0

Does a firewall running on a machine only block stuff from outside that machine, or do they block communication between processes on a machine communicating via ports?

Specifically, I'm writing a windows service which will expose an http RESTful service for other processes on the machine. Do I need to worry about any firewall that might be running on the machine?

This will be deployed only to windows machines - but I guess it's a general question.

NB: cross-posted on SO.

2
  • To be fair, if this is going to a customer machine, you'll probably need to note that antivirus and third-party firewall software can interfere, regardless of the Windows firewall part. Sep 26, 2010 at 22:40
  • Hence the question! :) Any pointers to what I should look at or consider specifically?
    – Rory
    Sep 26, 2010 at 23:44

4 Answers 4

1

It depends on the configuration of the firewall, and how the apps running on the local machine talk to each other.

I think it would be possible (but highly unlikely unless you did it deliberately) to block localhost traffic.

More likely what you need to consider is the firewall blocking outbound traffic from your applications, preventing them from accessing services on other servers. That is quite commonly configured, and some firewalls will have very secure default policies that close off most outgoing traffic.

2

You're not likely to run into any problems because it's a local application. You'd only need to worry about the firewall if you wanted to expose the service to other clients/machines.

EDIT: The above is true of windows firewall, other firewall may prompt for local connections as pointed out in the comment below.

2
  • 2
    Not true. Many desktop firewall products will prompt for loopback/localhost HTTP connections. Sep 27, 2010 at 11:06
  • Yes fair point, I was under the impression the system was using windows firewall, but the question is more generic and you are correct. Sep 28, 2010 at 21:31
1

A local firewall will block the ports you are disallowing, and allow the ports that being allowed will take traffic. The OS is allowed to receive traffic on ports it is listening on and unblocked on the firewall. It doesn't matter if the traffic is internal or external to the system, if the host based firewall allows the traffic through, and the system is listening on that port, then it will get through.

IMO better setups shut off most listeners, so host firewalls are only catching incorrect requests.

0

The Windows firewall does have SOME outgoing traffic protection under Windows XP.

Windows Vista and 7 have very different firewalls that may seem more advanced (and they are in some ways), but they have one fatal flaw: there is no way to have it ask for internet access if an application needs it. It either blocks everything (with static rules for exceptions) or it allows everything (the default setting).

Other than that, incoming protection is pretty much done properly by both firewalls. For Windows XP and 2003 though, I HIGHLY recommend Sygate Personal Firewall (http://filehippo.com/download_sygate_personal_firewall/). Now bought and killed off by Symantec, it is the only, and best possible firewall in many ways, it is free, offers any possible configuration you could ever want, and it'll ask for permission on ANY process that could ever use access. Ping? Request for access. Windows share? Request. Windows services? Request. Chrome after an update? Notification that the executable has changed, request for access. You'll love it.

For Windows 7, I can't recommend Comodo enough. It seems to be the only competent firewall that fully replaces the built-in Windows one, and fills pretty much the hole Sygate left behind.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .