November 2, 2026 · CertCrack Blog

What Is a Firewall? Stateful vs Stateless, Zones, and How Firewalls Really Work

Every network has a border: the point where traffic from the trusted inside meets traffic from the untrusted outside. A firewall is the guard posted at that border. It inspects network traffic and decides, packet by packet, what is allowed through and what is blocked — based on rules written by an administrator, not on guesswork. If you have ever wondered why a game server works on your home network but not from the internet, or why a company's web server is reachable while its internal database is not, the answer is almost always a firewall rule.

What a firewall actually does

At its simplest, a firewall is a filter with a rulebook. Each rule describes traffic — a source address, a destination address, a port, a protocol — and an action: allow or deny. When a packet arrives, the firewall works through its rules in order and applies the first one that matches. Traffic that matches no allow rule is dropped. That last point matters: well-run firewalls end with an implicit deny, meaning "if no rule says this is allowed, block it." Starting from deny-by-default and opening only what is needed is the single most important firewall habit, and it is the opposite of the common beginner mistake: an "allow everything" rule that makes the firewall decorative.

A firewall can sit in different places. A network firewall is a dedicated device (or a function on a router) guarding the boundary between networks. A host firewall is software running on one computer — Windows Firewall is the one most students meet first — guarding just that machine. Big networks use both: the network firewall guards the perimeter, and host firewalls catch anything that gets past it or moves sideways inside the network.

Stateful vs stateless: does it remember?

The distinction exams test most is stateful versus stateless inspection.

A stateless firewall, also called a packet filter, judges every packet on its own, with no memory of what came before. It looks at the packet's source and destination addresses, ports, and protocol, checks the rules, and allows or blocks it. It is fast and simple, but it has a blind spot: it cannot tell whether an incoming packet is a reply to something you requested or an unsolicited knock from a stranger. To let replies back in, a stateless firewall needs explicit rules allowing return traffic — which means opening ports that an attacker can also use.

A stateful firewall keeps a table of active connections. When your laptop sends a request out to a web server, the firewall records that connection: source, destination, ports, protocol, and state. When the reply comes back, the firewall recognises it as part of an existing, legitimate conversation and lets it through — without needing a permanent inbound rule. Traffic that arrives with no matching entry in the state table, and no rule allowing it, is dropped. That memory is what makes a stateful firewall practical for everyday networks: you can browse the web, stream video, and download files without the administrator writing a rule for every reply packet, while unsolicited inbound connections are still blocked.

Most modern firewalls are stateful by default. Stateless packet filtering still appears as a concept — and in simple access control lists (ACLs) on routers — but if an exam question describes a firewall that "tracks connections" or "remembers sessions," the answer is stateful.

Zones: why the web server is not on the same network as the database

A firewall does more than separate "inside" from "outside." It divides a network into zones, and traffic between zones must pass through the firewall and its rules. The classic layout has three zones:

• LAN (trusted): employee workstations and internal servers. Most outbound traffic is allowed; inbound traffic from outside is not.
• DMZ (demilitarised zone, or screened subnet): a middle zone holding servers the public must reach, such as a company website or mail server. The public can reach the DMZ, but the DMZ cannot freely reach the LAN.
• WAN / internet (untrusted): everything outside.

The point of the DMZ is containment. If an attacker compromises the public web server, they land in the DMZ — not on the internal network. The firewall rules between DMZ and LAN are tight: the web server might be allowed to query one specific internal database on one specific port, and nothing else. Without a DMZ, a single compromised public server would expose the whole internal network. If a scenario question asks where to place a public-facing server, the DMZ is almost always the answer.

Types beyond the basics

Packet filtering and stateful inspection are the foundation, but two more types appear on exams and in job descriptions. A proxy or application-layer firewall understands the application itself — it can inspect web traffic at Layer 7, not just addresses and ports — and can block, for example, a specific type of web request rather than a whole connection. A next-generation firewall (NGFW) bundles several functions into one device: stateful inspection plus intrusion prevention, application awareness (knowing that traffic on port 443 is actually a particular app, not just "HTTPS"), and often malware filtering. NGFWs are the standard enterprise choice today, but they are not magic: they still depend on rules, updates, and someone reviewing their logs.

Cloud firewalls follow the same ideas in a different form. Cloud providers offer security groups and network firewalls that filter traffic to virtual machines, and web application firewalls (WAFs) that specialise in protecting web applications from attacks such as SQL injection and cross-site scripting. The concepts — allow/deny rules, default deny, zones — transfer directly.

What a firewall is not

Yesterday's article made one point worth repeating here: NAT is not a firewall. NAT translates addresses and, as a side effect, drops unsolicited inbound packets that match no translation entry. A firewall makes deliberate allow/deny decisions and logs them. A home router usually does both jobs at once, which is why people confuse them — but on an exam, "it blocks inbound traffic" alone does not make something a firewall.

A firewall is also not antivirus, and not a complete security strategy. It cannot stop a user from clicking a phishing link and handing over a password, because that traffic was requested from inside and looks legitimate. It cannot inspect encrypted traffic it has not been configured to decrypt, and it does nothing about an attacker who is already inside the network unless internal segmentation and host firewalls are also in place. Firewalls are one layer; defence in depth means several layers working together.

When something is blocked: a troubleshooting habit

"My app works locally but not over the network" is a classic help-desk ticket, and the firewall is a prime suspect. Work through it in order: is the traffic reaching the firewall at all (check connectivity first); is there a rule allowing it, in the right direction, for the right port and protocol — TCP and UDP are different, and a rule for one does not cover the other; is another firewall in the path (host firewall on the destination machine is the one most often forgotten); and what do the firewall logs say — a denied packet that appears in the log tells you exactly which rule, or lack of one, blocked it. Change one thing at a time, and remember rule order: a broad deny above a specific allow wins, and the specific allow never gets reached.

Exam connection

Firewalls appear across the certifications this site covers. Security+ (SY0-701) tests firewall types — stateful versus stateless, NGFW, host versus network — and where to place them, including the DMZ. Network+ (N10-009) tests the same concepts from the networking side: firewall placement, zones, and ACLs. CCNA (200-301) goes hands-on with access control lists, the router's version of packet filtering, including standard versus extended ACLs and the implicit deny at the end of every list. A+ Core 2 (220-1202) covers the host-firewall side: Windows Firewall settings and the basic security configuration of a workstation. CySA+ (CS0-004) builds on all of it: reading firewall logs, tuning rules, and spotting misconfigurations. Whenever a question mentions "implicit deny," "state table," or "screened subnet," it is testing firewall fundamentals — and the answer usually comes back to default deny and least privilege.

Practical takeaway

Think of a firewall as a border checkpoint with a rulebook and, in the stateful case, a logbook of who is already inside legitimately. The rulebook says what kinds of traffic may cross; the logbook lets replies to your own requests back in without leaving the gate permanently open. Keep the default at deny, open only what a service actually needs, put public servers in a DMZ rather than on the internal network, and check the logs before assuming a blocked app is broken. That discipline — deny by default, least privilege, zones, and logs — is what exam questions and real networks both reward.

FAQ

Is the firewall on my home router enough?

For a home network, a stateful firewall on the router plus the host firewall on each device is a reasonable baseline. It blocks unsolicited inbound connections. It does not replace keeping software updated, using strong unique passwords, or being careful with phishing — those are separate layers.

What is the difference between a firewall and an ACL?

An access control list is a list of allow/deny rules; a firewall is a device or program that enforces such a list, often with stateful tracking and logging added. On a router, ACLs are the basic form of packet filtering; on a dedicated firewall, ACL-style rules are one part of a larger feature set.

Why do exam questions keep saying "implicit deny"?

Because it is the safety net. With an implicit deny at the end of the rule list, a missing or mistyped rule fails closed — traffic is blocked — instead of failing open and letting anything through. Every well-designed firewall and ACL ends with one, even when it is not written as an explicit rule.