Hands-On Project - Firewall Rules

In this project you will create two simple firewall rules in Windows Advanced Firewall. This may be the first time you have made a modification to the firewall on your computer. The first rule will block all ICMP traffic. This will effectively prevent you from using the ping command to send ICMP packets to other computers. You will use a command prompt to verify the rule was effective.

The second rule will block all outgoing Port 80 traffic. Port 80 is traditionally associated with Web traffic (HTTP). Once you create and enable the rule, all outgoing Port 80 traffic will be blocked. You will use a Web browser to verify the rule was effective, however, secure Web traffic (HTTPS) running over Port 443 will still be accessible.

Both of the rules in this project will apply to outgoing traffic only. It is important to remember to disable the rules at the end of the project so your ICMP and Port 80 traffic will not be blocked.
Directions:

1. Click Start.
2. In the search box, type cmd
3. Press Enter.
4. Type ping www.google.com
5. Press Enter. (This will ping www.Google.com)
6. Type time
7. Press Enter twice.
8. Take a screenshot.
9. Click Start, Control Panel, System and Security, and Windows Firewall.
10. Click Advanced settings.
11. Click Outbound Rules.
12. Click New Rule (right-hand pane).
13. Click Custom, Next, and Next.
14. Change the dropdown box to ICMPv4.
15. Click Next, Next, Next, and Next.
16. Name the rule YourName_Block_ICMP. (Replace YourName with your first and last names. In this case, it was RandyBoyle_Block_ICMP.)
17. Click Finish.
18. Return to your command prompt.
19. Type ping www.google.com
20. Press Enter. (This will ping www.google.com. You should get a "General failure" error.)
21. Type time
22. Press Enter twice.
23. Take a screenshot.
24. Open a Web browser.
25. Browse to www.Google.com. (This will verify that you do have Internet access.)
26. Return to the Windows Advanced Firewall window.
27. Click Outbound Rules.
28. Click New Rule (right-hand pane).
29. Click Port, and Next.
30. Type "80" into the text box for Specific remote ports. (This will effectively block all outgoing Web traffic from your computer. You will disable/delete this rule later.)
31. Click Next, Next, and Next.
32. Name the rule YourName_Block_Port_80. (Replace YourName with your first and last names. In this case, the rule was named RandyBoyle_Block_Port_80.)
33. Click Finish.
34. Return to your Web browser.
35. Browse to any non-secure (not HTTPS) website of your choosing. You can browse to any website as long as it does not make an HTTPS connection (Port 443). The rule you made only blocks Port 80 Web traffic.
36. Take a screenshot of the blocked website. (In this case, it was www.Microsoft.com.)
37. Return to the Windows Advanced Firewall window.
38. Select both of the rules you created.
39. Right-click the selected rules.
40. Click Disable Rule. (If you don't disable the rules, your ICMP and Web traffic will still be blocked.)
41. Take a screenshot of your disabled rules.

Submit your Screenshots and answer the following questions:

• How could blocking all ICMP traffic protect you?
• Could you still access some websites with your Port 80 rule enabled? Why?
• Why would you want to allow incoming (not outgoing) Port 443, but block incoming Port 80?
• Could malware rename itself in order to get through a firewall? Why would this work?

Your well-written paper should meet the following requirements:

• Be two to four pages in length
• Contain an illustrative table or a diagram created from properly cited external references
• Include two credible external references in addition to the textbook
• Formatted according to APA writing guidelines.