Firewall – What Does a Layer 3,4 Firewall do that a Layer 7 Does Not

I don't really believe there is a very clear definition of what exactly they mean. They could be specifically referring to a function of something that is part of iptables, or they could just be using the word flush as a somewhat generic term to mean something like restart/reboot.

I think they may man something like:

• Removing all firewall rules, and then adding them back.
  • Sometimes this may be necessary if you have a process that dynamically adds/changes rules.
  • If you use DNS names in firewall rules, this may be necessary after the DNS has been changed.
  • (On Linux based systems the DNS name is resolved when the rule is added to the kernel tables, not each time a packet arrives.)
• Remove all firewall state data. Firewalls these days must track the state of every connection passing through it. Perhaps they are simply clearing out all the state information.
• Only, clearing out any rules automatically created by a Intrusion Prevention System.
  • If the system was using something like fail2ban or something else login failures can result in a firewall rule being added to explicitly block connections for the IP address you are trying to connect from.
• Restart any Application Level Proxies/Gateways. To clear out any cache session state or resolve bugs in the application.

You could simply ask them what exactly they mean by flush. They should be able to provide a good answer about exactly what they mean. If they can't provide a reason why it should fix the issue you are having, or at least a plausible theory, then you may want to consider getting a second opinion.

It looks like this Microsoft patent filing from earlier this year might tell you what you want to know.

From what I can gather, this flag allows firewall rules to apply to traffic that has been encapsulated by, for example, an IPv6 to IPv4 tunnel originating outside the border of the network. As patents often are, this one is written in such a generic manner as to apply to any different type of tunneling protocol, from what I can tell.

The payload of this encapsulated traffic would be opaque to the any firewall at the network on the other end of the tunnel. Presumably, these encapsulated packets would be passed through unfiltered to the internal host where the other end of the tunnel terminated. That host would receive the traffic, pass it through its own firewall, decapsulate the traffic (if allowed by its own firewall), and pass the decapsulated packets back its firewall. When the packet travels thru the firewall the second time (after decapsulation), it has an "this packet traversed the network edge" bit set such that only rules with the "edge traversal" bit also set will apply to the packet.

Figure 4 of that patent application appears to describe the process graphically, and the "Detailed Descriptions" section beginning on page 7 describes the process in painfully specific detail.

This basically permits a host-based firewall to have different rules for traffic that came in via a tunnel thru the local network's firewall, as opposed to traffic that was just sent unencapsulated by a tunnel directly through the local network's firewall.

I wonder if the iptables "mark" functionality would be prior art to this patent? It certainly seems like it does a very similiar thing, albeit in an even more generic fashion (since you can write user-land code to "mark" packets for virtually any reason if you want to ).