-2

there's no policy from internet to local network in Juniper firewall, but softwares like skype an torrent work without any problem. without any incoming policy how do these programs work ?

1
  • You need to provide more information and prove that you've done some research, and that you're a professional before others are able to help you here. Sep 9, 2013 at 12:46

2 Answers 2

1

Usually, by (ab)using the Statefulness of the firewall.

Most, if not all, firewalls these days are Stateful. They keep track of traffic going in and out so they know the 'relationship' between packets. For example, if a host on the inside of the network sends out a SYN packet to somewhere on the outside, the firewall knows that, and knows to expect a corresponding SYN ACK packet from the address the original SYN was sent to.

So as long as a host on the inside establishes a connection out, then the "floodgates are open" for the return traffic.

There are other more complicated methods available too. A small example list includes:

  • Tunnelling (eg, inside HTTPS or ICMP)
  • UPnP (not really applicable to enterprise firewalls like Juniper)
  • STUN
1

P2P applications use techniques to traverse the NATs that most people have in their residential gateway. The tricks used are based on the fact that outgoing connections are allowed, which is why they work on firewalls that have the same policy.

The simplest and most successful method is UDP hole punching.

Its TCP variant is a bit more complicated, but if it fails a software can try to fall back on tunneling TCP over UDP.

There's also ICMP hole punching which uses another approach to allow initial contact without going through a third party.

1
  • Generally correct in a modern sense... although the articles seem to completely gloss over the fact that Stateful Firewalls are a relatively new idea (though decades old), these completely ignore the fact that they don't work on stateless firewalls.
    – Chris S
    Sep 9, 2013 at 13:18

Not the answer you're looking for? Browse other questions tagged .