Let It Back In? — TechKnowSurge

About this interactive

Put an ACL on the WAN interface that stops all incoming traffic and the threat actors on the internet cannot get in. The trouble is that a PC that asks a website for a page now never gets the page: the reply is incoming traffic too, and the guard turns it away. The established traffic rule is the fix. When a PC on the LAN reaches out, say 192.168.54.16 to a web server at 216.15.24.20, the router records that conversation: the source, the destination and the ports. When a packet comes back from 216.15.24.20 to 192.168.54.16 on those ports, it matches the record and is let in. An adversary who reaches out first finds no record and is refused. This is the premise of a stateful firewall, stateful packet inspection: outbound traffic is allowed, and inbound traffic is allowed only when it belongs to a conversation someone inside started.

What you'll learn

Decide whether traffic arriving from the internet is let in under an established traffic rule: replies to conversations an inside host started come in, unsolicited connections from outside do not
Explain the link between established traffic and stateful packet inspection: the router keeps a record of each outbound conversation and admits only traffic that belongs to one

Aligned to

CompTIA Security+

4.5 Given a scenario, modify enterprise capabilities to enhance security.

3.2 Given a scenario, apply security principles to secure enterprise infrastructure.

2.5 Explain the purpose of mitigation techniques used to secure the enterprise.

Key terms

Established Traffic Rule: An ACL rule that permits inbound return traffic for sessions initiated from the internal network, while blocking unsolicited inbound connections.
Stateful Packet Inspection: A firewall method that tracks the state of active connections and uses that context to determine whether inbound packets belong to a legitimate outbound session.
Access Control List: A set of rules that defines which users or systems are granted or denied access to a resource.
Interface Direction: The orientation of traffic flow on a router interface, either inbound (into the interface) or outbound (out of the interface), which determines where an ACL is applied and evaluated.

Topics

Established Traffic Rule Stateful Packet Inspection Access Control List Interactive Streak Sort

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →