If more complex filtering is desired, filter rules can be configured separately. Tunnels require filters, but filters do not require tunnels. Filtering is a basic function in which incoming and outgoing packets can be accepted or denied based on a variety of characteristics. This allows a system administrator to configure the host to control the traffic between this host and other hosts. This filtering is done at the IP layer, so no changes are required to the applications.
Tunnels define a security association between two hosts.
These security associations involve specific security parameters that are shared between end points of the tunnel. The following illustration indicates how a packet comes in the network adapter to the IP stack. From there, the filter module is called to determine if the packet should be permitted or denied. If a tunnel ID is specified, the packet will be checked against the existing tunnel definitions. If the decapsulation from the tunnel is successful, the packet will be passed to the upper layer protocol.