I'm working on extracting some traffic-direction results on several stateful firewalls and I pondered on how you define the direction of the traffic in these stateful firewalls.
Bottom line:
I have to define what direction the traffic is flowing on those stateful firewalls.
Eg.:
- You have a stateful firewall with VPN functionality with 2 interfaces (Inside and Outside)
- VPN users are connecting to the firewall on the Outside interface to gain access to the company network/or gain privacy from their current network
Which direction is the traffic flowing in?
Simply put, in the end, the traffic is flowing in both directions because:
- The VPN users has to connect to the firewall to gain access/privacy - That's an inbound direction
- After the VPN connection is created, the traffic is now flowing in both directions because of the existing VPN connection between the VPN-client and the firewall - That's an inbound and outbound direction
- When the user is connected via the VPN connection and trying to go on a website, the traffic is still flowing in both directions because the traffic has to originate from the VPN-client through the firewall and out through the outside interface (to the WAN) - That's an inbound and outbound direction
But the "result-worthy" way I see it, the traffic is flowing in an outbound direction because it goes without saying the connection between the VPN-client and the firewall is needed in this context and the VPN-client is actually acting as it was physically behind the firewall on the Inside interface.
Can someone clarify the definition of traffic-direction? Does a clear definition to traffic-direction even exist, or is it up to how I look at it?