# What is a Stateful Firewall?

> A stateful firewall filters network traffic using both a ruleset and recorded information about flows or connections.

- Canonical URL: https://yellowcube.eu/glossary/stateful-firewall/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

It creates entries in a state table for permitted communication and compares later packets with the expected addresses, ports, protocol, direction, and connection state. Matching return traffic can therefore be handled without a separate broad inbound rule.

For Transmission Control Protocol (TCP), the firewall can follow establishment, use, and termination. Connectionless protocols such as User Datagram Protocol (UDP) have no equivalent handshake, so implementations usually maintain temporary flow state and expire it after a timeout. Products vary in sequence validation, application awareness, fragment handling, and state synchronization between redundant nodes.

### Key points

- **Policy decision:** A new flow must satisfy the configured rule; subsequent packets must satisfy both policy and the state the firewall has recorded.
- **State operations:** Size tables and timeouts for expected demand, protect against state exhaustion, monitor abnormal creation rates, and remove stale entries without breaking long-lived services.
- **Architecture:** Account for asymmetric routing, clusters, failover, network address translation, and paths that bypass the stateful enforcement point; synchronize state where continuity requires it.
- **Important limitation:** Connection state is not user authentication or application safety. A permitted stateful flow can carry malicious content, and inaccurate, exhausted, or missing state can block legitimate traffic or admit traffic that policy did not intend.

### Related terms

[Firewall](<https://yellowcube.eu/glossary/firewall/>) · [Stateless packet filtering](<https://yellowcube.eu/glossary/stateless-packet-filtering/>) · [Network address translation (NAT)](<https://yellowcube.eu/glossary/network-address-translation/>) · [Network access control list (ACL)](<https://yellowcube.eu/glossary/network-access-control-list/>) · [TCP/IP protocol suite](<https://yellowcube.eu/glossary/tcp-ip-protocol-suite/>)

### Sources

[NIST glossary: Stateful Inspection](https://csrc.nist.gov/glossary/term/stateful_inspection) · [NIST SP 800-41 Rev. 1: Guidelines on Firewalls and Firewall Policy](https://csrc.nist.gov/pubs/sp/800/41/r1/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.