What is the difference between a stateful and a stateless firewall?
Show the answer
Say this first
A stateless filter, like a router ACL, judges every packet on its own against the rules, so I must write rules for both directions, including the return traffic. A stateful firewall keeps a connection table: when an allowed flow starts, it records the session (addresses, ports, protocol, TCP state) and automatically allows the replies that belong to it, while unsolicited packets from outside are dropped. Stateful goes at trust boundaries. Stateless ACLs are cheap and fast, good for infrastructure protection and edge cleanup.
Go deeper
Stateless return traffic is clumsy
ip access-list extended INTERNET-IN
10 permit tcp any 10.1.0.0 0.0.255.255 established
20 permit udp any eq domain 10.1.0.0 0.0.255.255established only checks for the ACK or RST flag in each packet, so a crafted ACK passes. Line 20 has
to open every UDP port on every inside host to anything sourced from port 53. A stateful firewall
instead allows only the reply to the exact DNS query that went out.
What a stateful firewall tracks and checks
- The 5-tuple, state and idle timer for each session. TCP sessions also get sanity checks: a session must start with a SYN, and segments must fit the expected sequence window.
- Application inspection for protocols that open extra connections (FTP data channels, SIP media): the firewall reads the control channel and opens only the needed pinhole.
- Idle timeouts, typically long for TCP and short for UDP and ICMP. Values are vendor specific.
Same split in the cloud
AWS security groups are stateful, AWS network ACLs are stateless, and the classic interview follow-up is that a NACL needs an outbound rule for the ephemeral return ports.
They will ask next
Is NAT a security feature?
PAT keeps a translation table, so unsolicited inbound packets have nothing to match and are dropped, which looks like a firewall. It is a side effect, not a policy. It does not inspect, log or enforce anything about the traffic that is allowed.
What attacks target the state table itself?
SYN floods and connection floods fill it so new legitimate sessions cannot be created. Firewalls defend with embryonic connection limits, SYN cookies or SYN proxy, and per-source session limits.
Traps
- Saying the
establishedkeyword makes an ACL stateful. It only looks at flags in each packet.