A retailer's firewall has one rule for its web server: allow TCP 443 from anywhere. The rule is correct, and on Tuesday it passes a request carrying a SQL injection string straight to the checkout page, because the firewall checked only the port number. On Wednesday a bot tries 40,000 passwords against the login page, also over port 443, and the rule passes those too.
Both are firewall problems, but they need different kinds of firewall. On the CompTIA Security+ SY0-801 exam, firewalls sit under objective 4.1, which expects you to choose and apply mitigating controls in a given scenario. This lesson covers how rule-based firewalls work, the difference between stateless and stateful filtering, what separates Layer 4 from Layer 7 inspection, host and network firewalls, unified threat management and rate limiting. Writing and ordering rules is the next lesson, and web application firewalls get their own lesson after that.
A firewall enforces written rules about what may cross a boundary
A firewall sits where traffic passes from one zone to another, such as the internet to the internal network, the user VLAN to the server VLAN, or the network into a single host. It compares traffic against a policy and allows or blocks it.
A rule-based firewall expresses that policy as an ordered list of rules. Each rule has match conditions and an action. The classic conditions are source address, destination address, protocol and port; newer firewalls add the application, the user and the website category. The actions are allow (also called permit or accept), deny, and log. A deny can be a silent drop, which gives a scanner nothing back, or a reject, which answers with a TCP reset or an ICMP unreachable message so a legitimate client fails fast instead of timing out.
Every well-built firewall policy ends in default deny: anything no rule allows is blocked. That single principle does more than any individual rule, and the next lesson shows how it interacts with rule order.
The firewall log is where you see the policy at work:
Oct 21 09:14:52 fw01 action=DROP in=outside src=198.51.100.44 dst=203.0.113.10 proto=TCP spt=51522 dpt=3389 rule=default-deny
Oct 21 09:14:53 fw01 action=ALLOW in=outside src=198.51.100.71 dst=203.0.113.10 proto=TCP spt=60114 dpt=443 rule=14-web-https
The first line is someone on the internet trying Remote Desktop (3389) against the web server; no rule allowed it, so default deny dropped it. The second is an ordinary HTTPS visitor allowed by rule 14. Reading lines like these quickly is a skill worth practicing.
Rule-based access control as a general access control model is covered in the identity and access management section; a firewall rule list is its textbook example.
Stateless filters judge each packet alone, while stateful firewalls track the conversation
A stateless packet filter looks at each packet's header in isolation. It has no memory of what came before. Router access control lists work this way, and so do some cloud network ACLs. Stateless filtering is fast and simple, but it creates a problem for return traffic. When a user browses to a website, the reply comes back from source port 443 to a random high port on the user's machine. A stateless filter needs a broad rule to let that reply in, such as "allow TCP from any source port 443 to any internal high port", and attackers abuse rules like that by setting their own source port to 443 when they scan.
A stateful firewall tracks every connection in a state table. When an internal host opens a connection, the firewall records it, and replies that match the entry are allowed automatically. A packet that claims to belong to a connection the firewall never saw, such as a TCP ACK with no prior SYN, is dropped. UDP has no connections, so the firewall tracks UDP flows with short timers instead.
Proto Inside Outside State Idle timeout
TCP 10.1.4.88:50412 203.0.113.80:443 ESTABLISHED 3599s
UDP 10.1.2.53:61022 192.0.2.53:53 ACTIVE 28s
TCP 10.1.4.91:50877 198.51.100.9:22 SYN_SENT 28s
The state table costs memory, and a SYN flood that opens half-connections faster than they time out can exhaust it, which is one reason DDoS protection sits in front of firewalls. Even so, nearly every modern network firewall is stateful. Stateless ACLs survive where raw speed and simplicity matter, such as on core routers.
On the exam, "tracks sessions", "allows return traffic automatically" or "drops packets that aren't part of an established connection" describes a stateful firewall. "Each packet is evaluated independently" describes a stateless one.