Stateful Inspection

A stateless firewall checks each packet independently. Problem: how to allow return traffic?

Example:

• Outbound: client at 10.0.0.5:54321 → google.com:443.
• Inbound: google.com:443 → 10.0.0.5:54321 (response).
• Stateless: must allow ALL inbound from port 443. Too permissive.

Stateful (connection tracking):

• Track every connection in a table.
• Outbound packet creates entry: (10.0.0.5:54321, 142.250.x.y:443, TCP, ESTABLISHED).
• Inbound packet matches existing entry → allowed.
• No matching entry → apply default rules.

Conntrack states (Linux):

• NEW: first packet of a connection.
• ESTABLISHED: bidirectional, conn confirmed (e.g., SYN+SYN+ACK exchanged).
• RELATED: associated with another connection (e.g., FTP data channel related to control).
• INVALID: doesn't match any pattern.

Standard rule:

iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

Allow all return traffic. Then explicit rules for NEW connections.

Conntrack table:

• Per-connection entries.
• Tuple: (src_ip, src_port, dst_ip, dst_port, protocol).
• Timestamp for last packet.
• State: NEW → ESTABLISHED → CLOSE_WAIT → ...

Timeouts:

• TCP ESTABLISHED: 5 days default.
• TCP CLOSE_WAIT: 1 minute.
• UDP: 30 seconds.
• ICMP: 30 seconds.

Adjust if your network has long-running connections (e.g., persistent SSH).

Conntrack table size:

• Default 65536 entries on Linux.
• Under DDoS or heavy traffic, fills up → new packets dropped.
• Increase: net.netfilter.nf_conntrack_max.

Cleanup:

• Background thread sweeps expired entries.
• Or LRU eviction when full.

Stateless analog: iptables can match TCP flags directly:

• -m tcp --tcp-flags ACK ACK matches packets with ACK set.
• Less powerful than full state tracking.