Re: FW and TCP Sessions

[Henning Brauer <hb () bsws de>]

* Manoj Kumar Neelapareddy <manojkreddyutl () yahoo com> [2004-06-01 15:15]:
> if a FW is said to be a stateful firewall, then will
> it allow a TCP packet to pass through it(outbound), if
> i haven't sent a TCP SYN to initiate a TCP Session
> before sending this TCP packet?

this depends on the implementation.

In OpenBSD's pf, we evaluate the regular ruleset if there was no match 
in the state table.

> I heard that Statefull firewall won't allow any TCP
> packets, other than TCP SYNs to pass through it, if
> there is no session corresponding a TCP packet is
> maintained in FW's session table.

that may be true for some specific implementation, or even with a 
specific ruleset.

> and FW will create a new session only when it detects
> a TCP SYN.

again, this is implementation- and ruleset dependent.

in pf:
  pass in to $webserver port 80 keep state
would create state for any packet coming in and destined to $webserver 
port 80, while
  pass in to $webserver port 80 keep state flags S
would only do so for SYNs.

-- 
Henning Brauer, BS Web Services, http://bsws.de
hb () bsws de - henning () openbsd org
Unix is very simple, but it takes a genius to understand the simplicity.
(Dennis Ritchie)
_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards