Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My understanding of the situation is that, when the Windows firewall is off, every port on the computer (all 65535 of them) is fully open. This means that any application running on the computer can send any traffic from the computer through any port to any device on the network or the internet. This also means that any device on the network or the internet can send traffic through any port on the computer.

When the firewall gets switched on, every port is closed (as in inbound and outbound traffic on every port is blocked) unless the user specifically opens one, or Windows UAC indicates to the user that a particular port on the firewall needs opened for an application to run (this usually happens when an application is being installed). In this scenario the user clicks yes and Windows configures the firewall to allow the application to function properly on their behalf.

So there we have it. If the firewall is off, every port is open and any application running on the computer can send and receive data through any port if it is designed to do so. Also any device that can connect to the computer (as a rule of thumb any device that can ping the computer) can send data through any port. Also, turning the firewall makes everything nice and secure right?

Firstly, I am sure that there is more to the Windows Firewall than this so what am I missing? Secondly, what have I misunderstood or got plain wrong about how the firewall works? Thirdly, is it as important as I think it is to have the firewall switched on at all times (I think it is very important) and lastly is the firewall as effective as I think it is (I am currently under the illusion that it is very effective).

Thanks

share|improve this question
2  
Pretty much everything you said is wrong. A port is only open if something has a connection on that port. A firewall allows the user to indicate if they want to allow that traffic on that port or not. I won't even get into the fact that a large majority of all uses use a home router. –  Ramhound Mar 27 '12 at 18:30
1  
If you have a more liberal interpretation of the term 'open', he's not THAT far off. And if he's referencing 'Windows Firewall', then he might be thinking of a host firewall. –  schroeder Mar 27 '12 at 19:32

3 Answers 3

up vote 9 down vote accepted

This means that any application running on the computer can send any traffic from the computer through any port to any device on the network or the internet. This also means that any device on the network or the internet can send traffic through any port on the computer.

Let's deal with that notion first...

Getting traffic on the internet over TCP/IP is kinda like sending post (with a few inconsistencies) to an apartment block. The IP address maps to the address of the apartment block and the TCP port to the apartment number in the building.

In order to send a packet to this address, you must first own an apartment in real life so you have a return address. Then, you try posting your parcel.

If nobody lives in that apartment, your package won't be received. It'll be left in the lobby with the porter and probably abandoned. The same is true of TCP ports - if there's no application listening (or "bound") to the port, the OS won't pass it into an application. However, the porter (the OS) does indeed handle that packet, if only briefly. Bugs in the porter are quite serious.

Now, in reality, just like with post, it's not as simple as you put your packet into the post and it comes out the other end. When you post your packet, your local post service take it so far, look up some information and work out which postal service to pass it on to (think international post).

Now we need to get a bit complicated. Suppose the person you want to post to works in a university building on a campus. Postal services don't deliver there; instead, they deliver to the porter in the main building; he then devices where to direct that package. This is a microcosm of the routing situation I alluded to above and is analogous to NAT.

So so far, we've learned that you can't always get packages to the requisite address, and you need someone there to receive them in the first place.

When the firewall gets switched on, every port is closed (as in inbound and outbound traffic on every port is blocked) unless the user specifically opens one, or Windows UAC indicates to the user that a particular port on the firewall needs opened for an application to run (this usually happens when an application is being installed). In this scenario the user clicks yes and Windows configures the firewall to allow the application to function properly on their behalf.

Nope. They're only open if there's someone at home with the light on. Otherwise, the porter looks at the package and says "who dis?" before promptly binning it (putting it the trash, if you're American).

So there we have it. If the firewall is off, every port is open and any application running on the computer can send and receive data through any port if it is designed to do so. Also any device that can connect to the computer (as a rule of thumb any device that can ping the computer) can send data through any port. Also, turning the firewall makes everything nice and secure right?

Well... in a very, very simplistic way, yes, kind of.

See, in truth, it is possible that the person living at the address you're posting to just doesn't like you very much. It's nothing personal, they've just never met you. So they don't open your package either, having had a quick peek at the sender. Many applications, e.g. webservers can direct traffic based on its incoming parameters. A common example is the HTTP HOST: header.

So, now let's fit Windows Firewall into our analogy. Windows Firewall is basically a Porter with a degree from MIT. He looks at the incoming packages and knows about people living in the various apartments. He has a list of rules which he can check recipients against - for example, he might allow Fred to receive packages from anyone on his street, or town, but not from France. How exactly he does this really depends on how he is instructed by whoever owns the building.

That is, in essence, how a firewall works. It does control what ports are open and closed and may do additional filtering based on packet destinations, sources, ports and even contents. However, the on/off idea isn't quite there. It's nowhere near that simple.

To explain, let's assume Fred and George live on the same street. George doesn't like Fred very much, because Fred uses a Mac (or your own stupid reason of choice in here. I just don't like Macs). So George decides to send Fred a stinkbomb.

Fred's porter has a rule that says if anyone wants to send something and they live on the same street, then Fred should be sent the packet. So George posts his package and next thing you know there's a smell of rotten eggs in Fred's flat.

I realise that's not the sort of IT professional-speak, so let's put it another way - your firewall only protects you according to the rules you have allowed. However, if one of those allowed rules gives an attacker a way to exploit your system, and the attacker does, the presence of the firewall will not help. This is true of Windows firewall as much as any other firewall.

share|improve this answer
1  
I think I like this idea of writing analogies to security solutions while in the pub :-) –  Rory Alsop Mar 27 '12 at 21:09
1  
@Rory that my ip address says I'm in the pub is an illusion. I'm really at home, working. Very hard. Honest! C'mon, how often do we tell people not to trust IP-based security ;) –  user2213 Mar 27 '12 at 21:26
    
This analogy is fundamentally flawed. The analogy in this post actually describes a system without a firewall. When you have a firewall, the main difference is that there is a dictator landlord that has absolute authority to override the rules that Fred and George requests from the porter. The landlord may decide that the porter never deliver letters from Fred's girlfriend to Fred. That landlord is the user/sysadmin. –  Lie Ryan Dec 4 at 11:12

A firewall is a mechanism used to protect a trusted network from an untrusted network, usually while still allowing traffic between the two. They are defined by the layer they work at: packet, circuit, application, or proxy.

Firewalls examine all traffic -- both incoming and outgoing -- and allow or deny based on rules.

Firewalls don't all simply refuse traffic based on port, most also perform packet filtering and can do NAT (network address translation).

share|improve this answer
    
Not true of all firewalls - some do just filter on port. Admittedly they are less common now, but they are still out there –  Rory Alsop Mar 27 '12 at 18:53
    
True. Thx. Edited. –  goblinbox Mar 27 '12 at 18:57
1  
and you get my +1 :-) –  Rory Alsop Mar 27 '12 at 19:01
    
does a snoopy dance –  goblinbox Mar 27 '12 at 19:08

As others have said, you have to redefine your use of 'open'.

1) Without a host firewall (which I assume you are referencing in your question), any service (program) can use any port on your computer, and any outside host can attempt to establish a connection. With a host firewall, you can prevent or allow access to those ports, both in and out. That's what a firewall does, and that's all that Windows Firewall does.

2) You are 'basically' correct in your understanding of firewalls, if you change your use of 'open'

3) It is very important to have a firewall on at all times. It does not offer complete or perfect protection, but it is part of the bare minimum that should be turned on (and more importantly, configured correctly)

4) Firewalls do what they are told to do. Their fundamental function is simple and effective, but what that means for how protected you are depends on many factors, including configuration and expectation. It is possible for a program to use an 'allowed' port that it is not expected to use (like port 80).

There are others who have answered the questions behind your questions. I hope I answered your questions directly so that you can consider their deeper answers more fully.

share|improve this answer
    
schroeder: Perhaps to clarify one point for the OP as well as myself (networking largely goes over my head) - if "open" is the incorrect term, what is the correct term? "Available" or something? Thanks. –  chrisallenlane Mar 27 '12 at 21:44
    
'unfiltered' or 'unblocked' work. 'Open' is not technically correct, but networking professionals use it all the time, because it means the combination of there being a service responding to it that is not blocked by firewall. –  schroeder Mar 27 '12 at 21:51
    
Excellent. Thanks for the clarification. Now I know. –  chrisallenlane Mar 27 '12 at 21:55

protected by Community Oct 2 at 13:17

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.