0

Being a hardware firewall, it can only see the TCP/UDP packets, how can they know that a packet coming inside is inbound or response to an outbound request?

6
  • I don't understand why "it can only see TCP packets" would prevent it from knowing where the packet has to go. Once the firewall is done inspecting it, it needs to know where to send the packet next anyways. In fact, every machine that handles packets does this. How do they know? Once you can answer that, you can answer this question too.
    – MechMK1
    Jun 28, 2020 at 10:29
  • @MechMK1 The firewall knows where to send it but how can it know if its an inbound packet or a response to an outbound pakcet just by inspecting the packet. Both would look the same right? But the job of the firewall is to block one and allow the other. I'm wondering how hardware firewall achieving that. Jun 28, 2020 at 10:32
  • 2
    Because inbound means it's coming from outside to something inside, and outbound means it's coming from the inside to the outside.
    – MechMK1
    Jun 28, 2020 at 11:31
  • "but how can it know if its an inbound packet or a response to an outbound pakcet just by inspecting the packet." - as MechMK1 already pointed out: the usual meaning of inbound and outbound is not the one you use. It might be that you are asking about packets for a new connection and packets for an established connection - in which case have a look at how stateful firewalls works. Jun 28, 2020 at 12:05
  • 1
    Your question is based on an incorrect assumption. Seeing and inspecting TCP/UDP packets brings a lot of information about established connections, so it's in fact trivial to tell whether a packet is inbound or a response to an established connection.
    – Pedro
    Jun 30, 2020 at 9:23

1 Answer 1

3

Since there seems to be some confusion about the terms inbound, outbound, stateful and stateless, allow me to explain how they all relate to the concept of firewalls.

What is an inbound packet?

An inbound packet is a packet that enters a network. For example, if 198.51.100.23 would like to communicate with an internal web server 10.100.22.161, the request will be considered an inbound packet.

What is an outbound packet?

An outbound packet is a packet that leaves a network. If we take our previous example, the response from the internal web server 10.100.22.161 to the client somewhere on the internet at 198.51.100.23 will leave our internal network, and is therefore an outbound packet.

What is a stateless firewall?

A stateless firewall is a firewall that looks at each inspected packet in isolation - at least on the OSI layer it is designed to inspect.

For example, a simple firewall rule could be "Allow every incoming packet to the subnet 10.100.22.0/24 to port 443". The firewall does not know what the content of these packets is, nor does it care what packets came before.

All it does it look at its rules, matches them to the packet, and then executes whichever action is attached to the rules.

What is a stateful firewall?

A stateful firewall is a firewall that has some internal state related to what has happened before. For example, you might want your server to be able to communicate with clients, but only if they send a request first.

In order to do that, the firewall has an internal state of how the network traffic around it is like. It knows which clients have opened connections to which servers, and how long ago these connections are.

A simple stateful firewall rule could be "Allow every outbound packet from the network 10.100.22.0/24 on port 443, but only to clients who have an active TCP connection already".

Not the answer you're looking for? Browse other questions tagged or ask your own question.