Disallowing a TCP Connection to an Inside Web Server

Disallowing a TCP Connection to an Inside Web Server

[View full size image]

The firewall's rules, shown at the bottom of the figure, tell it two types of connections that can be initiated from the outside to the inside. This new connection does not match either of those rules. So, the firewall discards the IP packet, which prevents the TCP connection from ever being completed. Because a TCP connection must be completed before any application data can be sent, there will never be HTTP application messages sent between the server and the client; in fact, not even this initial TCP segment reaches server 1.1.1.2. The server is completely unaware that C3 tried to reach it.