2
votes
1answer
22 views

iptables: does a scanner knows if you DROP packets?

I know how REJECT and DROP chain works. But, as I read here REJECT vs DROP when using iptables, user Dagelf said that the server still replies with TCP SYN/ACK. Does the scanner knows that a packet ...
0
votes
0answers
26 views

Force all traffic through VPN

I am using PfSense as a firewall, with its VPN functionality. The client I use is Shrew Soft VPN client. As it is a split tunnel, is there a way I can force all traffic through the VPN connection, ...
-1
votes
3answers
90 views

Is blocking SMTP ports prevent server from sending emails?

I have a Centos server with cPanel on it. Yesterday, some hackers had successfully connected to my smpt server and sent thousand of emails from it. What I want to do is blocking every ports except ...
0
votes
0answers
14 views

Can a web server be secured with just a firewall? [migrated]

I'm about to go online with my first web site, it is a small project hosted on a regular home PC running Windows 7. I want to keep the software footprint at minimum, so it only contains the operating ...
25
votes
8answers
5k views

Block employee access to public cloud

First of all, let me state that this is not my idea and I don't want to discuss whether such an action is reasonable. However, for a company, is there a way to prevent employees to access public ...
2
votes
2answers
68 views

What are the security issues in creating a firewall between two subnets?

As I understand it, the hosts on different subnets cannot communicate with each other unless there is a router somewhere on both subnets that forwards traffic between them. I have have two subnets ...
1
vote
0answers
98 views

Firewall/iptables rules for GlusterFS

A great pleasure would be to know which exact iptables rules to use for securing GlusterFS 3.4.2 (with Debian Wheezy) in shared environment. I'm running some dedicated servers at ISP. There are two ...
1
vote
1answer
51 views

Defending PCs against APTs

We are evaluating the security of the PCs used by people with access to high-value company documents. At the moment they are kept patched and run a virus checker, but we are concerned about zero-day ...
2
votes
2answers
68 views

With Azure, can I create a VLAN and put all my worker roles and VM's in there?

Is it possible to create a sort of VLAN or private azure LAN thingy .. where I can put any new Workers or VM's in that VLAN? one of the reasons is because I was hoping to create a SQL server on a VM ...
0
votes
3answers
48 views

Limiting the connection source in firewall

I'm new at server management, and wrote an IPTables script for firewall. I'm very concerned about the security of my server, and thus I'm wondering about something that I read often from people using ...
0
votes
1answer
41 views

Allow access to certain ports on the server, via only one of the server IP addresses

I'm trying to allow access to certain ports on the server, via only one of the server IP addresses. So for example if the server has two IP addresses: 1.1.1.1 1.1.1.2 I only want for example ports ...
0
votes
1answer
41 views

A way to only allow some ports on windows server

I have been trying to make this work the last few hours but haven't come far. I have a windows server 2008 and a set up Local Security Policy firewall yet "no" inbound rules (yet). My domains look ...
0
votes
1answer
116 views

iptables DROP all access except my dynamic IP, is it possible and how/workaround?

If not possible, is there any workaround without affecting CPU performance? iptables -A INPUT -p tcp --dport 80 -j DROP
0
votes
1answer
581 views

Open port 8009/tcp on Fortigate necessary?

A nmap scan of a Fortigate Firewall showed that TCP port 8009 open is. According to knowledge base articles this is only to download the client for ssl vpn. Is this port used for anything else, and if ...
1
vote
1answer
41 views

Outbound ports for a firewall for webserver and db server

I have an environment where there is one firewall, and there is a secure segment and a DMZ segment behind it. There is a bunch of servers in the secure segment - DB server, the QA server, etc and ...
0
votes
0answers
54 views

Shutting Down Firewall Rules for TMG 2010

Since TMG is being sunsetted next year we have decided to go with a new firewall/web filter and put the TMG 201O server off the network and used ONLY as a front-end authentication/proxy piece for our ...
0
votes
1answer
75 views

Securing database server with IPTables

I have my app (WordPress) and database (MySQL) on separate servers; they are connected on a private network provided by the hosting service provider, and I've taken all the preliminary steps (that I ...
0
votes
1answer
37 views

Is a reverse proxy useful behind a load balancer and IPS

We have a Web infrastructure with a farm of Web Servers. They are behind a loadbalancer which does SSL offload. We also have a IPS and obviously a set of firewalls. Now, for security reason we have ...
0
votes
2answers
46 views

making sure that iptables is running

Is there a tool for monitoring that iptables (or shorewall or similar) is up and running with a core set of important rules? I need something which alerts me either if the firewall goes donw ...
-1
votes
1answer
67 views

Is this CentOS 6.2 system reasonably secure as described? [closed]

This is a CentOS 6.2 system. For my login with the hosting company website, I set a 20-character mixed case, letters, numbers, symbols password and enabled two-factor authentication. In ...
-2
votes
1answer
89 views

How is my firewall making all websites look like a login page [closed]

In the morning this question came across my mind. You would notice my poor knowledge on firewalls. My office installed a new firewall. I am provided a new username and a password. And here we have a ...
0
votes
1answer
52 views

Export iptables logs to network storage in a limited storage dd-wrt router

Because some routers have very limited storage space; security logs are disabled in the micro version of dd-wrt. Is it possible to export the (iptables) logs to an external storage?
0
votes
1answer
71 views

Iptables to lock down compromised server to a single ip [duplicate]

I have a Linux server which is compromised, I can see nasty looking perl scripts executing with root privileges. I want to get some data off it before I wipe it. How can I block all inbound and ...
0
votes
1answer
50 views

why iptables giving error when using with --src-range

I am using iptables v 1.4.8 and used following command but getting one error message on terminal # iptables -A INPUT -m iprange --src-range 10.0.4.92-10.0.4.99 -j DROP modprobe: module 'ip_tables' ...
0
votes
1answer
48 views

Blocking Port 22 From Unknown IPs Security Measure

A server I'm working on has blocked all unknown addresses from accessing port 22 (via a firewall). An IP address has to be added to the firewall first via a control panel (or command line) before it ...
0
votes
1answer
349 views

Ubuntu Server DDoS protection [duplicate]

I've seen many articles on DDoS protection, but none work. I need protection for a socket server i'm running on the server. It's running on port 9876 and it's for a flash-based game. when it gets ...
3
votes
1answer
94 views

Traffic backlogged after (D)DoS attack? [closed]

About 25 hours ago, I got an e-mail from UptimeRobot (uptimerobot.com) telling me that me websites had gone down. I raced over to my server room, where my TP-Link router was completely unresponsive ...
1
vote
1answer
69 views

Given an Amazon Web Service Security Group, how can I find out what the IP's are?

I'm looking at using a cloud service which has an AWS Security group... I've got a hardware firewall and a software firewall. I have no idea how to say: Given that security group, allow any ...
0
votes
1answer
226 views

How to find which local process is sending spam on a Windows Server 2008 server

I am managing a Win Server 2008 system with a number of hosted web sites. Recently I found that something was sending spam through our SMTP server. The logs indicate that the connections were being ...
3
votes
1answer
401 views

Should I dual home our webservers (DMZ/Internal network) or just do 1-to-1 NAT?

I'm setting up a rack of servers which will have 2 webservers and 10 internal servers that provide back end application support (migrating from an AWS environment). We'll have virtual machine ...
-1
votes
1answer
86 views

Server is unable to make outgoing ftp requests. How to open this?

I have setup a new server on rackspace & have used these exact rules in iptables http://articles.slicehost.com/assets/2007/9/4/iptables.txt I don't want server to act as a ftp server but when I ...
1
vote
2answers
152 views

How to implement firewall in LAN(out of users' os) like EC2 have done?

In aws ec2, users can set up security groups which works like a firewall, usually, firewall work behind a gateway/nat server, however, I found that firewall in EC2 works in the LAN, too. For example, ...
0
votes
2answers
182 views

Webhosting on virtual sever vs physical server: Security vulnerability

In comparison to a physical server, is there any special security vulnerability in virtual servers for purpose of hosting several websites? For example, can the fact that there is not any hardware ...
-2
votes
1answer
50 views

Local development server risk: inbound connection [closed]

My local development environment is Windows with xampp/nginx. Yesterday I installed malwarebytes and today when I started my xampp server, I soon find out that there is an inbound connection blocked ...
3
votes
5answers
1k views

When would I open Port 53 for DNS?

Locking down an application server. The server hosts a web app that is served via http. There are a few other ports open as well. Port 53 is open for DNS. Why would I need this? Extra: (Do not ...
-1
votes
1answer
92 views

Firewall distribution in a campus network [closed]

In designing a campus network how would you distribute your firewalls I have designed a university network with 2 campuses. They use a leased line to link the two campuses. There is a firewall on the ...
2
votes
3answers
214 views

Firewall for VMware ESXi or vSphere

I want to protect individual VMs on a vSphere/ESXi host with firewalls rules using a solution that works directely on the hypervisor. By default vSPhere does not allow that, right? It has to support a ...
0
votes
3answers
159 views

Ubuntu Server: Attack on blocked ports leads to Ping timeout [duplicate]

I was searching for a solution a long time but cant find anything useful. My webserver is secured by a firewall (iptables with ufw userinterface). Default is deny all and only some ports are open. ...
1
vote
3answers
128 views

IPTables allow then block with active connection

I have a backup server and I was wondering if I set a cron job to allow connection from a server in IPTables then once it connects with rsync, can I use IPTables to then shut off the port to prevent ...
0
votes
1answer
1k views

iptables - Block incoming on Eth1 and Allow All from eth0

I am a bit stuck with iptables to do deal with two Ethernet ports. eth0 port for LAN use (192.168.1.50 Private IP). eth1 port is connected to the internet via cable modem (80.0.xxx.xxx public IP). ...
5
votes
1answer
1k views

iptables: building a rule set against abuse for DNS amplification attacks

I have been working on building a rule set to detect and block a DNS amplification attack. I got stuck and am hoping to find help here. I'll post here what I have (bash scripting, the portions that ...
-1
votes
3answers
736 views

Not using SSH Pubkey Authentication is really serious security flaw compare to regular Password Authentication

How would using PubkeyAuthentication would be in a single way more secure than using PasswordAuthentication, considering the fact that the server's Firewall blacklists an IP after 2 unsuccessful ...
2
votes
1answer
92 views

How does iptables determine which packets are multicast?

Are packets assumed to be multicast solely based on their ip address? I've been looking at the RFC 1112 and a quick scan doesn't appear to indicate any other flags on the ip packet.
4
votes
1answer
88 views

Managing security and firewalls in complex, distributed applications

We have a distributed application composed of several different components. For example, we have Python app servers, PostgreSQL DB servers, Redis servers, Memcached, etc. Some of these services are ...
2
votes
1answer
92 views

How can I implement an ip whitelist to protect my server?

I'm going to start running a gameserver soon and I want a way to reduce the the damage of a denial of service attack. I want to make it so when someone joins the game their ip adress is added to a ...
1
vote
0answers
104 views

CSF: Changing portflood settings to deny IP longer than second interval?

I've recently been under attack and I'm configuring CSF firewall for my Ubuntu server (latest). I found out portflood settings only block the ip for the specified second count, but I would like ...
-1
votes
3answers
631 views

Block incoming traffic to specific computer

I have a router that is connected to the internet. To that router we connect via LAN and WAN. WAN settings are up, router user/pass, router access is secured with WPA/WPA-2. I want to make some ...
1
vote
3answers
182 views

Several border firewalls in the same network [closed]

I'm currently analyzing the consequences of multipath connections for the firewalls. In that context, I'm wondering if it's really uncommon to have several firewalls at the borders of a network to ...
-2
votes
1answer
31 views

Securing a server for service provider [closed]

I am looking at setting up a host that users can host services from. These are specific types of games and will require the user to log in. I'm bouncing between either bsd oor Debian to host, but I ...
0
votes
4answers
92 views

How to I start with a remote IP address connected to my computer to the process that has opened the connection?

If I type "netstat", I can see a list of IP addresses that my PC is connected to. If I start with an IP address, how do I find the process that has opened the connection to said IP address?