Do firewall rules have to be symmetric? That is, does a firewall have to block a particular traffic type both inbound (to the protected site) and outbound (from the site)? Why or why not?
I have to answer the above question. What is the meaning of symmetric rules in firewall? can anyone please explain it to me
Q: Do firewall rules have to be symmetric?
Short and simple answer: No, they don't HAVE to be. But it doesn't mean that they CAN'T be.
Why?
It depends on the traffic that is expected to pass through the firewall, but most of the time the rules won't be symmetric.
For example, if you don't have a DNS server inside your network, you will probably block incoming DNS traffic, but if you block outbound DNS traffic, you won't be able to access anything that uses domain names. From web sites to ftp servers, ssh servers, your backup account in the cloud, etc.
But it makes sense if you don't want employees accessing anything that is not in your internal network. Obviously, there are ways to bypass that (to memorize the server ip address...), but it will definitely make things harder for them.
So, symmetric rules might break things for you. But maybe that is exactly what you wanna do.
I believe you have some terminology mistakes in your question, but I still think I can answer it. To answer your question I'll explain both common types of firewalls, stateful and stateless. Both types of firewalls compare packets against their rulesets. Both work from a set of data often referred as a tuple, which typically includes Source IP, Destination IP, Source Port and Destination Port. There are some important differences I'm going to outline below.
Stateful firewalls maintain a table of connections. This means that once a connection is established, traffic that matches that session is allowed through the firewall. For example, if you created a rule that allowed port 80 from the internet to a system behind the firewall, the packet the server sent back as part of the TCP handshake would be allowed. Since a stateful firewall is aware of TCP state it is capable of filtering packets with invalid TCP header information.
Stateless firewalls are limited in their filtering capabilities compared to a stateful firewall, but generally are much faster because of their simpler rule processing logic. Each direction of a connection must be explicitly allowed since no state is saved and each packet is checked against the firewall rules each time. For example, if you created a rule that allowed port 80 from the internet to a system behind the firewall, the packet would be allowed as before. However, without a corresponding rule for the packet from the server back to the client, the response packet would be dropped. These firewalls are not generally able to filter packets with invalid TCP header information.
The meaning of the word symmetric is in your question, inbound and outbound rule for the traffic. As for blocking the traffic part, actually it is the other way around. All traffic is blocked by default and particular traffic needs to be allowed. If I answer the part related to allowing the traffic symmetrically, then the answer would be yes for stateless firewalls (packet filters) which do need keep the information on sessions. But you don't have to for statefull firewalls which keep the session information.
This sounds suspiciously like a homework question, but I'll answer anyway.....
Do firewall rules have to be symmetric?
No.
That is, does a firewall have to block a particular traffic type both inbound (to the protected site) and outbound (from the site)?
No.
Why or why not?
I've somewhat answered that question here: Firewall & TCP Traffic
The reason is that modern firewalls are stateful, which means that communication is free to flow both ways once initiated from the allowed source to the allowed destination over the allowed port and/or service.
This is the reason why a symmetric rule is not necessary.
