Firewalls: Stateful, Stateless and Next-Generation

A firewall controls network traffic according to rules. Depending on the technology, several generations are distinguished.

Stateless (packet filter)

Checks each packet individually against rules (IP, port, protocol). Fast and cheap, but without context: an allowed reply packet cannot be distinguished from an unwanted one.

Stateful

Remembers connection states (connection tracking). Reply packets to existing connections are automatically allowed. Standard in modern systems (iptables conntrack, pf, nftables).

Next-generation (NGFW)

Additionally deep packet inspection (DPI), application detection, IDS/IPS, TLS inspection. Detects SQL injection or malware in the data stream — also on port 443.

Best practices

• Default-deny: block everything, allow only what is needed.
• Keep rules minimal and documented.
• Management access only from trusted networks.

See also: Networking.