A Firewall is an application or hardware device used to inspect and filter network traffic.

learn more… | top users | synonyms

5
votes
2answers
2k views

Windows Firewall - blocking IP address ranges en masse - performance considerations?

One of our services is an extranet for the exclusive use of our 200 employees across the UK. We're seeing a huge number of login attempts from China, Russia, Ukraine and Nigeria. I have large lists of ...
5
votes
1answer
419 views

Configuring firewallD in Fedora 18/19

I am new to firewallD and have been going through the documentation but I thought maybe I can discuss some things here with everyone. So I see that firewalld has now replaced the iptables service as ...
5
votes
3answers
6k views

Restrict Computer or Users from Internet but allow access to intranet and Windows Update / ePO?

So this may be impossible but I've been asked to try and find something about it. So far nothing I have found is possible. I need to restrict specific machines or user accounts from regular Internet ...
5
votes
3answers
2k views

iptables — OK, **now** am I doing it right?

This is a follow up to a previous question where I asked whether my iptables config is correct. CentOS 5.3 system. Intended result: block everything except ping, ssh, Apache, and SSL. Based on ...
5
votes
2answers
674 views

Storm Botnet on Linux?

We have a customer who is running an office CCTV system which he accesses from home. The system runs on an embedded Linux box behind a NAT firewall forwarding to ports 8080 for web browser access and ...
5
votes
3answers
9k views

automatically block IP address after many failed login attempts

I am receiving a lot of failed login attempts (1 per sec) on a Windows 2008 server, I have already set local security policy to automatically lock an account after too many login attempts, but is ...
5
votes
1answer
1k views

Cisco ASA Config for PCI Compliant Office

We have a small business office, but due to PCI compliance we need to segment this into two internet networks (one 'compliant' and one for any other devices to use). We currently have a Draytek ...
5
votes
2answers
468 views

Is there a way to run FTPS on Windows Server 2008 / FTP 7.5 through a Firewall?

I'm attempting to setup a FTPS server on Windows Server 2008. The inner workings have been successful -- I can connect locally or on the VPN. But I can't seem to craft the firewall rules to make it ...
5
votes
2answers
2k views

Linux fails to interpret ACK, keeps resending SYN+ACK

The following is a wireshark dump of the problem occurring, IP-adresses replaced with 'client' and 'server': 4414.229553 client -> server TCP 62464 > http [SYN] Seq=0 Win=65535 Len=0 MSS=1452 ...
5
votes
5answers
3k views

iptables vs. hardware firewall

I was wondering if anyone could speak to the advantages of a hardware-based firewall vs using iptables directly on a web server. I'm evaluating the cost effectiveness of having a dedicated firewall ...
5
votes
1answer
5k views

Can't connect to MySql server on remote server

Connecting to: CentOS v?? with MySql 4.?? in Nashville (example public ip=11.11.11.11) Stack: Cable modem as gateway > router with forwarding > CentOs Box Connecting from: Windows 2003 R2 in ...
5
votes
5answers
8k views

iptables port forwarding on debian

I'm trying to setup a simple port forwarding firewall and I can't make the basic non-firewall configuration to work. I have setup the iptables script as follows #!/bin/sh # interfaces LAN="eth1" ...
5
votes
2answers
761 views

How should I set up my Hyper-V server and network topology?

This is my first time setting up either Hyper-V or Windows 2008, so please bear with me. I am setting up a pretty decent server running Windows Server 2008 R2 to be a remote (colocated) Hyper-V host. ...
5
votes
0answers
204 views

What's the best way to simulate being behind China's Great Firewall? [closed]

We're having issues with an iOS app of ours that uses in-app purchase to unlock downloadable content - but it seems only from China. We see many negative reviews from China for this reason. Our in ...
5
votes
0answers
20k views

Openvpn routing for lan to lan through tun

I am trying to setup an OpenVPN tun to connect two lan's The open vpn connection is up and working but there is a problem with my routing or nat or something. What I need is an example of what a ...
4
votes
11answers
4k views

Small business firewall/VPN device [closed]

What's a good small business (<50 users at a location) firewall and VPN device? Wireless would be a nice addition, and I'm thinking of something in the $1,000 range. This would be for businesses ...
4
votes
12answers
4k views

Should you run firewalls inside your network perimeter?

The age-old question. I've seen responses go both ways on this, but never a comprehensive answer as to why you want firewalls active within your trusted network. When I say "trusted", I (typically) ...
4
votes
3answers
5k views

iptables error: unknown option --dport

The command iptables no longer recognizes one of the most commonly used options when defining rules: --dport. I get this error: [root@dragonweyr /home/calyodelphi]# iptables -A INPUT --dport 7777 -j ...
4
votes
2answers
12k views

Should I use TCP or UDP to run a web server

I have just installed Apache web server on my computer. I have managed to use it locally (I can open index.php from my computer using my web browser). But I would like to make my web site available ...
4
votes
6answers
3k views

Are there any security benefits to having a dedicated firewall?

Are there any security benefits to having a dedicated firewall rather than having a firewall established on a router? Thanks.
4
votes
10answers
36k views

“account currently disabled” when accessing share, even before logging in

When I try to access a share folder, say \\share-folder, I get the following error message: logon failure: account currently disabled This seems strange to me, since there is no 'account' to be ...
4
votes
2answers
372 views

Content Aware Firewall and Encrypted Content

There are firewalls out there that analyze the traffic that goes through and block it if it is not wanted. How good do these firewalls work with encrypted traffic, e.g. HTTPS or IMAP over SSL? An ...
4
votes
3answers
2k views

Comparison of Firewall, Intrusion Prevention, Detection and Antivirus Technologies in Organizational Network Architecture

in these days i'm reading about intrusion prevention/detection systems.When reading i really confused in some points. First, the firewall and antivirus technologies are known terms for years, however ...
4
votes
3answers
7k views

How long does it take for an iptables rule to apply?

How long does it take for an iptables rule to apply? I use a script with the code below in an attempt to block hosts, but they don't appear to take immediately. Is there some delay, is iptables not ...
4
votes
5answers
637 views

Why is my port 25 so active?

Using netstat -na I notice that I have a lot of connections like tcp 0 0 XXX.XXX.XXX.XXX:25 YYY.YYY.YYY.YYY:13933 ESTABLISHED tcp 0 0 XXX.XXX.XXX.XXX:25 ...
4
votes
5answers
9k views

When would I open Port 53 for DNS?

Locking down an application server. The server hosts a web app that is served via http. There are a few other ports open as well. Port 53 is open for DNS. Why would I need this? Extra: (Do not ...
4
votes
1answer
258 views

Iptables - allow traffic from entire 10.x.x.x

Is there any way to configure iptables to ACCEPT the traffic from 10.anything? currently I have the rule to the single address, but I want the entire range: sudo iptables -I INPUT --src ...
4
votes
2answers
265 views

Standard Firewall and Network Change Testing Procedure

I am looking for a standard that advises on the best practice for testing of the following situations: Network Changes Firewall Changes Does any standard exist? If so, please note where I can find ...
4
votes
2answers
9k views

Can I use pfsense as a DNS server?

If I have a pfsense based firewall in front of my servers, can I use this also for DNS? Thanks
4
votes
5answers
2k views

Is iptables enough security, if port 80 is the only unblocked port and apache is setup correctly?

We are using PHP,MySQL,SVN, and Apache. I want to know if I assume the local subnet trusted, and allow all ports on our subnet using iptables, then allow only port 80 as open to "anyone". If it is ...
4
votes
7answers
2k views

Real-time traffic monitoring router / firewall device

I'm looking for a router & firewall device that will provide built-in bandwidth monitoring; meaning, I go to the web control panel for the device and I can see a real-time breakdown of how much ...
4
votes
3answers
6k views

Iptables not persisting after reboot on CentOS 6.2

I've tried adding a few rules to my iptables but they don't seem to be saving. In order to save them, I've tried running iptables-save and service iptables save. Each time I have run either of those ...
4
votes
2answers
735 views

How to block an IP using iptables

So this should be a simple issue, but for whatever reason I can't figure it out. Here are my current rules: Chain INPUT (policy ACCEPT) target prot opt source destination block ...
4
votes
5answers
314 views

Requests take a really long time from certain ISP

We have an Apache server with PHP running on a virtual machine. Document roots are inside the users' home folders (/home/users/{first letter}/{username}/), and /home/users/ is mounted over NFS. It ...
4
votes
3answers
2k views

ESXi hosted on public IP without firewall

So I've got an interesting problem. I currently rent a couple of servers from Hetzner (a German hosting provider). Each server has a soft firewall and does something like web hosting / database. I ...
4
votes
3answers
13k views

Centos iptables open port 53

I am having problem opening port 53 on my centos machine, for DNS configuration. Here is my iptables config -A INPUT -p udp -m udp --sport 53 -j ACCEPT -A OUTPUT -p udp -m udp --dport 53 -j ACCEPT ...
4
votes
3answers
7k views

Placing a server in the DMZ vs opening firewall ports

When should you place a server in a DMZ vs opening ports on the firewall and keeping it within the network? I'm referring to active directory servers, IIS servers, and mostly things on a windows based ...
4
votes
6answers
1k views

Skype in a business - what's your view?

We currently don't allow Skype usage on the LAN. The reasons ultimately come down to that great cover-all of "security", though I have to admit that these days I'm not sure if Skype has turned into a ...
4
votes
3answers
644 views

Can't access Exchange OWA from Wireless Subnet - Firewall rule?

The Problem The issue is that I can't access port 80 (or 443) on the Exchange server, unless I add a blanket rule to allow all traffic from the client to the server's subnet. If I add a rule to ...
4
votes
5answers
407 views

recommend firewall options for a dedicated server

I'm looking for recommendations on firewalls for a dedicated server that will be hosting a few websites of average traffic (5000 uniques monthly). the hosting company has port and full hardware ...
4
votes
5answers
982 views

Is it beneficial to chain multiple firewalls at the perimeter?

I'm currently running ISA 2004 and will soon be running an Untangle box. I've always felt a tiny bit safer putting these more advanced software firewalls behind a dumb hardware firewall (like ...
4
votes
1answer
2k views

What IP range do I ask the system administrator to open in order for S3 to work?

I've written some programs for Raspberry Pi, which some small companies have shown interest in. I sold pre-configured Raspberry Pi:s to them, with my program on them, and it works for everybody except ...
4
votes
3answers
1k views

Can our firewall detect traffic sniffing inside the network?

We use Cisco ASA's firewall and NAT functions in our network (200 computers). Is there any possibility to configure Cisco ASA to detect traffic sniffering (for example wireshark) and network ...
4
votes
3answers
9k views

Denying ICMP type 3 code 4 traffic - good or bad?

Investigating a slow VPN connection (Cisco ASA IPSec) to a remote office, I noticed on our firewall a lot of access rule matches: Denied ICMP type=3, code=4 from *ip_address* on interface outside I ...
4
votes
2answers
6k views

iptables - What does the range in bracket mean? [duplicate]

Possible Duplicate: Don’t understand [0:0] iptable syntax My server is Red Hat Enterprise Linux Server release 5. I'm not an expert in Linux iptables firewall. I've the following entries ...
4
votes
5answers
4k views

connect to ssh server thru 80 via HTTP proxy?

Please help: I want to connect to my ssh server at home However, I'm behind a corporate (CORP) firewall, which blocks almost all ports (443, 22, 23 etc). But it seems that 80 is not blocked, coz I ...
4
votes
3answers
3k views

How to simulate a source IP to test which iptables rules are/aren't firing? [closed]

We have a fairly complicated iptables/ipchains configuration, which is generated by APF. Traffic to port 80 should be blocked, but our Apache logs show that someone was able to probe for web pages: ...
4
votes
3answers
3k views

Blocking IP behind a load balancer

Is there any way to block IP address of an intruder (or any IP), when our server is behind a Load balancer. For example if my servers are behind ELB (Amazon ELB) or Rackspace Load balancer, i am ...
4
votes
1answer
7k views

DMZ Setup with two firewalls - Traffic from DMZ to LAN and LAN to DMZ

I am setting up a network with machines that need to be accessible from the internet. I'm planning on putting these in a DMZ. Some of the machines in the DMZ need access to machines on the private ...
4
votes
1answer
237 views

Can tcpdump tell accessed port numbers?

I have a server with two NICs, and I would like to only have those ports open on eth1 that are being used. Question How do I get tcpdump to tell me the port numbers that is being accessed on eth1?