there's no policy from internet to local network in Juniper firewall, but softwares like skype an torrent work without any problem. without any incoming policy how do these programs work ?
closed as off-topic by Ward, Rex, Dave M, Falcon Momot, Jenny D Sep 10 '13 at 7:33
This question appears to be off-topic. The users who voted to close gave this specific reason:
Usually, by (ab)using the Statefulness of the firewall.
Most, if not all, firewalls these days are Stateful. They keep track of traffic going in and out so they know the 'relationship' between packets. For example, if a host on the inside of the network sends out a SYN packet to somewhere on the outside, the firewall knows that, and knows to expect a corresponding SYN ACK packet from the address the original SYN was sent to.
So as long as a host on the inside establishes a connection out, then the "floodgates are open" for the return traffic.
There are other more complicated methods available too. A small example list includes:
P2P applications use techniques to traverse the NATs that most people have in their residential gateway. The tricks used are based on the fact that outgoing connections are allowed, which is why they work on firewalls that have the same policy.
The simplest and most successful method is UDP hole punching.
Its TCP variant is a bit more complicated, but if it fails a software can try to fall back on tunneling TCP over UDP.
There's also ICMP hole punching which uses another approach to allow initial contact without going through a third party.