Dutch Bangla Bank Assistant Network/ Hardware Engineer Exam: 2019 (BUET)প্রশ্ন ও সমাধান

	Stateful Firewall	Stateless Firewall
Tracking	Maintains a state table of active connections	No memory of previous packets
Decision basis	Full context of the connection (TCP handshake, sequence)	Static rules on header fields only (src/dst IP, port)
Also known as	Dynamic packet filter	Access Control List (ACL) filter
Security	Stronger — detects out-of-context/spoofed packets	Weaker — cannot tell a legitimate reply from a spoofed one
Performance	Slightly more overhead (state table lookups)	Faster, simpler, less resource-intensive
Example	Modern firewalls (iptables conntrack, most NGFWs)	Basic router ACLs

How it works:

• A stateful firewall inspects the full flow: when it sees an outbound SYN packet it remembers the connection; only inbound packets matching that established session (correct IP/port/sequence) are let back in — everything else is dropped by default.
• A stateless firewall evaluates every packet independently against a fixed rule list (e.g. "allow TCP port 80 from any"), with no notion of whether a connection was actually initiated from inside.

sequenceDiagram
  participant Int as Internal Host
  participant FW as Stateful Firewall
  participant Ext as External Server
  Int->>FW: SYN outbound, state entry created
  FW->>Ext: SYN forwarded
  Ext-->>FW: SYN-ACK matches state, allowed
  FW-->>Int: SYN-ACK forwarded

Exam takeaway: stateful = context-aware, tracks connections (more secure); stateless = per-packet static rules only (faster, less secure).