Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

When I'm on public WiFi (laptop), I want to configure my firewall through its advanced settings to allow only HTTPS web traffic.

My first attempt was to block incoming and outgoing by default, then allow both UDP and TCP port 443 from any computer to any computer (both in and out). However I experience a net error when using my browsers on any SSL/443 website. What am I misunderstanding that is causing my attempt to fail?

The browser error reported in Chrome is

Error 10 (net::ERR_ACCESS_DENIED): Unknown error.

Firefox gives a general error, but when I trace the HTTPS traffic using Fiddler I get this:

(request)

CONNECT mail.google.com:443 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.9.2.12) Gecko/20101026 Firefox/3.6.12 GTB7.1 ( .NET CLR 3.5.30729; .NET4.0E)
Proxy-Connection: keep-alive
Host: mail.google.com

(response)

HTTP/1.1 502 Connection failed Connection: close Timestamp: 21:57:34.739

HTTPS connection failed.

System.Net.Sockets.SocketException: An attempt was made to access a socket in a way forbidden by its access permissions xxx.xxx.xx.xx:443
at Fiddler.ServerChatter.CreateConnectedSocket(IPAddress[] arrDestIPs, Int32 iPort, Session _oSession)
at Fiddler.Session._handleHTTPSConnect()

When the policy is set up right I plan to export it (save it) for the future when I'm back on public WiFi.

Note: If a different version of Windows has similar config nuances, feel free to post those answers too - if it's close I can probably extrapolate.

share|improve this question

migrated from serverfault.com Nov 29 '10 at 6:16

This question came from our site for professional system and network administrators.

2 Answers 2

To browse the web, you will need to allow DNS as well: UDP port 53 (and TCP too, but not so much).

share|improve this answer
    
Thank you. That likely got me a step closer however I'm still experiencing the same error noted in the question. –  John K Nov 29 '10 at 3:30

When your browse to a website, your browser sends an outbound TCP SYN packet to set up the connection. Conveniently the firewall automatically allows all traffic in both directions that belongs to this connection. So please don't allow inbound traffic unless you're running a web server and want people to initiate TCP connections to you.

Some sites may need TCP/80 (HTTP) to establish the TCP/443 (HTTPS) connection, so try opening 80 as well as the DNS ports already mentioned.

Windows 7 lets you specify programs by name (such as your browser) and control access to/from the specific program/process. XP applies the rules to all programs/processes. I don't have Vista handy to check its level of control.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.