Stateful vs. Stateless Firewalls

The distinction between stateful and stateless firewalls comes down to one thing: memory.

A stateless firewall examines each packet in isolation. It has no idea what happened five seconds ago. A stateful firewall remembers which connections you initiated and automatically recognizes response traffic. This difference sounds simple, but it changed network security fundamentally.

What Stateless Firewalls Do

A stateless firewall looks at each packet's headers—source IP, destination IP, ports, protocol—and compares them against its rules. Allow or deny. Then it forgets the packet ever existed.

This is computationally efficient. No memory to maintain, no state to track. Just rules applied to packets, one at a time.

Early firewalls worked this way. They were called packet filters, and they seemed like a reasonable approach until people discovered the problem.

The Problem: You Can't Secure What You Can't Remember

Here's the dilemma stateless firewalls create.

When you connect to a web server, your computer picks a high-numbered source port (say, 54321) and connects to port 80 on the server. The server sends responses back to your port 54321.

With a stateless firewall, you need rules for both directions. You allow outbound traffic to port 80 (your requests). But you also need to allow inbound traffic to high-numbered ports (the server's responses).

See the problem? You've just opened every high-numbered port on your network to inbound traffic. An attacker can connect to any of those ports, and your firewall has no way to know this isn't a legitimate response—because it has no memory of which connections you actually started.

Without memory, a firewall can't tell the difference between a reply you asked for and an attack you didn't.

The workaround was to use TCP flags. TCP connections start with a SYN packet and continue with ACK packets. Stateless firewalls could block inbound SYN packets (new connections) while allowing inbound ACK packets (responses to existing connections).

This helped, but attackers learned to craft packets with specific flag combinations to slip through. The fundamental problem remained: without tracking actual connections, the firewall was guessing.

How Stateful Firewalls Changed Everything

A stateful firewall remembers.

When you initiate an outbound connection, the firewall doesn't just allow the packet—it creates an entry in its state table. This entry records the source and destination addresses, the ports, the protocol, and the connection's current state.

Now when response packets arrive, the firewall checks its state table. It finds the matching entry and recognizes these packets as responses to your initiated connection. It allows them through without needing a separate rule.

This changes the security model completely. You no longer need to leave ports open for inbound traffic. The firewall permits responses to connections you started and blocks everything else.

The State Table: How Memory Works

The state table is the firewall's memory. Each entry represents one active connection.

For TCP connections, the entry tracks both endpoints, the current TCP state (establishing, established, closing), sequence numbers to prevent spoofing, and timing information for timeouts.

For UDP, which has no formal connection concept, the firewall tracks pseudo-connections based on address and port pairs, removing entries when no traffic has passed for a while.

The firewall maintains this table constantly—adding entries for new allowed connections, updating entries as connections progress, removing entries when connections close or time out.

This requires memory and processing power. A busy firewall might track millions of connections simultaneously, searching the state table for every packet. Modern firewalls use optimized data structures to perform these lookups in microseconds.

Connection States and Security

Tracking TCP's connection lifecycle has security implications beyond just allowing responses.

TCP connections follow a predictable sequence: SYN, SYN-ACK, ACK, data transfer, FIN exchange. The stateful firewall knows where each connection should be in this sequence.

If a packet claims to be part of an established connection but the firewall has no record of that connection being initiated, something is wrong. Either it's a spoofed packet from an attacker or a scan probing for open services. Either way, it gets dropped.

The firewall can also detect attacks like SYN floods, where attackers initiate thousands of connections without completing them, trying to exhaust server resources. A firewall tracking connection states recognizes this abnormal pattern.

Simpler Rules, Better Security

Stateless firewall rules require you to think about both directions explicitly. You need rules for outbound requests and separate rules for inbound responses, carefully crafted to avoid security holes.

Stateful firewalls simplify this dramatically. You specify what traffic you want to initiate. The firewall handles responses automatically.

A stateless rule set might need:

Allow TCP from internal network to Internet port 443
Allow TCP from Internet to internal network ports 1024-65535 (ACK flag set)

A stateful firewall needs only:

Allow TCP from internal network to Internet port 443

The second rule isn't needed—the firewall remembers the outbound connection and allows the response.

State Table Exhaustion

The state table is finite, which creates a potential attack vector. An attacker who initiates thousands of connections can fill the table until the firewall can't track new legitimate connections.

Firewalls defend against this with connection limits per source, aggressive timeouts for suspicious traffic, and pattern detection for exhaustion attempts. Enterprise firewalls have large state tables specifically to make these attacks impractical.

Where Stateless Filtering Still Makes Sense

Stateless filtering hasn't disappeared entirely.

At network edges handling massive traffic volumes, stateless access control lists can perform initial filtering at wire speed before traffic reaches stateful systems. Blocking obviously bad traffic early reduces load on the stateful firewall.

Routers often implement stateless ACLs as a basic security layer, even when dedicated firewalls provide stateful inspection downstream.

For extremely simple networks with minimal requirements, stateless filtering might provide adequate protection with less complexity.

But for most purposes, stateful inspection is simply the standard. The overhead is minimal on modern hardware, and the security benefits are too significant to forgo.