Home / server / Questions / 74629
Accepted
noctonura
Asked: 2009-10-15 17:10:02 +0800 CST

Windows Server 2008 Firewall: Do inbound rules override outbound rules?

  • 772
  1. I have in inbound rule to allow all communication with MyApp.exe
  2. I have an outbound rule to block all traffic to 192.168.0.88

Can MyApp.exe communicate with 192.168.0.88 - I don't understand which rule takes precedence.

windows-server-2008

3 Answers

  1. Best Answer

    I will caveat my answer with this: I havn't worked with Windows 2008 firewall and they may be doing something non-standard. That being said the way every firewall that I have worked with the answer depends on if you are using TCP or UDP for communication.

    If you are using TCP, then yes the traffic should be allowed, rules are applied to NEW connections, so if you had an inbound TCP connection from 192.168.0.88 it would be allowed by the inbound rule. Since TCP is stateful the TCP session is then tracked inside the firewall and all return traffic for that session is allowed back outbound.

    If you are using UDP, then the answer is no. Since UDP is not stateful the firewall cannot track the session as there is none, and you need to allow that traffic both ways through the firewall as each side of the conversation is seen as a NEW connection in the firewall.

    • 4

  2. Inbound and outbound rules are mutually exclusive. If you have a rule permitting inbound access on a port, but do not allow outbound on the same port, the connection will come in, and then as far as the client is concerned never be seen again.

    I'm confused about your "Inbound Rule" though, because inbound rules are assigned to ports and IP addresses - not to applications...

    Looks like this is a software firewall, so I think your question might be best had over at superuser.

    • 0

  3. Usually firewall rules have an order of processing - like top to bottom.

    The first rule that matches the traffic would then be used. So if there's an allow rule before a deny rule - the allow rule should take precedence.

    • 0