Packet Filtering Disadvantages

• Hard to configure

  • Rules can get complex

• Hard to test and verify rules

• Incomplete implementations

• Bugs often “fail unsafe” -- allow unintended traffic to pass