Routing versus forwarding

A clearly defined policy has to be written as to whether the firewall will act as a router or a forwarder of Internet packets. This is trivial in the case of a router that acts as a packet-filtering gateway: The firewall (router in this case) has no option but to route packets. Applications gateway firewalls should generally not be configured to route any traffic between the external interface and the internal network interface, because this could bypass security controls. All external-to-internal connections should go through the application proxies.

Source routing

Source routing is a routing mechanism whereby the path to a target machine is determined by the source, rather than by intermediate routers. Source routing is mostly used for debugging network problems but could also be used to attack a host. If an attacker has knowledge of some trust relationship between your hosts, source routing can be used to make it appear that the malicious packets are coming from a trusted host. Therefore, because of this security threat, a packet-filtering router can easily be configured to reject packets containing a source route option. Thus, a site administrator who wants to avoid the problem of source routing entirely would write a policy.