Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My router, an up-to-date ADSL Fritz!Box 7340 router with a fixed leased IP address, has been configured to block all incoming traffic.

Assuming, for the sake of argument, no extra security is applied to the home network and the machines are unattended and wireless is disabled, how secure is this "block all" configuration against some hacker that tries to knock on my door?

I know that each OS and every single software program has its flaws and can be attacked, but when nobody gets in, they can never get to the flawed software, right?

share|improve this question
1  
If you blocked all incoming traffic then you are basically no longer connected to the internet, since you cannot recieve responses from servers, even the domain namespace servers from your isp. The fact you posted on this website tells me you have not actually done what you claim you have done. –  Ramhound Mar 30 '12 at 12:39
1  
@Ramhound: no, there's a difference between outgoing and incoming connections. I only disallow incoming connections. The firewall knows the difference from NEW / ESTABLISHED as explained here. So once a connection is established (i.e., to this very server serving this page) the firewall knows the incoming traffic is connected to my outgoing request. TCP is a connection-based protocol, as opposed to UDP. –  Abel Mar 30 '12 at 12:57

2 Answers 2

up vote 3 down vote accepted

Using this statefull firewall should stop a large amount of unwanted connections.

Statefull firewalls are not completely impenetrable, it is possible to force a user to initiate a connection using embedded javascript within a webpage. Once connection outbound has been made it could be possible for the server to respond and deliver their payload.

The Register - Hacker pierces hardware firewalls with web page

The link above gives a greater detailed example regarding exploit via the IRC protocol but the theory should be possible on a wider scale.

share|improve this answer
    
That's the kind of information I was after. I still requires a user's action (so, in the case of unattended servers, we would seem pretty safe still, unless a specific vulnerability rises). –  Abel Mar 30 '12 at 13:49

Yes, but.

Yes, you're stopping someone exploiting vunerabilities in services you expose thru your router to the Internet, by not having any.

But, there are other possible attacks. What if you initiate a connection from inside, and the attacker has compromised the other end? Or if the attacker is pretending to be the other end (man in the middle). Or what if the attacker exploits a vulnerability in your router software? Or breaks into your house? Or social engineers you into telling them your mail password? Or steals your offsite backups? Or...

So yes, it works as described, and if you do not need to expose any services to outside you should block everything incoming: but there are other ways to attack your network.

share|improve this answer
    
So, unless there's a flaw in the firewall on the router itself, you essentially say my assumptions are correct (but I shouldn't feel too safe for other reasons). –  Abel Mar 30 '12 at 12:59
    
Yes, that's about the size of it. –  Graham Hill Apr 2 '12 at 11:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.