A stateful firewall tracks active connections in a state table. When an internal host starts a connection, the firewall remembers it. Return traffic matching that connection is automatically allowed.
Benefits of stateful inspection:
- You don't need rules for return traffic
- The firewall blocks spoofed packets claiming to be responses
- It detects connection anomalies
If a host at connects to a web server, the firewall notes this. Return traffic from the server is permitted automatically because the firewall knows it's part of an established connection.