TechKnowSurge
TechKnowSurge Catalog Videos Established Traffic
VideoSecurityFree

Established Traffic

Established traffic rules allow ACLs to permit inbound packets only when they are replies to outbound requests originating from inside the network, blocking unsolicited traffic from external threat actors. This mechanism forms the foundation of stateful packet inspection and modern firewall behavior.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Established traffic rules are a critical component of access control list configuration, designed to solve a fundamental security challenge: blocking unsolicited inbound traffic while still allowing internal hosts to receive replies to their own outbound requests. Without this capability, a strict deny-all inbound ACL would prevent legitimate return traffic from reaching internal machines, breaking normal internet communication for users on the LAN. The mechanism works by tracking outbound sessions at the router. When an internal host initiates a connection to an external IP address, the router records the source IP, destination IP, and associated port information. When reply traffic arrives at the WAN interface, the ACL evaluates whether that inbound packet matches a known outbound session. If a match exists, the traffic is permitted through to the requesting host. If no match is found, as would be the case with an unsolicited connection attempt from an external threat actor, the traffic is denied and the internal network remains protected. This approach reflects the core logic behind stateful packet inspection, a method used by modern firewalls to make forwarding decisions based on the state and context of a connection rather than examining each packet in isolation. While basic ACLs operate statelessly, the established traffic rule introduces a layer of session awareness that bridges the two concepts. Understanding established traffic rules provides a practical foundation for working with stateful firewall technologies and designing network security policies that balance accessibility with protection.

What you'll learn

What's covered

Established Traffic Rule

Key terms

Access Control List
ACL
A set of rules that defines which users or systems are granted or denied access to a resource.
Stateful Firewall
A firewall that tracks the state of active network connections and makes filtering decisions based on context.
Packet Filtering
A firewall technique that inspects packets and allows or blocks them based on source, destination, and protocol.
Established Traffic Rule
An ACL rule that permits inbound return traffic for sessions initiated from the internal network, while blocking unsolicited inbound connections.
Stateful Packet Inspection
SPI
A firewall method that tracks the state of active connections and uses that context to determine whether inbound packets belong to a legitimate outbound session.

Topics

Networking Access Control Lists Stateful Packet Inspection Firewall Configuration Inbound Outbound Traffic Network Security

Transcript

Setting Up the Scenario

There's another type of rule that we need to be familiar with: the established traffic rule.

Let's develop a little scenario here. What we have is LAN 1 here, which is a bunch of machines that need to communicate, and so on and so forth. And we have LAN 2 here, a bunch of machines that need to communicate as well. And then we have our WAN interface. This goes to the outside world, the cloud, the internet.

But we have an issue out there. There are hackers, there are threat actors, there are adversaries that are going to try to get into your network. And if you allow them, what they will do is come in through their WAN connectivity and go into your other networks. We want to avoid this. We want to stop them from being able to get into our networks. As a result, what we're going to do is post the ACL at the front door. We're going to guard it against these adversaries so they can't get in. So we're not going to allow traffic to come in through this WAN interface.

The Problem That Creates

But this causes a problem, because now a machine is going to want to access the internet. So what they're going to do is go out and access the internet. There's a packet that goes out and says, "Hey, I'd like this website." And what will happen is this website will then return back, and it will make a reply back and send it back to this machine over here. But the security guard, this access control list, is going to say, "Uh-uh, no, you're not getting into my network. I'm protecting my network."

How Established Traffic Works

This is where established traffic comes into place. This is a special rule that can be put on certain interfaces. So what will happen is that this machine will reach out to something on the internet, and when it does that, this router right here will establish what is the source IP address and what is the destination IP address. So now when the traffic comes back through, this ACL right here will allow traffic to come back and reach the machine. So now we can get the traffic that we asked for.

So let's say this machine is 192.168.54.16, and it's going into this router, coming out to get to 216.15.24.20. When it makes this journey, this interface is going to record that 192.168.54.16 is communicating with 216.15.24.20. So now when the reply packet comes through, it's going to say, well, is this the source, and is it going to this destination? And it'll look at the ports as well. If that's the case, then it will say, okay, then I will allow it back in to get to this machine right here.

Now when the adversary reaches out and tries to get in, it doesn't see that in this table and says, nope, you're not allowed. So I'm not going to allow you to get into this network.

The Link to Stateful Packet Inspection

This is the premise of how firewalls work. What we want is we want traffic to be able to go out to the rest of the world. But if it was coming back in and was not requested, then this firewall is going to stop that traffic from coming in to the rest of the network.

One thing we could associate this with is a stateful firewall, or stateful packet inspection. When we're doing something like this, it's really stateful packet inspection. Know that there's an association between this established traffic and allowing it, and this stateful packet inspection.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →