In the case of a firewall device seperate from a server host, I believe there is a clear benefit to using a stateful firewall.
But in the case of a host firewall, where the services in scope are well defined, what specific scenarios would be prevented by a stateful firewall that would not be blocked by a stateless firewall?
Consider a policy for a web and ssh server, connecting to a database...
- allow any source IP/port to local IP address on ports 80 and 22 (local as server)
- allow ports 80 and 22 on local IP to any destination IP/port (local as server)
- allow local IP/port to mydbserver.example.com, port 3306 (local as client)
- allow mydbserver.example.com, port 3306 to any local IP/port (local as client)
A stateless firewall configured as a above, could in theory be subverted. A spammer might bind a mailgun client to port 80 on a local IP and fire SMTP traffic out across the firewall. However the privilege required to achieve this would, in all cases I've come across, also give him the rights to change a stateful firewall config on the host. Hence for this threat mode, there is no advantage.