1. I have in inbound rule to allow all communication with MyApp.exe
  2. I have an outbound rule to block all traffic to

Can MyApp.exe communicate with - I don't understand which rule takes precedence.

  • Somebody has voted that this belonging on SU but the way I see it this is very much a sysadmin question. – John Gardeniers Oct 15 '09 at 2:59

I will caveat my answer with this: I havn't worked with Windows 2008 firewall and they may be doing something non-standard. That being said the way every firewall that I have worked with the answer depends on if you are using TCP or UDP for communication.

If you are using TCP, then yes the traffic should be allowed, rules are applied to NEW connections, so if you had an inbound TCP connection from it would be allowed by the inbound rule. Since TCP is stateful the TCP session is then tracked inside the firewall and all return traffic for that session is allowed back outbound.

If you are using UDP, then the answer is no. Since UDP is not stateful the firewall cannot track the session as there is none, and you need to allow that traffic both ways through the firewall as each side of the conversation is seen as a NEW connection in the firewall.

  • +1 for the distinction between TCP and UDP to a stateful device. – MDMarra Nov 5 '09 at 0:57
  • This needs to be amended - if you are using UDP the "connection" is defined as an exchange of packets over the same SIP:sport-DIP:dport tuple within a given timeframe. In most implementations a dynamic timer is reset every time a packet is received in either direction of the "connection" (see also: UDP hole punching). As for the rest, the description is accurate for the Windows Firewall - whether the "inbound" or the "outbound" ruleset is being applied would basically depend on which direction the very first packet of the connection did have. – the-wabbit Feb 7 '13 at 21:20

Inbound and outbound rules are mutually exclusive. If you have a rule permitting inbound access on a port, but do not allow outbound on the same port, the connection will come in, and then as far as the client is concerned never be seen again.

I'm confused about your "Inbound Rule" though, because inbound rules are assigned to ports and IP addresses - not to applications...

Looks like this is a software firewall, so I think your question might be best had over at superuser.


Usually firewall rules have an order of processing - like top to bottom.

The first rule that matches the traffic would then be used. So if there's an allow rule before a deny rule - the allow rule should take precedence.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.