Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I kind of know that how a firewall's rules for IP/port work, but I have no idea how a firewall deals with individual programs.

In other words, how does the firewall know a program wants to access the Internet and stop it?

share|improve this question
There are many different types of firewalls. See bethlakshmi 's answer for a basic overview. The type of filewall you are asking about semms to be a host based (on your own computer) application firewalls (block specific programs rather than just data). – this.josh Aug 16 '11 at 20:49
@this.josh yeah, my fault.... – user1221 Aug 17 '11 at 1:26
Don't think of it as a fault, think of it as an opportunity to learn. A lot of frequent answer providers continue to learn new things by participating on this site. Asking good questions is a lot harder than it seems. See the FAQ for some pointers on asking good questions. One of the great features of the stack exchange sites is the ability to edit and revise your question, answer, or comment. If your post isn't perfect the first time, and my usually are not, revise it and make it better. – this.josh Aug 17 '11 at 5:04

Application filtering firewalls are hooked into the operating system at the kernel level and aware of any file access. That file access awareness includes network sockets.

For a visual demonstration of this on:

The firewall is aware of the requesting process and associated network information (port, state, address, etc.) just as those applications above are, but it also has the ability to modify, prevent, or close connections.

share|improve this answer
Maybe netstat --program would be a better example. – this.josh Aug 16 '11 at 20:54
This answer is specific to host-based firewalls, not network-based firewalls. Network-based firewalls generally have no knowledge of the operating systems of end point devices. – Bill Frank Aug 17 '11 at 22:07
The question specifies individual programs, which is implicit of a host-based firewall. Individual protocols would be different. I gather from the wording that the poster understands basic network firewalls. – Jeff Ferland Aug 17 '11 at 22:46

Jeff Farland's answer is absolutely correct so if you're looking for the short, quick answer, that in my opinion is it.

However, I like to know exact details (like how exactly is it done) because I'm like that and this is a bit too long for a comment, so, I'll focus on Windows software-based firewalls, since that's where you are most likely to find commercial software application firewalls. A lot of these links are direct to developer documentation and get quite technical quite quickly, so if that's not you the reader's thing, I apologise, hopefully it's a useful introduction to someone though.

Basically, Windows actually has a whole set of OS functionality that allows you to filter out, deny requests, inject requests etc. The most easy to find documentation on the subject starts with the file filtering manager used by many antivirus products. There's a brilliant diagram in there showing you exactly how each request works. Essentually, there's a driver stack, part of which includes a series of minifilters which are sorted by priority order and applied to the request. This is probably what your average antivirus does and is why many antivirus products can't be installed simultaneously; they interfere with each other. Although this is for file based activity, so:

For firewalls, going forward it makes the most sense to talk about the Windows Filtering Platform, one of the many security changes that came about in Vista. A direct link of interest is the part explaining the many ways application level firewalls could be implemented in previous versions of windows. Basically put, it was very complicated and again why two firewalls might not just cause collisions, but actual system instability. Aside from that, a lot of vendors were (are) writing firewalls.

The really simple way to explain WPF is this: you have two options available to you. The kernel (Windows itself) provides you with a certain set of default filters you can apply (which are fairly flexible looking at the samples). If you want to do anything more, you need to build a callout driver which is essentially the same idea as the minifilters above. In callout driver mode, you can inspect the contents of the packet and do whatever you want to to it based on that information.

The reason for introducing this change is the introduction of Kernel Patch Protection, a mechanism to prevent drivers modifying the core of Windows in ways you do not want. Coupled with that, it is entirely possible to do a lot of filtering without even writing drivers, see this sample code. And if you're interested in making one, or just wondering where I found all this, here's the steps to learn about it building a WFP based product page from MSDN.

So, basically, what Jeff said, really. Obviously Linux and Mac OS X are different again; I've tried to concentrate on the OS with which most people will have used a product like this.

By the way; Jeff mentioned Process Explorer. The sysinternals utilities use these and other filtering APIs to give you the information you see there these days.

share|improve this answer
Nice description and explanation. – this.josh Aug 16 '11 at 21:12

Backing up a step here, and writing between the posts - there are a number of different types of firewalls out there. The capabilities built into the firewall and the location of the firewall within the network have a lot to do with what the firewall can do. Whether or not a firewall can even detect the program transmitting the data has a lot to do with these factors.

First, a definition - a firewall can (really loosely) be defined as something that watches and filters traffic on a network. It can be:

  • part of a network device - built into a router or a switch
  • a standalone device that does nothing but filter traffic
  • a piece of software installed on a computer system like a workstation or labtop

It can be located virtually anywhere it can be plugged in, but the general idea is to put it between stuff you want to protect and stuff you don't trust.

From there, there are dizzying number of types of firewalls out there and how they work has a huge influence on what they can do. Here's some examples of variations:

  • network layer watched - application, session and network layer are the big ones. I'm sure that if one looks hard enough, one can find firewalls that operate on other layers, but those are the big ones.

  • proxy vs. stateful - if it's a proxy type firewall all it can do is compare this message to a set of rules for wrong vs. right for the given target. If it's stateful, it can build up a set of rules based on what's come before.

Combining even these three things (where it's located, what layer of networking it can watch, and whether its proxy or stateful) can produce a wide variation in what the firewall can do.

In general, all firewalls have a set of rules for good vs. bad behavior. I would suspect that unless you are talking about an application level firewall running on the protected computer system with non-firewall-like features - that the firewall can not spot a program and stop it from running. I've never heard of a firewall that can, for example, see that I'm using Microsoft Word and stop me from using it.

What an application firewall can do, however, is block application level traffic, which will render some applications useless - for example, try using a web browser without access to the Internet. Usually when a firewall claims to block applications, it means applications in the sense of network transmissions. In that sense, the HTTP traffic produced by my web browser is considered the application.

Rules can range from things that are really simple - i.e. "don't allow incoming HTTP GET requests" to something complicated, like diagnosing a series of requests that shows the handle of some sort of attack. The key is, about all a firewall has to go on is where the message seemed to come from, where it's headed, and what's in it.

One last caveat - encryption methods will change what a firewall can and can't do. If the firewall terminates the SSL/TLS session, then it can be capable of doing application level processing, even on SSL transmissions - but if the SSL/TLS or other encrypted pathway is from client to server, then the best that the firewall can do is make sure that the SSL is well formed.

share|improve this answer
Nice job spotting the OP's confusion about different types of firewalls. I have seen programs that prevent you from using specific application, but I don't think I would call them firewalls. – this.josh Aug 16 '11 at 21:09
Let's be more specific about the definition of "application." I would call HTTP a protocol. Facebook, for example, actually consists of many different applications. A firewall that can classify traffic by application block Facebook games and allow Facebook mail. Stateful inspection firewalls, by definition, cannot detect applications. A proxy-based firewall might be able to, but only on the ports to which it is listening and only for the protocols it can proxy. – Bill Frank Aug 17 '11 at 22:13
OK, I'm talking about the "application layer" as defined by the OSI model - - in which the HyperText Transfer Protocol is included. Pardon for mincing words, but it seemed redundant to call HTTP a protocol when it's already in the name itself. :) In that context I have frequently seen HTTP referred to as an "application", and my point was to clarify that an "application" to folks talking about a network is different than an "application" to folks talking about an operating system. – bethlakshmi Aug 18 '11 at 15:00

Since you make reference to IP and port, I will assume you are referring to a network-based firewall. Since all application-aware firewalls are not the same, I can only speak about the one with which I have experience - Palo Alto Networks. If mentioning a specific vendor violates the rules of this website, then just remove this answer.

All of Palo Alto Networks' application-based rules/policies are based on network-based application identification. In other words, PAN does deep packet inspection of all the traffic, all the time, across all ports. So the firewall does not know or care about applications running on end points.

Palo Alto uses four methods of traffic analysis - Application Protocol Detection (includes SSL decryption), Application Protocol Decoding, Application Signatures, and Heuristics). I know these sound like buzzwords, but the point is that there are multiple methods used. BTW, none of them are proxy-based, which is a good thing.

Once the traffic is classified, then the rules/policies are applied. Rules can include LDAP groups and/or users, QoS, Zones, etc. BTW, you can still use ports and IP addresses in rules along with the other items.

If Palo Alto cannot identify the application of a specific session, you can block it. In other words, default deny. Of course, at first you would just alert before enabling block. Palo Alto provides a report for these sessions so you can go back and determine why it could not identify the application. There are several remediation methods depending on the reason.

share|improve this answer
Good answer - this approach applies to some of the broader group of Deep Inspection Firewalls. Most Deep Inspection Firewalls will carry out the protocol and traffic analysis, but the heuristics is quite new. I don't know who else does it aside from Palo Alto. – Rory Alsop Aug 16 '11 at 20:06
Mentioning specific prodicts is fine. If I am not affiliated with a product I mention, I usually put a note indicating 'I work with product x, but have no other afilliation'. If you are affiliated with a product or company it is considered rude not to disclose that fact. – this.josh Aug 16 '11 at 20:57

I'd recommend you take a look at application layer (3rd Gen) firewalls. These are the type that are aware of a particular protocol or application.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.