Patent ID: 7512781

Claim:
A stateful inspection bridging network security device for controlling the flow of packets into and out of an internal network, via a data link layer said device including: a first network card connected to an external network; a second network card connected to the internal network; a third network card which is a management interface having a private, not publicly routed IP address which is used to configure a stateful inspection firewall; and the stateful inspection firewall connected to said first network card and said second network card, wherein during inflow of packets from the external network to the internal network, the first network card forwards each packet to the firewall for inspection to determine whether or not the packet is part of an existing session by examining a stateful inspection table stored in the firewall, and wherein: (i) if the packet is part of an existing session the packet is forwarded via the data link layer to the second network card where the packet is forwarded on to the internal network, and (ii) If the packet is not part of an existing session the packet is compared with a set of rules which determine whether the packet is acceptable or not acceptable to the network and wherein: (a) if the packet is acceptable the packet is forwarded via the data link layer to the second network card where the packet is forwarded to the internal network, and the session is entered into the stateful inspection table, (b) if the packet is not acceptable the packet will be dropped and will disappear, and wherein during the outflow of packets from the internal network to the external network, an outbound packet passes through the second network card to the firewall where the outbound packet is inspected to determine whether or not the outbound packet is part of an existing session and, if so, the outbound packet is forwarded to the first network card to exit the device to the external network, and, if not, the outbound packet is compared with the set of rules and if acceptable the outbound packet is forwarded via the data link layer to the first network card to exit the device to the external network and, if not acceptable, the outbound packet is dropped and disappears.