Symantec™ Security Gateways Reference Guide - Sawmill

70 Controlling service accessFilters■To protect non-security gateway related services from attacks. For example, a packet filter couldprevent the security gateway from forwarding RIP packets, which contain information about theprotected network, to the Internet.You should not run any general services on the security gateway. If this is unavoidable, packet filtersplaced on the security gateway interface provide a measure of protection.Filter processingAs shown in Figure 5-2, packet filters, if they exist, are applied before the driver examines incomingpackets, and after the Symantec driver has reviewed outgoing packets.Figure 5-2Position of interface filtersInput filterIncoming packet checksOutgoing packet checksOutput filterIncoming packets are filtered in the following order:■■■If no filter is present, packets continue on to the incoming packet checks.If a filter is present, but the filter contains no criteria/action pairings, the packet is dropped.If a filter is present, and criteria/action pairings exist, each pairing is examined, in the order they wereadded, until a match is found. Once a match is found, the defined action (allow or deny) is applied, andno further examination takes place. If no match is found, the packet is dropped.Outgoing packets are filtered in the following order:■■■If no filter is present, packets continue on to their destination.If a filter is present, but the filter contains no criteria/action pairings, the packet is dropped.If a filter is present, and criteria/action pairings exist, each pairing is examined, in the order they wereadded, until a match is found. Once a match is found, the defined action (allow or deny) is applied, andno further examination takes place. If no match is found, the packet is dropped.Note: If an input filter causes a packet to be dropped, a log entry is written to the log file that includes theinterface, source address, destination address, and protocol.