Defining the traffic-direction in stateful firewalls

Question

I'm working on extracting some traffic-direction results on several stateful firewalls and I pondered on how you define the direction of the traffic in these stateful firewalls.

Bottom line:

I have to define what direction the traffic is flowing on those stateful firewalls.

Eg.:

• You have a stateful firewall with VPN functionality with 2 interfaces (Inside and Outside)
• VPN users are connecting to the firewall on the Outside interface to gain access to the company network/or gain privacy from their current network

Which direction is the traffic flowing in?

Simply put, in the end, the traffic is flowing in both directions because:

1. The VPN users has to connect to the firewall to gain access/privacy - That's an inbound direction
2. After the VPN connection is created, the traffic is now flowing in both directions because of the existing VPN connection between the VPN-client and the firewall - That's an inbound and outbound direction
3. When the user is connected via the VPN connection and trying to go on a website, the traffic is still flowing in both directions because the traffic has to originate from the VPN-client through the firewall and out through the outside interface (to the WAN) - That's an inbound and outbound direction

But the "result-worthy" way I see it, the traffic is flowing in an outbound direction because it goes without saying the connection between the VPN-client and the firewall is needed in this context and the VPN-client is actually acting as it was physically behind the firewall on the Inside interface.

Can someone clarify the definition of traffic-direction? Does a clear definition to traffic-direction even exist, or is it up to how I look at it?

Answer 1

Generally speaking, the direction of the traffic is determined by the location of the host establishing the connection.

In your example, as you indicated, the original VPN connection (#1) is inbound because the traffic originates at a host outside the network which establishes a connection to an internal resource.

Once this connection is established (#2), while the data flows in both directions, it is still an inbound connection because it was still initiated from the external host. All return traffic is considered to be part of this original connection.

When a client is connected to VPN, this establishes a "virtual" presence inside the network. So, for the VPN client accessing the web site (#3), the physical host uses the inbound connection to the virtual host that was already created, and the virtual host establishes an outbound connection through the firewall to the web site.

Again, this may not be universally true with all vendors, but generally this is how inbound/outbound connections are treated.