Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

For example if I were configuring my PC to browse the web over HTTP and I have denied all inbound and outbound requests and responses, would I need to only open port 80 to outbound requests or would I need to open port 80 to outbound and inbound requests?

share|improve this question
    
Depends on your firewall. Some are smart enough to be able to match the flow of traffic, and allow stuff back in that corresponds to the stuff sent out. –  Tom O'Connor Jul 22 '11 at 8:28
    
@Tom O'Connor - Can you elaborate? –  PeanutsMonkey Jul 22 '11 at 17:48
    
read Zoredache's answer about Stateful Firewalls. –  Tom O'Connor Jul 22 '11 at 19:26

1 Answer 1

up vote 2 down vote accepted

Your question is a bit on the vague side. There are many different firewall implementations.

On old low-end firewalls (stateless packet filters) you had to write rules to permit or deny the traffic for both directions. Most firewalls these days are stateful. If you build your rules the correct way, then you can write a rule to permit the connection to be established, and once it is established everything else will be permitted. You can still write stateless rules on most stateful firewalls.

A linux iptables based firewall would setup stateful connections like this. Note I am only have an explicit rule for the incoming connections to the mysql server, the outgoing will be handled by the ESTABLISHED rule.

# permit established connections
iptables -t filter -A FORWARD -m state --state ESTABLISHED -j ACCEPT

# permit incoming requests to a mysql server
iptables -t filter -A FORWARD -p tcp --destination mysql.server.ip --dport 3306 \
         -m state --state NEW\,ESTABLISHED -j ACCEPT

If the firewall you curious about is not Linux based, you will almost certainly have to dig into the docs for that specific firewall.

share|improve this answer
    
Thanks Zoredache. I can appreciate the types of firewalls i.e. stateful and stateless however assuming either are being used, I assume based on your answer in its most basic form of communication I would need to allow HTTP for incoming and outgoing. Is that right? –  PeanutsMonkey Jul 22 '11 at 17:47

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.