Workshop

Packet-Filtering Routers
Previous Table of Contents Next
A packet-filtering router usually depends on access rules—that is, rules you set up within the router
software itself. A packet filter usually has a rule set that starts with least common and works its way up
to most common. What’s a rule set? Typically, a rule set looks something like a routing table but
includes sockets as well as addresses. Any packet that comes in is compared against rule 1, then rule 2,
all the way to the end. If at any time it matches up against a rule, processing stops. For example, for my
192.168.1.0 network, the rules might be as follows:
• Allow 192.168.1.0:any on if 0 to connect to all:any.
• Deny all:any to connect to all:any.
This means that anybody within my 192.168.1.0 network (provided they come in on router interface
0) can connect to anything they darn well please. If condition 1 was not true, then condition 2 would
apply, which denies everything. This is probably the most common firewall configuration: Allow certain
sockets (or all sockets) from the inside to go to the outside and disallow all other connections (for
example, connections from the outside).
The most effective packet-filtering routers will have a filter on “which interface” the packet comes in on,
in addition to what IP address the packet is from. This helps eliminate packet spoofing, where a packet
claims to be from a certain network, but actually is not.
A complex rule set results in confusion and possible misconfiguration. If you’re configuring a rule set,
you should keep it simple.
You should know that certain applications (such as active FTP) will ask the destination station to initiate a
connection back to the requesting workstation, even though it’s a TCP application. It’s sort of like “Hey
Fred, find out when the movie is, then call me back.”
Under many firewall configurations, this is prohibited, because it means the firewall has to be configured
so that a random workstation from the outside can initiate a connection to a random workstation on the
inside. Might as well use a colander rather than a firewall!
You can usually get around this type of application problem by using a different mode of the