[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

I don't need no stinking firewall!

Subject: I don't need no stinking firewall!
From: jay at west.net (Jay Hennigan)
Date: Thu, 07 Jan 2010 22:55:25 -0800
In-reply-to: <[email protected]>
References: <[email protected]> <[email protected]> <[email protected]> <[email protected]>

Nenad Andric wrote:
> On Tue Jan 05, 2010 at 01:04:01PM -0800, Jay Hennigan <jay at west.net> wrote:

>> Or better:
>>     - Allow from anywhere port 80 to server port > 1023 established
> 
>  Adding "established" brings us back to stateful firewall!

Not really.  It only looks to see if the ACK or RST bits are set.  This 
is different from a stateful firewall which memorizes each outbound 
packet and checks the return for a match source/destination/sequence.

--
Jay Hennigan - CCIE #7880 - Network Engineering - jay at impulse.net
Impulse Internet Service  -  http://www.impulse.net/
Your local telephone and internet company - 805 884-6323 - WB6RDV

Follow-Ups:
- I don't need no stinking firewall!
  - From: henry at AegisInfoSys.com (Henry Yen)

References:
- I don't need no stinking firewall!
  - From: bjohnson at drtel.com (Brian Johnson)
- I don't need no stinking firewall!
  - From: simon at slimey.org (Simon Lockhart)
- I don't need no stinking firewall!
  - From: jay at west.net (Jay Hennigan)

Prev by Date: Default Passwords for World Wide Packets/Lightning Edge Equipment
Next by Date: Default Passwords for World Wide Packets/Lightning Edge Equipment
Previous by thread: I don't need no stinking firewall!
Next by thread: I don't need no stinking firewall!
Index(es):
- Date
- Thread