Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've been spending the morning playing with my routers and I've checked one thing:

All of them come by default with an implicit deny configuration for incoming traffic, that is all packets should be rejected unless otherwise specified. Outgoing is either as implicit accept or does not have any rule at all.

With that default setup, I can browse without any problem. But I do not understand why. The connection starts because outgoing traffic is allowed, however when the response comes, it should be dropped because incoming traffic is implicit denied.

I'm trying to figure out why is this happening, and the only idea with sense that comes to my mind is that outgoing rules must have priority over incoming rules. Is there any other explanation?

share|improve this question
    
The packets may be inbound, the TCP connection is not. UDP is trickier. –  CodesInChaos Oct 8 '13 at 15:28

1 Answer 1

up vote 3 down vote accepted

Your firewall configuration on the router is a stateful one.

When an outbound connection is established, the router/firewall keeps track of the connection and allows any response over the same connection through the firewall.

share|improve this answer
    
Indeed, sometimes it's also referred to as "connection tracking". –  Matrix Oct 9 '13 at 9:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.