wikipedia say: XP's Windows Firewall cannot block outbound connections; it is only capable of blocking inbound ones.

another article says: XP defends you with your traffic coming from the web but doesn't protect what is sent to the internet.

Why XP can not do that?

is there any alternate solution for increase security in XP?

closed as off-topic by AviD Jul 30 '15 at 19:05

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    Just use another firewall product if the default one doesn't meet your requirements? – Luc Nov 29 '12 at 8:12
  • seek for reason of that decision in Microsoft Product. – saber tabatabaee yazdi Nov 29 '12 at 8:20
  • 2
    @sabertabatabaeeyazdi - Your guess as for the reason is as good as anyones. We cannot speak for Microsoft. Besides there are already products on the market that can block outgoing traffic and incomming traffic. – Ramhound Nov 29 '12 at 12:55
  • @Ramhound I vaguely remember an MSDN blog post on the subject, where they said something along the lines of "outbound wasn't considered anywhere near as important as inbound", but it's not exactly concrete. I think the best educated guess is that they didn't bother with the less-important part because it just wasn't deemed cost-effective. – Polynomial Nov 29 '12 at 13:44
  • @Polynomial - My response really is based on the fact were talking about a feature that was introduce 10 years ago and the reasons features within that feature are missing. – Ramhound Nov 29 '12 at 13:59

The presence of an unwanted outbound connection assumes that your machine has software on it that is acting against your will. If your box is already compromised, why bother trying to block a connection when the malware can just disable the firewall? Obviously there are some benefits - you can reduce the amount of outbound bad traffic from a box infected with simple malware - but it's largely a sticking plaster on a much more serious issue.

As such, I guess they felt that the feature didn't provide enough benefit for the amount of work (time and money) required to implement it.

  • Due date come. Microsoft doesn't have enough time so do important job?. Until the next version to compensate.? – saber tabatabaee yazdi Nov 29 '12 at 9:16
  • 3
    I don't think so, they wrote a basic firewall to prevent external attacks and built it into their operating system. Their goal was limited to that. If they put in more functionality then they wouldn't be able to sell you another product. – GdD Nov 29 '12 at 9:30
  • 1
    As GdD said, it's not really an important feature. Blocking incoming traffic is significantly more important, and they have business requirements and deadlines to meet. – Polynomial Nov 29 '12 at 9:31

MS were just trying to develop a basic firewall that was easy to use. If they blocked outbound connections then every time someone installs an app that needs to access the internet the user would have to approve the connection. MS were not trying to compete with Cisco by making an application for sys admins, they were simply implementing basic security for the average joe.


Yes, there are two ways to fix your issue. First, you could use an alternative software firewall which allows the blocking of outbound connections. Second, you could install a hardware firewall in your network and filter traffic using rules for both egress and ingress traffic.

I believe the reason that they don't allow you to block outbound traffic is for usability. If they took a "default deny," also known as a positive security model approach then a lot of users would have a lot of problems.

They could not suggest that you turn on your firewall by default if it took a positive security model to ingress and egress traffic from your box. However, I don't know why they didn't disable the egress functionality and allow users to manually enable it.


Windows Firewall if is enabled blocks unsolicited connections to your computer. So any programs can connect to internet if user's actions make that happent but no connection can inbound whitout a previously demand.

In conclusion: no IN without OUT and vice versa no OUT denies IN.

  • This does not seem to answer the OP's question which is why Windows default firewall is limited to this behaviour. As already stated by other users a few years (!) ago, some other standalone firewall software offer the possibility to allow the initial output traffic to a specific list of software and block others, but such functionality was not in scope of Microsoft bundled free firewall. – WhiteWinterWolf Aug 1 '15 at 10:46

Not the answer you're looking for? Browse other questions tagged or ask your own question.