Firewalls explained: stateless, stateful and next-generation
In short: Stateless filters judge each packet alone, stateful firewalls track whole connections, and next-generation firewalls add application, user and threat awareness on top.
The main types
| Type | Decides using | Typical example |
|---|---|---|
| Stateless packet filter | Each packet's source, destination, protocol and port, with no memory of earlier packets | Router ACLs, basic cloud network ACLs |
| Stateful firewall | A connection table: return traffic for an allowed session is permitted automatically | Most hardware firewalls, cloud security groups |
| Next-generation firewall (NGFW) | Stateful inspection plus the actual application, the user, content and threat signatures | Enterprise perimeter and data centre firewalls |
| Web application firewall (WAF) | HTTP requests: blocks attacks such as SQL injection and cross-site scripting | In front of websites and APIs |
Why stateful matters
With a stateless filter you must write rules for both directions, including the random high ports clients use for replies. A stateful firewall remembers that a user started the connection, so it lets the reply back in automatically and blocks anything unsolicited.
What "next-generation" adds
- Application identification: allow "Microsoft Teams" or block "BitTorrent" whatever port it uses.
- User identity: rules like "Finance group can reach the accounting server", tied to your directory.
- Threat prevention: intrusion prevention, malware and URL filtering.
- TLS inspection: decrypting traffic to inspect it, which needs careful privacy and legal planning.
Rule-writing principles for any firewall
- Order matters: rules are read top to bottom and the first match wins. Put specific rules above general ones.
- Default deny: allow only what's needed; everything else is blocked.
- Least privilege: specific sources, destinations and ports instead of "any".
- Document every rule: who asked for it, why, and when to review it.
- Log and review: remove rules nobody uses.
Test yourself with the "Nobody can reach the HTTPS server" challenge.
Key takeaways
- Stateless = per packet; stateful = per connection.
- NGFWs add application, user and threat awareness.
- First match wins, so order rules from specific to general.
- Default deny plus least privilege, always documented.
Tracks your learning on this device only. See your progress on the learning paths.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.