Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite
1

wikipedia say: XP's Windows Firewall cannot block outbound connections; it is only capable of blocking inbound ones.

another article says: XP defends you with your traffic coming from the web but doesn't protect what is sent to the internet.

Why XP can not do that?

is there any alternate solution for increase security in XP?

share|improve this question
1  
Just use another firewall product if the default one doesn't meet your requirements? – Luc Nov 29 '12 at 8:12
seek for reason of that decision in Microsoft Product. – saber tabatabaee yazdi Nov 29 '12 at 8:20
2  
@sabertabatabaeeyazdi - Your guess as for the reason is as good as anyones. We cannot speak for Microsoft. Besides there are already products on the market that can block outgoing traffic and incomming traffic. – Ramhound Nov 29 '12 at 12:55
@Ramhound I vaguely remember an MSDN blog post on the subject, where they said something along the lines of "outbound wasn't considered anywhere near as important as inbound", but it's not exactly concrete. I think the best educated guess is that they didn't bother with the less-important part because it just wasn't deemed cost-effective. – Polynomial Nov 29 '12 at 13:44
@Polynomial - My response really is based on the fact were talking about a feature that was introduce 10 years ago and the reasons features within that feature are missing. – Ramhound Nov 29 '12 at 13:59
show 1 more comment

3 Answers

up vote 7 down vote accepted

The presence of an unwanted outbound connection assumes that your machine has software on it that is acting against your will. If your box is already compromised, why bother trying to block a connection when the malware can just disable the firewall? Obviously there are some benefits - you can reduce the amount of outbound bad traffic from a box infected with simple malware - but it's largely a sticking plaster on a much more serious issue.

As such, I guess they felt that the feature didn't provide enough benefit for the amount of work (time and money) required to implement it.

share|improve this answer
Due date come. Microsoft doesn't have enough time so do important job?. Until the next version to compensate.? – saber tabatabaee yazdi Nov 29 '12 at 9:16
1  
I don't think so, they wrote a basic firewall to prevent external attacks and built it into their operating system. Their goal was limited to that. If they put in more functionality then they wouldn't be able to sell you another product. – GdD Nov 29 '12 at 9:30
As GdD said, it's not really an important feature. Blocking incoming traffic is significantly more important, and they have business requirements and deadlines to meet. – Polynomial Nov 29 '12 at 9:31
up vote 1 down vote

MS were just trying to develop a basic firewall that was easy to use. If they blocked outbound connections then every time someone installs an app that needs to access the internet the user would have to approve the connection. MS were not trying to compete with Cisco by making an application for sys admins, they were simply implementing basic security for the average joe.

share|improve this answer
up vote 1 down vote

Yes, there are two ways to fix your issue. First, you could use an alternative software firewall which allows the blocking of outbound connections. Second, you could install a hardware firewall in your network and filter traffic using rules for both egress and ingress traffic.

I believe the reason that they don't allow you to block outbound traffic is for usability. If they took a "default deny," also known as a positive security model approach then a lot of users would have a lot of problems.

They could not suggest that you turn on your firewall by default if it took a positive security model to ingress and egress traffic from your box. However, I don't know why they didn't disable the egress functionality and allow users to manually enable it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.