Solved

Firewall Question

Posted on 2002-03-08
4
190 Views
Last Modified: 2013-11-16
I have a quick question re: port issues on a Stateful Inspection firewall. Ie fw-1

(for simplistic reasons i am assuming no NAT!)
Ok i am on my companys LAN and want to connect to for eg www.bbc.com, I understand that I make a connection to their web server on TCP port 80. And their web server connects back to my machine on a random high end port.

My question is how do FW rules apply... to this.. ie let out traffic for port 80 and anything back in????????? (ie to connect to my machine on the high range port) therefore do the rules apply goingout/coming in? or does the firewall dynamically open the port coming back in?

Thanks
0
Comment
Question by:dbrannigan
  • 2
4 Comments
 
LVL 8

Accepted Solution

by:
scraig84 earned 100 total points
ID: 6850389
Your last statement is correct.  The firewall will see that a TCP SYN packet has gone out from a particular source port on the inside to a particular destination port on the outside.  When the ACK packet comes back with the ports and addresses reversed (source now destination and vice-versa), the firewall will let that information flow.  It is statefull as it will watch the state of the connection - it will not allow a server on the outside to just randomly send packets with a source of 80 to any inside port.  Also, once the TCP session is completed, the firewall re-blocks the ports.  This way, somebody watching the session can't come in later spoofing the original destination IP address and ports and establish a connection with the inside.  The firewall will know that the session is over and not allow the communication.

Even filters on routers can do this to some degree, for example using the "established" keyword on a Cisco ACL.

Hope this helps and made some sense!
0
 
LVL 16

Expert Comment

by:SteveJ
ID: 6850419
What scraig84 is correct. I would add that some "stateful" inspection engines will incorrectly allow a packet through just because an ACK bit is set on the assumption that it is a response packet. I believe this was a problem with the "established" keyword in Cisco ACLs. I could be wrong. I'm CERTAIN someone will correct me.

Good luck.
Steve
0
 
LVL 8

Expert Comment

by:scraig84
ID: 6850436
You are wrong wrong wrong wrong!!! :)

Actually, I do think Cisco had some problems with that.  They did create a new way to create this scenario that was supposed to be better, but I forget what its called (dynamic ACL?) or how to do it.  It was much messier and had a lot more config lines is all I can remember.  In my opinion if you are pretending that a router ACL is good enough for security, you're asking for a world of hurt anyway, so why care?
0
 

Author Comment

by:dbrannigan
ID: 6850479
excellent as always scraig84! Cheers
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
How VPC help preventing STP Loops 4 93
Clarification on Network "Usage" for ESXi host. 13 65
EIGRP STUB 19 69
Setting up static routes to  sonicwll 4 27
Don’t let your business fall victim to the coming apocalypse – use our Survival Guide for the Fax Apocalypse to identify the risks and signs of zombie fax activities at your business.
ADCs have gained traction within the last decade, largely due to increased demand for legacy load balancing appliances to handle more advanced application delivery requirements and improve application performance.
Viewers will learn how to connect to a wireless network using the network security key. They will also learn how to access the IP address and DNS server for connections that must be done manually. After setting up a router, find the network security…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

813 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now