If you block all incoming connections, how can you still use the internet?

Question

If your ISP or firewall is blocking all incoming connections, how can web servers still send you data to your browser? You send the request (outgoing) and server sends data (incoming). If you block all incoming, how can the web server respond?

What about video streaming and multiplayer games, where it uses UDP? UDP is connectionless, so there is no connection to be established, so how will the firewall or ISP handle that?

Answer 1

"Incoming block" means that incoming new connections are blocked, but established traffic is allowed. So if outbound new connections are allowed, then the incoming half of that conversation is okay.

The firewall manages this by tracking connections state (such a firewall is often called a "stateful firewall"). It sees the outgoing TCP SYN and allows it. It sees an incoming SYN/ACK, and can verify that it matches the outbound SYN it saw, and lets that through, and so on. If it permits a three-way handshake (e.g., it's allowed as per the firewall rules) it will allow that conversation. And when it sees the end of that conversation (FINs or RST) it'll take that connection off the list of packets to allow.

UDP is done similarly, although it involves the firewall remembering enough to pretend that UDP has a connection or session (which UDP doesn't).

Answer 2

@gowenfawr has the high-level picture down. However, I thought I'd add some details as to how the "matching" for connection tracking is performed, as it might sound like magic to the uninitiated.

Every TCP connection has a port number of each side. As most techies know, HTTP servers run on port 80. When your browser connects to a web server, it will ask the operating system to generate a "local" port number, which will be something random like 29672 that is not used by any other TCP connection from that computer (and the OS can do this because it knows about all active TCP connections). Then an initial TCP setup packet will be sent from your machine's ip (IP_YOURS) and port number 29672 to the web server's ip (IP_WEBSERVER) and port number 80. At that point, the stateful firewall will say "aha, future packets from IP_WEBSERVER port 80 going to IP_YOURS port 29672 are not new connections, they are responses to an existing connection, and are to be allowed". Stateful firewalls maintain a table, and entires of this table expire eventually if no packets are seen going in either direction for a long time.