Rules commonly use source and destination addresses, protocol numbers, transport ports, interfaces, direction, and selected header fields. Routers, switches, hosts, cloud controls, and firewalls can provide this function.
Because no connection history is consulted, return traffic must match its own explicit rule. This can make policy predictable and resource-efficient for simple flows, but protocols with dynamic ports, fragments, asymmetric behavior, or complex request-and-response patterns require careful handling. Implementations differ in rule order, default action, logging, and the fields available for matching.
Key points
Rule designStart with required flows, use narrow sources, destinations, protocols, ports, and directions, define the default action, and document rule ownership and purpose.
Packet handlingSpecify IPv4 and IPv6 behavior, fragments, options or extension headers, spoofed source controls, ingress and egress policy, and malformed packets.
OperationsTest allowed and denied paths, review counters and logs, remove obsolete or shadowed rules, and assess performance under high packet rates rather than assuming efficiency removes resource limits.
Important limitationA packet can satisfy every header rule and still carry an attack. Stateless filtering cannot determine whether it belongs to a legitimate prior exchange, and broad return-path rules can expose services unexpectedly.