0

In a larger organisation the main firewall will be carefully fine tuned to only allow outbound connections to the internet under control.

However, one of my clients is behind a relatively simple BT Home Hub which doesn't offer much in terms of outbound firewall connectivity - and they have a pretty unmanaged Windows 2012 server sat on their LAN. I was surprised (well not that surprised) to learn that the default on Windows 2012 firewall outbound is to allow all outbound traffic. I'd always assumed that because there are a whole block of enabled outbound rules sat there that only the ports/programs configured in those rules have access. I was perplexed how I was able to telnet to their ISP's SMTP server without an obvious rule allowing it. Change the default behaviour to block briefly and yes, lost telnet to port 25.

My question is it safe to change the default to block and will Windows and other programs have added the required outbound rules or do I face spending quite a while adding custom rules?

I tempted to suggest we find a good value firewall that does allow outbound rules to be controlled.

  • In a larger organisation the main firewall will be carefully fine tuned to only allow outbound connections to the internet under control. - I wouldn't say that that's universally implemented. What are your specific concerns regarding outbound traffic? – joeqwerty Dec 2 '16 at 0:38
1

Yes, it is safe. And yes, you will spend quite some time adding the custom rules for valid traffic... That said, it is a very good security posture to block all unknown outbound traffic.

FYI, the below command run at an admin command prompt will block everything outbound, all protocols.

netsh advfirewall firewall add rule name="BlockOutbound" dir=out action=block

You can quickly delete that rule with a:

netsh advfirewall firewall del rule name="BlockOutbound"

And, the below will give you usage/examples... very handy to have in case you do go with blocking everything. You can use these commands to build yourself some scripts to easily poke some holes for valid outbound traffic

netsh advfirewall firewall add rule
  • 1
    Thanks for the clarification. I went ahead and changed the default a few weeks ago and not surprisingly, lots of things stopped working as you predicted. As internal access is probably okay, I allowed outbound to anywhere on the LAN. I then used the incredibly useful TcpLogView free utility to monitor which applications and which ports were being opened in and out which allowed me to allow those outbound connections that were needed. What an eye opener that app was as to seeing just exactly which apps were accessing the internet without your knowledge! – Rob Nicholson Dec 20 '16 at 14:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.