Firewall question for all you network guys

[FiberOptik]

I use a linux based floppy firewall to keep all my computers somewhat safe from the dangers of the internet. While I try to get as much info as possible on the workings of today's firewalls one detail still eludes me. How is it that even though I am behing a firewall that stealths all ports users on Kazaa/WinMX can still download from me? Maybe there is a rule in my firewall that allows UDP traffic through but not TCP? I was trying to explain to one of my friends why people could still connect to him behind his firewall when I myself realized that I don't know the answer! Anyone here know how it is possible for someone to connect to your PC behind your firewall?

 

[cmetz]

The FastTrack (Kazaa) and probably other protocols have a request that they can send over the already established control connection that says "request to send <x> to <IP addressort>" - and your client will open up the TCP connection to the other end. This is why you almost always have to have one of the peers in a "p2p" network have a public IP address or at least have incoming ports mapped in.

 

[Saltin]

That's the difference between a solicited and un-solicited connection.

Some firewalls can be configured to allow a solicited connection to pass.