What is a firewall and how does it protect a network? Can you explain the difference between stateful and stateless firewalls?

Question

Accepted Answer

A firewall is a network security device or software that monitors and controls incoming and outgoing network traffic based on predetermined security rules. It acts as a barrier between a trusted internal network and untrusted external networks, such as the internet. Firewalls examine data packets and decide whether to allow or block them based on configured policies.

Firewalls protect networks in several ways. They filter traffic to block unauthorized access attempts while allowing legitimate communications. They can prevent malware from reaching internal systems by blocking connections to known malicious addresses. They enforce network policies by controlling which applications and services can communicate across network boundaries. They also provide logging and monitoring capabilities that help security teams detect suspicious activity.

A stateless firewall, also known as a packet filter, examines each packet in isolation without considering the context of previous packets. It makes decisions based solely on information in the packet header, such as source and destination IP addresses, port numbers, and protocol type. For example, a rule might allow all incoming traffic on port 443 from any source. Stateless firewalls are fast and efficient because they do not maintain connection state, but they cannot distinguish between legitimate responses and unsolicited traffic.

A stateful firewall tracks the state of active connections and makes decisions based on the context of traffic flow. When an internal user initiates a connection to an external server, the firewall records this in its state table. When response packets arrive, the firewall checks whether they belong to an established connection and allows them through. Unsolicited packets that do not match any known connection are blocked. This approach provides better security because it can differentiate between legitimate return traffic and potential attacks.

In modern networks, stateful firewalls are the standard because they offer superior protection. However, many organizations deploy next-generation firewalls that go beyond connection tracking to include deep packet inspection, application awareness, and integration with threat intelligence feeds.