using iptables on Ubuntu Server. It's a web server on a VPS. I'd like to know if I should rate-limit packets. If so, what should I rate-limit? And should I do so globally or per IP address? ...
4
votes
1answer
228 views

Can tcpdump tell accessed port numbers?

I have a server with two NICs, and I would like to only have those ports open on eth1 that are being used. Question How do I get tcpdump to tell me the port numbers that is being accessed on eth1?
4
votes
3answers
324 views

node.js 0.4.0 not serving files to external IPs

When I run the following script http = require('http'); http.createServer(function (req, res) { res.writeHead(200, {'Content-Type': 'text/plain'}); res.end('Hello World\n'); }).listen(80, ...
4
votes
3answers
4k views

MSMQ Firewall Ports

I'd like to know what ports need to be opened on a firewall in order to allow public read access to an MSMQ private queue. I'm aware that Microsoft publishes a list of ports here: ...
4
votes
1answer
1k views

Linux NFLOG - documentation, configuration from C

Several different places (e.g. http://wiki.wireshark.org/CaptureSetup/NFLOG) recommend using Linux's "NFLOG" firewall module to capture packets generated by a particular UID, like this: # iptables -A ...
4
votes
3answers
1k views

connected to Centos openvpn but no outside internet access

I am using Windows 7 to connect to a VPS server running CentOS 6.4 First off, I have read every single post and just cant find the solution to my problem I configured my VPN server with openvpn, and ...
4
votes
2answers
189 views

ipv6 multiple addresses and firewall on remote machine

I have an ubuntu server (serverA) which has a couple of IPv6 addresses. One of these is based on it's MAC address, and is known to the network, the other one I presume ubuntu created as a 'private' ...
4
votes
5answers
12k views

Why is this iptables file line failing in CentOS 6

Hi could could anyone help me understand why line 15 is failing supposedly in my iptables file. I'm using CentOS 6. When I try to restart iptables service, get the following: [root@dbserver ~]# ...
4
votes
2answers
3k views

Secure NAT setup with iptables

I have a Debian running device that needs to act as an internet-gateway. On top of that I want to provide a firewall that not only blocks inbound traffic, but also outbound traffic. And I figured ...
4
votes
2answers
4k views

How can I track down what part of pfsense is blocking website access?

I've got a PFSense firewall/gateway on our network. Everything works great except for the fact that I cannot access one specific website. Pfsense is running the following packages Country Block ...
4
votes
2answers
624 views

Iptables - Block https response only

I'm quite new to Linux and using iptables. Here is what I am trying to accomplish: I have an ASP.net client that talks with a web service hosted through web-logic on linux. The communication is over ...
4
votes
1answer
506 views

Block outgoing LOIC attacks in a network

I am admin of a small network. Users in our network have access to internet through a squid NAT server. Recently, we have detected that some users are using LOIC to attack servers on the internet. ...
4
votes
5answers
239 views

What are the 'gotcha's' a software developer needs to look out for if tasked with setting up a production ready server?

As a software developer I am very used to installing my typical stack (java, mysql and tomcat/apache) on my development machine. But setting up and securing a production machine is not something I ...
4
votes
3answers
22k views

How can I open a port on my EC2 instance?

I'm working for a client here who has set up an EC2 instance for me to configure. I've installed the software asked for, now all I need to do is open up some ports. I'm currently SSH'd into the ...
4
votes
3answers
188 views

linux Firewall question

I have few generic questions about firewalls and I thought the community up here could help me out. 1) So I recently installed Ubuntu server barebones. I checked for open ports, none were open which ...
4
votes
2answers
1k views

iptables and blocking potentially impossible traffic

I am working on some iptables firewall rules and have seen many examples that suggest the importance of blocking potentially impossible traffic from non-routable IP address spaces. This would include ...
4
votes
2answers
1k views

Windows Firewall - blocking IP address ranges en masse - performance considerations?

One of our services is an extranet for the exclusive use of our 200 employees across the UK. We're seeing a huge number of login attempts from China, Russia, Ukraine and Nigeria. I have large lists of ...
4
votes
4answers
704 views

Why on linux machines, any packets do not pass except icmp, but correctly pass on windows

There is a cluster on proxmox. In a cluster have vm - configured router (pfsense). In the our net have Windows and Linux machines. There is the problem: Windows-machines have access to the internet, ...
4
votes
1answer
113 views

Managing security and firewalls in complex, distributed applications

We have a distributed application composed of several different components. For example, we have Python app servers, PostgreSQL DB servers, Redis servers, Memcached, etc. Some of these services are ...
4
votes
1answer
892 views

Firewall ACL management tool [closed]

Is there any Firewall ACL management tool which can generate set of ACLs for all my network, including switches, checkpoint, cisco routers, windows, linux etc? I think such tool would make sense as ...
4
votes
1answer
103 views

Seeing strange IPv6 requests being dropped in our firewall

I'm seeing the following IPv6 addresses having requests dropped by our firewall. It doesn't seem to be anything too malicious, but there seems to be a strange pattern to them: ...
4
votes
1answer
1k views

Cannot loopback to localhost php gateway causing nginx to timeout while setting up firewall with ufw

I'm setting up ufw for the first time. Using Ubuntu 10.04 LTS on an OpenVZ VPN and have the following rules: sudo ufw allow 22/tcp sudo ufw allow 25/tcp sudo ufw allow 53 sudo ufw allow 80 sudo ufw ...
4
votes
3answers
6k views

How to configure remote access to multiple subnets behind a SonicWALL NSA 2400

I have a client that uses a SonicWALL NSA 2400 as their firewall. I need to setup a second LAN subnet for a handful of PC. Management has decided that there should be a second subnet even though ...
4
votes
3answers
2k views

OWA not working from outside the network

I have an Exchange server behind an ISA 2004 server and from inside the network, it's possible to access Outlook Web Access. I have published the server but from outside the network I'm not even ...
4
votes
1answer
101 views

firewall and private cloud

We have a private bay in which we built a private cloud with vmware vSphere. We received directly the web trafic on a firewall VM and then we forward the trafic to the appropriate VMs. We are worry ...
4
votes
1answer
214 views

Ban an IP when the server received an amount of data from it

What I need : There are many result for adding a drop rules by an amount of request per laps of time, but I need to drop by received byte count from a particular address over a period of time. ...
4
votes
2answers
127 views

iptables - allow connections to a port only for IP addresses with established state on a different port

I want to allow connections on port x for IP addresses that have a 'established' state on port y. Is this doable by just using iptables?
4
votes
1answer
615 views

pf slows traffic extremely down

I am running a web and mail server on FreeBSD 9.1. The system is installed on a KVM vServer. Everything works fine - until I enable pf(4). My weblog becomes unconscionably slow. So does all the other ...
4
votes
3answers
7k views

automatically block IP address after many failed login attempts

I am receiving a lot of failed login attempts (1 per sec) on a Windows 2008 server, I have already set local security policy to automatically lock an account after too many login attempts, but is ...
4
votes
3answers
6k views

pfsense log file retention

We have a pfSense firewall in our datacentre. By default, pfSense is only storing 500K of firewall filter logs, which is only a few hours for us. How can I increase this? pfSense uses clog rather ...
4
votes
3answers
9k views

psexec Couldn't access \\IP/computername The system cannot find the path specified

Tried psexec \\ip.add.re.ss -accepteula -u local_admin -p cmd.exe psexec \\computername -accepteula -u local_admin -p cmd.exe psexec \\computername.fdqn -accepteula -u local_admin -p cmd.exe where ...
4
votes
7answers
27k views

problem with passive FTP behind cisco asa firewall

i've problems connecting to an ftp-server behind a cisco asa firewall using passive mode. ftp works using active and "extended passive" mode, however: when i turn off "extended passive" (epsv in ftp ...
4
votes
1answer
615 views

Why does Terminal Services open WMI, RPC, and NB ports in the firewall?

After adding the Remote Desktop Session Host roll to a server the following firewall rules get created and are enabled by default. Name Group Profile ...