A stateful firewall allows a packet if the ruleset permits it as a new connection or if it matches an entry in the firewall's state table of existing connections. Anything that claims to belong to a session the firewall never saw is dropped. That is how return traffic is allowed without opening inbound ports.
What is in the state table?
NIST SP 800-41 Rev. 1 says entries vary by product but typically include source address, destination address, port numbers and connection state. For TCP, it describes three major states: connection establishment, usage and termination.
Follow one session. An internal host, 192.168.1.100, opens a connection from port 1030 to an external web server at 192.0.2.71, port 80. The firewall checks the ruleset and, because outbound web is permitted, adds a table entry marked Initiated. When the three-way handshake completes the state changes to Established, and traffic matching the entry is allowed through in both directions. When either side closes, or the connection sits idle too long, the entry goes away.
Why does that stop forged packets?
NIST gives the case directly. An attacker could craft a packet whose header says it belongs to an established connection, hoping it passes. A stateful firewall first verifies the packet is part of an established connection in its table. A plain packet filter, which looks at each packet alone, would let it through if a rule allowed the ports.
Many firewalls go further. NIST notes it is common to check attributes such as TCP sequence numbers and reject packets that are out of sequence.
What about UDP, which has no connection?
UDP has no handshake, so state cannot be read from the transport layer. NIST says most stateful firewalls then track only addresses and ports. A UDP packet must still match an entry to pass: its example is a DNS response from outside, which is permitted only if the firewall previously saw a matching DNS query from inside.
Because the firewall cannot tell when a UDP exchange has ended, the entry is removed after a preconfigured timeout. Application-aware firewalls that recognize DNS over UDP may end the session once the response arrives.
What problems does the table cause?
Three show up in practice, and each is a direct consequence of how the table works.
Idle timeouts. A long-lived connection that goes quiet, such as a database session held by an application pool, can have its entry removed. The next packet is then dropped and the application sees a mysterious reset. Raising the timeout or sending keepalives fixes it.
Table exhaustion. The table is finite memory. A flood of new connection attempts can fill it and block legitimate traffic, which is why denial of service defenses watch the connection count.
Asymmetric routing. If the outbound packets leave through one firewall and the replies return through another, the second firewall has no entry and drops them.
What does a stateful firewall not see?
It understands the transport layer, not the content. Traffic on an allowed port can still carry an attack. NIST describes application firewalls and proxy gateways as the next step up, adding stateful protocol analysis or acting as an intermediary. A web application firewall is a separate control again, focused on HTTP.
How to check or apply this
- Read the firewall's session or state table during normal operation and confirm entries match what you expect.
- Check the timeout values for TCP established, TCP closing and UDP, and compare them with your longest idle connection.
- Alert when the table passes a set share of its capacity.
- Confirm routing is symmetric for every path that crosses a stateful device, or use a synchronized pair.
- Write rules for the first packet of a connection only. The table handles replies.
- Pair the firewall with controls that see content where the risk justifies it.
- Test with a harmless unsolicited reply from outside to prove it is dropped.
Quick check
What is the difference between stateless and stateful filtering?
A stateless filter judges each packet alone using addresses, ports and protocol. A stateful firewall also tracks connections in a table and drops packets that do not fit.
Does a stateful firewall inspect application content?
Not by default. It tracks connections at the transport layer. Application firewalls and proxies add content awareness.
Sources
Last reviewed: 18 October 2026.
