Understanding Asymmetric Routing in Computer Networks
In the vast landscape of computer networks, various complex phenomena influence the efficiency and reliability of data transmission.…
The difference is memory. A stateless firewall examines each packet on its own, with no knowledge of what came before. A stateful firewall keeps a connection table and judges every packet in the context of the conversation it belongs to.
That one difference changes the rules you write, the attacks you can stop, and how much hardware you need.
Side by Side
| Stateless | Stateful | |
|---|---|---|
| Decision basis | The individual packet header | The packet plus the connection’s state |
| Tracks connections | No | Yes — a state table entry per flow |
| Return traffic | Needs an explicit rule in both directions | Permitted automatically |
| Layers inspected | 3 and 4 headers only | 3, 4 and connection state; modern ones go to 7 |
| Memory use | Minimal | Scales with concurrent connections |
| Throughput | Very high, predictable | High, but bounded by table size |
| Detects out-of-state packets | No | Yes |
| Handles dynamic-port protocols | Badly | Yes, via inspection helpers |
| Rule complexity | High — every flow needs two rules | Low — one rule per intent |
| Typical form | Router ACL, cloud security group, switch ACL | Dedicated firewall, NGFW, host firewall |
How a Stateless Firewall Works
It matches packets against an ordered list of rules using source and destination address, protocol, and port. First match wins. It has no idea whether a packet is a fresh connection attempt or part of an established session.
Allowing internal users to browse the web therefore requires two rules:
! Outbound: let users reach web servers
permit tcp 192.168.1.0 0.0.0.255 any eq 443
! Inbound: let the replies back in
permit tcp any eq 443 192.168.1.0 0.0.0.255 establishedThe established keyword is the tell. It only checks whether the ACK or RST flag is set in the TCP header — it does not verify that a matching outbound connection ever existed. An attacker can craft a packet with the ACK bit set and walk straight through. That is a real limitation, not a theoretical one, and it is why established ACLs were superseded.
The problem is worse with UDP, which has no flags at all. There is no way for a stateless rule to distinguish a DNS response to your query from an unsolicited DNS packet from anyone.
How a Stateful Firewall Works
- An internal host sends a TCP SYN to a web server. The firewall checks its policy, permits it, and creates a state table entry recording source and destination addresses, ports, protocol and connection state.
- The SYN-ACK returns. The firewall finds the matching entry and permits it without consulting the rule base at all.
- Data flows in both directions, matched against state.
- The connection closes with FIN or RST, or times out, and the entry is removed.
Policy becomes one rule:
permit tcp 192.168.1.0/24 any 443Return traffic is implicit. A packet arriving from outside with no matching state entry is dropped by default — including the crafted ACK that defeats a stateless rule.
The state table
Every connection consumes an entry, so the table is a finite resource and a genuine capacity constraint:
# Cisco ASA
show conn count
show resource usage
# Linux netfilter
cat /proc/sys/net/netfilter/nf_conntrack_max
cat /proc/sys/net/netfilter/nf_conntrack_countWhen the table fills, new connections are refused. A SYN flood is essentially an attack on this table, which is why SYN cookies and connection rate limits exist.
Inspection helpers
Some protocols negotiate a second connection on a port chosen at runtime. Active-mode FTP, SIP, H.323 and TFTP all do this. A stateful firewall reads the control channel, learns the port that is about to be used, and opens a temporary pinhole for it. A stateless firewall cannot do this at all — you either open a wide port range or the protocol does not work.
What Each One Actually Stops
| Attack or condition | Stateless | Stateful |
|---|---|---|
| Traffic to a blocked port | Yes | Yes |
| Traffic from a blocked source | Yes | Yes |
| Crafted ACK with no prior connection | No | Yes |
| Unsolicited UDP reply | No | Yes |
| TCP flag combinations that make no sense (XMAS, NULL, FIN scans) | Partially, with explicit rules | Yes |
| Sequence number outside the valid window | No | Yes |
| Session hijacking attempts | No | Largely |
| Malicious payload on an allowed port | No | Only with deep inspection (NGFW) |
Where Each Belongs
Use stateless when
- You need very high throughput with predictable behaviour — a core router ACL dropping bogon and RFC 1918 sources at line rate.
- You are doing coarse filtering as a first pass in front of a stateful device, so it never has to allocate state for obvious junk.
- The device genuinely cannot hold state — most switch and router ACLs.
- You are blocking a specific source or destination outright, where direction and session do not matter.
- Anti-spoofing filtering at the edge, where the rule is purely “this source cannot legitimately arrive here”.
Use stateful when
- It is a perimeter or segmentation firewall — which is essentially every case.
- You need return traffic permitted without opening inbound holes.
- You run protocols that negotiate dynamic ports.
- You want out-of-state and malformed packets dropped by default.
- You need per-connection logging that actually reconstructs sessions.
In practice, real designs use both: stateless ACLs on routers and switches for cheap bulk filtering, a stateful firewall at every trust boundary. Packet-filtering firewalls are the stateless category; almost everything sold as a firewall today is stateful.
A Note on Cloud Security Groups
This trips people up regularly:
- AWS Security Groups are stateful. Allow an outbound rule and the response is automatically permitted.
- AWS Network ACLs are stateless. You must explicitly allow the ephemeral port range (typically 1024–65535) inbound for return traffic, or connections that look correctly configured will simply hang.
- Azure NSGs and GCP firewall rules are stateful.
Half-open connections in a VPC almost always trace back to a stateless NACL missing its return-path rule.
Beyond Stateful — Next-Generation Firewalls
Stateful inspection stops at the connection layer: it verifies the conversation is legitimate, not that its contents are. An NGFW adds application identification (recognising the protocol regardless of port), user identity from the directory, TLS inspection, and integrated IPS.
That capability costs throughput. A firewall rated for 10 Gbps stateful may deliver 2 Gbps with full inspection and TLS decryption enabled — a sizing detail that catches people out after deployment.
Frequently Asked Questions
Is a stateless firewall less secure?
For a trust boundary, yes — it cannot verify that inbound traffic belongs to a session you initiated. For its actual job, dropping clearly invalid traffic at high speed, it is the right tool and adds no risk.
Are router ACLs stateful?
Standard and extended ACLs are stateless. Cisco’s Reflexive ACLs, CBAC and Zone-Based Firewall add statefulness to IOS, but a plain access-list has no memory of prior packets.
Why does my connection work outbound but not inbound?
Almost always a stateless filter somewhere without a return rule — commonly an AWS Network ACL, or an established-less ACL on a router.
Do stateful firewalls slow the network down?
Marginally, and less than the state table’s capacity limits do. The bigger risk is exhausting the connection table under load or attack, at which point new connections fail while existing ones continue.
Is Windows Defender Firewall stateful?
Yes. Like most host firewalls it tracks connections, which is why outbound traffic works without you creating matching inbound rules.
What happens when a stateful firewall reboots?
The state table is lost and every existing connection is dropped, because the return packets no longer match anything. High-availability pairs replicate state between units specifically to survive a failover without this happening.
