Intuition The ONE core ideaA firewall is a rule-driven gate that reads only the address labels on the front of each
data packet and decides ALLOW or DROP. The entire chapter is one question: should the gate
decide using only the packet in front of it (stateless), or also using a memory of
conversations it already approved (stateful)?
Before you can judge that question, you must be able to read every "address label" a firewall
reads. This page builds each one from nothing — no prior networking assumed. We link the parent
Firewalls topic and the
prerequisite vault notes as they arise.
A packet is one small envelope of data sent across a network. Like a postal envelope it has
two parts: a header (the printed labels on the outside — who it is from, who it is for) and
a payload (the letter inside). A firewall is cheap because it reads only the header , not
the letter.
Intuity Why the topic needs itEverything a firewall inspects — IP addresses, ports, flags — lives in that header rectangle.
Look at the labelled slots in the figure; each following section zooms into one slot.
An IP address is the unique number that identifies one machine on a network, like a street
address for a house. Written as four numbers 0–255 joined by dots, e.g. 10.0.0.5. Every packet
header carries a source IP (who sent it) and a destination IP (who it is for).
Think of the whole internet as a city of houses. The source IP is the return address; the
destination IP is where the envelope is heading. The firewall guards one house (or one street)
and can refuse envelopes from a bad neighbourhood.
Definition Subnet and the/24 notation
A subnet is a block of neighbouring addresses that share a leading part — one "street".
10.0.0.0/24 means "all addresses 10.0.0.0 through 10.0.0.255": the /24 says the first
24 bits (the first three numbers 10.0.0) are fixed , and the last number is free. That is why
the parent's rules say 10.0.0.0/24 — it means "any laptop on our internal street".
Related vault note: OSI Model — Layers 3 and 4 — the IP address lives at Layer 3 .
A port is a number from 0 to 65535 that identifies one program on a machine. One house
(IP) has many doors (ports): door 443 is the HTTPS web server, door 80 is plain HTTP, door 22 is
SSH. The header carries a source port and a destination port .
Intuition Why two ports, not oneThe destination port says which service you want (443 = "I want the secure website"). The
source port is a temporary number your own machine picks so replies can find their way back to
the right browser tab. Look at the figure: the same house has many numbered doors, and a
conversation is "my door 50000 talking to their door 443".
Definition Well-known vs high portsPorts 0–1023 are well-known (reserved for servers: 80, 443, 22…). Ports 1024–65535 are
"high" ports, used as the temporary source port on your own side. That is exactly why the
parent's stateless rule #2 says dst port >1023 — a reply comes back to the high port your
laptop chose , never to a server port.
Ports live at Layer 4 — see OSI Model — Layers 3 and 4 .
Definition Protocol fieldThe header's protocol field says which rulebook the two machines are following. The three
you meet here:
TCP — a reliable conversation with a handshake, acknowledgements, and an orderly goodbye.UDP — fire-and-forget: send a packet, no handshake, no memory.ICMP — tiny control messages like ping.
Intuition Why the topic caresStateful tracking is easy for TCP because TCP has an explicit begin (SYN) and end (FIN/RST) —
the firewall can watch the conversation start and stop. UDP has no such markers, which is why
the parent needs extra helpers for UDP-based protocols.
This is the single most important symbol in the whole parent note, so we build it slowly.
Inside a TCP header sit a few one-bit switches called flags . Each is either 0 (off) or 1
(on). The four that matter:
SYN = "let's start a connection" (SYNchronise).ACK = "I acknowledge what you sent" (ACKnowledge).FIN = "I'm finished, let's close."RST = "reset — abort this connection now."
Intuition Why a bit, and why "set""ACK is set " is jargon for "the ACK bit = 1". A bit is the smallest possible label: a light
that is on or off. The firewall can read these lights instantly, which is why flag-based rules
are so cheap.
See the dedicated note TCP Flags (SYN ACK FIN RST) .
Definition Three-way handshakeTo open a TCP connection, two machines exchange three packets: SYN → SYN-ACK → ACK .
This is the three-way handshake .
Intuition The key fact the whole parent hinges onLook at the figure. Only the very first packet (the SYN) has ACK=0. Every packet after
it has ACK=1. That single truth is why the parent's stateless "allow inbound only if ACK=1"
trick blocks a brand-new inbound connection (its first packet is a bare SYN, ACK=0) while
letting real replies through. It is also why an attacker forging ACK=1 out of thin air can fool
a memoryless filter — the flag looks like an ongoing conversation.
Full details: TCP Three-Way Handshake .
Now stack sections 1–3 together.
A single connection is uniquely named by five header fields together — the 5-tuple :
( srcIP , dstIP , srcPort , dstPort , protocol ) from-house, to-house, from-door, to-door, rulebook. No two live conversations
share all five.
One row = one arrow between a specific door on one house and a specific door on another, in a
specific language. A stateful firewall keeps a notebook (the state table ) with one such row
per conversation it approved. That notebook is the "memory" that separates stateful from
stateless.
A state table (or flow table) is the firewall's list of active 5-tuples plus each one's
current TCP phase (e.g. SYN_SENT, ESTABLISHED). "Stateful" literally means "keeps this
table"; "stateless" means "keeps nothing".
Related: Network Address Translation (NAT) also keeps a per-connection table, and
Access Control Lists (ACLs) are the ordered rule lists a stateless filter walks.
Definition Decision as a functionThe parent writes Decision = f(this packet's header, rule list). Here f ( … ) ALLOW (let it through) or DENY /DROP (throw it away). Deny-by-default means the
last rule is "drop everything not already allowed".
Packet = header + payload
TCP flags SYN ACK FIN RST
Firewalls stateless vs stateful
Each foundation feeds exactly the part of the parent that would otherwise be a mystery symbol.
Cover the right side and test yourself. If any line stumps you, reread its section above.
A packet is made of which two parts? A header (the labels) and a payload (the data inside).
What does an IP address identify? One machine on the network — its "house address".
What does 10.0.0.0/24 mean? All addresses 10.0.0.0–10.0.0.255; the first 24 bits are fixed.
What does a port number identify? One program/service on a machine — a numbered "door".
Why is the reply's destination port >1023? It returns to the high, temporary source port the client chose.
Name the three protocols the firewall distinguishes. TCP, UDP, ICMP.
What does "the ACK flag is set" mean literally? The ACK bit equals 1.
Which is the only TCP packet with ACK=0? The very first SYN of a new connection.
What are the three handshake packets in order? SYN, SYN-ACK, ACK.
List the five fields of the 5-tuple. srcIP, dstIP, srcPort, dstPort, protocol.
What is a state table? The firewall's memory: one row per active 5-tuple plus its TCP phase.
Read p ∈ StateTable "This packet's connection is already in my remembered list."
What does ⟺ "If and only if" — both sides are true together or false together.
