What are the security implications of allowing all incoming connections in a firewall on a typical Windows server?

Question

Say I have a Windows Server (let's go with Windows Server 2012, but I'm thinking in general). It's running IIS. We have our standard website, accessible via port 80 (HTTP) and 443 (HTTPS). And let's throw in an FTP server (ports 21 and 22) for administration. Standard user authorization on that (no anonymous FTP). Otherwise everything is in the default settings and we have whatever applications that Windows includes and runs by default.

What's the implications now if we allowed all incoming connections in the firewall?

If I understand correctly, this is almost akin to disabling the firewall -- it turns it into a blacklist, but by default there isn't any block rules, so it's like the firewall wasn't there. I can't think of anything that would be listening on a port that the firewall blocks access to, so can't see what the difference is (and trust that Windows can handle data sent to closed ports appropriately).

EDIT: Actually, I decided to try this on a server that I have access to (hopefully this wasn't a completely stupid idea). I ran an nmap port scan on that server and found the following ports are open (some I have descriptions for but don't know what they are):

• 21 (FTP)
• 80 (HTTP)
• 3389 (ssl/ms-wbt-server?)
• 5985 (Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP))
• 8172 (Microsoft IIS httpd 8.5)
• 47001 (Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP))
• 49152-49164 (RPC)

Answer 1

Each port that's open to connections from the internet is a possible attack vector, opening just one port ie TCP/80 gives the hordes of botnets the ability to connect and try to exploit any vulnerability with IIS to gain access or possibly break your server.

Opening every port multiplies this risk greatly, more ports and services, more chance that one of them is misconfigured or vulnerable and it only takes one vulnerability or an easily guessed password for your server to be compromised.

Is every single service running on that server patched and hardened? Does every service have protection against brute force attacks? Do you know what every open port is doing? If the answer to any of those questions is no, then the implication is that your server will eventually be hacked. The internet is not a forgiving place.

Answer 2

The main benefit of blocking all incoming connection is that if your website gets infected by a trojan and it opens a port for the attacker to connect back. The firewall won't let the attacker connect (so easily).

Basically “Incoming block” means that incoming new connections are blocked, but established traffic is allowed. So if outbound new connections are allowed, then the incoming half of that exchange is okay.

The implication is that the firewall manages this by tracking the state of connections (such a firewall is often called a Stateful Firewall). It sees the outgoing TCP/SYN and allows it. It sees an incoming SYN/ACK, verifies that it matches the outbound SYN it saw, lets that through, and so on. If it permits a three-way handshake (i.e. it is allowed by the firewall rules), it will allow that exchange. And when it sees the end of that exchange (FINs or RST), it will take that connection off the list of allowed packets.

Also if you turn your firewall on, you won't see the name of services running on the port by using nmap. They will appear as filtered ports. This would increase difficulty of the fingerprinting process and become a turn off for a lot of script kiddies out there.