Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a rather weird issue..

I'm trying to configure Windows Firewall to block all outgoing connections to a certain app, but allow all incoming. This app is used to transfer files across a network. The reason for this type of setup is to only allow certain users (IP Address) access to the files I have, but to still allow others to see what's available.

Since Windows Firewall defaults to allowing all outgoing connections, I made a rule to deny all outgoing connections that were not in the IP ranges I specified.

For the incoming connections, I'd like to leave it at allow all, but at the moment it is set to only allow the connections that also have outgoing permissions set.

If I blanket say allow all incoming connections, I observe that unauthorized IP Address are able to actually download files, even though their IP was blocked in the outgoing connections. To shed a little more visibility on this, I used NetLimiter to see what was going on. NetLimiter showed me that the connection was an incoming connection. Shouldn't this be an outgoing connection, as I am uploading files to them, not the other way around? Is there a way to make the connection type be correct and show up as outgoing instead of incoming?

share|improve this question
up vote 3 down vote accepted

"Outgoing" or "incoming" doesn't depend on which way the data goes. In fact, any TCP connection must send data in both sides – the TCP handshake, as well as "acknowledgment" packets.

Most application-level protocols that go on top of TCP are also bidirectional; e.g. you have to send a request before you can receive a file.

What defines whether the connection is "outgoing" or "incoming" is which side starts the TCP handshake. For example, when your browser connects to a web server, you will see the connection as outgoing, even though the browser receives much more data than it sends. (The web server will see the same connection as incoming.)

Likewise, when somebody connects to your file server, your computer sees the connection as incoming, but data flows to both sides. To actually prevent users from downloading files, you will need to configure your file sharing program.

share|improve this answer
I was 90% done typing the same thing – Keltari Sep 15 '12 at 14:39
Very good explanation, makes perfect sense, thanks! – TehTechGuy Sep 15 '12 at 18:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .