A stateful firewall is a type of firewall that is used to maintain the state of network connections passing through it and make decisions about whether to allow or block them based on a set of predefined rules.
These Predefined rules are customisable as per your requirements with implicit “deny all” for rest traffic which isn’t specified in rules.
Stateful Firewall Examples
Below are the some examples how stateful firewall works:
Example 1: Packet Inspection Through Stateful Firewall
- A client device initiates a connection to a server by sending a request packet.
- The stateful firewall receives the request packet and checks its rules to determine whether the connection is allowed.
- If the connection is allowed, the firewall establishes a state for the connection and allows the request packet to pass through.
- The server responds to the request, and the response packet is sent back to the client.
- The stateful firewall receives the response packet and checks its state table to confirm that a connection has been established.
- If a connection has been established, the firewall allows the response packet to pass through.
- The client and server continue to communicate, and the stateful firewall tracks the state of the connection and continues to allow packets to pass through as long as the connection remains active.
- When the connection is terminated, the stateful firewall removes the state from its state table and no longer allows packets related to that connection to pass through.
Example 2: File Downloading Through Stateful Firewall
- A client device, such as a desktop computer, initiates a connection to a server by sending a request packet to access a file stored on the server.
- The stateful firewall, which is located between the client and the server, receives the request packet and checks its rules to determine whether the connection is allowed. Let’s say the firewall has a rule that allows all FTP traffic.
- Since the request is for FTP traffic, the firewall establishes a state for the connection and allows the request packet to pass through.
- The server, which is running an FTP server, responds to the request by sending a response packet acknowledging the request.
- The stateful firewall receives the response packet and checks its state table to confirm that a connection has been established. Since a connection was established in step 3, the firewall allows the response packet to pass through.
- The client and server continue to communicate, with the client sending requests to download files and the server sending responses with the requested files. The stateful firewall tracks the state of the connection and continues to allow packets to pass through as long as the connection remains active.
- When the client finishes downloading the files or the connection is otherwise terminated, the stateful firewall removes the state from its state table and no longer allows packets related to that connection to pass through.