Questions tagged [firewall]
A Firewall is an application or hardware device used to inspect and filter network traffic.
1,059
questions with no upvoted or accepted answers
7
votes
0
answers
1k
views
pfSense Internal Traffic Policy Based Routing
What is the current and correct way to apply policy based routing to pfSense internal traffic (originating from the firewall itself)? Creating a floating rule with the WAN interfaces selected, ...
- 556
6
votes
0
answers
323
views
firewall-cmd to drop existing connections
I want to use firewall-cmd to temporarily block mysql port 3306, including existing connections.
However after I remove MySQL service, only new connections are blocked. The existing connections are ...
- 161
6
votes
1
answer
7k
views
What options do I have if I need a firewall behind AWS network load balancer?
Today we're using WAF for Application Load Balancer and it's great, but WAF not support Network Load balancer.
So we need a solution that will protect us behind or after the NLB. For example:
1. ...
- 173
6
votes
0
answers
11k
views
Nginx proxy_pass reverse proxying behind corporate firewall
Has anyone any idea of how to setup nginx behind a corporate firewall, to reverse proxy requests to servers outside the firewall?
The reason I want to do this is I am trying to use an application ...
- 191
5
votes
1
answer
1k
views
IPset Alternatives and Firewall Management
I have CentOS 7, Plesk 12, 8GB RAM VPS.
I have around 1000 rules in my IPtables to block abusive users. But when reloading IPtables it takes 15 seconds to reload all 1000 rules.
First of all, is it ...
- 221
5
votes
0
answers
3k
views
Windows Filtering Platform blocking packets for legitimate traffic
I am running into an issue with traffic from a webapp server to a database server being blocked or filtered. I have allowed inbound and outbound traffic on the needed ip and port with a firewall rule, ...
- 51
5
votes
0
answers
869
views
Firewall "Connection Security" when there is no trust and NATing between the two computers
First a little explanation of my network topology.
I have a internal domain, and edge network domain. There is no trust between the two domains (and IT will not allow a one way trust to be set up ...
- 1,465
4
votes
1
answer
2k
views
ICMP Host Unreachable messages result in martian source packets
I've been trying to understand a peculiar behavior in our routing/firewall setup for quite some time now, but don't really understand what's going on.
We have a firewall/router appliance that has two ...
- 437
4
votes
1
answer
10k
views
Port 443 appears to be closed in Nmap scans even when there's no firewall
I was trying to diagnose a problem where any HTTPS request to my VPS returns with ERR_CONNECTION_CLOSED. I'm using Let's Encrypt implemented on NGINX while the web server itself is a Node.js app.
The ...
- 141
4
votes
2
answers
6k
views
Create group of ip ranges for network security groups in Azure?
Is there a way for to group several ip address ranges in Azure?
Usage example: I have a list of IP ranges from Salesforce that I want to whitelist for a bunch of NetworkSecurityGroups. Let's say ...
- 233
4
votes
0
answers
611
views
Block incoming traffic in bonding mode when primary interface is down
My server running on latest kernel (4.4.6) has configured a bond device (bond0) with two enslaved interfaces eth0, wlan0 with primary interface eth0.
cat /proc/net/bonding/bond0
Ethernet Channel ...
- 41
4
votes
1
answer
448
views
Reject all except for whitelist policy with firewalld
I've been reading on firewalld for about the whole morning, and I came up with the following public zone:
<?xml version="1.0" encoding="utf-8"?>
<zone>
<short>Public</short>
...
- 279
4
votes
1
answer
603
views
Can't firewalld replace iptables?
I used Iptables on Centos 6.5 and tried to translate iptables rules into firewalld rules on centos 7.
However, with firewalld, i have discovered i am unable to
drop packets in invalid states
create ...
- 641
4
votes
0
answers
678
views
What's the recommended way to restrict Internet access per process using SELinux?
Before I have tried to do this using a phony user and iptables to execute commands that needs to be restricted. However now the commands need to read configuration set by each user's environment vars ...
4
votes
0
answers
408
views
Sophos firewall default settings do not allow HTTPS from Java 6 clients
Our current (default) Sophos firewall (Apache reverse proxy) settings does not allow Java 6 clients to connect over HTTPS. The ssltest result shows that the reason is "Client does not support DH ...
- 953
4
votes
0
answers
2k
views
TFS Check In Issue: The underlying connection was closed: A connection that was expected to be kept alive was closed by the server
I've recently started seeing the below error when attempting to check in code to TFS:
The underlying connection was closed: A connection that was expected to be kept alive was closed by the server.
...
- 1,366
4
votes
2
answers
8k
views
Packets marked INVALID in FORWARD rule
I have a firewall that has 3 IP aliases on 1 physical interface. Packets get dropped between these 3 interfaces (either ICMP, HTTP, or anything else). We tracked it down to these packets being marked ...
- 12.6k
4
votes
0
answers
2k
views
Clickonce applications being allowed through firewall
The company I work for uses an application that is deployed through clickonce. This means that everytime they update said program the program regenerates in a new location ie:
C:\Users\%username%\...
- 41
4
votes
0
answers
2k
views
Only allowing certain Java apps through firewall
Using Windows Firewall and Advanced Security, I block everything outgoing by default and define outgoing rules to allow my approved apps through.
For Java apps, I only allow java.exe through to ...
- 213
3
votes
0
answers
1k
views
Any attempt to connect to a server with ssh times out
after an attempt to get up a IKEv2 vpn server, I lost an ability to ssh to my server (the ssh just times out). I was able to console into the machine (with ubuntu) with hetzner console and reset all ...
- 131
3
votes
0
answers
171
views
Why is UFW blocking this connection?
I have a problem with a user who is unable to access a Ubuntu 22.04 webserver (he gets ERR_CONNECTION_RESET), apparently due to the firewall blocking his connections. However he IS able to access a ...
- 131
3
votes
0
answers
4k
views
how to allow outgoing traffic with firewalld / libvirt on CentOS 8?
I installed a CentOS 8 guest on a CentOS 8 host using libvirt. However firewalld is blocking all outgoing traffic from the guest to the internet unless I use target=ACCEPT for the libvirt zone.
The ...
- 213
3
votes
0
answers
3k
views
(HTTP) Traffic from DMZ to internal LAN using reverse proxy
I see a lot of threads on this topic, but I'm still confused, so apologies if this is "obvious" (I'm not a network engineer).
Currently we have a two-zone DMZ/LAN setup. No traffic is allowed from ...
- 131
3
votes
0
answers
6k
views
How to find out what is blocking a port in Centos 7?
I'm trying to make a mailserver with postfix/dovecot but I'm stuck. The problem is I cannot connect to some of the ports I want open, for example 587. As far as I can tell the port is open and ...
- 873
3
votes
0
answers
219
views
Limit Docker container access to specific domain
Can I limit docker container's internet access to specific domains using docker and docker-compose configs, or do I have to fiddle with usernames and external firewall?
- 158
3
votes
0
answers
7k
views
Active Directory Ports to be Allowed
What ports should be allowed in the firewall so that my workstations can access the Active Directory Server and have group policies pushed to the workstations.
The group policies are used to ...
- 131
3
votes
0
answers
130
views
How to know which program is modifying iptables?
I noticed at some random time, my iptables rules se flushed, or not matching what I set up. I'm the only user of this server, so it is not another user but it is another program I guess.
How to know ...
- 31
3
votes
0
answers
4k
views
Blocking ALL outgoing traffic Using firewalld to dedicated network subnets?
I have several RHEL7/CentOS7 servers on which I need to block all OUTGOING traffic to dedicated machines or dedicated network subnets e.g. CIDR 168.192.10.0/24.
For the moment I tried with firewall-...
- 31
3
votes
0
answers
671
views
PFSense IPv4 TCP/UDP connections from LAN not connecting
I have a PFSense firewall sitting as a gateway for a group of VM's sitting on top of a Xen hypervisor (all machines except for the host are virtual). I have PFSense acting as a waypoint for me to be ...
3
votes
0
answers
2k
views
iptables match forwarded packet if src address is in same network as dst address
I am looking for a way in iptables to match forwarded packets where the source address is in the same network as the destination address, without specifying the network.
Of course, when I specify the ...
- 1,796
3
votes
0
answers
485
views
Firewall : Is inbound required for getting response while Outbound rule already there?
I developed one MVC web application which have Web APIs and hosted in Amazon Instance and one windows application for calling those APIs for getting response from that server.
Both Web and Windows ...
3
votes
0
answers
2k
views
Set outgoing interface on Fortigate explicit proxy
I am testing the explicit proxy on a Fortigate 200D firmware 5.4
WAN1 and WAN2 are both members of the wan load balancer interface.
I need to set the proxy to use WAN1 but it it is defaulting to ...
- 15.6k
3
votes
0
answers
658
views
OpenSwan IPSec log explanation
I am trying to understand the IPSec logs. Would be really great if someone can help me to understand the main things I look for and how to troubleshoot any ipsec issue. Would be really great of ...
- 131
3
votes
0
answers
3k
views
WhatsApp call blocking
I'm managing a small network and I'm requested to block WhatsApp calls without blocking its messaging features. As they provide their public IP addresses I thought it'd be straightforward to add some ...
- 131
3
votes
1
answer
2k
views
ip6tables blocking outgoing+incoming connections
i just changed to a server with ipv6 and therefore i changed my firewall script. Changing my iptables-script to ip6tables does not seem to work though. This is the ipv6 part which neither allows ...
- 33
3
votes
0
answers
650
views
Allowing outbound internet access with NSX while maintaining micro segmentation
I am getting into the world of VMware's NSX product for the purpose of micro segmenting VM's in the datacenter. That is to say, living in the same network space but not being able to talk to one ...
- 185
3
votes
0
answers
434
views
Windows Firewall Connection Security, require encryption with IPv6?
I've set up Windows Firewall on a Server 2012 R2 to always require IPSec Encryption for all Connection Security Rules.
I've then specified Inbound Rules for specific ports and services, and ...
- 687
3
votes
0
answers
1k
views
Multi vlan internet access via Watchguard
i'm pretty new to network and routing so i would appreciate some tips on this.
I have a firewall(watchguard x1250e), connecting to a switch(Nortel Baystack 5510) with multiple vlans for internet ...
- 31
3
votes
0
answers
1k
views
Understanding packets dropped by iptables from puppetmaster
I am seeing packets getting dropped during my puppet client runs on a semi regular basis. And I do not understand what is causing this. I should mention that Puppet is managing the firewall rules ...
- 91
3
votes
0
answers
366
views
RANCID - timeout connecting PALOALTO in HA
When rancid try to connect via SSH to PALO (the active one) i get a time out message.
Connecting manually everything is ok.
I believe is something related to prompt containing parethesis.
add user ...
- 43
3
votes
0
answers
950
views
Solving an asymetric HA Firewall/router
I have an old Linux HA firewall/router setup that never quite worked. As it was never quite put into true production (just testing and demo's), I always had to have one firewall shutdown to make it ...
- 14.7k
3
votes
1
answer
830
views
Whitebox firewall in datacenter environment
I am looking into alternatives to commercial firewall appliances.
Most of the resources available online describe home network firewalls or sub-gigabit networks. Considering than 10GbE is becoming the ...
- 183
3
votes
0
answers
384
views
firewall-cmd forward rules for interface with multiple ips
I'm looking for a way with firewall-cmd or another command to do the following.
An incoming public interface has multiple ip addresses bound to it.
How can I forward ports only for one of the ip ...
- 31
3
votes
1
answer
226
views
Smart solution for XenServer firewall?
I've been searching for a smart solution for a XenServer firewall for about a month now. The documentation for the new default networking backend "openvswitch" is not that detailed and I can barely ...
- 31
3
votes
0
answers
6k
views
Mikrotik router RDP brute force blocking with whitelist
Masters,
We have a miktorik router, and we would like to block RDP brute force, but we need whitelist also to allow our collegaues to connect without blocking them. (they sometimes hitting wrong ...
- 227
3
votes
0
answers
1k
views
How can configure Cisco ASA 5510 to allow access to Web server in DMZ from LAN with port translation?
I am trying to configure Cisco ASA 5510 firewall to allow access from LAN to DMZ web server. Web server is located in the DMZ and is using port 8080. I don't want users to type port number every time ...
- 131
3
votes
0
answers
2k
views
What is Bonjour Linux IPTables Firewall Ports?
I'm trying to configure my iptables in order to allow Pidgin to use Bonjour protocol, now according to: Bonjour for Windows doesn't work due to firewall settings, I have to allow Multicast DNS / (5353/...
- 13.6k
3
votes
0
answers
2k
views
juniper ssg320 intrazone configration issues Close - AGE OUT
We have one main office and another small office that holds only 5 people. We have recently setup OpenVPN on our main office and created a bridged vpn between our main office LAN and a windows 2003 ...
- 31
3
votes
0
answers
349
views
SVN checkout returns 400 error
I'm trying to download the http://code.opencv.org/svn/opencv/trunk/ repository of all of the OpenCV source code - as specified in an OpenCV installation tutorial.
In the tutorial, the repository ...
- 151
3
votes
0
answers
3k
views
Redundant Firewalls And Switches HSRP and CARP
I currently have planned
2 x uplinks (HSRP Active/Standby)
2 x pfsense firewalls (Carp Enabled)
2 x layer2 switches
Please criticize or offer help on the correct way to do this.
I have a feeling im ...
- 3,608