Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a question regarding network firewalls and TCP traffic. When a firewall rule is set to block either inbound traffic, outbound traffic, or both on a port, does that only apply to initial communication requests?

Just as an example, if I have a computer that has outbound port 80 blocked, but inbound port 80 opened, does that mean this computer can serve web pages, but cannot request any? Or does it mean that whenever a client connects, establishes a TCP session, and sends the HTTP request, the server is not allowed to send anything back?

Please let me know if this question is hard to understand. If so, I will try to clarify.

share|improve this question
    
As per the comments below Lucas's answer, could you clarify whether you are talking about destination or source ports or a combination of both and whether the policy is DENY or ALLOW in your example? –  Ladadadada Jun 27 '13 at 9:32
    
I'm not really a networking expert, and I'm a little confused on the source/destination ports. I'm guessing that refers to the ports on the client and server respectively. Anyway, both answers below answered my question. Once the connection is established, traffic is allowed to flow freely on that connection. –  QAH Jun 27 '13 at 16:54
add comment

2 Answers

up vote 4 down vote accepted

In the spirit of keeping it simple:

Just as an example, if I have a computer that has outbound port 80 blocked, but inbound port 80 opened, does that mean this computer can serve web pages, but cannot request any?

Yes

Or does it mean that whenever a client connects, establishes a TCP session, and sends the HTTP request, the server is not allowed to send anything back?

No

Think of it this way. The source determines who is allowed to initiate the request. Once the connection has been established (assuming it's a stateful connection, ie: TCP) the communication is free to flow both ways until the session is over.

share|improve this answer
add comment

If you allow inbound, but disable outbound, the server will never have a chance to reply to your request since your firewall will block his reply. A solution to this is to allow established connections. This means that if someone requested a page, your server is allowed to send outbound traffic since a connection has been established (new connections originating from your server on port 80 will still be blocked).

Do note that if you block outbound requests (even when allowing established connections) your web application itself will not be able to perform requests. For instance if your website is dependent on an external API which is called directly from the server (not via the client) then there is no chance of your application reaching that API since it will get blocked.

share|improve this answer
    
This answer assumes you have a DENY policy (i.e. a default rule if no other rule matches). If your policy is ACCEPT then this answer would be quite different. –  Ladadadada Jun 27 '13 at 8:56
    
It's because he said: * If I have a computer that has outbound port 80 blocked, but inbound port 80 opened, does that mean this computer can serve web pages, but cannot request any? * –  Lucas Kauffman Jun 27 '13 at 9:07
    
The question also doesn't mention whether the blocking is on source or destination ports but I assume he meant destination ports. In this case, the initial SYN to port 80 will be allowed, the response SYN/ACK will not match any rule and will fall through to the policy because the source port for this packet is 80 but the destination port is a high port chosen by the client. –  Ladadadada Jun 27 '13 at 9:30
    
but if he allows established connections, the SYN/ACK should be allowed no? –  Lucas Kauffman Jun 27 '13 at 9:43
1  
@ktothez iptables. –  Ladadadada Jun 27 '13 at 18:42
show 4 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.