A manager must configure the packet filter to specify the set of packets that can pass
a packet filter is configured by specifying packets that are allowed rather than specifying packets that are denied
As Figure 2 illustrates, a packet filter can be embedded in a router