There may be different rule sets at each point where filtering is applied. Your firewall's packet filtering rules should implement some portion of your organization's network security policy. If the entire policy can be implemented in packet filters, then other firewall mechanisms may not be required. If some elements of your policy can not be implemented with packet filters, then consider additional firewall mechanisms such as proxies. Why this is important Packet filtering can be a high performance, low cost means by which to implement a substantive portion of your network security policy.
Intrinsic information is information that is contained within a packet itself.
Some or all of this information may be referenced in filter rules depending on the actual implementation of the packet filter mechanism in the firewall software you have selected. Most packet filters only support references to information in headers. Extrinsic information is information that exists outside of a packet. Most packet filters are implemented as separate sets of rules for each interface, sometimes with separate sets for arriving and departing packets. By placing a given rule in the appropriate interface s rule set, you are using extrinsic information in the design of your rules.