1

If I have an open port on a firewall it means that I can receive traffic on that port. If it's unencrypted I assume that the raw data is just allowed through.

If TLS is being used, does firewall decrypt the traffic before relying it to the client or does it relay crypted traffic to the client which then somehow decrypts it?

How does the firewall act with CRYPTED/UNENCRYPTED traffic?

Best regards,

1

If TLS is being used, does firewall decrypt the traffic before relying it to the client

Traditionally, no, for most definitions of "firewall."

or does it relay crypted traffic to the client which then somehow decrypts it?

It just relays the packets, and the client decrypts.

I say "Traditionally" because there are other devices - reverse proxies, load balancers, Intrusion Prevention Systems - which will decrypt the traffic and either pass along clear text or re-encrypt for the final hop to the client. And many "Firewalls" today are hybrid devices which wear some of those devices' hats as well.

But in general, a "firewall" should just pass traffic, and doesn't manipulate the encryption.

  • To add, the firewall usually doesn't even know or check what kind of data is passing through it. In the most common cases, it is only looking at header values of the transport layer and below. Things related to encryption and applications are at higher layers. – multithr3at3d Apr 23 at 22:06
0

The payload of a packet is meaningless to a normal firewall, the encryption/decryption is done on the client because it is the only device (other than the server at the other end) that has the key.

Unlike what the other poster implied, it is also not easy/possible for an other device to decrypt TLS traffic (the whole point of TLS is to prevent that sort of thing). You need to gain access to the local device making the connections and install a dodgy certificate on it to be able to decrypt the traffic.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.