Stateful vs Stateless Firewalls
The most fundamental distinction in firewall design is whether the firewall tracks connection state. A stateless firewall (packet filter) evaluates each packet in isolation against a list of ACL rules — checking source IP, destination IP, protocol, and port — with no memory of previous packets. A rule either matches and allows/blocks the packet, or does not match and the default action applies. Stateless filters are fast and simple but require explicit rules in both directions for each allowed flow.
A stateful firewall maintains a connection tracking table. When an outbound TCP SYN leaves the network, the firewall records the 5-tuple (source IP, source port, destination IP, destination port, protocol) and marks the connection as "established" when the SYN-ACK returns. Return traffic matching an established connection entry is automatically allowed without a separate inbound rule. This is why you can browse the web without writing an inbound rule for every website — the firewall knows the inbound packets are replies to connections you initiated. Stateful inspection is the standard for every home router and most business firewalls.
Firewall types and capabilities
| Type | What It Inspects | Common Use |
|---|---|---|
| Stateless packet filter | IP, port, protocol (per packet) | Router ACLs, simple edge filtering |
| Stateful firewall | Connection state + IP/port | Home routers, traditional enterprise edge |
| Application-layer firewall (WAF) | HTTP/HTTPS content, SQL, XSS | Web application protection |
| Next-generation firewall (NGFW) | App identity, user, DPI, IDS/IPS signatures | Enterprise perimeter, managed security |
| Host-based firewall | Per-process rules on a single device | Windows Defender Firewall, iptables/nftables |
Next-generation firewall (NGFW) features
A next-generation firewall extends stateful inspection with capabilities that traditional firewalls lack:
- Deep Packet Inspection (DPI): reads payload content to identify the actual application, not just the port number. Port 443 carries HTTPS, but DPI can distinguish Netflix from Dropbox from SSH tunnelled over 443.
- Application awareness: policies are written per application ("allow Zoom, block BitTorrent") rather than per port, which is unworkable when applications use dynamic or well-known ports.
- Integrated IDS/IPS: signature-based detection of known attack patterns (SQL injection, exploit payloads, malware C2 traffic) in the packet stream, with the option to block matching flows.
- User identity integration: rules tied to authenticated users (via Active Directory or LDAP) rather than only IP addresses — useful when DHCP assigns different IPs to different users at different times.
- TLS inspection: NGFW can decrypt, inspect, and re-encrypt TLS traffic to apply DPI and IPS to HTTPS sessions, though this requires a trusted CA certificate on client devices.
Firewall zones: LAN, WAN, DMZ
Enterprise and prosumer firewalls organise interfaces into security zones with different trust levels. The LAN zone contains trusted internal devices. The WAN zone is the untrusted internet-facing interface. The DMZ (Demilitarised Zone) is a semi-trusted zone for servers that must be reachable from the internet — web servers, mail relays, VPN concentrators — but should not have unrestricted access to the LAN. Traffic from the WAN to the DMZ is allowed on specific ports; traffic from the DMZ to the LAN is blocked by default, limiting the blast radius if a DMZ server is compromised.
Firewall rules ordering: first-match wins
Most firewalls evaluate rules in order from top to bottom and stop at the first matching rule. This makes rule order critical. A broad "deny all" rule at the top of the list would block everything, while the same rule at the bottom acts as a catch-all default deny. The standard approach is: specific allow rules first (permit known good traffic), then specific deny rules for known bad traffic, then a final implicit or explicit deny-all for anything unmatched. When troubleshooting why traffic is blocked, always check whether a higher-priority rule is matching before your intended allow rule reaches evaluation.
NAT and firewall relationship
NAT and firewalling coexist in home routers but are distinct functions. NAT translates private RFC 1918 addresses to the single public IP for outbound traffic and maintains a translation table to map return packets back to the correct LAN device. This incidentally blocks most unsolicited inbound connections because no translation entry exists for them — the router has nowhere to forward the packet. However, this is a side effect of address translation, not a security policy. A stateful firewall on the same device applies explicit allow/deny logic independently of NAT. With IPv6, where devices may have globally routable addresses, NAT is absent — only the stateful firewall blocks unsolicited inbound traffic.
Firewall logging and what to look for
Firewall logs record every allowed and denied connection: timestamp, source IP and port, destination IP and port, protocol, rule matched, and action taken. Useful patterns to watch for: repeated deny hits from external IPs on port 22 (SSH brute-force scanning), outbound connections to unusual foreign IPs on high ports (potential malware C2), and LAN devices initiating connections to ports they should not use. Many home routers provide minimal logging; pfSense, OPNsense, and enterprise firewalls offer detailed per-rule logging with export to a syslog server.
Inbound vs Outbound Rules
Inbound rules control unsolicited traffic entering your network. Outbound rules control traffic leaving. Home routers typically allow all outbound traffic by default. Businesses add outbound rules to block malware callbacks, enforce approved services only, prevent data exfiltration, and stop lateral movement from compromised hosts. A port forward is an intentional inbound exception for a specific port directed to a specific internal host — useful for hosting a server, game server, or remote access, but each forward increases exposure and should be removed when no longer needed.
Frequently Asked Questions
What does a firewall do?
It enforces network traffic policy — allowing expected, authorised traffic while blocking unsolicited or unauthorised connections. Stateful firewalls track connection state so return traffic for established sessions is automatically permitted without explicit inbound rules.
Is my router a firewall?
Yes — most home routers include a stateful firewall that blocks inbound connections by default. NAT provides additional implicit blocking as a side effect, but the stateful firewall is the deliberate security component.
Can a firewall slow internet speed?
Basic stateful firewalling rarely slows a modern router under normal load. Deep packet inspection, TLS decryption, IPS signature scanning, VPN processing, or heavy logging can reduce throughput on underpowered hardware.