3 ms·
> 1. The inside-server behind the firewall MUST reply to all clients, so the stateful firewall must allow all Internet initiated-sessions to reach the server (n
by mrkeen 3y ago
> 1. The inside-server behind the firewall MUST reply to all clients, so the stateful firewall must allow all Internet initiated-sessions to reach the server (no usage of a state table here).
I don't understand this requirement, (more specifically the second half of it).
Isn't a firewall literally a device which allows in some connections, rather than all connections?
(And state plays a role in letting the firewall remember which external clients are acting DOSy?)
- fulafel 3y ago(not the GP poster) By my reading the rate-limiting case was covered as the exception in a latter part of the comment ("This could be useful in rare case when you have a very big firewall able to limit the number of sessions toward your small inside-server.") But in the usual case you'll block connection attempts to the wrong port statelessly, and there's no benefit in tracking the served sessions in an external firewall.