Re: FW and TCP Sessions

* Manoj Kumar Neelapareddy <manojkreddyutl_at_yahoo.com> [2004-06-01 15:15]:
> if a FW is said to be a stateful firewall, then will
> it allow a TCP packet to pass through it(outbound), if
> i haven't sent a TCP SYN to initiate a TCP Session
> before sending this TCP packet?

this depends on the implementation.

In OpenBSD's pf, we evaluate the regular ruleset if there was no match
in the state table.

> I heard that Statefull firewall won't allow any TCP
> packets, other than TCP SYNs to pass through it, if
> there is no session corresponding a TCP packet is
> maintained in FW's session table.

that may be true for some specific implementation, or even with a
specific ruleset.

> and FW will create a new session only when it detects
> a TCP SYN.

again, this is implementation- and ruleset dependent.

in pf:
  pass in to $webserver port 80 keep state
would create state for any packet coming in and destined to $webserver
port 80, while
  pass in to $webserver port 80 keep state flags S
would only do so for SYNs.

-- 
Henning Brauer, BS Web Services, http://bsws.de
hb_at_bsws.de - henning_at_openbsd.org
Unix is very simple, but it takes a genius to understand the simplicity.
(Dennis Ritchie)
_______________________________________________
firewall-wizards mailing list
firewall-wizards_at_honor.icsalabs.com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards