Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Ok, so assume that I have an ingress access list that looks like this:

access-list outside_in extended ip permit any X.Y.Z.1 eq 25
access-group outside_in in interface outside

And I want to do egress filtering. I want to allow inside machines to respond on port 80, and I want to allow ports over 1024. Given that the firewall is statefull, do I need to have the rule

access-list inside_in extended ip permit X.Y.Z.1 any eq 25

in my inside_in ACL, or can I get away with just

access-list inside_in extended ip permit any any gt 1024
access-group inside_in in interface inside

In other words, if I apply an egress access list, do I have to explicitly allow machines to respond to requests allowed by the ingress access list, or does the statefullness of the firewall handle that for me?


share|improve this question
up vote 1 down vote accepted

Once a TCP connection is established, the traffic flow has been evaluated and allowed, which counts for the lifetime of the flow; the egress rule would not be needed.

share|improve this answer
Great, thanks. How does this affect PINGs? I've seen acls that have both "permit icmp any HOST echo" and "permit icmp HOST any echo-reply", if the firewall is statefull then isn't the second rule redundant? – Nate Mar 9 '11 at 15:55
@Nate It's a little more difficult for it to deal with connections that are inherently stateless, ICMP and UDP. You'll want the echo-reply rule. Another IMCP example you'll see sometimes is ICMP unreachable messages. UDP is usually fine, but you'll see the occasional packet drop when it loses track of a "flow". – Shane Madden Mar 9 '11 at 16:02

To put it very simply: when building rules for TCP connections, you just need to think about the path the first SYN will take. Build the ACLs that would allow those and only those SYNs you consider acceptable, and the firewall will take care of the rest.

I recommend sticking to ingress rules only, unless you have a good justification to do otherwise. This example doesn't look like one.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.