When I began my career in network security, almost a decade back, the industry standard was stateful firewalls that even had the ability to inspect some application layer protocols. I had only heard that a packet filtering firewall was the previous generation of firewalls. I never got to work with and understand how a strict packet filtering, stateless firewall works. Now, I want to understand it better. I had an intern ask me this and I want to show him the difference between the 2 firewalls. I believe iptables can be used to set up a stateless packet filtering firewall. The thing is I am not sure how a stateless firewall would track incoming responses that originate from the behind the firewall. I tried my best to find some resources online on how to implement such a firewall. Any pointers to some article would be very helpful.
For a stateless firewall, you can either accept or drop a packet based on its protocol, port number and origin ip address. For example, the rule below accepts all TCP packets from the 192.168.1.x subnet that are bound for port 80.
-A INPUT -p tcp -s 192.168.1.0/24 -m tcp --dport 80 -j ACCEPT
For output, the rules look similar. Therefore, outgoing(egress) packets are only accepted if there is a matching rule. The rule below allows only outgoing packets on port 80.
-A OUTPUT -o eth0 -p tcp --sport 80 -j ACCEPT
For a stateful firewall, you have the ability to monitor state. For example, the rule below only accepts packets to port 80 if it is initiating a new connection or is associated with an existing connection. The tracking is done by a kernel module "ip_conntrack". It keeps a table of all active connections.
-A INPUT -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT