22

If your ISP or firewall is blocking all incoming connections, how can web servers still send you data to your browser? You send the request (outgoing) and server sends data (incoming). If you block all incoming, how can the web server respond?

What about video streaming and multiplayer games, where it uses UDP? UDP is connectionless, so there is no connection to be established, so how will the firewall or ISP handle that?

Improve this question
1
  • 2
    Block all incoming phone calls/Forward all incoming phone calls to voicemail? Doesn't stop you from calling out to someone.
    – WernerCD
    Mar 24, 2015 at 12:37

3 Answers 3

Reset to default
43

"Incoming block" means that incoming new connections are blocked, but established traffic is allowed. So if outbound new connections are allowed, then the incoming half of that conversation is okay.

The firewall manages this by tracking connections state (such a firewall is often called a "stateful firewall"). It sees the outgoing TCP SYN and allows it. It sees an incoming SYN/ACK, and can verify that it matches the outbound SYN it saw, and lets that through, and so on. If it permits a three-way handshake (e.g., it's allowed as per the firewall rules) it will allow that conversation. And when it sees the end of that conversation (FINs or RST) it'll take that connection off the list of packets to allow.

UDP is done similarly, although it involves the firewall remembering enough to pretend that UDP has a connection or session (which UDP doesn't).

Improve this answer
1
  • 2
    For UDP, since there is no actual connection, the firewall will usually track the destination IP and port of outgoing UDP packets, and if there is an incoming packet with the same IP and port as source it will assume it is a reply and let it in.
    – WhiteWinterWolf
    Mar 25, 2015 at 13:16
17

@gowenfawr has the high-level picture down. However, I thought I'd add some details as to how the "matching" for connection tracking is performed, as it might sound like magic to the uninitiated.

Every TCP connection has a port number of each side. As most techies know, HTTP servers run on port 80. When your browser connects to a web server, it will ask the operating system to generate a "local" port number, which will be something random like 29672 that is not used by any other TCP connection from that computer (and the OS can do this because it knows about all active TCP connections). Then an initial TCP setup packet will be sent from your machine's ip (IP_YOURS) and port number 29672 to the web server's ip (IP_WEBSERVER) and port number 80. At that point, the stateful firewall will say "aha, future packets from IP_WEBSERVER port 80 going to IP_YOURS port 29672 are not new connections, they are responses to an existing connection, and are to be allowed". Stateful firewalls maintain a table, and entires of this table expire eventually if no packets are seen going in either direction for a long time.

Improve this answer
4
  • 3
    This is mostly correct, but, as a couple of minor points, port numbers stop at 65535 (they're 16-bit unsigned numbers) and, in addition to the timeout, packets with FIN or RST flags set can also signal that a TCP connection is now closed.
    – reirab
    Mar 24, 2015 at 9:32
  • @reirab Oh whoops, yeah port number fail. Wrt closing, it would of course be possible to inspect TCP flags, but having to take into account possible packet loss and retransmission of close sequences is complicated enough that I would assume most firewalls simply repurpose the least-recently-used table entry rather than keeping track accurately.
    – Atsby
    Mar 24, 2015 at 9:45
  • @atsby You can always edit your post and replace the port numbers with something more suitable?
    – Coburn
    Mar 24, 2015 at 13:17
  • All of these are great information. Just wanted to add one thing to the ports discussed by above comments. They are called 'ephemeral ports' and their range is defined by kernel specific to each OS. On Linux you can get those by "cat /proc/sys/net/ipv4/ip_local_port_range" --- the default range is "32768 to 61000"
    – Arul Selvan
    Mar 24, 2015 at 15:58
0

I guess firewall is just to block unauthorised income connection. As you send request to DNS, the DNS replies, this is not unauthorised incoming connection.

Improve this answer
1
  • 1
    Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Jul 25 at 14:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.