Like the border router, firewalls use ACLs to determine what to do with each packet that arrives. A major difference, however, is that firewalls are designed to act as filters and only permit packets that meet specific conditions to pass. Thus, unlike border routers, the final rule in a firewall ACL usually specifies that any packet not allowed entry by a previous rule should be dropped. Note, however, that firewalls do not block all traffic, but only filter it. That is why all the firewalls in Figure 7-4 have holes in them-to show that certain kinds of traffic can pass through.