I have a machine that I use only to browse the Internet. What if I blocked all ports on this machine (inbound and outbound) except for port 80 and port 443, and restricted these two ports to an internet browser executable. Would this make my machine more secure?

  • 1
    You cannot restrict these ports to "an internet brower executable": 80 and 443 are server ports for HTTP/HTTPS, and you have no idea what is making a connection on these ports (curl, metasploit, etc can mimic a Firefox behavior)
    – Xenos
    Oct 19, 2019 at 11:58
  • "protected" from what? That's the question.
    – schroeder
    Oct 19, 2019 at 15:51
  • 2
    Blocking ports that don't have a listening service running on them does effectively nothing. Oct 19, 2019 at 17:37
  • @schroeder protecting from any unauthorized communication with the outer world (i.e. potential spyware that slipped into the machine somehow).
    – Sisyphus
    Oct 20, 2019 at 19:27
  • @multithr3at3d please explain what do you mean exactly?
    – Sisyphus
    Oct 20, 2019 at 19:27

2 Answers 2


First, it might make your system slightly more secure but it does not make it fully secure. In the majority of attacks today the victim unknowingly invites the attacker implicitly into the local network. This is for example done when surfing the web: all content you visit is downloaded to your local system and rendered or executed (depending on the content) there. The same is true for emails - any attachments you open will be opened on your local system. And attached Office documents, PDF, archives etc are typical vectors to infect your system. No firewall which just blocks based on ports will protect you against these most common attacks.

Apart from that you should only block incoming ports for data which are not part of an established connection (initiated from the inside). Otherwise you will simply not be able to surf the web anymore. And websites are not only located on port 80 and 443, so restricting outgoing access to these ports will probably result in over-blocking too. Similar you might need access to other ports like 143, 993, 465 ... to retrieve and send mail (unless you use web based mail). And games or whatever applications you use might also need different outgoing ports.

Depending on what system you use it might the best (most security with less side effects) if you use the systems capabilities. For example if you declare your computer to be inside a public network it will already adjust the firewall accordingly to not allow any incoming connections but allow outgoing connections.

  • Assuming the worst case that a spyware has slipped into the machine somehow, either email or an infected USB flash or whatever. Wouldn't blocking communication with the outer world by restricting communications to only web browsing traffic and only to a web browser, keep the machine protected from leaking data to unauthorized remote party rendering the slipped trojan useless to the attacker (assuming a spyware scenario)?
    – Sisyphus
    Oct 20, 2019 at 19:31
  • 1
    @Sisyphus: Blocking any kind of network activity for applications which are not the web browser might help somewhat. But it will also block various legit and important traffic, like software updates done by the various programs (often each uses its own updater program). Apart from that malware might actually employ the browser itself to communicate with the outside, thus bypassing the block. Oct 20, 2019 at 19:41

Any trojan can exploit the open outbound port 80 to send its malicious traffic to its central "command and control" server.

You'd need an Intrusion Detection & Prevention System (IPS/IDS) on a dedicated firewall to be able to check if the communication outbound on that destination port 80, is actually Http and that it doesn't see other signatures in the traffic that can be linked to known trojan communication traffic.

If the IPS/IDS is backed by a nice AI system, malicious/anomalous patterns can be quickly identified. But AI-backed IPS /IDS as a feature on firewalls is quite expensive.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .