Home/Learn/Computer Networks/Firewalls & Packet Filtering

Firewalls & Packet Filtering

Intermediate

Security

A firewall controls network traffic by inspecting packets and applying rules to allow or deny flows — operating at Layer 3/4 (packet filtering) or Layer 7 (application-aware deep packet inspection).

Overview

Firewalls are the first line of defence in any network. A stateless packet filter checks each packet independently against rules based on IP, port, and protocol. A stateful firewall tracks connection state — only allowing return traffic for established sessions. A next-generation firewall (NGFW) adds deep packet inspection (DPI), application awareness, and intrusion prevention. In cloud environments, Security Groups (AWS) act as stateful firewalls at the instance level, while Network ACLs are stateless. Understanding firewalls is essential for designing secure deployments and answering architecture interviews.

Stateless vs Stateful Firewalls

A stateless firewall evaluates each packet in isolation using a rule table (ACL). It is fast but cannot distinguish legitimate return traffic from an unsolicited inbound packet. A stateful firewall maintains a connection tracking table — it automatically allows return packets for established connections without needing an explicit inbound rule.

Stateless vs stateful firewall comparison

// Stateless firewall — each packet checked independently
// Rule table (evaluated top-to-bottom, first match wins):
// ┌───────┬──────────┬───────────┬──────┬──────────┬────────┐
// │ Rule  │ Src IP   │ Dst IP    │ Port │ Protocol │ Action │
// ├───────┼──────────┼───────────┼──────┼──────────┼────────┤
// │ 100   │ any      │ 10.0.0.5  │ 443  │ TCP      │ ALLOW  │
// │ 200   │ any      │ 10.0.0.5  │ 80   │ TCP      │ ALLOW  │
// │ 300   │ 10.0.0.0 │ any       │ any  │ any      │ ALLOW  │
// │ 32767 │ any      │ any       │ any  │ any      │ DENY   │
// └───────┴──────────┴───────────┴──────┴──────────┴────────┘
// Problem: return traffic (src port 443 → dst port 54321) also needs a rule

// Stateful firewall — connection tracking table:
// Outbound packet: 10.0.0.10:54321 → 93.184.216.34:443 TCP SYN
// ↳ Firewall creates entry: src=10.0.0.10:54321, dst=93.184.216.34:443, state=SYN_SENT
// Return packet: 93.184.216.34:443 → 10.0.0.10:54321 TCP SYN-ACK
// ↳ Firewall finds entry, state=ESTABLISHED → ALLOW automatically

AWS Security Groups & Network ACLs

AWS Security Groups are stateful firewalls at the instance level — if you allow inbound port 443, return traffic is automatically allowed. NACLs (Network ACLs) are stateless and operate at the subnet level — you must explicitly allow both inbound and outbound directions.

AWS Security Group vs NACL configuration

// AWS Security Group — stateful, instance level
// Inbound rules:
resource "aws_security_group_rule" "allow_https_in" {
  type        = "ingress"
  from_port   = 443
  to_port     = 443
  protocol    = "tcp"
  cidr_blocks = ["0.0.0.0/0"]
  // Return traffic automatically allowed (stateful)
}

// AWS NACL — stateless, subnet level
// Must allow BOTH directions:
resource "aws_network_acl_rule" "allow_https_inbound" {
  rule_number = 100
  protocol    = "tcp"
  rule_action = "allow"
  cidr_block  = "0.0.0.0/0"
  from_port   = 443
  to_port     = 443
}
resource "aws_network_acl_rule" "allow_ephemeral_outbound" {
  // Must also allow outbound ephemeral ports 1024-65535 for return traffic
  rule_number = 200
  rule_action = "allow"
  from_port   = 1024
  to_port     = 65535
}

Deep Packet Inspection & WAF

A Web Application Firewall (WAF) operates at Layer 7 — it can inspect HTTP request content, detect SQL injection patterns, block XSS payloads, rate-limit by IP, and enforce geo-blocking. WAFs like AWS WAF, Cloudflare WAF, or ModSecurity sit in front of web applications and are a key component of defence-in-depth.

WAF rules for SQLi protection and rate limiting

// WAF — Layer 7 inspection example (AWS WAF managed rules)
// Protects against: SQLi, XSS, Log4j, known bad IPs, rate limiting

// AWS WAF rule — block SQL injection:
{
  "Name": "SQLiRule",
  "Priority": 1,
  "Statement": {
    "ManagedRuleGroupStatement": {
      "VendorName": "AWS",
      "Name": "AWSManagedRulesSQLiRuleSet"
    }
  },
  "Action": { "Block": {} }
}

// Rate limiting rule — max 1000 req/5min per IP:
{
  "Name": "RateLimitRule",
  "Statement": {
    "RateBasedStatement": {
      "Limit": 1000,
      "AggregateKeyType": "IP"
    }
  },
  "Action": { "Block": {} }
}

Key Points to Remember

1Stateless firewalls inspect each packet independently; stateful firewalls track connection state and auto-allow return traffic.
2AWS Security Groups are stateful (instance level); NACLs are stateless (subnet level) — NACLs require explicit rules for both directions.
3A WAF operates at Layer 7 — it can block SQLi, XSS, enforce rate limits, and apply geo-restrictions on HTTP traffic.
4Default-deny posture: block all traffic and explicitly allow only what is needed — never default-allow.
5Firewall rules are evaluated in order; the first matching rule wins. Order matters significantly for ACLs.

Interview Questions

What is the difference between a stateful and stateless firewall?

EasyTCS

What is the difference between AWS Security Groups and Network ACLs?

MediumAmazon

Where does a WAF sit in the network stack and what attacks does it prevent?

MediumThoughtWorks

Why do NACLs require explicit rules for return traffic but Security Groups do not?

MediumInfosys

What is deep packet inspection and when is it used?

HardEqual Experts

Ask Aria about Firewalls & Packet Filtering

Your personal AI tutor — ask anything about this concept

Revision Status

Personal Notes

Discussion

Loading discussion…

Certificates & PKI

VPN Deep-Dive