Which firewall type keeps track of outbound connections and allows legitimate return traffic while blocking others?

Optimize your success on the FSNA Readiness Exam. Engage with flashcards and multiple choice questions, each designed with hints and explanations. Prepare thoroughly for your test and excel!

A stateful network-based firewall tracks the state of active connections. It keeps a table that records details of each ongoing session—source and destination IPs, ports, and the protocol. When you initiate an outbound connection, the firewall marks that session as established. Incoming traffic is then allowed only if it matches an existing, tracked connection (the legitimate return traffic). Any inbound packet that doesn’t fit an active session is blocked, which prevents unsolicited or potentially harmful traffic from slipping through.

This behavior relies on context, not just isolated packets, which is what makes it distinct from a stateless firewall. A stateless firewall evaluates each packet by fixed rules without considering prior traffic, so it can’t reliably distinguish a valid response from an attack that happens to use the same ports. Proxy firewalls operate at the application layer and proxy connections through the firewall, rather than focusing on connection states. Next-generation firewalls extend stateful filtering with additional features like deep packet inspection and intrusion prevention, but the mechanism described—tracking and validating ongoing connections—defines a stateful approach.