Symantec™ Security Gateways Reference Guide - Sawmill

68 Controlling service accessFiltersTypes of filtersThe security gateway supports the following types of filters:■■■■■InputOutputForwardingVPNFilter groupsInput filterInput filters apply to traffic arriving at a network interface or traffic coming out of a VPN tunnel. An inputfilter is one of the first incoming packet checks performed. Packets that do not satisfy the filter are droppedbefore being seen by the proxies or any local applications. The security gateway logs all packets dropped byinput filters.The steps necessary to create an input filter are found in your product’s administrator guide.Output filterOutput filters apply to traffic leaving from a network interface or traffic going into a VPN tunnel. An outputfilter is one of the last outgoing packet checks performed. Packets that do not satisfy the filter are dropped.Unlike packets dropped by an input filter, packets dropped by an output filter are not logged.The steps necessary to create an output filter are found in your product’s administrator guide.Forwarding filterA forwarding filter forwards all allowed packets through the security gateway without first passing thepackets to the application layer. Packets not allowed through the forwarding filter continue up the stack tobe inspected by the proxies. The behavior of a forwarding filter approaches that of a simple packet-filteringrouter, but is applied simultaneously to all packets at all interfaces; the filter is applied to both incoming oroutgoing packets. Unlike input and output filters which apply at a single interface, forwarding filters applyto all interfaces simultaneously.Note: A network interface can have separate input and output filters, whereas a forwarding filter has asingle filter for both input and output.A forwarding filter should be a last resort for letting packets through the security gateway. A forwardingfilter provides minimal security for allowed packets because packets matching the chosen forwarding filterbypass application-level checks. Forwarding filters are useful under some specific cases, but you should tryusing a custom protocol instead.Note: When using a forwarding filter, it is vitally important to understand the security implications. If youcreate a broad filter (one that allows protocols other than those you require), you are creating a hole in yoursecurity gateway. This may seriously undermine the security of your network.You might consider configuring a forwarding filter to support a point-to-point tunneling protocol (PPTP)server behind the security gateway. The security gateway does not include a PPTP proxy (which involvesboth GRE and TCP protocols). If you want external entities to access the PPTP server, you need to configurethe security gateway to pass PPTP.