Will a standard NAT-router firewall stop outgoing traffic?
I can see that the firewall will stop incoming traffic, but what will stop outgoing traffic in the case of malware being on the machine?
Is it the responsibility of the operating system's firewall to stop outgoing traffic?
The hardware firewall cannot readily distinguish between "good" or "bad" packets, since they all come from the same source. The software firewall can ascertain which application generated the packet, so is better prepared to block them as desired.
Many higher-end firewalls have outgoing filters that accomplish what you are describing, and some call it Gateway Anti-Virus. This Gateway Anti-Virus mostly runs in the background as traffic passes through the gateway.
There are also Content Filters which prevent web requests and other types of traffic from going outbound through the firewall, but this is mostly to prevent users from intentional actions, not preventing unintentional virus activity.
More advanced firewalls allow the sysadmin to create to create custom Firewall Application Rules for custom IP addresses, groups of addresses within the LAN, or all addresses to prevent certain kinds of traffic from traversing. For example, you could set up a rule to stop all email to a certain address.
Of course, none of this filtering works over https, because the firewall cannot decipher the encrypted ssl traffic. All a firewall can do for https is analyze the source and destination of the traffic.
