CyberGlossary

Network Security

Stateful Firewall

Also known as: Stateful inspection firewall

Definition

A firewall that tracks the state of active connections in a connection table and allows return traffic that matches an established session.

A stateful firewall maintains a connection table that records each flow's 5-tuple (source IP, destination IP, source port, destination port, protocol) along with TCP flags or UDP/ICMP pseudo-state. Once a session is allowed outbound, return packets that match the entry are admitted automatically without needing an explicit inverse rule. This greatly simplifies rulebases and stops many spoofed packets that would slip past stateless filters, but it adds memory and CPU cost and can be exhausted by SYN-flood or session-table attacks. Stateful inspection is the baseline of every modern enterprise firewall and forms the foundation for NGFW features such as application identification.

Examples

  • A Linux iptables ruleset using conntrack to permit ESTABLISHED,RELATED return traffic.
  • A Cisco ASA tracking outbound HTTP flows so responses are allowed back automatically.

Related terms