router ACL點分in out bound?

kratos

睇左好多reference都唔太明
想問係每個port都有in/out bound?但其實點分個port的方向?
standard acl最好放係destination port但放in定out好?
點解有時D reference 個in/out方向好似次次唔同咁?
有冇師兄可以解答下?thank you

KinChungE

簡單D講inbound = download, outbound = upload
至於port, 最常見既係:
如果你自己開server, 自己port就係server socket listen既port, 但係對方port係乜都有可能(1-65536)
如果你連出去人地server, 自己port就係乜都有可能, 對方port就係對方server socket listen緊既port

kratos

但係router上的in/out bound都係download同upload的分別?

alanh999

I don't know what kind of router/firewall you are working on but inbound/outbound could mean different things when the traffic is seen from different interfaces or applications.

Let me present you 2 simple examples to help you understand (hopefully).
Let's say you got a router with 1 * LAN interface and 1 * WAN interface.

1. On router level:
- A packet traveling from the LAN subnet through its LAN interface to the internet through its WAN interface, LAN is "in" and WAN is "out". (Upload)
- The other way round, for a packet traveling from the internet through the router's WAN interface to the LAN subnet through its LAN interface, WAN is "in" and LAN is "out". (Download)

2. On interface level:
- For the LAN interface: a packet traveling from the LAN subnet through the LAN interface for the internet through the WAN interface, the packet coming from the LAN subnet is "in" while the packet leaving the LAN interface for the WAN interface is "out".
- For the WAN interface, the same packet flow, that packet coming from the LAN interface is "in" while the packet leaving WAN interface for the internet is "out".
The 2 steps which I descripted above forms (in a simplified manner) the upload packet flow.