Hi. Please help me understand why blocking outbound ports is a good security measure. I've been discussing this with several people and searched the internet, but I'm still unable to understand it.

My argument is that any attacker can just open port 80 on their machine, so anyone with malicious motives won't be stopped by that measure. One argument for port-blocking that I've heard was that blocking the ports means you don't need to scan them (and can focus on only scanning the traffic on http/https ports instead). But since the attacker can just use the http/https ports too, it doesn't sound very effective in theory.

It also doesn't reduce the maximum possible packet throughput, as ports are just abstract numbers. And for that matter, anyone scanning the traffic, needs to check every single packet anyway, in order to tell which port the packet is trying to establish connection with on the remote device.

What am I missing or misunderstanding?

@Cosinux depends on how paranoid you want to be.

1. Low ports need elevated permissions to access

2. You need outbound ports to connect out to things in many cases

3. IF you know you don't need outbound ports for stuff, maybe

4. In some cases firewalls allow specific applications to connect out - so you can block off everything else (windows built in one works that way?)

5. It makes people feel better that they checked off a box :D

I'm not sure how to interpret you first point. Do I need elevated permissions to connect to an HTTP site? What are considered low ports?

no no

say you're running a system where you have an application that uses a well known/low port

say a web server - you need elevated permissions when starting the application, then you can drop down to a regular user

is worth a read

especially serverfault.com/a/86110/33193

also en.wikipedia.org/wiki/… by what I mean by low ports

Do you also need elevated privileges to bind a socket to a low port on Windows?

Or is this a Unix-specific thing?

hmm

I don't really remember

I've hardly run servers on windows as an adult.

and I've had really fun port blocks on my ISP as a teen

"fun"

You could trivially look it up :D

Hmm, okay ... Well the Wikipedia article doesn't mention Windows, but I don't think it applies to my question anyway. If I'm connecting to a remote device, I don't need to bind my socket anyway, correct?

Unfortunately, the serverfault link you've provided just adds to the confusion. D: The answer says that you don't need any open outbound ports to connect to a website, but how does one connect to the website if all the ports are blocked? It mentions something about proxies, but you still need to be able to connect to a proxy, right? Or, if proxy is within your network, the proxy itself will need a way to connect to an external server.

And I still don't see how blocking outboubd ports makes a device more secure than not blocking them. Blocking specific applications sounds like a much better security measure, although somewhat agressive, but I also don't see how an external firewall could identify (with certainty) which app sent the packet.

It... dosen't particularly :D

Also if you're worried about outbound connections, mean you're already compromised

This question has been in my mind for months, maybe even years. But whenever I got into an argument about it with someone, it always ended up with "if you don't need it, it's better to block it". I however know the inconvenience that outbound port-blocking can cause, while I can't see any safety benefit of it, based on my knowledge of computer networks.

But I never dare to insist on my arguments, because I'm not a professional in the field, and I'm afraid that although no one knows why they're blocking outbound ports, there might actually be a good reason why it's being done ... some sort of vulnerability or an edge case that I haven't considered. So I'm wondering if any of you, that probably know a bit more than I do about the topic know of any concrete reason why someone blocks/blocked their outbound ports.

@JourneymanGeek of course, although an argument that I've also heard is that blocking ports prevents the malware or a compromised piece of software from communicating with the attacker, which however doesn't sound true.

not really no

if you got compromised, you can't really trust the system anyway

Completely unrelated... my oldest (12 and 8) just spent an hour playing a game of their own invention called "Penis Balls". It involved sitting across a room from each other with their legs wide open, and then they took turns rolling a golf ball across the room trying to hit each other in the testicles... Seriously... they also were constantly shouting at each other to "tighten up your pants" so that if they scored a direct hit their pants wouldn't absorb any of the blow

They're kids, and so weren't winging it at each other at high speed, but there were definitely some direct hits and lots of groaning and fetal position

/I don't understand children