Rregullat Stateful kundër Stateless

A stateless firewall checks each packet in isolation, while a stateful firewall tracks connections.

In a purely stateless firewall, if you want to allow your users to browse the internet you must open both outbound TCP to port 80 and also inbound TCP from port 80 back to ephemeral ports — which effectively exposes every workstation to any attacker who sources packets from port 80. Stateless rules force this kind of trade-off between usability and security. Stateful firewalls solve the problem by remembering that the user initiated the outbound connection. When reply packets arrive they are matched against the connection table and allowed only if they are part of an expected session. This is why almost every modern firewall, from consumer home routers to Cisco ASA, is stateful by default. There are still cases where stateless rules are useful: high-throughput edge routers that cannot afford to keep per-flow state, and infrastructure ACLs that block spoofed packets. Understanding the difference is critical when troubleshooting why a firewall is suddenly dropping traffic you thought you had allowed.

Mjete për inspektim stateful:

• conntrack-tools në Linux — inspekton tabelën e lidhjeve.
• nft list ruleset, iptables -L -v.
• pfSense Diagnostics → States.

Shiko lidhjet aktive që po i ndjek kerneli:

conntrack -L
conntrack -S   # statistika
ss -tulnp      # porta të hapura + procese

Rregull stateful me nftables që lejon vetëm lidhje të reja hyrëse në portin 443:

table inet filter {
  chain input {
    type filter hook input priority 0;
    ct state established,related accept
    ct state new tcp dport 443 accept
    ct state new drop
  }
}

1. Në një VM Linux, shto një rregull stateful dhe bëj curl nga jashtë. Shiko si zhvendoset lidhja nëpër NEW → ESTABLISHED → TIME_WAIT.
2. Trego dallimin mes një ACL-je stateless dhe një rregulli stateful me shembuj konkretë.

• conntrack-tools
• RFC 2979 — Firewalls.