1

My router, an up-to-date ADSL Fritz!Box 7340 router with a fixed leased IP address, has been configured to block all incoming traffic.

Assuming, for the sake of argument, no extra security is applied to the home network and the machines are unattended and wireless is disabled, how secure is this "block all" configuration against some hacker that tries to knock on my door?

I know that each OS and every single software program has its flaws and can be attacked, but when nobody gets in, they can never get to the flawed software, right?

Improve this question
3
  • 1
    If you blocked all incoming traffic then you are basically no longer connected to the internet, since you cannot recieve responses from servers, even the domain namespace servers from your isp. The fact you posted on this website tells me you have not actually done what you claim you have done.
    – Ramhound
    Commented Mar 30, 2012 at 12:39
  • 1
    @Ramhound: no, there's a difference between outgoing and incoming connections. I only disallow incoming connections. The firewall knows the difference from NEW / ESTABLISHED as explained here. So once a connection is established (i.e., to this very server serving this page) the firewall knows the incoming traffic is connected to my outgoing request. TCP is a connection-based protocol, as opposed to UDP.
    – Abel
    Commented Mar 30, 2012 at 12:57
  • @Abel then you haven't blocked all incoming but most new incoming. This of course is the difference between statefull and sateless firewalls. There are ways to holepunch through still generally by getting the user inside to initiate a connection out. One could also spoof a connection that already exists to get through though now you need to crack the software that's setup to listen to those connection parameters.
    – ewanm89
    Commented Jun 12, 2016 at 16:13

2 Answers 2

Reset to default
6

Using this statefull firewall should stop a large amount of unwanted connections.

Statefull firewalls are not completely impenetrable, it is possible to force a user to initiate a connection using embedded javascript within a webpage. Once connection outbound has been made it could be possible for the server to respond and deliver their payload.

The Register - Hacker pierces hardware firewalls with web page

The link above gives a greater detailed example regarding exploit via the IRC protocol but the theory should be possible on a wider scale.

Improve this answer
2
  • That's the kind of information I was after. I still requires a user's action (so, in the case of unattended servers, we would seem pretty safe still, unless a specific vulnerability rises).
    – Abel
    Commented Mar 30, 2012 at 13:49
  • @Abel a server is not much of a server if it can't accept at least one inbound connection to serve out on.
    – ewanm89
    Commented Jun 12, 2016 at 16:14
3

Yes, but.

Yes, you're stopping someone exploiting vunerabilities in services you expose thru your router to the Internet, by not having any.

But, there are other possible attacks. What if you initiate a connection from inside, and the attacker has compromised the other end? Or if the attacker is pretending to be the other end (man in the middle). Or what if the attacker exploits a vulnerability in your router software? Or breaks into your house? Or social engineers you into telling them your mail password? Or steals your offsite backups? Or...

So yes, it works as described, and if you do not need to expose any services to outside you should block everything incoming: but there are other ways to attack your network.

Improve this answer
2
  • So, unless there's a flaw in the firewall on the router itself, you essentially say my assumptions are correct (but I shouldn't feel too safe for other reasons).
    – Abel
    Commented Mar 30, 2012 at 12:59
  • Yes, that's about the size of it.
    – Graham Hill
    Commented Apr 2, 2012 at 11:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .