When I began my career in network security, almost a decade back, the industry standard was stateful firewalls that even had the ability to inspect some application layer protocols. I had only heard that a packet filtering firewall was the previous generation of firewalls. I never got to work with and understand how a strict packet filtering, stateless firewall works. Now, I want to understand it better. I had an intern ask me this and I want to show him the difference between the 2 firewalls. I believe iptables can be used to set up a stateless packet filtering firewall. The thing is I am not sure how a stateless firewall would track incoming responses that originate from the behind the firewall. I tried my best to find some resources online on how to implement such a firewall. Any pointers to some article would be very helpful.
For a stateless firewall, you can either accept or drop a packet based on its protocol, port number and origin ip address. For example, the rule below accepts all TCP packets from the 192.168.1.x subnet that are bound for port 80.
-A INPUT -p tcp -s 192.168.1.0/24 -m tcp --dport 80 -j ACCEPT
For output, the rules look similar. Therefore, outgoing(egress) packets are only accepted if there is a matching rule. The rule below allows only outgoing packets on port 80.
-A OUTPUT -o eth0 -p tcp --sport 80 -j ACCEPT
For a stateful firewall, you have the ability to monitor state. For example, the rule below only accepts packets to port 80 if it is initiating a new connection or is associated with an existing connection. The tracking is done by a kernel module "ip_conntrack". It keeps a table of all active connections.
-A INPUT -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
What about rule for the return traffic for egress packets? Dec 8, 2014 at 15:13
The first rule. Since it is stateless, it cannot differentiate return traffic from new traffic so it can only decide based on protocol, port number and origin ip address. Dec 8, 2014 at 15:17
1Suppose I go out to
www.google.comfrom the LAN. This would mean something like
192.168.1.100:5400 -> www.google.com:80. Now the return traffic would be
www.google.com:80 -> 192.168.1.100:5400. How did a stateless firewall handle this sort of return traffic? What rules did they have in place to tackle such traffic? Dec 8, 2014 at 17:55
2You would have to manually open port 513 to 65535 for it to happen. Have a look at serverfault.com/questions/253508/…. The first 2 answers use the ip_conntrack module to provide stateful capability. The last uses only stateless features. Dec 9, 2014 at 1:15
@user1720897 The stateless firewall inspect every packet and work with a set of rules. To allow access to google, it will need to allow outgoint SYN packet to port 80, to permit return traaffic, the incoming SYN-ACK need to be allowed. And ACK bidirectional traffic to the TCP connection to work. Blocking incoming SYN packet will block incoming TCP connections.– charlesFeb 2, 2022 at 1:07