3

I have a question regarding network firewalls and TCP traffic. When a firewall rule is set to block either inbound traffic, outbound traffic, or both on a port, does that only apply to initial communication requests?

Just as an example, if I have a computer that has outbound port 80 blocked, but inbound port 80 opened, does that mean this computer can serve web pages, but cannot request any? Or does it mean that whenever a client connects, establishes a TCP session, and sends the HTTP request, the server is not allowed to send anything back?

Please let me know if this question is hard to understand. If so, I will try to clarify.

Improve this question
2
  • As per the comments below Lucas's answer, could you clarify whether you are talking about destination or source ports or a combination of both and whether the policy is DENY or ALLOW in your example?
    – Ladadadada
    Commented Jun 27, 2013 at 9:32
  • I'm not really a networking expert, and I'm a little confused on the source/destination ports. I'm guessing that refers to the ports on the client and server respectively. Anyway, both answers below answered my question. Once the connection is established, traffic is allowed to flow freely on that connection.
    – QAH
    Commented Jun 27, 2013 at 16:54

2 Answers 2

Reset to default
5

In the spirit of keeping it simple:

Just as an example, if I have a computer that has outbound port 80 blocked, but inbound port 80 opened, does that mean this computer can serve web pages, but cannot request any?

Yes

Or does it mean that whenever a client connects, establishes a TCP session, and sends the HTTP request, the server is not allowed to send anything back?

No

Think of it this way. The source determines who is allowed to initiate the request. Once the connection has been established (assuming it's a stateful connection, ie: TCP) the communication is free to flow both ways until the session is over.

Improve this answer
3

If you allow inbound, but disable outbound, the server will never have a chance to reply to your request since your firewall will block his reply. A solution to this is to allow established connections. This means that if someone requested a page, your server is allowed to send outbound traffic since a connection has been established (new connections originating from your server on port 80 will still be blocked).

Do note that if you block outbound requests (even when allowing established connections) your web application itself will not be able to perform requests. For instance if your website is dependent on an external API which is called directly from the server (not via the client) then there is no chance of your application reaching that API since it will get blocked.

Improve this answer
9
  • This answer assumes you have a DENY policy (i.e. a default rule if no other rule matches). If your policy is ACCEPT then this answer would be quite different.
    – Ladadadada
    Commented Jun 27, 2013 at 8:56
  • It's because he said: * If I have a computer that has outbound port 80 blocked, but inbound port 80 opened, does that mean this computer can serve web pages, but cannot request any? *
    – Lucas Kauffman
    Commented Jun 27, 2013 at 9:07
  • The question also doesn't mention whether the blocking is on source or destination ports but I assume he meant destination ports. In this case, the initial SYN to port 80 will be allowed, the response SYN/ACK will not match any rule and will fall through to the policy because the source port for this packet is 80 but the destination port is a high port chosen by the client.
    – Ladadadada
    Commented Jun 27, 2013 at 9:30
  • but if he allows established connections, the SYN/ACK should be allowed no?
    – Lucas Kauffman
    Commented Jun 27, 2013 at 9:43
  • 1
    @ktothez iptables.
    – Ladadadada
    Commented Jun 27, 2013 at 18:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .