Stateful Firewalls

One of the improvements we made to firewalls, even way back when firewalls were first coming out, was when we went to stateful packet inspection. When we went to that method, it really helped us implement better security.

Stateless Inspection

Initially, we protected our networks with routers and firewalls that we now call stateless. But there were some huge improvements when we went to stateful inspection.

Let's start by developing a little scenario. Let's say we're on this machine right here, where there is a web server here, and we are requesting information from that web server and now it is returning. So that's the scenario that we're working with.

A stateless firewall really is going to allow traffic based off of the IP address and port numbers, and really nothing else besides that. So what it's going to do is it's going to examine every single packet to see if it is allowed through the firewall. That means if we want to communicate to this web server, we have to have a rule that allows this to come through and get to our machine. Now this is problematic, because we don't know if this is a trusted source or a not trusted source. How do we know which web servers, which resources we want to let through our system or not?

How a Stateful Firewall Changes Things

Let's say we're connecting to this web server out there. What a stateful firewall will do is it'll keep track of the state of the conversation. There's a conversation that's happening here between two devices, and so what happens is, once that conversation is established, it will let all the packets through that are associated with that established conversation.

So what will happen is this machine cannot send packets to this machine right there. It will not allow it. But what will happen is that this machine will make a request to this web server and say, hey, I want to start a conversation, I want to start a connection, here's a TCP handshake. And it begins that TCP handshake. Now this firewall records and says, oh, this machine wants to start a conversation with this web server. So there's an establishment of this conversation, and now all packets that are being sent in fulfillment of that will get to the end machine, because this firewall is keeping track of that conversation. Now as soon as this machine says, oh yeah, okay, thank you, I am done, I appreciate that, then what this firewall will do is it will close out that conversation, and no more packets will be allowed after that because the conversation is now closed.

What "State" Means

The term stateful really is the state in which this conversation happens at. So what is the state? Is it in listening mode? Is it established and they're communicating back and forth? Is it closing — so maybe there's a close and it says I'm done with this? Or maybe it's related to this conversation.

For instance, when you're making a connection to a web server, a lot of times you're not just making one TCP connection to it. You're actually making multiple TCP connections to it, and you're downloading multiple things to your machine. So what happens is that maybe it's a different TCP conversation, but it's related to the conversation that was already requested. So the firewall keeps track of that information, and then it can understand whether it's going to accept or allow it through the firewall or not.

The Stateless Decision Tree

Here is a decision tree. A decision tree allows us to see how this information is being processed and flows.

Stateless first — stateless is the simple one. What's happening is the packet enters the firewall. We do a check against the policy table. So these are the rules, these are the access control lists. It's going to check against that and see, is this acceptable or not? Is it allowed by the policy? If yes, then it's going to route the packet. If not, it's going to discard the packet. It's very simple, very simplistic. It's just checking against this table right here.

The Stateful Decision Tree

Now we see a stateful decision tree, and we can see that it's quite a bit more complex. So the packet enters the firewall. Then there's a check against the state table. Was there an entry already in it? If there is, and it is a valid next step — for instance, it's taking a look at other information and saying, oh, is this what I would expect next, is the sequence number, acknowledgement number symbolic of this conversation, does this conversation have a natural flow to it, or is there something odd like maybe an adversary is manipulating or changing it.

So if it doesn't look like it's a valid next step, then it will discard it. That would be in the case of, like, there's an adversary that's trying to do an attack. But if it does look like the next step, then what it will do is it's going to route the packet and send it along its way, and then update the state table if it needs to be updated. For instance, maybe this is a closing out message and saying, hey, I want to close out our TCP connection. Then it will change that state in the table, so no other communication can happen after that.

So that is if it is existing in this table right here. If it's not existing in the table, then it says, is this a request for a new connection? You can't just start in the middle of a conversation. It's got to be initiated from within the network, and then it says, hey, I want to establish a connection with you. If it's not doing that, it's just going to discard it, because there's no conversations that are already happening and you're trying to start midway, so it doesn't make sense, so we're going to discard it. But if it is a new request for a connection, then it will check that policy table — so those rules and stuff — and if it's allowed by that policy table, then it's going to route that packet and update the state table, and now that conversation has begun. If it is not allowed by the policy, then it just discards it.

So that's the stateful decision tree and how it comes up with its answer on whether it's going to accept or deny this traffic, whether it's going to permit or allow that traffic.