A Firewall is an application or hardware device used to inspect and filter network traffic.

learn more… | top users | synonyms

4
votes
0answers
65 views

IPset Alternatives and Firewall Management

I have CentOS 7, Plesk 12, 8GB RAM VPS. I have around 1000 rules in my IPtables to block abusive users. But when reloading IPtables it takes 15 seconds to reload all 1000 rules. First of all, is it ...
4
votes
0answers
8k views

TCP Keepalive and firewall killing idle sessions

In a customer site, the network team added a firewall between the client and the server. This is causing idle connections to get disconnected after about 40 minutes of idle time. The network people ...
4
votes
0answers
429 views

Firewall “Connection Security” when there is no trust and NATing between the two computers

First a little explanation of my network topology. I have a internal domain, and edge network domain. There is no trust between the two domains (and IT will not allow a one way trust to be set up ...
4
votes
0answers
1k views

cisco asa reloading

After having both memory and code upgrades, we have a significant number of our asa 5520's (in active/standby pairs) develop problems. The problem manifests itself as losing connectivity to the other ...
3
votes
0answers
105 views

Hacker bypassing iptables

(moved from SO) I have iptables protecting a sip server. It blocks all IPs except ones I specifically opened, and it seems to work for almost everyone. I have tested from lots of ip addresses that ...
3
votes
0answers
27 views

Do new Windows firewall rules affect currently open connections?

If I added a rule to windows firewall that blocked an ip or port currently used by an open connection, does that rule take effect immediately or only after the connection were closed? I.e, If I have ...
3
votes
0answers
181 views

pfSense Internal Traffic Policy Based Routing

What is the current and correct way to apply policy based routing to pfSense internal traffic (originating from the firewall itself)? Creating a floating rule with the WAN interfaces selected, ...
3
votes
0answers
47 views

What's the recommended way to restrict Internet access per process using SELinux?

Before I have tried to do this using a phony user and iptables to execute commands that needs to be restricted. However now the commands need to read configuration set by each user's environment vars ...
3
votes
0answers
100 views

Sophos firewall default settings do not allow HTTPS from Java 6 clients

Our current (default) Sophos firewall (Apache reverse proxy) settings does not allow Java 6 clients to connect over HTTPS. The ssltest result shows that the reason is "Client does not support DH ...
3
votes
0answers
64 views

RANCID - timeout connecting PALOALTO in HA

When rancid try to connect via SSH to PALO (the active one) i get a time out message. Connecting manually everything is ok. I believe is something related to prompt containing parethesis. add user ...
3
votes
0answers
192 views

Solving an asymetric HA Firewall/router

I have an old Linux HA firewall/router setup that never quite worked. As it was never quite put into true production (just testing and demo's), I always had to have one firewall shutdown to make it ...
2
votes
0answers
39 views

Block incoming traffic in bonding mode when primary interface is down

My server running on latest kernel (4.4.6) has configured a bond device (bond0) with two enslaved interfaces eth0, wlan0 with primary interface eth0. cat /proc/net/bonding/bond0 Ethernet Channel ...
2
votes
0answers
17 views

Allowing outbound internet access with NSX while maintaining micro segmentation

I am getting into the world of VMware's NSX product for the purpose of micro segmenting VM's in the datacenter. That is to say, living in the same network space but not being able to talk to one ...
2
votes
0answers
39 views

Can't firewalld replace iptables?

I used Iptables on Centos 6.5 and tried to translate iptables rules into firewalld rules on centos 7. However, with firewalld, i have discovered i am unable to drop packets in invalid states create ...
2
votes
0answers
41 views

Windows Firewall Connection Security, require encryption with IPv6?

I've set up Windows Firewall on a Server 2012 R2 to always require IPSec Encryption for all Connection Security Rules. I've then specified Inbound Rules for specific ports and services, and ...
2
votes
0answers
88 views

Multi vlan internet access via Watchguard

i'm pretty new to network and routing so i would appreciate some tips on this. I have a firewall(watchguard x1250e), connecting to a switch(Nortel Baystack 5510) with multiple vlans for internet ...
2
votes
0answers
160 views

Understanding packets dropped by iptables from puppetmaster

I am seeing packets getting dropped during my puppet client runs on a semi regular basis. And I do not understand what is causing this. I should mention that Puppet is managing the firewall rules ...
2
votes
0answers
144 views

firewall-cmd forward rules for interface with multiple ips

I'm looking for a way with firewall-cmd or another command to do the following. An incoming public interface has multiple ip addresses bound to it. How can I forward ports only for one of the ip ...
2
votes
0answers
648 views

TFS Check In Issue: The underlying connection was closed: A connection that was expected to be kept alive was closed by the server

I've recently started seeing the below error when attempting to check in code to TFS: The underlying connection was closed: A connection that was expected to be kept alive was closed by the server. ...
2
votes
0answers
866 views

sophos access https site when user portal is activated

I use a SOPHOS on UTM 9. I have a website behind it on Win Server 2012 R2 / IIS 8 created with a subdomain (e.g. myaccess.mydomain.com). On UTM9 i had do what Stephane say on "serverfault -> sophos ...
2
votes
0answers
2k views

Mikrotik router RDP brute force blocking with whitelist

Masters, We have a miktorik router, and we would like to block RDP brute force, but we need whitelist also to allow our collegaues to connect without blocking them. (they sometimes hitting wrong ...
2
votes
0answers
682 views

How can configure Cisco ASA 5510 to allow access to Web server in DMZ from LAN with port translation?

I am trying to configure Cisco ASA 5510 firewall to allow access from LAN to DMZ web server. Web server is located in the DMZ and is using port 8080. I don't want users to type port number every time ...
2
votes
0answers
871 views

Clickonce applications being allowed through firewall

The company I work for uses an application that is deployed through clickonce. This means that everytime they update said program the program regenerates in a new location ie: ...
2
votes
0answers
6k views

cisco asa NAT to site-to-site VPN

I'm trying to NAT an external address to an internal address which is not local, but on a remote end of a site-to-site VPN connection. Is this possible? Log says Routing failed to locate next hop for ...
2
votes
0answers
108 views

Connection reset with duplicate query parameters

Is there anything that could cause a connection reset when duplicate query parameters are passed to a page? http://test/?test[]=1&test[]=2 Causes a connection reset http://test/?test[]=1 Works ...
1
vote
0answers
50 views

Can't reach a Kubernetes service on a guest node

I have tried to run the guestbook example in Kubernetes Github repository but I can't reach this service from my local host. My test enviroment consists of two virtual machines (with CentOS7) ...
1
vote
0answers
26 views

cisco asa public server nat issue

I have been tasked with some ASA configuration coming in a few weeks, and to test out some configuration options I have setup a web server on my local network which I would like to be able to access ...
1
vote
0answers
14 views

On Cisco firewall, show access-list main rules only (with line numbers)

For example, if I do a sh access-list Lets say I have a rule on line 2 that has one object-group to another object-group connected on X ports. Well, there may be 30 lines below that, that all say ...
1
vote
0answers
22 views

MySQL on Ubuntu. 10061 error on 3306

A fresh install of Ubuntu inside of a Virtualbox with LAMP option selected. I am unable to connect to the server via telnet on this port or via ODBC from my host machine. I can ping and SSH both ...
1
vote
0answers
33 views

Not able to RDP to the VM which is part of new subnet in Azure virtual network

Here are my environment detail I am using Azure IaaS (Infrastructure as Service) I am having one vNet (Virtual Network) I have set-up site to site connectivity (on-premise to azure) I have one subnet ...
1
vote
0answers
27 views

Sizing Firewall for Micro-Datacenter

We have a small data center we're finishing. We have a core+spline and then redundant TOR switches. Everything is basically whitebox 10gb switches running Cumulus; although, we will upgrade the core ...
1
vote
0answers
64 views

Cannot connect to remote MySQL server (RDS)

When I am trying to connect to RDS from my vps, it says connection refused. When I tried connecting it from local or other vps, it worked fine. I figured out that it must be a firewall issue on my ...
1
vote
0answers
33 views

UFW blocks permitted ports

I use ufw utility to manage my firewall for the system which runs web and mail services. The rules are follow: Status: active To Action From -- ...
1
vote
0answers
61 views

Correct Azure VM firewall settings for Azure SQL Database v12

One of the recommendations when a client runs on an Azure VM and needs to connect with your Azure SQL Database v12 is to: Ensure that the port ranges of 11000-11999 and 14000-14999 on your Azure ...
1
vote
0answers
101 views

Drop first packet for every IP with iptables

My servers are getting UDP-flooded with spoofed source IP addresses. They flood with real user packets so I cannot rate limit or block these packets. Is there a way to drop the first packet received ...
1
vote
0answers
46 views

TCP Syn cookies is it always turned on when enabled?

For Linux kernel 2.6.32 if I set net.ipv4.tcp_syncookies = 1 will that be always used or only during a SYN flood attack? I found 2 sources which says the opposite. 1: "There are, however, two ...
1
vote
0answers
218 views

Webdav through HAProxy

I am trying to connect to a WebDAV server through HAProxy. The goal is to direct all traffic through one port, 5443. My HAProxy server is bound to port 5443 with SSL. I have tried connecting to ...
1
vote
0answers
106 views

Is it possible to reverse ssh to a system behind a router via a third system if port forwarding is disabled on the middle system?

I want to access a workstation in my lab from my laptop in my hostel room. But I can't directly ssh to the machine as both my laptop (in my hostel) and the worstation are behind two different routers ...
1
vote
0answers
107 views

Dual WAN and NAT on ZyWall

I have Zyxell ZyWall USG-50 router firewall and I want to configure dual WAN navigation. On WAN1 I've 10Mbits connection and on WAN2 I've 100Mbits connection. I want my LAN to navigate with WAN2 and ...
1
vote
0answers
67 views

Exchange 2010 sp3 RPC connectivity between separate physical sites

Good evening! I have installed Exchange 2010 a few times in my life but never in an environment like this. Please don't judge me for this architecture, it wasn't my idea! ;) I have two physical sites ...
1
vote
0answers
71 views

External Access to Internal Network and Websites — Microsoft Networks

I need to be able to expose a set of "internal" web sites to Internet users somehow. Please bear with me as network engineering isn't my forte. I'd appreciate any insight or suggestions to this task. ...
1
vote
0answers
57 views

UFW Firewall on Ubuntu

I have installed UFW on Ubuntu 14.04. I used following commands to enable a port: sudo ufw allow 9384/tcp When I used the status command (sudo ufw status) it shows me that port is open for both IP4 ...
1
vote
0answers
213 views

Cisco 5512-x TCP request discarded

We have a fairly basic ACL and NAT rule allowing RDP inbound and NAT'd to a LAN IP (all IPs replaced with IP) object network STATIC-PAT-RDP host IP access-list outside_access_in extended permit ...
1
vote
0answers
244 views

Firebox x700 Reset to Default Not Working

I found a site that explains how to reset a Firebox 700 series back to default as you can see from this link: https://www.hashdoc.com/documents/7502/how-to-default-a-watchguard-firebox-700-or-x700 ...
1
vote
0answers
123 views

Stop Outbound SYN Scan

Hello I run a VPN company, and recently my host has been sending me these complaints that are likely coming from a user. I am not sure how to identify the user, if I could just do that I wouldn't ...
1
vote
0answers
87 views

Windows Server spamming devices on other subnets on port 445

I have a Windows Server 2012 that every few seconds sends packets destined for port 445 on local IPs on other subnets. The IPs on other subnets it is trying to reach are devices such as VoIP phones, ...
1
vote
0answers
627 views

Fortigate 60D - Empty log and report

Environment: Fortigate 60D Forti OS 5.0 I can not see any log or report in the firewall. I have already activated forticloud and I recieve empty reports. Is there something that we have to ...
1
vote
0answers
17 views

Can a firewall handle packets being sent to it by a network TAP?

We have the intention of examining incoming mails for security purposes. In order to do so we figured out the solution will include: Network TAP - To copy all SMTP traffic to the firewall Firewall - ...
1
vote
0answers
230 views

Apache blocking based on combination of ip, request and useragent - Can fail2ban do that?

3 times over the past 48 hours, we had about a 6X spike in traffic lasting a few hours. The server handled it each time, but just barely. This was almost all bad-bot traffic (or maybe failed DOS ...
1
vote
0answers
33 views

Why did BFD add euid=0 to APF IP deny_host.rules?

Trimming down some old deny_hosts today and I noticed this one: # added euid=0 on 11/03/14 11:00:04 with comment: {bfd.sshd} euid=0 Anyone know why the BFD would have added euid=0 root/permissions ...