What is it?
A firewall controls traffic between zones based on policy. A stateless firewall (like a basic ACL) evaluates every packet independently against rules. A stateful firewall tracks the state of each connection (in a state table) so that return traffic for an already-permitted session is automatically allowed, without needing a separate rule.
Why should I learn it?
Almost every enterprise firewall in production today is stateful. Understanding the state table is the difference between writing correct rules and writing rules that accidentally block return traffic.
How it works
Outbound packet matches an “allow” rule → firewall creates a state table entry (source/destination IP, port, protocol) → the matching return traffic is automatically permitted because it matches that state entry → the entry expires after the session ends or times out. You typically only need explicit rules for traffic initiated into your network, not for return traffic.
Real-world example
An internal user browses a website. The stateful firewall allows the outbound HTTPS request and automatically permits the returning web page traffic, without needing an inbound rule for port 443 from the internet.
Troubleshooting mindset
If return traffic is being unexpectedly blocked, check the state table first — a lot of “the firewall broke my app” tickets are actually asymmetric routing bypassing the state table.
Common mistake
Do not memorise the definition without connecting it to packet flow, device state and verification. Ask: what should happen, what actually happened, and which command or capture can prove the difference?
Quick recap
- Understand the job of the protocol or feature.
- Know where it sits in the traffic path.
- Verify behaviour instead of guessing.
- Connect the topic to the next networking layer.
Interview connection
Explain the concept in simple words first. Then give one practical example or troubleshooting check. That is stronger than repeating a textbook definition.
References & Further Reading
- AddySec original content — written for the Network Security track to build practical, interview-ready understanding.
Apni Bhasha mein samjho
Stateless firewall har packet ko akela dekhta hai. Stateful firewall poori connection (state) yaad rakhta hai — isliye return traffic automatically allow ho jaata hai.
Kaise padho?
Concept ko pehle flow ke saath samjho. Phir English note ke technical terms, commands aur tables dekho — technical terminology same rahegi.