What tangible security are gained by blocking all but a few outgoing ports in a firewall

Question

Our current hardware firewall allows for blocking incoming and outgoing ports. We have two possibilities:

1. Block certain troublesome ports (unsecured smtp, bittorrent, etc.)
2. Block all but a few approved ports (http, https, ssh, imap-ssl, etc.)

I see several downsides with option 2. Occasionally web servers are hosted on non-standard ports and we would have to deal with the resulting issues. Also, there is nothing preventing a malicious or unwanted service from being hosted on port 80, for instance. What are are the upsides?

Answer 1

In scenario (2), if a machine within the networks becomes infected by some malware, you prevent it from either sending mail (if you block or transparently proxy SMTP), or connecting to the IRC channel it’s designed to be remote-controlled from (or similar backdoors).

Edit Obviously, in either of these scenarios it’s not going to stop everything, but it will stop quite a lot of the common bots from turning your network into a source of spam e-mail and the like.

Answer 2

The upside is that you stop everything which cannot adapt (spam email malware, etc) and everyone who doesn't know how to get around it.

The other answers here seem to be of the nature "whatever you do I will get around it so don't even bother trying", but the majority of people do not know how to do things to get around firewall restrictions so you reduce the risk of trouble a lot.

On top of that, if someone can get to a service outside your firewall first try because the port is open, that's one thing, but if they have to deliberately work their way around your firewall that's quite another. It might give you more evidence to demonstrate misuse of computer systems, for instance.

And for regulatory compliance or auditing reasons you might need to justify every port open on your firewall, it would be better to be able to say "Port 1433 outbound because accounts need it for program Q even though it might open the door to some misuse" than "SQL works because we haven't bothered blocking anything".

tl;dr: Security isn't about one silver bullet solution which fixes anything, and option 2 can be another layer in helping to reduce risk and misuse.

Answer 3

If someone was going to run bittorrent on say port 80 it really makes no difference which option you choose but option 2 gives you a better chance of blocking unwanted traffic. You mention the possibility of having to open extra ports for special web sites but, depending on your firewall, you may be able to open those ports only for specific targets.

With option 1, when you start blocking ports to restrict traffic that traffic will almost certainly move to another port. In the end you'll find you need to close so many ports that you're pretty much back to where you would have been had you chosen option 2 at the start.

Bittorrent doesn't run on any particular port, so forget any dream you may have of blocking it that way. Even blocking access to all known tracker sites is pretty ineffective with today's trackerless systems.

There are admins who believe they have successfully blocked bittorrent traffic from their networks. Based on my own experiments as a bittorrent user I don't think I could ever be that confident. Of course I don't have access to all the different makes and models of firewalls to test against, so may simply be unaware of an effective system.

Answer 4

A simple answer is with #2, you don't need to be an expert on the use of every port, just the ones actually allowed by you. When a new IM/P2P service comes out that uses a different default port you don't have to do a single thing to block it. Option #2 also it allows you to know exactly what protocols are in use on your network and who asked you for them to be made available.

Answer 5

I prefer option #3 - block access to all ports, and proxy the services you need. In the vast majority of cases, this works well. In fact, most of the time, all you need is a web proxy - as mail is frequently handled by an internal server (or use outlook's RPC-over-http).

Most web proxies will also let you specify which ports you're allowed to make HTTP connections on - so you don't have to open up firewall holes for non-standard sites. Additionally, a web proxy may (depending on setup) give you some protection against users abusing that service by tunnelling VPN etc.

As Mo says, it's also highly beneficial from the perspective of limiting the spread of malware, and indeed those grey areas where users try to use their own software or email accounts. Even if you do want to allow that, you'd want to know first, I hope!