Understanding Stateful vs Stateless Firewalls

Lab Details

This lab will guide you through the steps necessary to distinguish between stateful (Security Group) and stateless firewalls (Network ACL).

The lab will be practiced using VPC or EC2.

Duration: 60 minutes

AWS Region: US East, N. Virginia us-east-1

Introduction

What is a Stateful Firewall?

Security groups are considered stateful. This means that any changes made to an incoming rule will automatically be applied to the outgoing one.

If you allow an outgoing port 22, the port 22 will automatically be opened.

You can inspect packets in context of traffic flow. This allows you to use more complicated rules and logs network traffic.

Traffic direction is governed by state laws

What is a Stateless Firewall?

Network ACLs do not have state: Any changes to an incoming rule are not applied to the outgoing.

You must also apply the outgoing traffic rule if you allow traffic to 22 ports.

Each packet should be examined individually, regardless of whether it is part of an approved, existing connection. This engine prioritises speed of evaluation. It accepts rules that meet the 5-tuple connection requirements.