4.3.29 · D1Firewalls — stateless vs stateful packet filtering
Ek firewall ek rule-driven gate hai jo har data packet ke upar sirf address labels padhta hai
aur decide karta hai ALLOW ya DROP. Poora chapter ek hi sawaal hai: kya gate ko sirf apne saamne
wale packet ke basis par decide karna chahiye (stateless), ya un conversations ki memory se
bhi jo usne already approve ki hain (stateful)?
Is sawaal ko judge karne se pehle, tumhe har woh "address label" padhna aana chahiye jo ek firewall
padhta hai. Yeh page unhe ek-ek karke bilkul scratch se banata hai — koi bhi prior networking
knowledge assume nahi ki gayi. Hum parent
Firewalls topic aur
prerequisite vault notes ko unke aane par link karte hain.
Packet ek network par bheji gayi data ki ek chhoti si envelope hoti hai. Ek postal envelope
ki tarah iske do parts hote hain: ek header (bahar ki printed labels — yeh kisse aaya, yeh
kiske liye hai) aur ek payload (andar ka letter). Firewall sasta isliye hota hai kyunki yeh
sirf header padhta hai, letter nahi.
Intuity Topic ko isko kyun chahiyeJo kuch bhi ek firewall inspect karta hai — IP addresses, ports, flags — woh sab us header
rectangle mein hota hai. Figure mein labelled slots dekho; aane wala har section ek slot ko
zoom in karta hai.
IP address ek unique number hai jo network par ek machine ko identify karta hai, jaise ek
ghar ka street address. Char numbers 0–255 ko dots se jod kar likha jaata hai, jaise 10.0.0.5.
Har packet header ek source IP (kisne bheja) aur ek destination IP (kiske liye hai) carry
karta hai.
Poore internet ko ek shehar ke gharon ki tarah socho. Source IP return address hai; destination
IP woh jagah hai jahan envelope ja rahi hai. Firewall ek ghar (ya ek street) ki raksha karta hai
aur kisi bure neighbourhood se aayi envelopes ko refuse kar sakta hai.
/24 notation
Subnet neighbouring addresses ka ek block hota hai jo ek leading part share karte hain — ek
"street". 10.0.0.0/24 ka matlab hai "saare addresses 10.0.0.0 se 10.0.0.255 tak": /24
kehta hai pehle 24 bits (pehle teen numbers 10.0.0) fixed hain , aur aakhri number free hai.
Isliye parent ki rules mein 10.0.0.0/24 likha hai — iska matlab hai "humaari internal street
par koi bhi laptop".
Related vault note: OSI Model — Layers 3 and 4 — IP address Layer 3 par rehta hai.
Port 0 se 65535 tak ek number hota hai jo ek machine par ek program ko identify karta
hai. Ek ghar (IP) ke kai darwaaze (ports) hote hain: darwaza 443 HTTPS web server hai, darwaza
80 plain HTTP hai, darwaza 22 SSH hai. Header ek source port aur ek destination port
carry karta hai.
Intuition Do ports kyun, ek kyun nahiDestination port kehta hai tumhe kaun si service chahiye (443 = "mujhe secure website chahiye").
Source port ek temporary number hai jo tumhari apni machine choose karti hai taaki replies sahi
browser tab tak apna raasta dhundh sakein. Figure dekho: usi ghar ke kai numbered darwaaze hain,
aur ek conversation hai "mera darwaza 50000 unke darwaaze 443 se baat kar raha hai".
Definition Well-known vs high portsPorts 0–1023 well-known hain (servers ke liye reserved: 80, 443, 22…). Ports 1024–65535
"high" ports hain, jo tumhari apni side par temporary source port ke roop mein use hote hain.
Isliye parent ki stateless rule #2 mein dst port >1023 likha hai — reply us high port par
wapas aati hai jo tumhare laptop ne choose kiya tha , kisi server port par kabhi nahi.
Ports Layer 4 par rehte hain — dekho OSI Model — Layers 3 and 4 .
Definition Protocol fieldHeader ka protocol field kehta hai ki do machines kaun sa rulebook follow kar rahi hain.
Teen jo tumhe yahan milenge:
TCP — ek reliable conversation jisme handshake, acknowledgements, aur ek orderly goodbye
hoti hai.UDP — fire-and-forget: packet bhejo, koi handshake nahi, koi memory nahi.ICMP — chhote control messages jaise ping.
Intuition Topic ko isko kyun fark padta haiStateful tracking TCP ke liye aasaan hai kyunki TCP ka ek explicit begin (SYN) aur end
(FIN/RST) hota hai — firewall conversation ko shuru aur khatam hote dekh sakta hai. UDP mein
aise koi markers nahi hain, isliye parent ko UDP-based protocols ke liye extra helpers chahiye
hote hain.
Yeh poore parent note mein sabse important symbol hai, isliye ise dheere-dheere banate hain.
Ek TCP header ke andar kuch one-bit switches hote hain jinhein flags kehte hain. Har ek ya
to 0 (off) ya 1 (on) hota hai. Jo char matter karte hain:
SYN = "chalo connection shuru karte hain" (SYNchronise).ACK = "jo tumne bheja maine acknowledge kiya" (ACKnowledge).FIN = "main khatam ho gaya, chalo band karte hain."RST = "reset — abhi is connection ko abort karo."
Intuition Ek bit kyun, aur "set" kyun"ACK is set " ka jargon hai "ACK bit = 1". Ek bit sabse chhota possible label hai: ek light
jo on ya off hoti hai. Firewall in lights ko instantly padh sakta hai, isliye flag-based rules
itni sasti hoti hain.
Dedicated note dekho TCP Flags (SYN ACK FIN RST) .
Definition Three-way handshakeEk TCP connection kholne ke liye, do machines teen packets exchange karti hain: SYN →
SYN-ACK → ACK . Yahi three-way handshake hai.
Intuition Woh key fact jis par poora parent note tika hua haiFigure dekho. Sirf pehla packet (SYN) ACK=0 ke saath hota hai. Har packet uske baad
ACK=1 ke saath hota hai. Yeh ek sachchi baat hi reason hai ki parent ki stateless "allow inbound
sirf tabhi jab ACK=1 ho" trick ek brand-new inbound connection ko block karti hai (uska pehla
packet ek bare SYN hai, ACK=0) jabki real replies ko through jaane deti hai. Isliye bhi ek
attacker jo ACK=1 forge karta hai hawa se woh ek memoryless filter ko fool kar sakta hai —
flag aisa lagta hai jaise ongoing conversation hai.
Poori details: TCP Three-Way Handshake .
Ab sections 1–3 ko ek saath stack karo.
Ek single connection ko paanch header fields milke uniquely name karti hain — 5-tuple :
( srcIP , dstIP , srcPort , dstPort , protocol ) from-house, to-house, from-door, to-door, rulebook. Koi bhi do live conversations
paanchon fields share nahi karti.
Ek row = ek ghar ke ek specific darwaaze aur doosre ghar ke ek specific darwaaze ke beech ek
specific language mein ek arrow. Ek stateful firewall ek notebook (the state table ) rakhta
hai jisme har approved conversation ki ek aisi row hoti hai. Woh notebook hi woh "memory" hai
jo stateful ko stateless se alag karti hai.
State table (ya flow table) firewall ki active 5-tuples ki list hoti hai jisme har ek ka
current TCP phase bhi hota hai (jaise SYN_SENT, ESTABLISHED). "Stateful" ka literally matlab
hai "yeh table rakhta hai"; "stateless" ka matlab hai "kuch nahi rakhta".
Related: Network Address Translation (NAT) bhi per-connection table rakhta hai, aur
Access Control Lists (ACLs) woh ordered rule lists hain jinhein ek stateless filter walk
karta hai.
Definition Decision as a functionParent likhta hai Decision = f(this packet's header, rule list). Yahan f ( … ) ALLOW (jaane do) ya DENY /DROP (phenk do). Deny-by-default ka
matlab hai aakhri rule hai "jo pehle se allow nahi hua woh sab drop karo".
Packet = header + payload
TCP flags SYN ACK FIN RST
Firewalls stateless vs stateful
Har foundation parent ke exactly us part ko feed karta hai jo warna ek mystery symbol hota.
Daayein side ko cover karo aur khud ko test karo. Agar koi line atka de, uska section upar se
dobara padho.
Ek packet ke kaun se do parts hote hain? Ek header (labels) aur ek payload (andar ka data).
IP address kya identify karta hai? Network par ek machine — uska "ghar ka address".
10.0.0.0/24 ka kya matlab hai?Saare addresses 10.0.0.0–10.0.0.255; pehle 24 bits fixed hain.
Port number kya identify karta hai? Machine par ek program/service — ek numbered "darwaza".
Reply ka destination port >1023 kyun hota hai? Yeh us high, temporary source port par wapas aata hai jo client ne choose kiya tha.
Un teen protocols ke naam batao jo firewall distinguish karta hai. TCP, UDP, ICMP.
"The ACK flag is set" ka literally kya matlab hai? ACK bit 1 ke barabar hai.
ACK=0 ke saath kaun sa aakela TCP packet hota hai? Ek nayi connection ka sabse pehla SYN.
Teen handshake packets order mein kya hain? SYN, SYN-ACK, ACK.
5-tuple ke paanch fields list karo. srcIP, dstIP, srcPort, dstPort, protocol.
State table kya hoti hai? Firewall ki memory: har active 5-tuple ka ek row plus uska TCP phase.
p ∈ StateTable "Is packet ki connection pehle se mere remembered list mein hai."
⟺ "If and only if" — dono sides ek saath sach hain ya ek saath jhooth.
