1

I have an application running on my Amazon EC2 hosted windows Server-2012. The application listens for devices to connect to it on a number of ports. This application (known as s.exe) on occation sends information back (outgoing) to the devices connected to it. I would like to stop this outbound traffic from s.exe as it is un-nessisary. I cannot remove all outgoing traffic from s.exe because it must connect to a remote mysql database.

I've been trying to block this outgoing traffic from my server to these remote devices but I cant no matter what i try. Windows firewall didn't work, nor any of the third party firewalls I have tried. In wireshark and in TCPView I still see this outgoing traffic.

The outgoing traffic is coming from one application (in the images it is labeled "s.exe" over local port 11600 to a number of different remote ports.

Image 1: enter image description here

Click here to enlarge enter image description here

I have attempted to block all outgoing traffic from local port 11600 but it has no affect at all, with windows firewall or outpost pro firewall.

Any help would be greatly appreciated

19
  • It may not be possible. Most firewalls (and I'm assuming Windows Firewall works the same) apply outbound rules to traffic originating from the machine. In your case the outbound traffic isn't originating from the machine, it's actually the return traffic to the external machine that originated the connection that is allowed by your inbound rule.
    – joeqwerty
    Commented Oct 11, 2013 at 14:01
  • Because its just return traffic it doesn't qualify as outbound?
    – Peter
    Commented Oct 11, 2013 at 14:05
  • It is outbound traffic but the outbound rules apply to outbound traffic that originates from the machine. In your case this outbound traffic isn't originating from the machine.
    – joeqwerty
    Commented Oct 11, 2013 at 14:06
  • Not to beat a dead horse, and i appreciate the help, but is there any way at all to block this traffic? A global outbound rule? My only limitation is that it is a remote server so i cant use any type of hardware
    – Peter
    Commented Oct 11, 2013 at 14:08
  • 2
    TCP is never "one-way communication". If you want to accept incoming data and not provide any ACK or outgoing packets, you'll have to use some other protocol, probably UDP.
    – mpez0
    Commented Oct 11, 2013 at 14:46

0

You must log in to answer this question.

Browse other questions tagged .