13

I had to go to System / Update / Update Settings and set to previous stable version 2.4.5 deprecated bc I am still on 2.4.5-RELEASE-p1. After doing that, package manger didn't show any updates for a few min and then eventually it started showing updates that were right for my branch. Then I was able to upgrade pfBlockerNG-devel to 3.0.0_10 whereas previously ...


13

Check your pfSense version. I had to update from pfSense 2.4.5_1 to pfSense 2.5.0. That solved the problem for me.


6

Your best bet is to buy a cheap mini-PC and run pfSense. pfSense is the software part of a very, very high level Firewall/Router and runs on commodity hardware (x64 PC). It is used heavily in enterprises as well as small shops. And it is free.


4

According to this article: https://social.technet.microsoft.com/Forums/windowsserver/en-US/4d8678e2-5653-4fd2-b275-62e0e7008ff9/conflicting-display-of-windows-firewall-setting-from-gui-and-netsh-advfirewall?forum=winserverGP Windows Firewall has mutliple configuration stores. One is for Group Policy and one is for local. The policy that is actually applied ...


4

You can disable Windows Defender Firewall with Group Policy. In the administrative templates for the computer, go to Network | Network Connections | Windows Defender Firewall | Standard Profile (or Domain Profile if your computers are connected to a domain network) and set "Windows Defender Firewall: Protect all network connections" to Disabled. As ...


4

That's not possible. For the client to send its request (with or without "magic" hostname), a TCP connection has to be established first. You could of course terminate/blackhole the connection if the desired Host header does not appear, but that's not very hidden.


3

There is a default rule to "let out anything from firewall host itself" you can check at Floating firewall rules. Your rule just tells to allow traffic at specific time interval. Also, you have configured it as "first match". The firewall works like this with your rule: Checks your condition to apply the rule (schedule, source, ...


3

If you can find an affordable mini-PC with enough network ports (or enough PCI-e slots for additional expansion cards), you can use it as a L3 router. Use Linux's built-in firewall to prevent forwarding between subnets. An example iptables setup would be: *filter :INPUT ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] -A FORWARD -i lan+ -o lan+ -j ...


3

Your question is a little unclear, but I'll give a broad overview. My apologies if this gets just a bit political, but I think its neccessary to explain properly. A VPN works by encrypting all traffic between the VPN endpoints - thus A correctly set up VPN of OK quality should bypass all restrictions if it can make a connection to an endpoint on the other ...


3

The local address always has to be a local address – as in an address that's literally assigned to a network adapter on this computer. So if a strange domain name shows up as a "local address", that just means one of your own IP addresses is resolving to that strange domain name. If you use netstat or disable the "Resolve network addresses&...


2

May I know if the rule for blocking ports 80, 443 was applied for local ports or remote ports? When the connection was established, ports 80 and 443 refer to the port on the server (website) side. The port of your client was randomly selected from 1001 to 65535. If you want to block HTTP/HTTPS traffic via windows firewall, you could disable remote port 80 ...


2

Using ufw to block everything by default but allow ssh and http/https: sudo ufw default deny incoming sudo ufw default deny outgoing sudo ufw allow 22 sudo ufw allow 80 sudo ufw allow 443 sudo ufw enable Also remember that by default Docker and ufw don't work well together, you'll need to change the Docker daemon config as described there: https://...


2

After a few comment exchanges, your question basically boils down to this: Do I need to open my RDP port 3389 on the client side for RDP to a cloud server to work, or is that a security risk? No, you never need to open a client side port at all. By the usage of the term open a port, I refer to creating a port mapping on the router and specifically allow ...


2

So I'm adding an answer not to compete with Eduardo, who has answered this question nicely, but to explain the options with proper formatting. so as we discussed, a rule with a schedule will only be active when the current time falls during the time the schedule defines. Schedules don't care about blocking or allowing. Also, note that you have a Default ...


2

-s means "source". By "outgoing packets to IP range" you most likely mean "destination". Change each -s to -d. Also keep in mind -A appends a rule to the end of the chain. Rules are processed starting from the head. The rule you append to the end will be processed last (if the flow ever gets to it). Rules previously (and still) ...


2

From admin elevated command prompt to delete the firewall rule run: netsh advfirewall firewall delete rule name="lolchat" Or go to Windows Firewall from the Control Panel and then delete the rule named lolchat, as picture below to delete it via the GUI method:


2

No, I think your computer's firewall is lying to you. Judging by the choice of local and remote ports, it's probably seeing perfectly normal response packets that belong to an existing outbound connection, but is unable to associate them with that connection for some reason. To know whether a connection is incoming or outgoing, a firewall has to be stateful –...


2

Because “all traffic” does not speak the SOCKS protocol. A SOCKS proxy expects its clients to speak SOCKS. That’s where redsocks comes in: It terminates TCP connections and speaks SOCKS “on the other end”. SOCKS is also a TCP-based protocol. When a SOCKS client connects, the following happens: TCP handshake (SYN →, SYN-ACK ←, ACK →) Client sends a SOCKS ...


2

You could try using the iptables string match module to match the packet contents so that it matches typical NTP protocol contents, and allow only those packets that match this criteria in your rules. However, this is not 100% waterproof, you need to carefully assign the matching strings. Also, a malicious intruder could detect this and add the string to his ...


2

This is found in Services > Port Forwarding:


2

Ideally, the entire /29 would be on the "inside" interface of the firewall, the firewall itself would be connected using a completely separate /31 (or /30), and the ISP would route the main /29 via your firewall... It's worth trying to call your ISP and ask if they can do that kind of "point to point" configuration. If that's not possible,...


2

The problem's the active mode. When that's used the server's trying to establish a connection with the client, but firewalls and NAT prevent that. Every SoHo router NATs the traffic between the user's system and the internet. Passive mode is recommended. Unfortunately Windows command-line FTP client (ftp.exe) doesn't support passive mode. However there's any ...


1

I think you are misinterpreting your packet traces and it's making you ask the wrong questions. Let me try to clarify some things: From the first packet trace: IP 192.168.47.1.64045 > 239.255.255.250.1900: UDP This is your router advertising UPnP services. This packet was created by your router itself; this packet was not forwarded from somewhere else. ...


1

Firewall rules only apply to packets that are routed at IP layer – but if both the sender and the recipient are in the same subnet, they will actually communicate directly at MAC layer, bypassing the router itself. (In RouterOS, you can see that the physical ports are bridged under /interface bridge port print.) Assuming both hosts are connected directly to ...


1

Possibly, it will depend on the firewall and the VPC in use. Firewalls are either Stateless or Stateful. Stateless firewalls will look at the ports and/or IP addresses used for connections and block or allow connections based on these. Stateful firewalls will look at the contents of the traffic being exchanged (possibly in concert with the IP addresses and ...


1

A firewall like this is only to allow or block connections. I think you might be unable to make a VPN connection in a hotel or like environment (double NAT causes issues). Otherwise, if you do succeed in making a connection, the firewall will not evaluate what it is. It all depends on the connection type (double NAT and firewall blocking) but I think these ...


1

Yes, you are being attacked. The reason is likely because you have port-forwarded the standard SSH ports on your router. In this way you have signaled the hackers of the entire world that here is an SSH server waiting to be attacked using dictionaries of standard user-names and often-used passwords. I suggest that you port-forward some other port from the ...


1

Under WSL1, ufw will simply refuse to run since it does not contain a "real" Linux networking stack. Under WSL2, the instance is running in a Hyper-V VM with a virtual NIC that is pseudo-NAT'd behind the Windows host network. ufw would likely run just fine, but it would only apply to traffic coming in to the WSL2 instance, not to Windows. It's ...


1

I just tried it on my home network. A samsung S5 = responded to pings. A LG G3 = responded to pings. A generic ZTE = responded to pings. All running different versions of android. If you have av/firewall apps running on the phone this is most likely the culprit.(mcafee/norton etc) Although the suggestions for the wireless access point ...


1

To block access to port 138 from the internet, you need to block it at the router. However, port 138 is never open by default. So unless you opened it yourself by configuring port-forwarding on the router, everything should work by default exactly as you want.


Only top voted, non community-wiki answers of a minimum length are eligible