14
votes
Accepted
Is a FIN only segment legal?
All the research of half an hour says that FIN-only is never legitimate.
http://www.whitehats.ca/main/members/Seeker/seeker_tcp_header/seeker_tcp_header.html
Packets should never contain just a ...
- 8,826
12
votes
Accepted
How does NAT Stitching work?
You must remember that a flow using NAT will look like two different flows: a flow pre-NAT, and a flow post-NAT. This is because NAT is changing one or more of the addresses in the packets. This can ...
- 98.7k
11
votes
How would a firewall kill a TCP connection without RST or FIN?
You don't mention the kind of firewall, but I suspect most simply drop the packets.
I have a Wireshark dump on server side and I tried to find if firewall
sends a FIN or RST with ip.dst==serverip ...
- 67.1k
11
votes
Do I get any security benefits by NATing a network that's already behind a firewall?
No.
I agree with @RonMaupin in the comment: NAT is not a security feature but a workaround for the lack of IPv4 addresses.
NAT only add complexity without increasing security, if the network and the ...
- 19.5k
10
votes
How does Deep Packet Inspection work with encrypted packets?
As you point out, traditional DPI methods have limited ability to deal with encrypted traffic completely. They can still address encrypted traffic at a surface level at the very least, but it does ...
- 27.2k
10
votes
Difference between firewall and ACL
ACLs are packet filters. They pass or block packets based on packet data, such as addresses, ports, or other data. They are also stateless. That means the decision to pass or block a packet is based ...
- 67.1k
8
votes
Accepted
How many pps (64Byte each) i can receive in 1Gbps throughput modem / firewall
If i have 1Gb/s throughput. I can receive how many pps in 64Byte each packet / s?
This is dependent on the platform. The more packets that must be processed in software, the fewer this will tend to ...
- 27.2k
7
votes
The use of DMZ and single firewall design
While not necessarily the answer you're looking for... (a) simplicity, and (b) cost. One firewall is half the cost of two. With enterprise grade hardware being rather expensive, when one springs for ...
- 31.8k
6
votes
Why do routers (and router firewalls) go through so much effort to make peer-to-peer difficult?
You are confusing a couple of things: firewalls, and NAT. While it's true that you can have NAT on many firewalls, they are not even close to the same technologies.
UDP hole punching is used on NAT, ...
- 98.7k
6
votes
How do I reset a Fortigate firewall password without resetting the firewall
Hey you could have just googled that and the first link is your answer. Here.
Do some research before asking please.
Here's the steps in short:
connect to the fgt with a com cable, if not com port ...
- 394
6
votes
How would a firewall kill a TCP connection without RST or FIN?
Most likely the firewall just dropped the packet without sending an RST packet, probably after hitting a session timeout value of some sort. This is typically configurable behaviour.
I personally ...
- 2,449
6
votes
How many pps (64Byte each) i can receive in 1Gbps throughput modem / firewall
The ethernet standard for 1 Gbps means that the ethernet interface can serialize frames at 1 Gbps. What you are seeing is the limitation of the device to process packets. That depends on many factors, ...
- 98.7k
5
votes
Why do routers (and router firewalls) go through so much effort to make peer-to-peer difficult?
I honestly think that you don't understand the question
I don't understand your question either, and it's probably because I believe you're operating under incorrect assumptions.
Let me be clear - ...
- 9,017
5
votes
Accepted
Network design question
First of all, as they mentioned above it is a poor design. No security engineer would consider exposing their servers directly to public without having any defenses (IPS, Firewall DMZ or host based ...
- 161
5
votes
Accepted
Firewall Policies vs Firewall Rules
Though there are (as far as I know) no strict definitions, you say that policies are the abstract, high level definitions of what traffic should and shouldn't be allowed. Firewall rules are the ...
- 17.1k
5
votes
Accepted
What are the advantages of a firewall over a Layer-3 switch?
Firewalls are usually stateful. Usually, you want a firewall to block everything but established communication, and this can be difficult to impossible with ACLs, depending on the router or switch ...
- 98.7k
5
votes
Accepted
TCP session established even if the server isn't listening on particular port
Fortinet has an ALG (proxy) for SIP (a VoIP protocol) since this protocol uses dynamic ports (like FTP) and thus need to be handled in a specific way. Port 5060 is the default port for SIP. This means ...
- 2,343
5
votes
Accepted
VLANS vs. subnets for network security and segmentation
Subnets are the IP stacks way of determining what hosts are "assumed to be on link". If an address is in the same subnet traffic will be sent directly, otherwise it will be sent to a router (by ...
- 13.2k
5
votes
Accepted
Urgent: how to configure different interface using same ip subnet in asa 5506?
The ASA 5506 doesn't have the switchport commands like the 5505. In routed mode, each interface is on a separate subnet, like a router.
- 67.1k
5
votes
Cisco ASA 5585X Internal-Data0/1 interface errors
From Cisco tech note:
The ASA interface error counter "overrun" tracks the number of times
that a packet was received on the network interface, but there was no
available space in the interface ...
- 67.1k
5
votes
Accepted
If you're behind a firewall and all the ports are blocked, how is your browser able to access the internet?
A firewall does not "block all ports" - otherwise you could just pull a cable instead of having some firewall. Instead simple firewalls block all incoming connections (what you read as all ports ...
- 2,343
5
votes
Accepted
How does Deep Packet Inspection work with encrypted packets?
For the actual payload inspection you need to break the encryption. That is the only way to detect drive-by malware downloads and similar threats.
The usual way that works is the same way as a man-in-...
- 82.6k
5
votes
Accepted
What is the difference between an ASA firewall and UTM firewall?
An ASA is a layer 3 and layer 4 firewall. UTM stands for Unified Threat Management, meaning it does the basic layer 3 and layer 4 firewalling but also has the capacity (much larger storage, more RAM, ...
- 4,690
5
votes
Accepted
Difference between Zero Trust Architecture and VPN + MitM Access Rights Management at Gateway
The comparison as given makes the two solutions seem very similar. Most Zero Trust Network Access implementations do implement the mentioned features but tend to add additional features and components ...
- 2,050
4
votes
How I can block Psiphon?
I'm quoting what is posted on the Psiphon page:
You can only establish connections via Psiphon by using the following ports:
53, 80, 443, 554, 1935, 7070, 8000, 8001,
6971-6999.
If you block ...
- 2,105
4
votes
Network design question
You need to get a beefier firewall that can handle the traffic. You really don't want your servers unprotected.
If you do go down the path of your drawing, you would need to get a larger public ...
- 98.7k
4
votes
Network design question
Place your public servers into a network segment that is being routed on the firewall for security and management reasons.
If you cannot do that due to performance reasons you should consider Host-...
- 767
4
votes
Accepted
Small network security Issue
the most simple way to do that is proxy server with black list include all sits you try to block , but to be onest with you in such environment any small solution could be hacked by the users. may you ...
- 3,444
4
votes
Accepted
Mikrotik RouterOS - NAT to multiple ports on the same IP
In a single NAT rule, you can specify multiple ports in the same rule by using a comma separator, or hypen for range, or combination of them both.
So for FTP, I use ports: 21, 990, 65000-65100
If ...
- 56
Only top scored, non community-wiki answers of a minimum length are eligible