methods of screening incoming packets are provided . a first firewall detects a tunnel formation . a second firewall maintains a list of open firewall sessions . each tunnel has one or more associated firewall sessions . the first firewall detects variable situations , such as when the tunnel is torn down , and notifies the second firewall so that , for example , the second firewall call act to clear an associated firewall session from the firewall session list . incoming packets that are associated with firewall sessions that have been cleared from the firewall session list may not be passed through the second firewall .