Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

there's no policy from internet to local network in Juniper firewall, but softwares like skype an torrent work without any problem. without any incoming policy how do these programs work ?

share|improve this question

closed as off-topic by Ward, Rex, Dave M, Falcon Momot, Jenny D Sep 10 '13 at 7:33

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions must be relevant to professional system administration. Server Fault is a site dedicated to professionals; novice questions are off-topic. Please see the Help Center for more information on topicality. The best advice we can give you is to hire a professional to help you out." – Ward, Rex, Dave M, Jenny D
If this question can be reworded to fit the rules in the help center, please edit the question.

    
You need to provide more information and prove that you've done some research, and that you're a professional before others are able to help you here. –  Drew Khoury Sep 9 '13 at 12:46

2 Answers 2

up vote 1 down vote accepted

Usually, by (ab)using the Statefulness of the firewall.

Most, if not all, firewalls these days are Stateful. They keep track of traffic going in and out so they know the 'relationship' between packets. For example, if a host on the inside of the network sends out a SYN packet to somewhere on the outside, the firewall knows that, and knows to expect a corresponding SYN ACK packet from the address the original SYN was sent to.

So as long as a host on the inside establishes a connection out, then the "floodgates are open" for the return traffic.

There are other more complicated methods available too. A small example list includes:

  • Tunnelling (eg, inside HTTPS or ICMP)
  • UPnP (not really applicable to enterprise firewalls like Juniper)
  • STUN
share|improve this answer

P2P applications use techniques to traverse the NATs that most people have in their residential gateway. The tricks used are based on the fact that outgoing connections are allowed, which is why they work on firewalls that have the same policy.

The simplest and most successful method is UDP hole punching.

Its TCP variant is a bit more complicated, but if it fails a software can try to fall back on tunneling TCP over UDP.

There's also ICMP hole punching which uses another approach to allow initial contact without going through a third party.

share|improve this answer
    
Generally correct in a modern sense... although the articles seem to completely gloss over the fact that Stateful Firewalls are a relatively new idea (though decades old), these completely ignore the fact that they don't work on stateless firewalls. –  Chris S Sep 9 '13 at 13:18

Not the answer you're looking for? Browse other questions tagged or ask your own question.