0

http://i66.tinypic.com/29p50zp.png

Can anyone explain how to read and understand row 1,2 and 3?

My understanding for row 1 is : If any inside packets want to go to outside via any source port to destination port number 80 using HTTP protocol. It is allowed.

Row 2, if any outside packets want to come in via source port number 80 to destination port number bigger than 1023 using Protocol HTTP. It is allowed

For Row 3, no matter, the action is not allowed.

Is my translation correct? Also, is it usual to have action in row 3 in real life?

Also, what is the importance of the ACK bit in the flag field? Is it to make sure the packet sent out or received?

Thirdly, wiki says no state is one of the advantage of Packet Filter. Why is no state being one of the drawbacks of Packet Filter?

0

You are basically correct.

Also, is it usual to have action in row 3 in real life?

Yes, if the intent is to only allow packets to your web server, you have to deny everything else. Many types of ACLs have an "implicit deny," meaning that if the packet doesn't match any ACE, it is denied.

what is the importance of the ACK bit in the flag field?

The ACK bit is set on established connections. The reason to filter on it is to prevent incoming TCP connections. That is, only connections started from the inside are allowed.

Why is no state being one of the drawbacks of Packet Filter?

Having state information allows you to enforce TCP protocol rules, which better protects your servers. The disadvantage is when you have multiple paths, you can have asymmetric flows which a stateful device doesn't handle very well.

Perhaps it's just the way your rules were written for this example, but a good practice would be to specify the IP addresess on the inside, instead of a generic range.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.