Last updated · reviewed for accuracy
Firewalls & ACLs
Every firewall ever built answers one question per packet: does a rule say you may pass? The interesting differences are in what the rule is allowed to know, and the biggest upgrade in firewall history was one word: state.
Stateless filtering: judging every packet alone
A stateless filter (an ACL) evaluates each packet against its rules with no memory of previous packets. It knows addresses, protocol and ports, but not whether this packet belongs to a conversation someone started.
Stateless filtering has a famous blind spot: return traffic. If you allow your users out to the web but deny everything inbound, the replies to their requests are inbound, and get dropped. Stateless fixes for this (allowing all high ports back in) are exactly the kind of hole attackers love. The IOS ACL lesson shows this syntax in practice.
Stateful inspection: remembering the conversation
A stateful firewall records every connection it permits in a state table. Return traffic matching a known connection is allowed automatically; unsolicited traffic matches nothing and dies. The rule set describes who may start conversations, and the firewall handles the replies.
| Stateless (ACL) | Stateful firewall | |
|---|---|---|
| Remembers connections | No | Yes: state table |
| Return traffic | Needs explicit rules | Allowed automatically |
| Cost | Free on every router/switch | Dedicated device or feature |
| Best at | Coarse filtering at edges | Policy between zones |
Default deny: the only sane starting point
A default-deny policy blocks everything, then permits only named, justified traffic. The alternative (default allow with specific blocks) fails open: anything you forgot to block is permitted.
You have already met this idea as the ACL implicit deny; a firewall policy just makes it explicit and organisation-wide. The practical shape: inbound from the internet, deny by default and publish only what must be public; outbound, permit what the business needs and log the rest. Every permitted rule should be able to answer “who asked for this and why.”
Where filtering lives in a real network
Filtering happens at layers: a perimeter firewall between you and the internet, ACLs or zone policies between internal segments, and host firewalls on the machines themselves. Each catches what the previous one cannot see.
The perimeter stops internet noise; inter-VLAN filtering stops an infected laptop reaching the finance servers; the host firewall stops lateral movement inside a segment. One firewall is a wall; layered filtering is a building with locked doors inside it, which is precisely the thinking Zero Trust takes to its conclusion.
The syntax half of this lesson
Want the exact commands? ACLs in IOS in the Cisco track writes and applies real access lists, including the implicit-deny trap covered here as policy.
Frequently asked questions
What does a stateful firewall track that an ACL does not?
Connection state: each permitted conversation lives in a state table, so return traffic is recognised automatically and unsolicited packets die without extra rules.
What is a default-deny policy?
Block everything, permit by exception. It fails safe: a forgotten rule blocks something legitimate and visible instead of silently permitting something hostile.
Do I still need a host firewall behind a network firewall?
Yes: the network firewall never sees traffic between two machines in the same segment. Host firewalls stop exactly that lateral movement.