why blocking incoming traffic does not block chatting or VOIP

Question

I just recently blocked all incoming traffic(all local ports and all external ips) in my windows 7 firewall and I understand that will not stop me from accessing websites as browsing needs outbound connection. That was fine with me.

However, though I'm not able to access any shared files or rdp to this computer from local networks, I find I can VOIP or chat in Internet. I wonder how it's possible.

According to my understanding, to send messages we need incoming ports open which I have blocked then why I can still chat or VOIP.

Answer 1

Most communication nowadays is done via remote servers. So clients connect to a central server and the server manages communication between clients. Blocking listening ports with a firewall will not stop this communication.

But some services require direct (Peer to Peer) communication for decreased latency and increased bandwidth. VoIP and other services can still communicate without having local ports open.

By combining the client-server model with the P2P model, new ways of establishing connections were invented:

• UDP hole punching is a commonly used technique employed in network address translator (NAT) applications for maintaining User Datagram Protocol (UDP) packet streams that traverse the NAT. NAT traversal techniques are typically required for client-to-client networking applications on the Internet involving hosts connected in private networks, especially in peer-to-peer and Voice over Internet Protocol (VoIP) deployments.

• TCP hole punching is a commonly used NAT traversal technique, for sending 2-way messages between nodes in an Internet computer network. The term "NAT traversal" is a general term for techniques that establish and maintain TCP/IP network and/or TCP connections traversing network-address-translation (NAT) gateways.

• STUN (Session Traversal Utilities for NAT) is a standardized set of methods and a network protocol to allow an end host to discover its public IP address if it is located behind a NAT. It is used to permit NAT traversal for applications of real-time voice, video, messaging, and other interactive IP communications. It is documented in RFC 5389

Skype uses UDP hole punching to get around firewalls.

Answer 2

Firewalls typically work by blocking unrequested traffic. Let's say you visit a web page (stackexchange.com which has an IP address 69.59.197.21) with your web browser. You make a three-way TCP handshake with 69.59.197.21 before any information is transmitted. That is your web browser first requests a SYN (SYNchronize) with a random 32-bit sequence number to the web server say (x=850003392). The web server replies with a SYN ACK (ACKnowledgment) that returns your sequence number (incremented by 1) as an ACK (x+1=850003393) along with its on random sequence number (y=4013010515), and then your client sends back an ACK (x+1, y+1) to complete the three-way handshake. The handshake ensures that both web server and client agree on numbers.

Then over the established TCP connection your browser sends an HTTP request to port 80 to 69.59.197.21 from some random port from your computer (say port 35235) that's not being used at the moment. A port is just a number between 0 and 65535 (2¹⁶ -1) that allows your ethernet card to have multiple different distinct conversations at the same time; so you can visit multiple webpages simulatenously and have multiple internet applications open; each with a separate connection. Every packet contains a source IP address and port, destination IP address and port). Your firewall sees that you just made a request for information from 69.59.197.21:80 on and then allows the IP address 69.59.197.21 to send an HTTP response (with the HTML web page; images; etc) back to your IP address on port 35235 which your operating system will then pass to your web browser.

Its similar for UDP except there's no TCP handshake.

Answer 3

An established TCP connection works by using packets which travel in both directions, and when a firewall "allows outbound connections only", it really means that the firewall allows all packets except the incoming packet which tries to open a new connection (i.e. the first packet of an inbound connection).

VoIP typically uses UDP, not TCP, and has its own rules. The equivalent to the TCP blocking system would be a firewall which allows incoming UDP packets only when they are "in response" of a previous outgoing packet (i.e. an incoming packet with source address s and source port p, and destination port q on the local machine, allowed by the firewall because it first saw an outgoing packet with destination address s and destination port p, and source port q).