Tag Info

New answers tagged

8

What mfinni said, except that we forward three ports to a behind-the-firewall all-in-one Exchange box: 25: SMTP 80: HTTP (redirect to OWA HTTPS) 443: HTTPS This works fine for people with Androids, iPhones, etc. Generally, people at home use OWA or their phone, anyway. Edit: Since you asked for a Microsoft source, this is a link to a TechNet ...


8

That looks mostly correct for a wide-open all-protocols implementation. Some suggestions: Unless you have mail clients, with a business justification, that require all that, limit it to just 25, 80, 443. Don't allow POP access, that's a plaintext password. Don't allow client SMTP access, that's a plaintext password. (Of course, to accept mail from the ...


1

The PIX501 predates jumbo frames. Consequently the hardware does not support it and as such there is no way to enable it in software or configuration. Since the PIX501 is out of CCO / Safenet support, I would recommend to start planning to migrate to the ASA5500 series of devices, many of which support GigE and jumbo frames, and which can still get support ...


0

I can't find anything that suggests that the PIX has a maximum MTU of more than 1500, so yeah, it'd be a bad idea to have it acting as the router for devices speaking 9000 byte frames. Better question, though, is why is your network being switched to jumbo frames? It's unlikely that the minor performance benefit will make much difference in anything but a ...


0

The free sophos appliance allow that


0

At high level and functionally they're mostly equivalent. In both cases the functionality will allow you to block or grant access to certain network ports to/from remote networks, regardless of how the server itself is configured. The underlying technology could be fundamentally different i.e. rather than the state-full packet inspection that is the more ...


2

Typically where you have -A INPUT -p tcp -m tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT On a FTP server I would expect -A INPUT -p tcp -m tcp --dport 21 -m state --state NEW -j ACCEPT to accept incoming FTP connections, which are NEW, as existing connections are already accepted by an earlier rule. Second you'll need to ensure the FTP ...


0

I believe the --state NEW in the corresponding entry is superfluous. Your rules may be more or less secure but there are some things missing that would allow you internet access from the machine at all. Let me show you what I consider a standard setup (not that this could not be found on a thousand sites): root@gw:~# cat /etc/iptables.up.rules # Generated ...


0

To answer the question "Can the security be tighten a little more", let me refer you to the following community wiki: iptables Tips & Tricks


2

Please use a dedicated firewall device. A Cisco ASA 5505 firewall is a good option. There are many questions about using a virtualized firewall in ESXi to bridge external and internal connectivity. People should not do this.


0

Dropping --syn will stop new connections and there shouldn't be any half-open connections to track. In general filtering "without keeping track" is possible at the -t raw -I PREROUTING stage.


2

This port is used for STUN (Simple Traversal of UDP for NAT), which is used by VoIP in some cases. It is also used by the Apple FaceTime application. It could also be used by malware. You may have unauthorized or incorrectly software on the workstations in question. It is also possible your firewall is blocking legitimate traffic for one of the above ...


1

It sounds as though you are describing an issue already within your network - in which case if I were you I'd be taking the workstations communicating with said IP offline for a full complement of virus/malware/etc detection, as well as of course uncovering what is attempting to communicate with the IP you mention - and if at all possible, trying to ...


1

CSF/LFD installs easily and works with pretty much zero configuration. But the default configuration will send you a LOT of lfd emails about processes - and whilst it is possible to turn emails off entirely that's a bad idea for obvious reasons. What you will need to do is spend the first few days of running CSF monitoring those emails and deciding if any ...


2

Nowadays even limiting the ICMP packets in server side can create headache on DDoS attacks. Attacks mostly done by sending huge window ICMP requests to one server and if the server is trying to respond to each of it, guess what happens? Main thing that we have a teamspeak server that gets bad packets every single day, there was few days in two months that ...


1

You'll do much better to simply use a network device that can do outbound load balancing, based on sessions, percentage of bandwidth used, etc. I'm answering your question as if it was a request for info about a technology, rather than an explicit product request.


0

I had to use sudo for traceroute and the -I option (Use ICMP ECHO for tracerouting): sudo traceroute google.com -I


0

For traceroute you need to allow outgoing UDP packets in the range 33434:33524. Some tools will allow you to use ICMP echo requests as well. As you have PING working, you must have enabled ICMP echo-requests packets. Return packets will be mostly ICMP time-exceeded packets. If you have enabled the required ICMP types, you won't need to configure ...


0

Suggest you allow a wider ICMP response. -A ufw-before-input -p icmp --icmp-type destination-unreachable -j ACCEPT -A ufw-before-input -p icmp --icmp-type source-quench -j ACCEPT -A ufw-before-input -p icmp --icmp-type time-exceeded -j ACCEPT -A ufw-before-input -p icmp --icmp-type parameter-problem -j ACCEPT -A ufw-before-input -p icmp --icmp-type ...


0

Try a small SOHO router (like a dlink or linksys). The SSG5 is an entry level firewall, on a big ISP link the packet inspection service can kill the firewal, while a SOHO router inspect nothing, like your PC too. If the test is ok, you will need to upgrade the router.


0

Anyone answering "Do not get a firewall" will be shot down. Entrypoint will be your Modem. Your Firewall needs to hook in right after that and from there everything else. There are many small Firewalls out there if it is a SonicWall or a FortiGate or a WhatEver it is called. Your initiel installation should be done by a professional so you do not think ...


0

You can use only a firewall, not the router over. It's like setupping a small firewall for your home usually, the sonicwall got a full webpage gui, easy to configure. Small office I seen usually just use a firewall (like a linksys or dlink). The Sonicwall tz105 is a good choice for a small office, it's a step over the dlink and linksys. Just be advised ...


3

This is, perhaps, a bit too obvious of a statement, but the blocking behavior has to be based on the information that the remote server is privy to. That would include: The source IP address The source TCP port, which should be ephemeral and changing on each request There's probably some passive fingerprinting of the client's IP stack that's possible The ...


0

yes but my problem is the ip-range in WAN side is the same. So all 3 IP-Adresses are in the same range with one default GW on WAN side. regards


0

You can use the pf route-to clause to forward traffic via specific interface. You can try something like that, considering ISP1 interface is vlan1 and it's the interface with default gateway: isp1if = "vlan1" isp2if = "vlan2" isp1ip = "192.168.0.1" isp2ip = "192.168.1.1" isp2gateway = "192.168.10.1" nat on $isp1if proto tcp from $isp1ip to any port 25 -> ...


1

You should specify the port when connecting from your home computer. Most FTP clients including Filezilla will attempt to connect on the default port 21 (FTP) and 22 (SFTP).


3

After hours of troubleshooting, I finally identified the culprit. I had a transposed a number in the IP address of my mailserver. (In the ScreenOS address list) My firewall rules were using the named address entry, so that explains why they wouldn't work, even when the rules were correct. Rather embarassing, but I did want to post the solution in case ...


0

It's definitely a good idea to clean up your firewall rules every so often, for me it's primarily for security and also good housekeeping. Security To keep it short, even if you did limit the rules to application names and/or exe hashes, it still provides a security risk to have a port open if you're not using it, so removing it when you're done is ...


3

The parameter logpath should be set to a path for a log file where the SSH attempts are going to be recorded in. So if that's /var/log/messages, then /var/log/secure is obviously incorrect. Change the logpath parameter to be the correct file.


3

Based on your debug ouput Your source IP is 10.10.94.187 But your eth0/1 is 10.11/24 so there's no zone match for the policy. You'll need to adjust your eth0/1 vlan to accomodate the zone properly.


0

Solution I found an answer to my problem, and it was the network configuration on the dmz. The dmz is on a Dell Power Edge 1950, where I'm running the hardware node on 10.10.1.2/24, and a venet0, virtual node for OpenVZ. I was not concerned about connecting to the OpenVZ nodes just yet, but could not even connect to the hardware node. After modifying the ...


1

Do you have more than one ip address assigned to the nic of the server? If you do, and the client accesses address1 and the server responds on address2/3/etc. then a firewall rule for one address could/would preclude traffic from reaching back from server to client.


0

DNS servers fall into a few different groups: Authoritative server Public recursor Non-public recursor In none of those cases will it make any sense to try to hide their existence. The authoritative DNS servers have to be publicly reachable in order to do the task they were set up for in the first place. A public recursor is pointless if you try to hide ...


1

We plan on using it on an https site and my question is do we need to create exceptions in the firewall or the proxy server or both? Usually the proxy will be standing behind the firewall (fw), or put it another way the fw is between the proxy & the INET. The fw will allow the proxy to connect to port 443, 80 etc on any INET servers. The servers are ...



Top 50 recent answers are included