New answers tagged

0

Yes, it's a common way if one is running Debian stable, but needs a more recent version of a specific software. The backports mechanism is the way to go, but there are no backports provided for shorewall. So, go ahead and guck luck; I'm quite sure it will work flawlessly.


0

I know this is an old post, but I'm leaving a message here for the future. I've found two situations that happened not to be firewall related even though that was the first place I looked. After reviewing the firewall logs I found that the inbound UDP 161 requests were being accepted. In Services, check the Security tab on the SNMP service and ensure ...


1

I just recently got a USG100 which is pretty much same and I was struggling with the LAN -> Server connection, so here is what i did to get it working for me. Created Object / Address for the server. Add Service if needed, I used HTTP/HTTPS in my case but tested with custom one succesfully. Created NAT rules using public ip address as original ip and NAT ...


5

You need to open endpoints for the services you want to make accessible from the Internet. In the old Azure portal these are listed under Endpoints. In the new portal under Inbound Security Rules.


0

When creating your firewall rule in Windows using the Inbound / outbound rule Wizard, check the Custom Rule button. It will open up more options, including Scope in which you can designate which IP range you want to allow traffic into. Simply specify which local IP the rule applies to, and fill out the rest of the options as you navigate the wizard.


0

What you're doing there is only changing the config. That much of it's correct, but then you need to apply those changes. For the case of VIPs, check what firewall_virtual_ip.php does when you apply changes. https://github.com/pfsense/pfsense/blob/master/src/usr/local/www/firewall_virtual_ip.php#L48 Do that in your code after doing the write_config.


1

I have never come across an online tool that can do all of this. Usually to ensure these tests are all compliant, you would get an external security audit team in to handle the tests and they would provide you with an idepth report of all vulnerabilities found There are also a plethora of tools you can use yourself to simulate these type of attack, such as ...


2

There is three main chains to catch all traffic - INPUT, OUTPUT, and FORWARD - put appropriate rules in all of them to see any kind of traffic. There is no direct way to do this. There is no chain (by default) to catch dropped/rejected traffic and no any flag in the packet itself to signify that it will be dropped. So, you need to create custom chain and ...


4

You can use IPTables for it, just set allow rules for your whitelisted IPs and reject all others.


1

Not sure if the following it too generic for you (if so, please post a comment accordingly), but your given regex doesn't match the host: ... value of the log generated by the attacker, specifically the / inside there. You could try out this instead: failregex = ^ \[error\] \d+#\d+: \*\d+ user "\S+":? (password mismatch|was not found in ".*"), client: <...


0

Found a solution for this old question that has also been bugging me for a long time! The New-NetFirewallRule TechNet article states this about the -Group parameter of the New-NetFirewallRule commandlet: [...] This parameter specifies the source string for the DisplayGroup parameter. [...] Rule groups can be used to organize rules by influence ...


5

Windows Server 2012 has a built-in firewall, which can be managed from either GUI (running wf.msc) or PowerShell, using Network Security Cmdlets.


0

centos7 uses firewall-cmd out of the box, unless you have disabled it. I assume you have not because you would have mentioned it otherwise. With that assumption in place, then you can simply run this on your postgresql host: firewall-cmd --add-service=postgresql Once you have verified that it works, then you can run it again with the permanent switch to ...


0

Can it be done? Yes. You will need a stateful NAT64 implementation. Normally these are used to provide local IPv6 clients with access to resources on the public IPv4 internet but there is nothing stopping you using one the other way round. Firewalls can be used to limit what hosts can be accessed through the NAT64 gateway. Should it be done? In general I ...


2

Per our discussion in the comments, it sounds like you may be confusing the role of a firewall with that of a transparent proxy. Firewalls do not rely upon DNS resolution to implement access policies. There are several reasons for this that I have covered before. The most significant reasons are: Reliance upon an easily spoofed protocol Added software ...


0

Ubuntu 16.04 LTS /etc/ufw/user.rules In general, try: locate user.rules Should output something like: /etc/ufw/user.rules /usr/share/ufw/user.rules /usr/share/ufw/user.rules.md5sum /usr/share/ufw/iptables/user.rules


0

You can use PF. It will be difficult, because you'll have to identify and turn off the dynamic rules which allow Screen Sharing to pass through, and override those settings. I'm sorry I can't point you towards how to do this directly, but Apple's design puts a lot of effort into making their GUI available— it used to be impossible to administrate one of ...


-1

Found the article 'Configure firewall settings for DPM' https://technet.microsoft.com/en-us/library/hh757794.aspx It must be the same ports as Windows Azure Backup Server is based in DPM.


0

Full Multicast routing gets much trickier (so much easier in the days of hubs). There is a package to install to make it much easier. WiFi is configured to not allow a WiFi device to talk to another WiFi device.


0

Websense was blocking forwarded ports. So it was network issue. Took me a lot of time to figure out.


0

Assigning a network security group on the subnet does work as expected. Adding a network security group to a NIC on the scale set didn't work, possibly a limitation or is different than the virtual machine ARM resource.


0

it looks like iptables can not add more IP addresses after some point That is expected behaviour for an ipset hashtable as described in the manual in the Introduction: ... When entries added by the SET target of iptables/ip6tables, then the hash size is fixed and the set won't be duplicated, even if the new entry cannot be added to the set. No ...



Top 50 recent answers are included