Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My router, an up-to-date ADSL Fritz!Box 7340 router with a fixed leased IP address, has been configured to block all incoming traffic.

Assuming, for the sake of argument, no extra security is applied to the home network and the machines are unattended and wireless is disabled, how secure is this "block all" configuration against some hacker that tries to knock on my door?

I know that each OS and every single software program has its flaws and can be attacked, but when nobody gets in, they can never get to the flawed software, right?

share|improve this question
If you blocked all incoming traffic then you are basically no longer connected to the internet, since you cannot recieve responses from servers, even the domain namespace servers from your isp. The fact you posted on this website tells me you have not actually done what you claim you have done. – Ramhound Mar 30 '12 at 12:39
@Ramhound: no, there's a difference between outgoing and incoming connections. I only disallow incoming connections. The firewall knows the difference from NEW / ESTABLISHED as explained here. So once a connection is established (i.e., to this very server serving this page) the firewall knows the incoming traffic is connected to my outgoing request. TCP is a connection-based protocol, as opposed to UDP. – Abel Mar 30 '12 at 12:57
@Abel then you haven't blocked all incoming but most new incoming. This of course is the difference between statefull and sateless firewalls. There are ways to holepunch through still generally by getting the user inside to initiate a connection out. One could also spoof a connection that already exists to get through though now you need to crack the software that's setup to listen to those connection parameters. – ewanm89 Jun 12 at 16:13
up vote 6 down vote accepted

Using this statefull firewall should stop a large amount of unwanted connections.

Statefull firewalls are not completely impenetrable, it is possible to force a user to initiate a connection using embedded javascript within a webpage. Once connection outbound has been made it could be possible for the server to respond and deliver their payload.

The Register - Hacker pierces hardware firewalls with web page

The link above gives a greater detailed example regarding exploit via the IRC protocol but the theory should be possible on a wider scale.

share|improve this answer
That's the kind of information I was after. I still requires a user's action (so, in the case of unattended servers, we would seem pretty safe still, unless a specific vulnerability rises). – Abel Mar 30 '12 at 13:49
@Abel a server is not much of a server if it can't accept at least one inbound connection to serve out on. – ewanm89 Jun 12 at 16:14

Yes, but.

Yes, you're stopping someone exploiting vunerabilities in services you expose thru your router to the Internet, by not having any.

But, there are other possible attacks. What if you initiate a connection from inside, and the attacker has compromised the other end? Or if the attacker is pretending to be the other end (man in the middle). Or what if the attacker exploits a vulnerability in your router software? Or breaks into your house? Or social engineers you into telling them your mail password? Or steals your offsite backups? Or...

So yes, it works as described, and if you do not need to expose any services to outside you should block everything incoming: but there are other ways to attack your network.

share|improve this answer
So, unless there's a flaw in the firewall on the router itself, you essentially say my assumptions are correct (but I shouldn't feel too safe for other reasons). – Abel Mar 30 '12 at 12:59
Yes, that's about the size of it. – Graham Hill Apr 2 '12 at 11:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.