What is a firewall, and what is the difference between a stateless and stateful firewall?

Question

Accepted Answer

A firewall is a network security device that monitors and controls incoming and outgoing network traffic based on predetermined security rules. It acts as a barrier between a trusted internal network and untrusted external networks like the internet, allowing legitimate traffic to pass while blocking malicious or unauthorized traffic.

A stateless firewall (also called a packet filter) examines each packet individually and makes forwarding decisions based solely on information in the packet header: source and destination IP addresses, source and destination ports, and protocol type. It does not track the state of connections. For example, if you allow outbound HTTP traffic on port 80, you must also create a separate rule allowing inbound traffic from port 80, because the firewall does not know the inbound traffic is a response to your outbound request. Stateless firewalls are fast and simple but provide limited security because they cannot distinguish between a legitimate response and an unsolicited inbound connection.

A stateful firewall tracks the state of active connections in a state table (also called a connection table or session table). When an internal host initiates a connection to an external server, the firewall records the connection details (source IP, destination IP, ports, protocol, sequence numbers). Return traffic matching an existing connection entry is automatically allowed without needing a separate rule. This is more secure because it ensures that only traffic that is part of an established, legitimate connection is permitted through the firewall.

Modern stateful firewalls examine traffic up through Layer 7 and are often called Next-Generation Firewalls (NGFWs). They include features like deep packet inspection (examining the payload, not just headers), application awareness (identifying applications regardless of port), intrusion prevention (detecting and blocking known attack patterns), URL filtering, and malware scanning. Examples include Palo Alto Networks, Fortinet FortiGate, and Cisco Firepower.

Firewalls use rules organized in an ordered list (also called an access control policy). Rules are evaluated from top to bottom, and the first matching rule is applied. Most firewalls end with an implicit deny rule that blocks any traffic not explicitly permitted. Best practice is to follow the principle of least privilege: deny everything by default and only allow specifically needed traffic.

Firewall placement is important. A perimeter firewall sits between the internal network and the internet. Internal firewalls can segment sensitive areas like server rooms or databases from general user traffic. A DMZ (Demilitarized Zone) is a network segment between two firewalls that hosts public-facing services like web servers, allowing internet access to those services while protecting the internal network.