Well I cannot say i have understood the question completely, even then i can share a few things that i know.I am talking about network firewalls which primarily looks at layer3 (Internet layer) and layer 4(transport layer) of the OSI stack.
All stateful firewalls maintain a table called session table.
So stateful firewalls are called stateful firewalls because of the presence of a session table.A basic session table will have 4 entries Source-ip of the packet,destination IP of the packet,Source port and destination port.The kind of firewall that i have worked on had 2 more entries, incoming and outgoing interface of the packet.
Ok,now we ll see how a connection is formed.
We ll take the case of a tcp connection on port 80 (http).To be more specific, a client sitting behind a firewall is trying to connect to google.com.The first packet coming out of the client will be a tcp SYN.This reaches the firewall.The firewall, being a network firewall would look at the destination IP and then will do a route lookup for google's IP.We are looking at the firewalling part so we assume that there is a routing table entry.From the routing table, the firewall gets the outgoing interface.
Now a typical network firewall will have several network interfaces and each interface would be mapped to a "zone".Firewalling involves the governance of traffic between the interfaces by using a set of rules.
So after getting the outgoing interface from the routing table,the firewall looks at the zone of the outgoing interface.Then the firewall looks for a policy (rule) from the incoming interface's zone to the outgoing interface's zone.If there is a policy which permits traffic between the 2 zones, the firewall sends the packet out of the outgoing interface and,then creates an entry in the session table.Note that this is the first packet of a connection.Now when the reply packet comes from the server back to the client, it doesnt have to go through the rule look up process because an entry is already present in the session table.Now, the source port of the reply packet would be 80 and the destination port would be the source port that was used by the client for the tcp syn.By matching the ports and IPs, the firewall decides if the incoming packet is a reply or not and then sends it out of the correct interface.
Suppose the server sends a packet which is not a reply to the client, the session lookup would fail and the firewall would look for a rule permitting traffic from the server's side to the client's side.If that rule is not present, the packet will be dropped.
Note that the this rule check is not done for a reply packet coming from the server because a session was already created by the initial request packet from the clients side..Hopefully this answers your question.. Please do feel free to ask if this answer is not clear