Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've seen many resources explaining how to set up a server's firewall to allow incoming and outgoing traffic on HTTP standard ports (80 and 443), but I can't figure out why I would need either of them. Do I need to unblock both for a "regular" web site to work? For file uploads to work? Are there situations where it would be advisable to unblock one and leave the other blocked?

Sorry if that's a basic question, but I couldn't find it explained anywhere (also I'm not a native english speaker). I know in a "regular" web site the client is always the one who initiates a request, so I'm assuming a web server must accept incoming traffic on those ports, and my common sense tells me the server is allowed to send a response without unblocking anything else (otherwise it wouldn't make sense to have two types of rules). Is that correct?

But what is an outgoing web (service) traffic, and what would be its use? AFAIK if the server wanted to initiate a connection with another machine, the specific port that matters is the one in the other end (i.e. the destination port would be 80), on its end any free port could be used (the source port would be random). I can open HTTP requests from my server (using wget for instance) without unblocking anything. So I'm assuming my concepts of "incoming" and "outgoing" are wrong somehow.

share|improve this question

3 Answers 3

up vote 4 down vote accepted

"Incoming" and "outgoing" are from the perspective of the machine in question.

"Incoming" refers to packets which originate elsewhere and arrive at the machine, while "outgoing" refers to packets which originate at the machine and arrive elsewhere.

If you refer to your web server, it mostly accepts incoming connections to its web service, and only occasionally (or maybe never) makes outgoing connections.

If you refer to your web client, it mostly makes outgoing connections to other services, and only occasionally (or maybe never) accepts incoming connections.

Clear as mud now?

share|improve this answer
1  
I would add tha In order to send a response to your client you need to allow outgoing traffic for established connections. So whenever a client establishes a connection to your port 80 your server can talk back to any port of the client. –  Hex Oct 27 '12 at 22:19
    
Quite correct. Though any stateful firewall should handle this automatically. –  Michael Hampton Oct 27 '12 at 22:57
    
So, my web server should unblock incoming connections on ports 80 and 433, does not need to worry about outgoing connections on those ports, but need to allow outgoing connection in the dynamic/ephemeral port range, is that right? And I'm still a bit confused with the outgoing thing: if a web client tries to connect to a site, the destination port would be 80, but the source port could be anyone. Which port would a firewall in that machine consider when deciding to block/unblock? –  mgibsonbr Oct 27 '12 at 22:59
    
@mgibsonbr Now you're veering into the theoretical. We prefer practical questions here. :) –  Michael Hampton Oct 27 '12 at 23:00
1  
Considering that you have limited knowledge of firewalls and traffic I would recommend you to use a firewall builder script. UFW is a good start. The project's webpage is help.ubuntu.com/community/UFW , have a look at it and you will gain a basic understanding of firewalls and traffic management. If you still need help I'll try to give a detailed clarification to your question. –  Hex Oct 27 '12 at 23:54

Without any context as to what the particular text you read means when they refer to "outgoing web service" traffic, I'll take the simplest approach in my answer:

  1. You have a firewall at the ingress/egress of your network.

  2. The firewall comes in a fully locked down state and allows NO inbound or outbound traffic.

  3. In order for your internal clients to browse external web sites you need to configure an "outbound web service" rule that allows them to connect to said external web sites.

In the simplest terms the rule would read something like this:

ANY internal host to ANY external host where the destination = TCP Port 80 then ALLOW.

share|improve this answer
    
The expression "outgoing web service traffic" came from this. In my particular case, I'm trying to set up the firewall in a server instance (IBM cloud). The default install came with most things blocked (I could run Apache but not access it from outside), and I'd like to know the miminal things I should unblock to be able to serve pages, receive file uploads (from the client's browser), etc. And I couldn't tell if that particular piece applied to my case or not - since it only tells how, not why. –  mgibsonbr Oct 27 '12 at 23:15

In your case you only have to let incoming requests to port 80.

When a connection is established, the firewall will automatically let packets out back to the client's port. You don't need to create rules for that because the firewall knows.

share|improve this answer
1  
This doesn't answer his whole question, but yes, if he's using a stateful firewall, only 80 and 443 are needed. –  tristan Mar 25 '13 at 10:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.