3

When I began my career in network security, almost a decade back, the industry standard was stateful firewalls that even had the ability to inspect some application layer protocols. I had only heard that a packet filtering firewall was the previous generation of firewalls. I never got to work with and understand how a strict packet filtering, stateless firewall works. Now, I want to understand it better. I had an intern ask me this and I want to show him the difference between the 2 firewalls. I believe iptables can be used to set up a stateless packet filtering firewall. The thing is I am not sure how a stateless firewall would track incoming responses that originate from the behind the firewall. I tried my best to find some resources online on how to implement such a firewall. Any pointers to some article would be very helpful.

Improve this question

1 Answer 1

Reset to default
5

For a stateless firewall, you can either accept or drop a packet based on its protocol, port number and origin ip address. For example, the rule below accepts all TCP packets from the 192.168.1.x subnet that are bound for port 80.

-A INPUT -p tcp -s 192.168.1.0/24 -m tcp --dport 80 -j ACCEPT

For output, the rules look similar. Therefore, outgoing(egress) packets are only accepted if there is a matching rule. The rule below allows only outgoing packets on port 80.

-A OUTPUT -o eth0 -p tcp --sport 80 -j ACCEPT

For a stateful firewall, you have the ability to monitor state. For example, the rule below only accepts packets to port 80 if it is initiating a new connection or is associated with an existing connection. The tracking is done by a kernel module "ip_conntrack". It keeps a table of all active connections.

-A INPUT -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
Improve this answer
5
  • What about rule for the return traffic for egress packets?
    – user1720897
    Dec 8, 2014 at 15:13
  • The first rule. Since it is stateless, it cannot differentiate return traffic from new traffic so it can only decide based on protocol, port number and origin ip address.
    – limbenjamin
    Dec 8, 2014 at 15:17
  • 1
    Suppose I go out to www.google.com from the LAN. This would mean something like 192.168.1.100:5400 -> www.google.com:80. Now the return traffic would be www.google.com:80 -> 192.168.1.100:5400. How did a stateless firewall handle this sort of return traffic? What rules did they have in place to tackle such traffic?
    – user1720897
    Dec 8, 2014 at 17:55
  • 2
    You would have to manually open port 513 to 65535 for it to happen. Have a look at serverfault.com/questions/253508/…. The first 2 answers use the ip_conntrack module to provide stateful capability. The last uses only stateless features.
    – limbenjamin
    Dec 9, 2014 at 1:15
  • @user1720897 The stateless firewall inspect every packet and work with a set of rules. To allow access to google, it will need to allow outgoint SYN packet to port 80, to permit return traaffic, the incoming SYN-ACK need to be allowed. And ACK bidirectional traffic to the TCP connection to work. Blocking incoming SYN packet will block incoming TCP connections.
    – charles
    Feb 2, 2022 at 1:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.