2

I wonder if a firewall can support this case. There are two servers: A and B.

  • A can send a request via an open port to B and B must respond to A during this connection.
  • B cannot send a request on its own to A.
4
  • 1
    You described the most basic function of a stateful firewall. Is there a reason that you think that this cannot be done? What challenge do you see?
    – schroeder
    Oct 24, 2023 at 9:13
  • 1
    @schroeder I have no experience with firewall, because I thought B cannot send data to A so the first requirement "B must respond to A during this connection" might not work. Oct 24, 2023 at 9:27
  • I'm very curious how you ran into this problem. Are you configuring a firewall? Is this a homework question?
    – schroeder
    Oct 24, 2023 at 9:31
  • 1
    @schroeder no it is not my homework, I was curious about how it can be done with a firewall. Oct 24, 2023 at 9:38

2 Answers 2

1

The concept you are looking for is a "stateful firewall". All firewalls are now Stateful.

This means that the "session" is tracked, not just the bare traffic. So, you can say in the firewall rules that B can respond to connections, but not make new connections.

0
1

First, most firewalls have an OS based on some kind of linux. Not all firewalls expose access to iptables so your mileage may vary.

For windows you would have to lookup the windows specific commands because windows doesn't have iptables but its own software.

iptables uses connection tracking. When setting up rules you can specify NEW and/or ESTABLISHED as options.

In your case I would just specify the ESTABLISHED keyword and not the NEW keyword.

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state NEW -j DROP

Depend on your kernel and iptables version you may have to use

iptables -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -m conntrack --ctstate NEW -j DROP

Conntrack supersedes state and that should be the preferred method on the newest version of iptables,nftables,kernel and etc.

It is likely you will have to tweak these rules to fit your specific needs.

1
  • thanks for your information, that is helpful for someone learning iptables Oct 29, 2023 at 17:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .