When I began my career in network security, almost a decade back, the industry standard was stateful firewalls that even had the ability to inspect some application layer protocols. I had only heard that a packet filtering firewall was the previous generation of firewalls. I never got to work with and understand how a strict packet filtering, stateless firewall works. Now, I want to understand it better. I had an intern ask me this and I want to show him the difference between the 2 firewalls. I believe iptables can be used to set up a stateless packet filtering firewall. The thing is I am not sure how a stateless firewall would track incoming responses that originate from the behind the firewall. I tried my best to find some resources online on how to implement such a firewall. Any pointers to some article would be very helpful.


For a stateless firewall, you can either accept or drop a packet based on its protocol, port number and origin ip address. For example, the rule below accepts all TCP packets from the 192.168.1.x subnet that are bound for port 80.

-A INPUT -p tcp -s -m tcp --dport 80 -j ACCEPT

For output, the rules look similar. Therefore, outgoing(egress) packets are only accepted if there is a matching rule. The rule below allows only outgoing packets on port 80.

-A OUTPUT -o eth0 -p tcp --sport 80 -j ACCEPT

For a stateful firewall, you have the ability to monitor state. For example, the rule below only accepts packets to port 80 if it is initiating a new connection or is associated with an existing connection. The tracking is done by a kernel module "ip_conntrack". It keeps a table of all active connections.

-A INPUT -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
  • What about rule for the return traffic for egress packets? Dec 8 '14 at 15:13
  • The first rule. Since it is stateless, it cannot differentiate return traffic from new traffic so it can only decide based on protocol, port number and origin ip address. Dec 8 '14 at 15:17
  • 1
    Suppose I go out to www.google.com from the LAN. This would mean something like -> www.google.com:80. Now the return traffic would be www.google.com:80 -> How did a stateless firewall handle this sort of return traffic? What rules did they have in place to tackle such traffic? Dec 8 '14 at 17:55
  • 2
    You would have to manually open port 513 to 65535 for it to happen. Have a look at serverfault.com/questions/253508/…. The first 2 answers use the ip_conntrack module to provide stateful capability. The last uses only stateless features. Dec 9 '14 at 1:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.