What this basically means is that the circuit-level gateway need not understand the application protocol in use. This differentiates a circuit-level gateway from an application-level gateway or proxy server that is able to understand the application protocol employed by the two endpoints of the connection. As such, it does not interfere with the data stream. Īfter having successfully established the second TCP connection, the circuit-level gateway simply relays application data forth and back. It establishes a second TCP connection to the server on the client s behalf.

It authenticates and possibly authorizes the client (or the user behind the client). It receives the TCP connection establishment request that is sent out by the client (because the client is configured to make use of the circuit-level gateway).

More specifically, a circuit-level gateway does the following three things when a client wants to establish a TCP connection to a server: In essence, a circuit-level gateway is a proxy server for TCP (i.e., it is typically located and running on the firewall of a corporate intranet and it relays TCP connections). This is equally true for circuit-level gateways. The idea of an application gateway is fundamentally different from a packet filter (i.e., a static or dynamic packet filter).

Circuit level proxy firewall