0
  1. I have in inbound rule to allow all communication with MyApp.exe
  2. I have an outbound rule to block all traffic to 192.168.0.88

Can MyApp.exe communicate with 192.168.0.88 - I don't understand which rule takes precedence.

Improve this question
1
  • Somebody has voted that this belonging on SU but the way I see it this is very much a sysadmin question.
    – John Gardeniers
    Oct 15, 2009 at 2:59

3 Answers 3

Reset to default
4

I will caveat my answer with this: I havn't worked with Windows 2008 firewall and they may be doing something non-standard. That being said the way every firewall that I have worked with the answer depends on if you are using TCP or UDP for communication.

If you are using TCP, then yes the traffic should be allowed, rules are applied to NEW connections, so if you had an inbound TCP connection from 192.168.0.88 it would be allowed by the inbound rule. Since TCP is stateful the TCP session is then tracked inside the firewall and all return traffic for that session is allowed back outbound.

If you are using UDP, then the answer is no. Since UDP is not stateful the firewall cannot track the session as there is none, and you need to allow that traffic both ways through the firewall as each side of the conversation is seen as a NEW connection in the firewall.

Improve this answer
2
  • +1 for the distinction between TCP and UDP to a stateful device.
    – MDMarra
    Nov 5, 2009 at 0:57
  • This needs to be amended - if you are using UDP the "connection" is defined as an exchange of packets over the same SIP:sport-DIP:dport tuple within a given timeframe. In most implementations a dynamic timer is reset every time a packet is received in either direction of the "connection" (see also: UDP hole punching). As for the rest, the description is accurate for the Windows Firewall - whether the "inbound" or the "outbound" ruleset is being applied would basically depend on which direction the very first packet of the connection did have.
    – the-wabbit
    Feb 7, 2013 at 21:20
0

Inbound and outbound rules are mutually exclusive. If you have a rule permitting inbound access on a port, but do not allow outbound on the same port, the connection will come in, and then as far as the client is concerned never be seen again.

I'm confused about your "Inbound Rule" though, because inbound rules are assigned to ports and IP addresses - not to applications...

Looks like this is a software firewall, so I think your question might be best had over at superuser.

Improve this answer
0

Usually firewall rules have an order of processing - like top to bottom.

The first rule that matches the traffic would then be used. So if there's an allow rule before a deny rule - the allow rule should take precedence.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .