What Are Stateful And Stateless Firewalls

As the world we dwell in is digitally advanced where the Internet has sneaked into our lives in almost every aspect. It’s hard to imagine a day without the Internet or devices capable of interacting with it. Although it has made our lives easier, the internet also welcomes tons of online threats that can harm an organization in a variety of ways. Hackers seek for security loopholes where they can inject viruses and other malicious intent to cost a business huge money and fame. Tech giants like Google and Facebook have also suffered from such theft. A CNBC report cites that scammers took a creative turn to steal $100M+ from Google and Facebook from 2013-2015. All thanks to modern advancements that firewalls have been introduced to protect against digital threats. They are designed to safeguard devices and valuable data by monitoring and controlling network traffic incoming and outgoing. However, hackers and their threats are evolving as we speak. Therefore, firewalls need to be smarter as well to face new challenges.

Are all firewalls the same?

No, all firewalls are not built the same. They have come a long way since the 1980s, and you can hear about their different types, such as:

Network firewallsWeb Application Firewalls (WAF)Software-basedHardware-basedCloud-basedMobile firewall

In this article, I am going to discuss stateful and stateless firewalls that people find confusing about. Each one of them has some pros and cons and applicability, but both are indeed important for network protection. So, let’s jump straight to know them!

What is a Stateful Firewall?

Stateful firewalls are capable of monitoring all aspects of network traffic, including their communication channels and characteristics. They are also referred to as dynamic pocket filters as they filter traffic packets based on the context and state. Now, what do these context and state mean in the language of network connections?

Context – it involves metadata of packets including ports and IP address belonging to the endpoint’s and destination, packet length, layer 3 information related to reassembly and fragmentation, flags, and numbers for TCP sequence of layer 4, and more.State – firewalls apply their policy based on the state of the connection. To understand the state, let’s take the example of TCP-based communication. In TCP, 4 bits control connection state – SYN, ACK, FIN, and RST.

When a connection initiates through a 3-way handshake, then the TCP indicates the SYN flag, which the firewall uses to indicate the arrival of a new connection. Next, the connection receives the flag SYN+ACK by the server. Until the client reverts with ACK, the connection does not establish. Similarly, on seeing FIN+ACK or RST packet, the connection is marked for deletion right there along with for future packets. Benefits

Powerful memory to retain key aspects of trafficHighly skilled to detect forged messaging or unauthorized accessIntelligent system to make better decisions based on present and past findingsWider logging capacity and stronger attack mitigationNeeds lesser ports for communication

It implies that stateful firewalls keep on analyzing every data packet trying to enter into a network. Once the stateful firewall approves a traffic request, it can travel freely inside the network. However, stateful firewalls can be vulnerable to DDoS attacks. The reason behind the same is the increased need for software-network connection and intense computational power for implementation.

What is a Stateless firewall?

Stateless firewalls utilize clues from key values like source, destination address, and more to check whether any threat is present. On detecting a possible threat, the firewall blocks it. There are certain preset rules that firewalls enforce while deciding whether traffic must be permitted or not. As stateless firewalls are not designed to consider as many details as stateful firewalls, they are less rigorous. For example, a stateless firewall cannot take into account the complete pattern in which packets are entering. Instead, it will inspect each packet in isolation. Furthermore, it also fails to differentiate between different traffic types of application-level, including HTTPS, HTTP, SSH, FTP, VolP, etc. Consequently, stateless firewalls are susceptible to online attacks spread across different packets. Benefits

Performs well in case of heavy trafficFastGenerally, cheaper than stateful firewalls.

You guessed it right, a stateless firewall does not inspect entire traffic or packet and can’t identify traffic types.

Which firewall is better – Stateful or stateless?

Now comes the interesting part! As you already have read the benefits of both the firewall types, you can buy anyone based on your needs. But, if you still have double-minds on that, lets narrow it down based on your personal or business requirements.

Small businesses

For small businesses, the main goal of buying a firewall is to protect systems and documents safe from bad players. In addition, they also have a limited budget in hand. As traffic volumes are mostly lower for smaller businesses, it means incoming threats will also be fewer or farther you could say. Hence, stateless firewalls could be a suitable option for you if you run a small business. Its fast performance, coupled with the ability to manage large traffic, could be the best value of your hard-earned money.

Enterprises

Enterprises have lots of systems and data, including the very sensitive ones that they never afford to get exposed to. It could take a toll on their reputation and money. Not to mention, they also have a larger inkling and outgoing traffic that needs monitoring. For them, stateful firewalls could do the talking. The powerful firewalls with sophisticated capabilities can better protect their extensive assets by providing a thick security layer to mitigate attacks.

Other scenarios

For a small office consisting of a few trusted employees requiring routing capabilities could use stateless firewalls.You can use a stateless firewall inside a trusted network that resides between a VLAN, making sure a stateful firewall is already monitoring the external traffic.