A Firewall is an application or hardware device used to inspect and filter network traffic.

learn more… | top users | synonyms

5
votes
2answers
6k views

What ports should be left open on a web server?

I'm going to try deploying my first web app soon, so my experience is lacking. I remember reading somewhere that port scans by bots happen within minutes of being exposed to the internet (maybe ...
5
votes
1answer
2k views

Linux NFLOG - documentation, configuration from C

Several different places (e.g. http://wiki.wireshark.org/CaptureSetup/NFLOG) recommend using Linux's "NFLOG" firewall module to capture packets generated by a particular UID, like this: # iptables -A ...
5
votes
1answer
955 views

pf slows traffic extremely down

I am running a web and mail server on FreeBSD 9.1. The system is installed on a KVM vServer. Everything works fine - until I enable pf(4). My weblog becomes unconscionably slow. So does all the other ...
5
votes
1answer
581 views

Block Google requests to 16k using pf firewall

I'd like to block access to Google search using PF after the threshold of 17500 requests (connection established) in 24h, from a host running FreeBSD 9. What I came up with, after reading pf-faq is ...
5
votes
2answers
10k views

Cisco ASA5510 Bandwidth Shaping/Limiting

This question is in two parts: Shape How can I limit the bandwidth on a ASA5510 to less than 10Mbps? Currently I have: policy-map shape_policy class class-default shape average 9000000 36096 ! ...
5
votes
1answer
437 views

Configuring firewallD in Fedora 18/19

I am new to firewallD and have been going through the documentation but I thought maybe I can discuss some things here with everyone. So I see that firewalld has now replaced the iptables service as ...
5
votes
3answers
11k views

psexec Couldn't access \\IP/computername The system cannot find the path specified

Tried psexec \\ip.add.re.ss -accepteula -u local_admin -p cmd.exe psexec \\computername -accepteula -u local_admin -p cmd.exe psexec \\computername.fdqn -accepteula -u local_admin -p cmd.exe where ...
5
votes
3answers
7k views

Restrict Computer or Users from Internet but allow access to intranet and Windows Update / ePO?

So this may be impossible but I've been asked to try and find something about it. So far nothing I have found is possible. I need to restrict specific machines or user accounts from regular Internet ...
5
votes
3answers
2k views

iptables — OK, **now** am I doing it right?

This is a follow up to a previous question where I asked whether my iptables config is correct. CentOS 5.3 system. Intended result: block everything except ping, ssh, Apache, and SSL. Based on ...
5
votes
2answers
676 views

Storm Botnet on Linux?

We have a customer who is running an office CCTV system which he accesses from home. The system runs on an embedded Linux box behind a NAT firewall forwarding to ports 8080 for web browser access and ...
5
votes
3answers
10k views

automatically block IP address after many failed login attempts

I am receiving a lot of failed login attempts (1 per sec) on a Windows 2008 server, I have already set local security policy to automatically lock an account after too many login attempts, but is ...
5
votes
1answer
1k views

Cisco ASA Config for PCI Compliant Office

We have a small business office, but due to PCI compliance we need to segment this into two internet networks (one 'compliant' and one for any other devices to use). We currently have a Draytek ...
5
votes
2answers
496 views

Is there a way to run FTPS on Windows Server 2008 / FTP 7.5 through a Firewall?

I'm attempting to setup a FTPS server on Windows Server 2008. The inner workings have been successful -- I can connect locally or on the VPN. But I can't seem to craft the firewall rules to make it ...
5
votes
2answers
2k views

Linux fails to interpret ACK, keeps resending SYN+ACK

The following is a wireshark dump of the problem occurring, IP-adresses replaced with 'client' and 'server': 4414.229553 client -> server TCP 62464 > http [SYN] Seq=0 Win=65535 Len=0 MSS=1452 ...
5
votes
5answers
3k views

iptables vs. hardware firewall

I was wondering if anyone could speak to the advantages of a hardware-based firewall vs using iptables directly on a web server. I'm evaluating the cost effectiveness of having a dedicated firewall ...
5
votes
1answer
5k views

Can't connect to MySql server on remote server

Connecting to: CentOS v?? with MySql 4.?? in Nashville (example public ip=11.11.11.11) Stack: Cable modem as gateway > router with forwarding > CentOs Box Connecting from: Windows 2003 R2 in ...
5
votes
5answers
8k views

iptables port forwarding on debian

I'm trying to setup a simple port forwarding firewall and I can't make the basic non-firewall configuration to work. I have setup the iptables script as follows #!/bin/sh # interfaces LAN="eth1" ...
5
votes
2answers
765 views

How should I set up my Hyper-V server and network topology?

This is my first time setting up either Hyper-V or Windows 2008, so please bear with me. I am setting up a pretty decent server running Windows Server 2008 R2 to be a remote (colocated) Hyper-V host. ...
5
votes
0answers
225 views

What's the best way to simulate being behind China's Great Firewall? [closed]

We're having issues with an iOS app of ours that uses in-app purchase to unlock downloadable content - but it seems only from China. We see many negative reviews from China for this reason. Our in ...
4
votes
11answers
4k views

Small business firewall/VPN device [closed]

What's a good small business (<50 users at a location) firewall and VPN device? Wireless would be a nice addition, and I'm thinking of something in the $1,000 range. This would be for businesses ...
4
votes
12answers
4k views

Should you run firewalls inside your network perimeter?

The age-old question. I've seen responses go both ways on this, but never a comprehensive answer as to why you want firewalls active within your trusted network. When I say "trusted", I (typically) ...
4
votes
3answers
5k views

iptables error: unknown option --dport

The command iptables no longer recognizes one of the most commonly used options when defining rules: --dport. I get this error: [root@dragonweyr /home/calyodelphi]# iptables -A INPUT --dport 7777 -j ...
4
votes
2answers
12k views

Should I use TCP or UDP to run a web server

I have just installed Apache web server on my computer. I have managed to use it locally (I can open index.php from my computer using my web browser). But I would like to make my web site available ...
4
votes
6answers
3k views

Are there any security benefits to having a dedicated firewall?

Are there any security benefits to having a dedicated firewall rather than having a firewall established on a router? Thanks.
4
votes
10answers
39k views

“account currently disabled” when accessing share, even before logging in

When I try to access a share folder, say \\share-folder, I get the following error message: logon failure: account currently disabled This seems strange to me, since there is no 'account' to be ...
4
votes
2answers
383 views

Content Aware Firewall and Encrypted Content

There are firewalls out there that analyze the traffic that goes through and block it if it is not wanted. How good do these firewalls work with encrypted traffic, e.g. HTTPS or IMAP over SSL? An ...
4
votes
3answers
7k views

How long does it take for an iptables rule to apply?

How long does it take for an iptables rule to apply? I use a script with the code below in an attempt to block hosts, but they don't appear to take immediately. Is there some delay, is iptables not ...
4
votes
4answers
2k views

What are the risk if all Outgoing connection/ports are open?

To solve facebook authorization connection on our server, we've decided to open all outgoing connection/ports in firewall to see if it's really security issue. after allowing, the facebook connection ...
4
votes
3answers
2k views

Comparison of Firewall, Intrusion Prevention, Detection and Antivirus Technologies in Organizational Network Architecture

in these days i'm reading about intrusion prevention/detection systems.When reading i really confused in some points. First, the firewall and antivirus technologies are known terms for years, however ...
4
votes
5answers
640 views

Why is my port 25 so active?

Using netstat -na I notice that I have a lot of connections like tcp 0 0 XXX.XXX.XXX.XXX:25 YYY.YYY.YYY.YYY:13933 ESTABLISHED tcp 0 0 XXX.XXX.XXX.XXX:25 ...
4
votes
5answers
10k views

When would I open Port 53 for DNS?

Locking down an application server. The server hosts a web app that is served via http. There are a few other ports open as well. Port 53 is open for DNS. Why would I need this? Extra: (Do not ...
4
votes
1answer
271 views

Iptables - allow traffic from entire 10.x.x.x

Is there any way to configure iptables to ACCEPT the traffic from 10.anything? currently I have the rule to the single address, but I want the entire range: sudo iptables -I INPUT --src ...
4
votes
4answers
20k views

What host names and ports would need to be opened in a firewall to allow Windows Updates to work?

We have a set of public web servers behind a firewall we would like to be able to perform Windows Updates on, without giving them more access than they need. Besides www.update.microsoft.com:443, ...
4
votes
2answers
274 views

Standard Firewall and Network Change Testing Procedure

I am looking for a standard that advises on the best practice for testing of the following situations: Network Changes Firewall Changes Does any standard exist? If so, please note where I can find ...
4
votes
2answers
10k views

Can I use pfsense as a DNS server?

If I have a pfsense based firewall in front of my servers, can I use this also for DNS? Thanks
4
votes
5answers
2k views

Is iptables enough security, if port 80 is the only unblocked port and apache is setup correctly?

We are using PHP,MySQL,SVN, and Apache. I want to know if I assume the local subnet trusted, and allow all ports on our subnet using iptables, then allow only port 80 as open to "anyone". If it is ...
4
votes
7answers
2k views

Real-time traffic monitoring router / firewall device

I'm looking for a router & firewall device that will provide built-in bandwidth monitoring; meaning, I go to the web control panel for the device and I can see a real-time breakdown of how much ...
4
votes
2answers
770 views

How to block an IP using iptables

So this should be a simple issue, but for whatever reason I can't figure it out. Here are my current rules: Chain INPUT (policy ACCEPT) target prot opt source destination block ...
4
votes
5answers
322 views

Requests take a really long time from certain ISP

We have an Apache server with PHP running on a virtual machine. Document roots are inside the users' home folders (/home/users/{first letter}/{username}/), and /home/users/ is mounted over NFS. It ...
4
votes
3answers
3k views

ESXi hosted on public IP without firewall

So I've got an interesting problem. I currently rent a couple of servers from Hetzner (a German hosting provider). Each server has a soft firewall and does something like web hosting / database. I ...
4
votes
3answers
8k views

Placing a server in the DMZ vs opening firewall ports

When should you place a server in a DMZ vs opening ports on the firewall and keeping it within the network? I'm referring to active directory servers, IIS servers, and mostly things on a windows based ...
4
votes
6answers
1k views

Skype in a business - what's your view?

We currently don't allow Skype usage on the LAN. The reasons ultimately come down to that great cover-all of "security", though I have to admit that these days I'm not sure if Skype has turned into a ...
4
votes
3answers
713 views

Can't access Exchange OWA from Wireless Subnet - Firewall rule?

The Problem The issue is that I can't access port 80 (or 443) on the Exchange server, unless I add a blanket rule to allow all traffic from the client to the server's subnet. If I add a rule to ...
4
votes
5answers
408 views

recommend firewall options for a dedicated server

I'm looking for recommendations on firewalls for a dedicated server that will be hosting a few websites of average traffic (5000 uniques monthly). the hosting company has port and full hardware ...
4
votes
5answers
1k views

Is it beneficial to chain multiple firewalls at the perimeter?

I'm currently running ISA 2004 and will soon be running an Untangle box. I've always felt a tiny bit safer putting these more advanced software firewalls behind a dumb hardware firewall (like ...
4
votes
1answer
3k views

What IP range do I ask the system administrator to open in order for S3 to work?

I've written some programs for Raspberry Pi, which some small companies have shown interest in. I sold pre-configured Raspberry Pi:s to them, with my program on them, and it works for everybody except ...
4
votes
3answers
1k views

Can our firewall detect traffic sniffing inside the network?

We use Cisco ASA's firewall and NAT functions in our network (200 computers). Is there any possibility to configure Cisco ASA to detect traffic sniffering (for example wireshark) and network ...
4
votes
3answers
9k views

Denying ICMP type 3 code 4 traffic - good or bad?

Investigating a slow VPN connection (Cisco ASA IPSec) to a remote office, I noticed on our firewall a lot of access rule matches: Denied ICMP type=3, code=4 from *ip_address* on interface outside I ...
4
votes
2answers
1k views

How to create a Windows 2008 Advanced Firewall rules group definition through the command prompt

Is there a way to create a group, or add to an existing group, to a rule in Windows Advanced Firewall (preferable through a command prompt or WSH script). Edit:
4
votes
2answers
7k views

iptables - What does the range in bracket mean? [duplicate]

Possible Duplicate: Don’t understand [0:0] iptable syntax My server is Red Hat Enterprise Linux Server release 5. I'm not an expert in Linux iptables firewall. I've the following entries ...