The scenario
Client (10.0.1.10) and Server (10.0.3.10) are on two subnets joined by two devices side by side: Router (10.0.1.1 and 10.0.3.1) and Firewall (10.0.1.2 and 10.0.3.2). Firewall is stateful and allows TCP port 80 and ICMP. Server's default gateway is Firewall, as it should be. Client's default gateway is Router, so Client's requests go around Firewall. Server's answers go back through Firewall, which has no record of any connection, so it judges each reply by its rules alone. The HTTP reply (a SYN-ACK from port 80 to a temporary port on Client) matches no rule and is dropped. A ping reply is ICMP, which the ICMP rule allows in either direction, so ping works and makes the network look healthy.
What you will work out
Learn why a stateful firewall must see both directions of a connection, how asymmetric routing breaks TCP while ping still works, and how to fix it with routing.
Why this matters
Asymmetric paths appear whenever there is more than one way between two networks: a second router added for a new link, two firewalls in a pair that do not share connection state, or two internet uplinks. The symptom is confusing because ping works and each device's routing table looks right on its own. When TCP connections hang but ping succeeds, trace the reply path as well as the request. Some firewalls can be told to skip state checks for known asymmetric flows (Cisco ASA calls this TCP state bypass), but making the routing symmetric keeps the firewall doing its job.
Running it
Asymmetric Path Breaks Firewall opens on a canvas, already wired and addressed. Trace a packet through it hop by hop, or run the same topology live on real Linux network namespaces. How the two modes differ.
Open Asymmetric Path Breaks Firewall
Runs in your browser. No install, no signup, and the simulation starts instantly.
Open the lab →