1

I'm just setting up a home wireless network with connection to the internet. The router has settings to configure the firewall rules.

Currently it's set to INBOUND ALL ANY and OUTBOUND ALL ANY.

What rules should I set (if any) to reduce the risk of compromises? The laptops connecting are Vista and XP. We only have simple browsing needs so can I just open up the following inbound ports?

80 HTTP
21 FTP
443 HTTPS

Is this enough for just normal web browsing? Should I set any outbound rules?

Not expecting to use POP or SMTP

Michael Hampton
  • 247,473
Guy
  • 2,678
  • Care to share what firewall you are using? A standard consumer internet router will have a basic firewall that has (relatively) secure default settings. – tomjedrz May 12 '09 at 18:28
  • This is the standard firewall settings on a SKY broadband home wireless router. There was no default secure settings! There must be hundreds of thousands of these in the UK! – Guy May 12 '09 at 18:34
  • Oh good God. An out of the box config for a consumer device that allows all inbound connections???? Someone was for SURE hitting the crack pipe prior to making that call. – squillman May 12 '09 at 18:36

4 Answers4

8

You should allow NO inbound traffic. You should allow the outbound traffic for the protocols that you will be using. Your list is good, although you might want to add DNS and also NTP if you are want to sync time.

Be aware that (by definition) TCP/IP is bi-directional. The directionality referred to here is the direction in which the connection is initiated. Meaning .. if you browse to www.serverfault.com, your PC will send HTTP traffic out to the IP address for serverfault.com. The firewall will recognize that a response is coming, and that response will be allowed in back to your PC. But that is referred to as "outbound" traffic, and you don't need to account for the response in most firewalls.

Suggestion: use Steve Gibson's Shields Up site to test what is allowed in on your firewall and for lots of info about what services are doing what.

tomjedrz
  • 5,974
4

Lose the inbound allow any! Only reason to have that is for active FTP but you can use passive instead. I personally allow any outbound.

If it's only simple browing then you should be good with the ones you have. The only difference is when applets or plugins in web pages want to talk directly to their home servers over something other than HTTP/HTTPS.

squillman
  • 38,013
  • Thanks for the quick reply. No wonder there is so many zombies when the standard config is so open! – Guy May 12 '09 at 18:31
  • FTP is strange .. "active" FTP uses both port 20 and port 21. Some firewalls understand this and accommodate, others don't. – tomjedrz May 12 '09 at 18:37
1

As squillman said, remove the inbound any immediately.

Assuming that the firewall is stateful, all you should need is 'allow any outbound'; return traffic should be allowed through as they will be matched to existing connections in the connection table.

Do you know the model of the router? It would be interesting to see what its default routing/NAT/port forwarding config is.

Murali Suriar
  • 10,326
1

[OUTBOUND-wise]

I suggest you start practicing some good'ol internet neighbor etiquette by applying egress filtering rules on your firewall. Pretty much, closing commonly unused ports (outgoing) that may be used by your clients when they get compromised. Here's a better explanation:

Egress filtering prevents you (and your clients) from sending unwanted traffic out to the Internet. This could include leaking out private address space or stopping compromised systems attempting to communicate with remote hosts. Egress filtering can also help prevent information leaks due to misconfiguration, as well as some network mapping attempts. Finally, egress filtering can prevent internal systems from performing outbound IP spoofing attacks.

Common ports that applies to this practice are:

  • SMTP (Prevent sending SPAM to the world)
  • DNS (Prevent DNS hijacking)
  • SMB
  • ICMPOops.. forgot my post was about egress! PMTUD (ICMP:rfc792)

.. you get the point.

l0c0b0x
  • 12,037
  • 3
    No, don't block outbound ICMP. It's part of the protocol for a reason, and blocking it causes problems with things like PMTUD. – Alnitak May 12 '09 at 21:18
  • Thanks for bringing this to the attention. Definitely looks like not all flavors of ICMP should be blocked... I'll research this a bit more. – l0c0b0x May 12 '09 at 21:57