9.6 Firewalls (Packet Filtering, Stateful Inspection) & IDS/IPS

Back to Computer Networks Notes

📚Module 09: Network Security & CryptographyTopic 9.6⏱️16 min read

🎯High-Yield For:Semester Exams (All Universities) • Placement Technical Rounds • Engineering Foundations

💡 Core Intuition: The Border Checkpoint and the Undercover Detective

🍳 The Everyday Analogy: Border Guards vs Customs Inspectors

Imagine securing a national border against hostile entry:

1. The Stateless Guard (Packet-Filtering Firewall): A checkpoint guard checks only an individual's passport nationality and age on a single sheet of paper. If someone presents a badge saying "Returning Resident", the guard lets them pass, even if that person never exited the country in the first place! The guard has no memory of past travelers.
2. The Stateful Guard (Stateful Inspection Firewall): The guard maintains a ledger of all citizens who left through the departure lane. When a traveler arrives at the entry lane claiming to be returning, the guard checks the ledger. If an exit stamp exists, entry is granted; if no prior exit is recorded, the traveler is detained.
3. The Customs Detective (Application Proxy / NGFW): An officer opens every suitcase, inspects cargo containers, runs luggage through X-ray machines, and interrogates travelers to ensure they are not smuggling weapons inside legal packaging.
4. The Security Camera vs The Tactical Guard (IDS vs IPS):
   • Intrusion Detection System (IDS): A surveillance camera recording the checkpoint. When a fugitive walks past, the camera sounds an alarm to alert the station (Passive Alert).
   • Intrusion Prevention System (IPS): An armed tactical guard standing directly in the doorway who physically tackles and restrains the fugitive on the spot (Active Inline Blocking).

---

📑Table of Contents

• 🏛️ The Three Generations of Firewalls
• 🔍 Generation 1: Stateless Packet-Filtering Firewalls
  • The 5-Tuple Inspection Matrix
  • Sample Stateless Firewall Rule Table
  • The Fatal Vulnerability of Stateless Filters
• 📋 Generation 2: Stateful Inspection Firewalls
  • How Stateful Connection Tracking Operates
• 🏰 Enterprise Perimeter Architecture: The DMZ
• 🚨 Intrusion Detection (IDS) vs Intrusion Prevention (IPS)
  • Detection Methodologies: Signature vs Anomaly
• 💻 Practical Inspection: Linux Stateful Firewalls via iptables
• 🏭 Real-World Production Context: Linux Netfilter/eBPF, AWS Security Groups & Next-Gen Firewalls
• 📐 Numerical Applications & Worked Examples
  • Example 1: Stateless Packet Filter Rule Evaluation & First-Match Order
  • Example 2: Stateful Connection Table RAM Sizing & SYN Flood Exhaustion
  • Example 3: Deep Packet Inspection & Snort IDS Signature Throughput
• 🎯 Exam & Interview Pitfall Check

---

🏛️ The Three Generations of Firewalls

A Firewall is a network security device that monitors and filters incoming and outgoing network traffic based on an organization's predetermined security rules.

The 3 Generations of Firewall Architecture

The progressive evolution of traffic filtering from Layer 3 headers up to Layer 7 application payloads

🚪

1. Stateless Packet Filter

Layer 3 & Layer 4

• Inspects packets in complete isolation based on 5-tuple header fields.
• Evaluates rules sequentially; first match wins.
• Zero memory: maintains no state table of established connections.
• Vulnerable to ACK-scanning and IP spoofing bypasses.

📋

2. Stateful Inspection

Layer 4 Connection Tracking

• Maintains a dynamic State Connection Table in kernel memory.
• Tracks TCP 3-way handshake state (SYN, ESTABLISHED, FIN/RST) and sequence numbers.
• Automatically permits return packets for legitimate outbound sessions.
• Standard architecture of modern enterprise firewalls (Linux iptables / conntrack).

🔍

3. Application Proxy (NGFW)

Layer 7 Deep Packet Inspection

• Acts as a full intermediary proxy, terminating client and server TCP connections.
• Reconstructs and parses complete application-layer payloads (HTTP, DNS, TLS).
• Inspects traffic for SQL injection, cross-site scripting (XSS), and malware payloads.
• Higher compute overhead, but provides complete semantic visibility.

🛡️

Default Security Policies

Default-Deny vs Default-Allow

• Default-Deny (Whitelisting): Drops all traffic unless explicitly permitted (Industry Standard).
• Default-Allow (Blacklisting): Permits all traffic unless explicitly blocked (Insecure).
• Rule Order Rule: Highly specific rules placed at top; broad default rules at bottom.

---

🔍 Generation 1: Stateless Packet-Filtering Firewalls

A Stateless Packet Filter inspects each incoming and outgoing IP packet independently, comparing its header fields against a static Access Control List (ACL).

The 5-Tuple Inspection Matrix

Stateless filters evaluate rules based on:

1. Source IP Address
2. Destination IP Address
3. Transport Protocol (TCP, UDP, ICMP)
4. Source Port Number
5. Destination Port Number
6. (Optional) TCP Control Flags (SYN, ACK, RST, FIN)

Sample Stateless Firewall Rule Table

Rule ID	Action	Source IP	Source Port	Destination IP	Destination Port	Flags	Description
1	ALLOW	192.168.1.0/24	Any	Any	80, 443	Any	Allow internal hosts to browse external web.
2	ALLOW	Any	80, 443	192.168.1.0/24	Any	ACK=1	Allow incoming web server responses back to clients.
3	DENY	Any	Any	192.168.1.5	22	Any	Block external SSH access to finance server.
4	DENY	Any	Any	Any	Any	Any	Default-Deny: Drop all unmatched packets.

The Fatal Vulnerability of Stateless Filters

Look closely at Rule 2: to allow internal clients to receive web pages, the firewall must permit incoming packets from external ports 80/443 with the TCP ACK flag set.

• The Attack: An attacker outside the network crafts a malicious probe packet destined for an internal database server, setting Source Port = 80 and turning on the ACK=1 flag.
• The stateless firewall inspects the packet in isolation, observes Source Port = 80 and ACK=1, matches Rule 2, and lets the malicious packet pass straight into the private LAN!

---

📋 Generation 2: Stateful Inspection Firewalls

To eliminate the stateless bypass vulnerability, Stateful Firewalls introduce a dynamic State Connection Table in kernel memory.

Stateless vs Stateful Firewalls: Architectural Comparison

The difference between isolated packet filtering and memory-aware session tracking

Stateless

Stateless Packet Filter (ACL)

🚪

Dominant Architecture / DomainHigh-Speed Core Routers (Cisco ACLs)

• •Evaluates packets in total isolation with zero historical context.
• •Requires static two-way rules: one rule for outbound request, one rule for inbound reply.
• •Cannot verify whether an incoming packet belongs to a legitimate active session.
• •Immune to state-table exhaustion attacks; minimal memory consumption.

"Blazing fast throughput but blind to connection validity."

Stateful

Stateful Inspection (Conntrack)

🛡️

Dominant Architecture / DomainEnterprise Perimeter & Host Firewalls (iptables, pfSense)

• •Monitors TCP handshake transitions: SYN_SENT -> ESTABLISHED -> TIME_WAIT.
• •Only outbound rule needed: return packets are automatically permitted via state match.
• •Validates TCP sequence numbers to prevent out-of-window packet injection.
• •Vulnerable to state-table exhaustion attacks (TCP SYN flood without SYN cookies).

"Complete session awareness preventing unsolicited inbound probe attacks."

How Stateful Connection Tracking Operates

1. Outbound Request: An internal client (192.168.1.50:1050) initiates a TCP connection to an external web server (93.184.216.34:443).
2. State Table Creation: The firewall inspects the outbound SYN packet and logs an entry in its state table:

   TCP 192.168.1.50:1050 <-> 93.184.216.34:443 [State: SYN_SENT, Timeout: 120s]

3. Session Establishment: When the server replies with SYN-ACK, the firewall matches it against the table, updates the state to ESTABLISHED, and tracks expected TCP sequence numbers.
4. Automatic Return Handling: All subsequent return packets belonging to that exact session are permitted automatically.
5. Session Teardown: When a FIN or RST is exchanged, the firewall purges the entry from its state table. Any unsolicited inbound packet from an external host with no matching state table entry is instantly dropped!

---

🏰 Enterprise Perimeter Architecture: The DMZ

In corporate and enterprise networks, servers providing public services (Web, Mail, DNS) must be accessible from the public Internet. However, placing them inside the private corporate LAN exposes internal databases and employee workstations to catastrophic compromise.

The solution is the Demilitarized Zone (DMZ):

Network Zone	Trust Level	Hosted Resources	Security Rules
External Zone	Untrusted ($0\%$)	The Public Internet	Inbound traffic strictly filtered; untrusted access.
Demilitarized Zone (DMZ)	Semi-Trusted ($50\%$)	Public Web Servers, Mail Relays, Authoritative DNS, Reverse Proxies	Accessible from Internet on specific ports (80, 443, 25). STRICTLY BLOCKED from initiating connections into the Internal LAN!
Internal LAN	Highly Trusted ($100\%$)	Database Servers, Active Directory, Accounting Systems, Employee Workstations	Can initiate outbound connections to DMZ and Internet. Completely shielded from direct inbound Internet traffic.

The Cardinal Rule of DMZ Architecture

DMZ servers must NEVER be allowed to initiate connections into the Internal LAN. If an attacker compromises an unpatched vulnerability in an Apache web server residing in the DMZ, the attacker is trapped inside the DMZ. The internal firewall blocks the compromised web server from reaching the corporate SQL database or Active Directory domain controllers!

---

🚨 Intrusion Detection (IDS) vs Intrusion Prevention (IPS)

While firewalls enforce traffic rules based on headers and ports, Intrusion Detection and Prevention Systems inspect packet payloads to detect active cyberattacks.

Intrusion Detection System (IDS) vs Intrusion Prevention System (IPS)

Contrasting passive out-of-band surveillance against active inline threat neutralization

Passive Sensor

Intrusion Detection System (IDS)

📢

Dominant Architecture / DomainOut-of-Band Monitoring (SPAN / Port Mirroring)

• •Receives a copy of network traffic via a switch SPAN port or network TAP.
• •Zero impact on network performance or packet latency.
• •Passive reaction: Generates alerts (SNMP, syslog, email) to security analysts.
• •Limitation: Cannot stop an in-progress attack before damage occurs.

"The security camera that sounds an alarm after the intruder enters."

Active Inline

Intrusion Prevention System (IPS)

⚔️

Dominant Architecture / DomainInline Deployment (Direct Traffic Path)

• •Sits physically or logically inline between network switches and routers.
• •Inspects every packet in real time; adds slight microsecond processing latency.
• •Active reaction: Drops malicious packets, resets TCP connections, and updates firewall rules.
• •Risk: A false positive can mistakenly block mission-critical legitimate business traffic.

"The armed guard in the doorway who tackles the attacker on the spot."

Detection Methodologies: Signature vs Anomaly

1. Signature-Based Detection:
   • Compares packet byte patterns against a database of known threat signatures (e.g. Snort rules, known SQL injection strings, CVE exploit payloads).
   • Pros: Blazing fast, minimal false positives on known attacks.
   • Cons: Completely blind to Zero-Day exploits and polymorphic encrypted malware.
2. Anomaly-Based Detection:
   • Uses machine learning or statistical modeling to establish a baseline of "normal" network behavior (typical bandwidth, port distributions, packet sizes).
   • Flags any statistically significant deviation from the baseline (e.g. sudden spike in outbound DNS queries indicating data exfiltration).
   • Pros: Capable of discovering previously unseen Zero-Day attacks.
   • Cons: High rate of false positives (e.g. legitimate marketing campaign mistaken for a DDoS flood).

---

💻 Practical Inspection: Linux Stateful Firewalls via iptables

In Linux, stateful packet filtering is managed by the kernel's netfilter subsystem and configured via iptables:

# 1. Allow established and related incoming sessions (Stateful Inspection)
sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# 2. Allow incoming SSH only on local subnet
sudo iptables -A INPUT -p tcp -s 192.168.1.0/24 --dport 22 -j ACCEPT

# 3. Allow incoming web traffic (HTTP/HTTPS)
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# 4. Default Policy: DROP all other unsolicited inbound traffic
sudo iptables -P INPUT DROP

---

🏭 Real-World Production Context: Linux Netfilter/eBPF, AWS Security Groups & Next-Gen Firewalls

Modern infrastructure security operates across bare-metal kernel drivers, hypervisors, and cloud virtual private networks:

• Linux Netfilter/iptables Bottlenecks & The eBPF/XDP Revolution:
  • For decades, Linux packet filtering relied on netfilter kernel hooks (PREROUTING, INPUT, FORWARD, OUTPUT, POSTROUTING) managed via iptables.
  • The Scale Problem: At 100 Gbps line rates in Kubernetes clusters with 20,000 services, sequential iptables rule chains consume massive CPU cycles and cause severe packet latency jitter.
  • The Modern Standard (eBPF & XDP): Cloudflare and Cilium run sandboxed eBPF (Extended Berkeley Packet Filter) programs directly inside the network interface card (NIC) driver layer via XDP (eXpress Data Path). Malicious DDoS packets are dropped before the Linux kernel even allocates an sk_buff memory struct, dropping up to 24 million packets per second per core!
• Cloud Infrastructure: AWS Security Groups vs Network Access Control Lists (NACLs):
  • In cloud architectures (AWS VPC, GCP VPC), network boundaries are software-defined:
    • Network ACLs (NACLs): Stateless packet filters enforced at the subnet boundary. Evaluated sequentially in numerical order (Rule 100, Rule 200). Because they are stateless, an outbound rule must be explicitly provisioned for ephemeral client ports (1024-65535) to allow responses back to clients.
    • Security Groups: Stateful virtual firewalls enforced directly at the Elastic Network Interface (ENI) hypervisor layer. All rules are evaluated simultaneously as a unified whitelist. When an inbound rule permits an external connection, return packets are automatically tracked and permitted by state, regardless of outbound rules.
• Next-Generation Firewalls (NGFW) & TLS Inspection (Palo Alto Networks / Fortinet):
  • Since >95% of enterprise traffic is TLS-encrypted, traditional port-based firewalls are blind to malware payloads traversing port 443.
  • Enterprise NGFWs deploy SSL Forward Proxy Decryption:
    • The NGFW intercepts the client's ClientHello, terminates the TLS connection, and issues a dynamic certificate to the client signed by an internal corporate enterprise CA pre-trusted on employee devices.
    • The firewall decrypts the payload in real-time, executes Deep Packet Inspection (DPI) to block malware and C2 beaconing, and establishes a secondary TLS connection to the destination server.

---

📐 Numerical Applications & Worked Examples

Example 1: Stateless Packet Filter Rule Evaluation & First-Match Order

Problem Statement: An edge router inspects incoming traffic against the following ordered stateless firewall rules:

• Rule 1: ALLOW TCP 10.0.1.0/24 any -> any 80
• Rule 2: DENY IP any any -> 192.168.1.10 any
• Rule 3: ALLOW TCP 10.0.0.0/16 any -> 192.168.1.0/24 443
• Rule 4: DENY TCP any any -> any 80
• Rule 5: ALLOW IP 10.0.0.0/8 any -> any any
• Rule 6 (Default): DENY IP any any -> any any

Evaluate the disposition (ALLOW or DENY) and the exact rule triggered for each of the following incoming packets:

1. Packet A: TCP from 10.0.1.55:51204 destined to 192.168.1.10:80.
2. Packet B: TCP from 10.0.2.14:49152 destined to 192.168.1.10:443.
3. Packet C: TCP from 10.0.2.14:49152 destined to 192.168.1.20:443.
4. Packet D: UDP from 10.5.1.1:53 destined to 8.8.8.8:53.
5. Packet E: TCP from 172.16.0.4:80 destined to 10.0.1.55:51204.

Step-by-Step Solution:

1. Packet A (10.0.1.55:51204 $\to$ 192.168.1.10:80, TCP):
   • Test Rule 1: Source 10.0.1.55 is inside 10.0.1.0/24, protocol is TCP, destination port is 80.
   • Rule 1 matches completely!
   • Action: ALLOW (Triggered by Rule 1).
   • Critical Nuance: Even though Rule 2 explicitly denies all traffic to 192.168.1.10, Rule 1 matched first. Packet filters stop evaluation upon the first matching rule.
2. Packet B (10.0.2.14:49152 $\to$ 192.168.1.10:443, TCP):
   • Test Rule 1: Destination port is 443 $\neq$ 80 (No match).
   • Test Rule 2: Protocol is IP (matches TCP), destination is 192.168.1.10.
   • Rule 2 matches!
   • Action: DENY (Triggered by Rule 2).
   • Note: Rule 3 would have allowed this traffic, but Rule 2 shadows Rule 3 for destination 192.168.1.10.
3. Packet C (10.0.2.14:49152 $\to$ 192.168.1.20:443, TCP):
   • Test Rule 1: Destination port 443 $\neq$ 80 (No match).
   • Test Rule 2: Destination 192.168.1.20 $\neq$ 192.168.1.10 (No match).
   • Test Rule 3: Source 10.0.2.14 is in 10.0.0.0/16, destination 192.168.1.20 is in 192.168.1.0/24, destination port is 443, protocol is TCP.
   • Rule 3 matches completely!
   • Action: ALLOW (Triggered by Rule 3).
4. Packet D (10.5.1.1:53 $\to$ 8.8.8.8:53, UDP):
   • Test Rules 1 to 4: All require protocol TCP (No match for UDP).
   • Test Rule 5: Source 10.5.1.1 is in 10.0.0.0/8, protocol is IP (matches UDP).
   • Rule 5 matches!
   • Action: ALLOW (Triggered by Rule 5).
5. Packet E (172.16.0.4:80 $\to$ 10.0.1.55:51204, TCP):
   • Test Rule 1: Source is 172.16.0.4 $\notin$ 10.0.1.0/24 (No match).
   • Test Rule 2: Destination is 10.0.1.55 $\neq$ 192.168.1.10 (No match).
   • Test Rule 3: Source not in 10.0.0.0/16 (No match).
   • Test Rule 4: Destination port is 51204 $\neq$ 80 (No match; Rule 4 checks destination port 80).
   • Test Rule 5: Source not in 10.0.0.0/8 (No match).
   • Test Rule 6: Default catch-all rule matches.
   • Action: DENY (Triggered by Rule 6 / Default Policy).

---

Example 2: Stateful Connection Table RAM Sizing & SYN Flood Exhaustion

Problem Statement: A stateful boundary firewall protects an enterprise data center on a $10\text{ Gbps}$ transit line.

• The Linux kernel nf_conntrack subsystem stores each tracked session in a pinned data structure consuming $C_{\text{entry}} = 320\text{ bytes}$ of non-paged kernel RAM.
• The firewall table is provisioned with a maximum capacity of $N_{\max} = 2,500,000$ concurrent connection entries.
• The timeout for half-open (embryonic SYN_RECV) TCP connections is configured to $T_{\text{embryo}} = 60\text{ seconds}$.

1. Compute the maximum RAM footprint consumed by the connection tracking table when operating at peak capacity.
2. An attacker launches a distributed TCP SYN flood generating $R_{\text{flood}} = 50,000\text{ spoofed SYN packets/second}$. Assuming zero legitimate background traffic, calculate the exact time $t_{\text{exhaust}}$ taken to completely exhaust the connection table and cause denial of service.
3. If the administrator enables SYN Cookies and lowers the embryonic timeout to $T_{\text{embryo}} = 5\text{ seconds}$, explain mathematically how state table exhaustion is eliminated.

Step-by-Step Solution:

1. Maximum Kernel RAM Allocation: $\text{RAM}_{\text{peak}} = N_{\max} \times C_{\text{entry}} = 2,500,000 \times 320\text{ bytes}$ $\text{RAM}_{\text{peak}} = 800,000,000\text{ bytes} \approx \frac{800,000,000}{1024^2}\text{ MB} \approx \mathbf{762.94\text{ MB}}$
2. Time to State Table Exhaustion ($t_{\text{exhaust}}$):
   • Each incoming spoofed SYN packet creates a new SYN_RECV entry in the conntrack table.
   • Since entries remain alive for $T_{\text{embryo}} = 60\text{ seconds}$, none of the spoofed entries will expire before $60\text{ seconds}$.
   • Time to fill $2,500,000$ entries at $50,000\text{ entries/sec}$: $t_{\text{exhaust}} = \frac{N_{\max}}{R_{\text{flood}}} = \frac{2,500,000}{50,000} = \mathbf{50.0\text{ seconds}}$
   • Within exactly 50 seconds, the kernel logs nf_conntrack: table full, dropping packet. All subsequent legitimate client connection attempts worldwide are dropped!
3. Neutralization via SYN Cookies:
   • When SYN Cookies are activated, the kernel allocates zero memory in the connection table upon receipt of an initial TCP SYN segment.
   • The server encodes the connection parameters into the 32-bit Initial Sequence Number ($ISN$) of the SYN-ACK: $ISN = \text{SHA-1}(S_{\text{IP}} \parallel D_{\text{IP}} \parallel S_{\text{Port}} \parallel D_{\text{Port}} \parallel \text{Secret} \parallel t) + \text{MSS\_Index}$
   • Because spoofed attacker IP addresses never return the final ACK, the flood consumes $0\text{ bytes}$ of connection table memory.
   • Conntrack entries are allocated only when a legitimate client returns the final ACK confirming possession of the authentic IP address, completely neutralizing table exhaustion attacks.

---

Example 3: Deep Packet Inspection & Snort IDS Signature Throughput

Problem Statement: An Intrusion Detection System (IDS) appliance inspects traffic on an enterprise campus link carrying an aggregate throughput of $B = 4\text{ Gbps}$ ($4,000\text{ Mbps}$) with an average packet size of $S_{\text{pkt}} = 1,000\text{ bytes}$.

• The IDS engine evaluates $M = 3,000$ signature rules using the Aho-Corasick multi-pattern string matching algorithm.
• Benchmarks show that a single dedicated CPU core inspects packet payloads at an average processing rate of $R_{\text{core}} = 650\text{ Mbps}$.

1. Compute the packet arrival rate $P_{\text{rate}}$ in packets per second (pps).
2. Calculate the minimum number of dedicated CPU cores $N_{\text{cores}}$ required to inspect all traffic at line rate without packet loss.
3. If campus traffic experiences a $35\%$ traffic burst ($B_{\text{peak}} = 5.4\text{ Gbps}$) while CPU core count remains fixed, compute the percentage of packets that must be dropped if no buffering queue is available.

Step-by-Step Solution:

1. Packet Arrival Rate ($P_{\text{rate}}$):
   • Bits per packet: $\text{Bits}_{\text{pkt}} = 1,000\text{ bytes} \times 8\text{ bits/byte} = 8,000\text{ bits}$
   • Packet rate: $P_{\text{rate}} = \frac{B}{\text{Bits}_{\text{pkt}}} = \frac{4 \times 10^9\text{ bps}}{8,000\text{ bits/pkt}} = \mathbf{500,000\text{ packets/sec (500 kpps)}}$
2. Minimum Dedicated CPU Cores Required ($N_{\text{cores}}$): $N_{\text{cores}} = \left\lceil \frac{B}{R_{\text{core}}} \right\rceil = \left\lceil \frac{4,000\text{ Mbps}}{650\text{ Mbps/core}} \right\rceil = \lceil 6.154 \rceil = \mathbf{7\text{ CPU Cores}}$
   • An 8-core CPU appliance provides $8 \times 650 = 5,200\text{ Mbps}$ ($5.2\text{ Gbps}$) total inspection bandwidth, guaranteeing line-rate Deep Packet Inspection under baseline conditions.
3. Packet Drop Rate Under a $35\%$ Traffic Burst ($B_{\text{peak}} = 5.4\text{ Gbps}$):
   • Total system processing capacity with 7 cores: $C_{\text{total}} = 7 \times 650\text{ Mbps} = 4,550\text{ Mbps} = 4.55\text{ Gbps}$
   • Unprocessed excess bandwidth: $\Delta B = B_{\text{peak}} - C_{\text{total}} = 5.40\text{ Gbps} - 4.55\text{ Gbps} = 0.85\text{ Gbps}$
   • Percentage of dropped packets: $\text{Drop Rate} = \frac{\Delta B}{B_{\text{peak}}} \times 100\% = \frac{0.85}{5.40} \times 100\% \approx \mathbf{15.74\%}$
   • To prevent dropping $15.74\%$ of legitimate traffic, enterprise appliances deploy hardware traffic bypasses (Fail-Open) or hardware offload cards (SmartNICs / FPGA pattern matchers).

---

🎯 Exam & Interview Pitfall Check

Question 1: Contrast Stateless Packet-Filtering Firewalls with Stateful Inspection Firewalls. Explain how an attacker can bypass a stateless firewall rule permitting established TCP connections, and how a stateful firewall prevents this attack.

Answer:

• Stateless vs Stateful Comparison:
  • Stateless Packet Filter: Evaluates each packet in complete isolation against a static rule table matching IP addresses, port numbers, and flags. It maintains no memory or historical context of previous packets.
  • Stateful Inspection Firewall: Maintains a dynamic State Connection Table in kernel memory tracking the status of active TCP connections (handshake stages, sequence numbers, timers) and UDP pseudo-connections.
• The Stateless Bypass Attack:
  • To allow internal clients to browse external web servers, a stateless firewall must contain a rule permitting inbound traffic from external web ports (e.g. Source Port 80) having the TCP ACK control bit set (ACK=1).
  • An external attacker can craft an unsolicited probe packet targeting an arbitrary internal host and port, setting Source Port = 80 and ACK = 1. The stateless firewall inspects the packet in isolation, matches the rule permitting inbound port 80 ACK packets, and forwards the packet into the private LAN.
• Stateful Prevention:
  • A stateful firewall inspects its internal state table when the incoming packet arrives.
  • Because no internal host ever initiated an outbound TCP SYN request matching that 5-tuple session, no corresponding entry exists in the state connection table.
  • The stateful firewall recognizes the packet as an unsolicited, illegitimate segment and drops it immediately, completely neutralizing the attack.

---

Question 2: Explain the architectural concept of a Demilitarized Zone (DMZ). Why are public-facing servers placed in a DMZ rather than directly inside the internal corporate LAN?

Answer:

• DMZ Architecture: A Demilitarized Zone (DMZ) is a perimeter subnetwork located between the untrusted public Internet and the trusted internal corporate network, typically partitioned using a dual-firewall or multi-homed firewall architecture.
• Why Public Servers Are Placed in a DMZ:
  1. Exposure of Public Endpoints: Web, email, and authoritative DNS servers must be directly accessible to arbitrary external clients on the Internet over well-known ports (80, 443, 25). Because they run complex application-layer software, they are prime targets for remote code execution vulnerabilities.
  2. Containment of Breaches: If a public-facing web server were deployed directly inside the internal LAN and subsequently compromised, the attacker would have immediate, unrestricted Layer 2 and Layer 3 access to internal database servers, active directory domain controllers, and employee workstations.
  3. Strict Unidirectional Traffic Policies: In a DMZ architecture, the perimeter firewall enforces strict segregation: external Internet traffic can enter the DMZ on designated ports, and internal LAN hosts can access the DMZ. However, DMZ servers are strictly prohibited from initiating inbound connections into the internal LAN. If a web server in the DMZ is compromised, the attacker remains isolated inside the DMZ and cannot pivot into the core corporate network.

---

Core Conceptual Questions

• What is a Web Application Firewall (WAF)?: Unlike network firewalls that inspect IP and TCP headers, a WAF (such as ModSecurity, Cloudflare WAF, or AWS WAF) operates strictly at Layer 7 (Application Layer). It decodes HTTP/HTTPS requests, inspecting query strings, POST bodies, and headers to detect application-layer attacks like SQL Injection (SQLi), Cross-Site Scripting (XSS), and Cross-Site Request Forgery (CSRF).
• What are SYN Cookies?: When an attacker launches a TCP SYN Flood, they overwhelm a stateful firewall or server by sending millions of spoofed SYN packets, exhausting the state table before completing the handshake. SYN Cookies eliminate the need to allocate memory for semi-open connections: the server encodes the connection state mathematically into the 32-bit initial sequence number of the SYN-ACK packet. Memory is only allocated after the client returns a valid ACK echoing the cookie.

Common Interview Traps

• Trap: Believing an IDS Drops Malicious Traffic: An IDS is purely passive. It sits out-of-band, monitors copied traffic, and generates log alerts. It cannot drop packets. Only an IPS (Intrusion Prevention System) sits inline and physically drops malicious packets in real time.
• Trap: Assuming Packet-Filtering Firewalls Defend Against Malware in Web Downloads: A packet filter only checks ports and IP addresses. If port 443 (HTTPS) is permitted, an employee downloading an encrypted ransomware executable over HTTPS looks completely identical to legitimate web browsing. Detecting payload malware requires a Next-Generation Firewall (NGFW) with TLS Decryption and Deep Packet Inspection (DPI).

---

🗺️View Complete Computer Networks Roadmap & Syllabus

← Previous Topic9.5 Public Key Infrastructure (PKI), Digital Certificates & TLS/SSLNext Topic →10.1 Data Rate Limits: Nyquist Bit Rate & Shannon Channel Capacity