Re: [fw-wiz] Firewalls that generate new packets..

Timothy Shea wrote:

What I believe you are referring too when you talk about
"generate a new packet ... " is a proxy firewall. This is a
piece of code that will take the original packet, suck out
the contents, (the content may be inspected at this point but
rarely happens), build a new packet, blow the content back
into the new packet, and send it along its way

Sorry Timothy, but if you refer to proxies firewall, the content *have to* be
inspected because proxy are at the application level...

The received packet goes up all the stack from IP to application level (HTTP,
SMTP, FTP, whatever...), then in an application gateway (it's just a new word
for a proxy, and it's the part which analyze, or inspect, the packet's content
compliance with the protocol definition and the security rules to enforce) then
a new protocol data unit goes out the application gateway and sends down the
stack to the IP level.
So, it's a full new packet going out of the proxy firewall.

Usually, deep packet inspection firewalls (a flavor of packet filters) do what
you describe.

JDG
_______________________________________________
firewall-wizards mailing list
firewall-wizards@xxxxxxxxxxxxxxxxxxxxx
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

Relevant Pages

  • Re: [fw-wiz] Firewalls that generate new packets..
    ... behind the firewall then it's a layer-7 problem for the service ... regexp match causes packet drop ... is exactly why I used the term "placebo" for "stateful ... inspection"; accupuncture patients report the same degree ...
    (Firewall-Wizards)
  • Re: Kerio PFW 2.14 - Safe?
    ... >> down user interface. ... Then consider the fact that most packet ... If Kerio 'X' says it's stateful it most ... >> way to know for sure would be to stand between the firewall and the ...
    (comp.security.firewalls)
  • Re: Firewall questions -- what is ...?
    ... packet payload inspection. ... IDS is not a firewall and does not necessarily protect you. ... port number for a well known service and the destination port is above 1023, ... Firewalls and IDS are prone to frequent false alarms. ...
    (microsoft.public.security)
  • Re: Max iptables rules?
    ... Here is my understanding of how Iptables processes firewall rules, ... Lets say the above is our firewall with 1000 rules in it. ... The packet will be compared to the list. ... On the 3rd rule, iptables will find a match and will allow the packet, ...
    (comp.security.firewalls)
  • Re: Max iptables rules?
    ... Here is my understanding of how Iptables processes firewall rules, ... Lets say the above is our firewall with 1000 rules in it. ... The packet will be compared to the list. ... On the 3rd rule, iptables will find a match and will allow the packet, ...
    (comp.security.firewalls)