如果到您的计算机的所有传入连接都被阻止，那么您如何仍能接收数据和/或保持活动连接？今天的超级用户问答帖子回答了一个困惑读者的问题。

今天的问答环节是由SuperUser提供的，SuperUser是Stack Exchange的一个分支，是一个由社区驱动的问答网站分组。

Linux屏幕截图（Flickr）提供的屏幕截图。

问题

超级用户读者Kunal Chopra想知道，如果所有传入连接都被阻止，他的计算机如何仍然可以接收数据：

If your ISP or firewall is blocking all incoming connecti***, how can web servers still send data to your browser? You send the request (outgoing) and the server sends data (incoming). If you block all incoming connecti***, how can the web server respond?

What about video streaming and multi-player games where UDP comes into use? UDP is connectionless, so there is no connection to be established, so how does the firewall or ISP handle that?

如果所有传入的连接都被阻止了，数据怎么还能到达库纳尔的电脑？

答案

超级用户贡献者gowenfawr为我们提供了答案：

“Incoming block” means that incoming new connecti*** are blocked, but established traffic is allowed. So if outbound new connecti*** are allowed, then the incoming half of that exchange is okay.

The firewall manages this by tracking the state of connecti*** (such a firewall is often called a Stateful Firewall). It sees the outgoing TCP/SYN and allows it. It sees an incoming SYN/ACK, verifies that it matches the outbound SYN it saw, lets that through, and so on. If it permits a three-way handshake (i.e. it is allowed by the firewall rules), it will allow that exchange. And when it sees the end of that exchange (FINs or RST), it will take that connection off the list of allowed packets.

UDP is done similarly, although it involves the firewall remembering enough to pretend that UDP has a connection or session (which UDP does not).

有什么要补充的解释吗？在评论中发出声音。想从其他精通技术的Stack Exchange用户那里了解更多答案吗？在这里查看完整的讨论主题。