I have blocked port 80 and 443 on Windows 10 via making a new Firewall rule but I still can browse. How to I block HTTP traffic via firewall?

Question

I have blocked port 80 and 443 on Windows 10 via making a new Firewall rule but I still can browse via Chrome. How do I block HTTP/HTTPS traffic via firewall?

This is what I did:

Firewall advanced settings --> Outbound rules

In the outbound rules I added new rule.

I choose "port". I chose the port numbers "80, 443". The protocol is TCP.

I choose "block the connection" and the rules is applied to "private, public and domain". I checked too that the rule is applied to all interfaces.

But checked if it's activated and the rule is activated. But still I can browse on Chrome. I visited websites I never visited before and I can visit them too.

Why the blocking of port 80 and 443 doesn't block HTTP and HTTPS traffic? My goal is to block all outgoing HTTP and HTTPS traffic.

Solution 1

May I know if the rule for blocking ports 80, 443 was applied for local ports or remote ports?

When the connection was established, ports 80 and 443 refer to the port on the server (website) side. The port of your client was randomly selected from 1001 to 65535.

If you want to block HTTP/HTTPS traffic via windows firewall, you could disable remote port 80 and 443 for a test.

Firewall--> Outbound Rules--> New Rule--> Rule Type=Custom--> Program=All programs--> Protocol type=TCP, Local Port=All Ports, Remote Port=Specific Ports 80, 443--> Which? Next--> Action=Block the connection--> When? Next--> Name, Description--> Finish

Solution 2

80 and 443 are the ports the HTTP(S) server listens on. Clients connecting to servers use ephemeral ports, short-lived single-use ports chosen randomly from a fixed range. This lets you communicate with multiple servers on multiple hosts simultaneously by opening one ephemeral port for each server. Also, you can't use low ports (<1000) without elevated privileges.

Firewall is not the right tool to achieve your goal. HTTP(S) can run on any port. You could filter out HTTP with packet inspection. HTTPS is just HTTP wrapped in a TLS tunnel and you can't inspect the HTTP part, so your only option is to block all TLS traffic. This will include a bunch of other services, for example encrypted FTP and e-mail.

Comments

[DavidPostill]

Ports 80 and 443 are used for inbound traffic if you are running alocal web server and have noting to do with outbound traffic

[gronostaj]

@Coder88 no, because client port is selected randomly and a server could run on any port.

[gronostaj]

HTTP is useless without bidirectional communication anyway, so I don't think that would make any difference. Maybe I could point you in the right direction if I knew why you're trying to do this.

[Coder88]

It's assignment from school to test some virus in virtual computer (attacking one virtual computer using another virtual computer), and I wanted to isolate the host computer to not spread the virus to other computers. Teacher suggested to block all HTTP using a Firewall rule for that purpose.

[gronostaj]

Ok, so we have a XY problem. You want to achieve X, but you're asking about Y which is not the right/straightforward solution. What VM software are you using? The better approach would be to create a virtual network and connect only your two VMs to it.

[Coder88]

I'm using VMWare. Just blocking all ports via Firewall on host computer does work too, since both virtual computers are installed in same host computer they can communicate (and send viruses) to each other.

[gronostaj]

@Coder88 Except you can't browse the web now and all services other than HTTP are still potentially vulnerable. Your goal was to isolate your sandbox from the host and this goal was not achieved. Unfortunately I'm not familiar with VMware so I can't provide exact instructions for it.