Bridge WAF
What is a stateful firewall?
A stateful firewall is a network firewall that keeps a record of each connection passing through it and judges every packet against that record, not in isolation. A packet is allowed when it belongs to a connection the firewall has already seen and approved. Otherwise it is checked against the rules or dropped.
The term sits in the waf glossary: the words behind the rules, next to the neighbouring ideas it is easy to confuse it with.
How it works
The firewall holds a table of active connections. Each entry stores the two addresses, the two ports, the protocol, and where the conversation currently stands, for example whether the TCP handshake has been completed. Every arriving packet is matched against this connection table first.
When a client inside the network opens a connection outwards, the firewall records it, and the replies are let back in without a separate rule for each one. A reply that nobody asked for has no entry to match, so it is refused.
A stateless filter works differently from a stateful firewall. It decides each packet on its own header alone, with no memory of what came before. That makes stateless rules simple and fast, but they cannot tell a genuine reply from an unsolicited packet made to look like one.
Because the table is about connections, the work happens at layers 3 and 4: addresses, ports and the state of the transport connection.
Three packets, three outcomes
The connection table decides what a stateful firewall does with each packet.
| Packet arrives | Connection table lookup | Result |
|---|---|---|
| Reply to a connection that a client inside the network started | Entry found, state fits | The stateful firewall allows the packet without a rule of its own |
| Unsolicited packet posing as a reply | No entry | The stateful firewall refuses the packet |
| First packet of a new inbound connection | No entry yet | The packet is checked against the rules, and an entry is created only if they allow it |
Why it matters
Remembering state lets a firewall be strict without being clumsy. It can refuse anything that does not belong to a known conversation, while legitimate traffic passes under a short rule set. It also gives the firewall a view of connection behaviour, so attacks that abuse connection setup, such as a SYN flood, show up in its table.
The same table is a limit. It has finite room, and a flood of half-opened connections can fill it. That is the weakness such attacks aim at.
The bigger limit is what the firewall reads. It knows who is talking to whom and whether the connection is legitimate, but not what is being asked. A well-formed request over an approved connection passes whatever the request contains, because meaning exists only at layer 7. Judging the content of HTTP requests is the job of a web application firewall. The two complement each other and do not replace each other. How they divide the work is set out on WAF vs firewall.
Related terms
- Connection table
- The firewall's record of active connections and their state.
- Stateless filter
- A rule set that judges each packet by its header alone.
- Half-open connection
- A connection whose handshake has started but not finished.
- Layer 7
- The level where the content of a request becomes visible.