Well I try to explain Incoming: somebody on the web trying to connect to your computer. Outgoing: your computer trying to connect to someone on the web. What to block what to allow. Allow nothing block it all If you use a program and it truly needs to get on the web you can allow it, things like ICQ you can allow it both ways. You can even tell it that it's a server so it will not bother you anymore. By not blocking outgoing your just waiting for the next exploit. I send you a trogan and you run it. I have it set to get on the web and download all it's buddie viruses and upload the key logger log I also installed at the same time... See not blocking outgoing is a great idea now isn't it? That's not a firewall it's a pothole. A small speed bump along the way of me owning your computer. But first thing is to test for leaks. Go to that site download the little program and run it. If you have leaks plug them with zone alarm. Look ma no bumps!