Subject: [NSIS] Simple question to NATFW people

From: Jukka MJ Manner <[email-masked]>
Date: Wed, 20 Dec 2006 00:19:55 +0200 (EET)

We are working on the NATFW, but a simple question just occured to me.

For browsing a simple web site, do I need 1 or 2 requests to the firewall?

Consider the following:

1) MyPC--->WWWserver  - I send a TCP SYN packet to the destination,
2) WWWserver <---MyPC - destination sends back SYN-ACK
3) MyPC--->WWWserver  -  I reply with an ACK.
4) From now on, data can be sent on both directions

I have a NATFW capable firewall protecting my network, working in proxy 
mode.

The spec doesn't mention any bi-directional firewall holes, so basically, 
do I need to request a hole for MyPC->WWWserver and a second for 
WWWserver->MyPC? 

Or can I just ask for 1 hole for this particular connection, for all 
packets belonging to this TCP flow, regardless of the direction?

Jukka

_______________________________________________
nsis mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nsis

---

From: "Martin Stiemerling" <[email-masked]>
Date: Wed, 20 Dec 2006 10:15:49 +0100

Hi Jukka,  

> -----Original Message-----
> From: Jukka MJ Manner [mailto:[email-masked]] 
> Sent: Tuesday, December 19, 2006 11:20 PM
> To: [email-masked]
> Subject: [NSIS] Simple question to NATFW people
> 
> 
> I have a NATFW capable firewall protecting my network, 
> working in proxy mode.
> 
> The spec doesn't mention any bi-directional firewall holes, 
> so basically, do I need to request a hole for MyPC->WWWserver 
> and a second for 
> WWWserver->MyPC? 
> 

You do need two requests to the firewall when operating in the regular
mode, i.e., both ends support NSIS:
- 1st request MyPC->WWWserver
- 2nd request WWWserver->MyPC

Basically, from an NSIS model view, those bi-directional flows are two
uni-directional flows, as also in the RSVP model.

However, you can use the proxy mode, where your local firewall is
generating the 2nd request, if only your side needs to be configured. 

> packets belonging to this TCP flow, regardless of the direction?

No, that is not possible. 

 Martin