How to Block 80 and 443 traffic for server

Go to juniper

- Click on configure

- Click on security

- Click on policy

- Click on apply policy

- Here we have to block all 80 and 443 traffic for the infected server

- Select zone – lan (from) and zone – wan (to) and apply filter

Then to determine what happening on the server, we can run below command

• tcpdump port http or port ftp or port smtp or port imap or port pop3 or port telnet -l -A | egrep -i -B5 'pass=|pwd=|log=|login=|user=|username=|pw=|passw=|passwd=|password=|pass:|user:|username:|password:|login:|pass |user '

Then from this command output, select one website URL ping it from local and take IP address and then run netstat command on server and kill the process related to that website

• netstat -anpt