What do firewalls do?

It is normal to protect your network by restricting inbound traffic by using firewall rules to control which external IP addresses and ports that can connect to your internet router or via Network Address Translations (NAT) to an internal device.

It was once fairly common practice to allow any internal device access to any external address on any port. The reasoning behind this approach was that inbound traffic from malicious servers would be blocked, preventing infection of internal devices. Meanwhile, internal devices had unlimited access to be able to browse the web and any other services without any risk of the firewall blocking and causing issues for users.

Why control outbound traffic?

Take for an example the following scenario that shows a Command and Control (C&C) infection:

1. A user on a computer connects to a malicious website and clicks on a link that downloads a piece of malware without the user’s knowledge.
2. The malware installs but for it to call home to the control server and to avoid detection, it uses a random port, say tcp/45678
3. Firewall allows the outbound connection from the infected device
4. Due to the traffic originating from inside the network to outside the firewall allows the return connection from the control server
5. The control server now has remote access to the infected internal device

How can I stop this?

To mitigate against the above scenario, we apply some basic outbound firewall rules and deny any other inside to outside traffic.

• Allow tcp/443 (HTTPS) and if required tcp/80 (HTTP) from internal device to any external address
• If required Domain Name Server as your router or an internal server should be responding to lookups, you would need to give the specific internal DNS servers IP address access to tcp/53 (DNS) and preferably only to your ISPs Name Servers.
• Any other ports required for internal systems to function, such as udp/123 (NTP), tcp/22(SFTP) and again, if possible, locked down to specific internal to external addresses.
• Final rule at the bottom of outbound is Deny any address to any port.

Now, if we go through the original scenario again:

1. A user on a computer connects to a malicious website and clicks on a link that downloads a piece of malware without the user’s knowledge.
   • Our firewall rules allow tcp/443 (HTTPS) outbound to any external address.
2. The malware installs but for it to call home to the control server and to avoid detection, it uses a random port, say tcp/45678
3. The firewall will block the outbound tcp/45678 connection due to the Deny any address to any port at the end of rules
4. The control server can no longer gain remote access to the infected internal device due to the firewall rules.

This is also true for local firewalls on each device such as Microsoft’s Windows Defender Firewall, which can control both inbound and outbound connections to each computer.