Firewalls Architecture, Packet Filtering & Stateful Inspection

Q: What is the difference between a Firewall and an Intrusion Prevention System (IPS)?

A firewall allows or blocks traffic based on addresses, ports, and connection states. An IPS analyzes packet payloads for exploit signatures, protocol anomalies, and malicious behavior in real time.

Master OSI Layer 3/4 packet filtering, stateful connection tracking, next-gen application firewalls (NGFW), and iptables rule chains.

How Firewalls Filter Network Traffic

A firewall is a network security device that monitors and controls incoming and outgoing network traffic based on predetermined security rules. Read more on TCP 3-way handshake.

Stateless Packet Filtering:Inspects each packet in isolation (Source IP, Dest IP, Source Port, Dest Port, Protocol) without memory of prior packets.
Stateful Inspection (SPI):Maintains a dynamic state table tracking established TCP sessions (SYN, SYN-ACK, ACK, ESTABLISHED).
Next-Gen Firewall (NGFW):Performs Deep Packet Inspection (DPI) at OSI Layer 7 (Application Layer), identifying malware, SSL decryption, and app-layer threats.

Packet Arrival at Ingress Interface: Layer 2 Ethernet frame header is validated and stripped; IP packet payload enters netfilter hooks.
Connection Tracking (conntrack): State engine looks up the 5-tuple in active memory tables: NEW, ESTABLISHED, RELATED, or INVALID.
Rule Chain Evaluation: Rules in PREROUTING, INPUT, FORWARD, and POSTROUTING chains are evaluated sequentially until first match.

Definition: Stateful Packet Inspection (SPI)

A firewall architecture that records active connection state attributes in memory, allowing return traffic for established sessions automatically while blocking unsolicited incoming probes.

State Table Lookup Complexity

O(1) Hash Map State Table Lookup

Variable Definitions & Term Breakdown:

Hash(5-tuple)Source IP, Dest IP, Source Port, Dest Port, Protocol hash

Timeout TTLExpiration timer for idle TCP connections (default 3600s)

Firewall Generation Comparison

Generation	OSI Layer	Inspection Scope	Performance Overhead
Packet Filtering (Gen 1)	Layer 3/4	Header IPs & Ports	Ultra Fast (< 1µs)
Stateful Inspection (Gen 2)	Layer 4	TCP/UDP Connection State	Fast (1-5µs)
Application Gateway (Gen 3)	Layer 7	Protocol Syntax (HTTP/FTP)	Moderate (10-50µs)
Next-Gen Firewall (NGFW)	Layer 7+ DPI	Payload, Malware, TLS Decryption	Heavy (50-200µs)

Stateless vs Stateful vs Next-Gen Application Firewalls

Tip

Always position established/related connection rules at the very top of your firewall rule chain to maximize packet throughput for active sessions.

PythonSimulated Stateful Firewall Connection Filter

1class Firewall:
2    def __init__(self):
3        self.state_table = set() # (src_ip, dest_ip, port)
4        self.rules = [('192.168.1.0/24', 80, 'ACCEPT'), ('192.168.1.0/24', 443, 'ACCEPT')]
5 
6    def process_packet(self, src_ip, dest_ip, port, is_reply=False):
7        if is_reply and (dest_ip, src_ip, port) in self.state_table:
8            return 'ALLOW (ESTABLISHED)'
9        if port in (80, 443):
10            self.state_table.add((src_ip, dest_ip, port))
11            return 'ALLOW (NEW CONNECTION)'
12        return 'DROP (UNAUTHORIZED PORT)'
13 
14fw = Firewall()
15print('Outbound HTTPS:', fw.process_packet('192.168.1.5', '142.250.190.46', 443))
16print('Inbound Return Packet:', fw.process_packet('142.250.190.46', '192.168.1.5', 443, is_reply=True))
17print('Unsolicited Inbound Probe:', fw.process_packet('203.0.113.1', '192.168.1.5', 22))

Output

Outbound HTTPS: ALLOW (NEW CONNECTION)
Inbound Return Packet: ALLOW (ESTABLISHED)
Unsolicited Inbound Probe: DROP (UNAUTHORIZED PORT)

BashLinux iptables Stateful Rule Set

1# Allow established and related return traffic
2iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
3 
4# Allow inbound web traffic
5iptables -A INPUT -p tcp --dport 443 -m conntrack --ctstate NEW -j ACCEPT
6 
7# Drop everything else
8iptables -P INPUT DROP

Output

[Rules Applied - Default Policy: DROP]

Quick Syntax & Reference Sheet

Concept / Rule	Syntax / Usage
State Table Lookup	`iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT`
Port Forwarding (DNAT)	`iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080`

Common Pitfalls & Developer Mistakes

✕ Mistake 1:

Blocking all incoming traffic without allowing ESTABLISHED sessions

Why it happens: When an internal machine sends a DNS query or web request, the external server's response packet is dropped as unauthorized incoming traffic.

Correction: Always permit incoming packets whose connection state is ESTABLISHED or RELATED.

iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

Frequently Asked Questions

What is the difference between a Firewall and an Intrusion Prevention System (IPS)?

A firewall allows or blocks traffic based on addresses, ports, and connection states. An IPS analyzes packet payloads for exploit signatures, protocol anomalies, and malicious behavior in real time.