-----BEGIN PGP SIGNED MESSAGE-----
paul at clubi.ie wrote:
| I.e., and this can't be stressed enough, *ONLY* the remote ends of the
| TCP sessions have the state needed to reliably drop packets. Anything in
| the middle is *bound* to get it wrong (and firewalls do, over and
| again!) - plus it makes redundant routing difficult.
|| In short, stateful filtering of TCP is simply needless and harmful.
In an attempt to put this argument to bed, allow me for a moment to
demonstrate that there is, in fact, a use for stateful packet inspection
and firewalling techniques based on same:
~ ----- = very slow connection
~ ===== = very fast connection
Let's use the example where 'host' initiates a web connection and gets
a response on port 1666. Also, the responding host decides to flood on
port 1667. (No, I don't know why - but let's say it does.)
In that case, to protect the network of slow connections behind the
firewall, a stateful firewall is (possibly) the appropriate solution.
Waiting for the state machine in the 'host' to discard useless (possibly
DoS) packets is too late, whereas the firewall has the knowledge to do
this at the edge.
So, there is a place for stateful inspection and firewalls operating in
that mode. Protection at the edge of a network is often deployed to
protect the network, not just the hosts. Unless the edge router
omnipotently knows all legal activities of the hosts behind it at all
times, it can be shown that it cannot protect the network in all cases
without gathering and acting on some kind of state.
Of course, this may bring some or all of the problems Paul describes,
such as wrongful packet drops, problems with rerouting, HA, etc.
However, it describes a valid function for a stateful firewall, I hope.
This e-mail is not, and is not intended to be in any way a statement of
advocacy for stateful firewalls or otherwise. No pets were harmed in the
writing of this e-mail.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
-----END PGP SIGNATURE-----
Maintained by the ILUG website team. The aim of Linux.ie is to
support and help commercial and private users of Linux in Ireland. You can
display ILUG news in your own webpages, read backend
information to find out how. Networking services kindly provided by HEAnet, server kindly donated by
Dell. Linux is a trademark of Linus Torvalds,
used with permission. No penguins were harmed in the production or maintenance
of this highly praised website. Looking for the
Indian Linux Users' Group? Try here. If you've read all this and aren't a lawyer: you should be!