Why block outgoing network traffic with a firewall?

Question

In terms of a home network, is there any reason to set up a router firewall so that all outgoing ports are blocked, and then open specific ports for things such as HTTP, HTTPS, etc. Given that every computer on the network is trusted, surely the amount of extra security provided by blocking outgoing ports would be pretty much negligible?

Answer 1

Blocking outbound traffic is usually of benefit in limiting what an attacker can do once they've compromised a system on your network.

So for example if they've managed to get malware onto a system (via an infected e-mail or browser page), the malware might try to "call home" to a command and control system on the Internet to get additional code downloaded or to accept tasks from a control system (e.g. sending spam)

Blocking outbound traffic can help stop this from happening, so it's not so much stopping you getting infected as making it less bad when it's happened.

Could be overkill for a home network tho' as there's a lot of programs which make connections outbound and you'd need to spend a bit of time setting up all the exceptions.

Answer 2

Coming from a security role, particularly if you've ever been involved in incident response, the idea of outbound filtering would seem a natural course in a high security environment. However, it is a very large and complex undertaking. Mention the words "egress filtering" to a firewall, network, or systems administrator and you'll likely get this response.

So while we know that high security environments may need this, and would warrant the extra work, it can sometimes be difficult to get buy-in. Particularly when a unit whose primary duty is to maintain uptime is suddenly asked to take on a potentially significant amount of extra maintenance to accomplish something that has a high probability of reducing uptime.

In this case we would be remis to not mention the compliance angle. Let's look at the PCI-DSS v2.0 for a moment. Requirements section 1 discusses systems and network security. This one is relevant here:

1.3.5

Do not allow unauthorized outbound traffic from the cardholder data environment to the Internet.

As much as we all like to talk about how "Compliance is a Starting Point" in the real world sometimes the only traction we can get is the goal of filling in that checkbox or passing that audit. Taking a look at compliance documents relevant to your field or service could be useful. While PCI-DSS is exclusively an industry requirement, agreed to by contract law, it is a fairly specific set of requirements that I have seen adopted as a standard to audit against in other places that have less well defined requirements.

Answer 3

Incoming traffic blocking can only prevent unsolicited traffic from reaching your internal network. However, if you get malware on an internal machine (via running an untrusted executable, or through an exploit) you can still be hit.

Blocking outgoing traffic helps limit the damage, by preventing the malware from connecting to a command & control server or exfiltrating data. Whilst your machine will still be compromised, it might save you from having your personal details stolen by a keylogger.

Answer 4

Two reasons:

1. In the event that malware makes its way into your network, blocking outgoing traffic can sometimes contain the damage by preventing the malware from contacting a remote server. If you firewall at the machine level, you may also keep the malware from spreading further through your network. Disallowing outgoing traffic also means that your machine becomes less interesting as part of a botnet.
2. Legitimate software with networking capabilities might be vulnerable and could be tricked into setting up outgoing connections which can then be used to further compromise your system. Consider, for example, a web server that runs an application with a flaw that allows an attacker to trick it into downloading files over the internet instead of opening local files (such a flaw is easy to produce and overlook in, for example, PHP). If you have it properly firewalled off, the request will simply fail, and maybe even trigger an alarm somewhere.

Answer 5

Unless you block all outgoing traffic other than a whitelist of legitimate websites you visit (and/or use a proxy that does whitelisting and security scanning), there's little additional security to be gained from blocking all ports except 80/443. Well, blocking port 25 might be good to keep your network from being used to send spam.

Many botnets already communicate over HTTP to connect to their command/control network since they know that other ports may be blocked (some even use DNS as their command/control protocol). So if you're going to let your network connect to any HTTP server, then you're not giving yourself much additional protection from joining a botnet, and you'll continually run into problems when you try to run things that use other ports like VPN, video conferencing, online gaming, websites on non-standard ports, FTP, etc. And you'd really need to regularly audit the logs to look for signs of infection.

Probably not worth the hassle on a home network. You're probably better off spending your time in trying to prevent malware infection in the first place than in mitigating damage once you've been infected.

Answer 6

Beyond damage-control after a compromise, you might also want to:

• Control how (and whether) users and processes inside the network use the Internet

• Monitor your inside processes to detect malware ("passive vulnerability scanning")

Answer 7

All the computers in the network are trusted but what about the humans. Some one may plug in an infected usb (may be unknowingly) to one of the systems and you have a malware infected pc (even after blocking all the unused incoming ports ) .

In this case the malware may be able to communicate with the server and may be your data is being sent outside.it is possible that your system may become a part of a botnet.

this is the least that you should do to protect your network.Even after blocking all unnecessary ports in and out covert channels may be used for secret communication.