Firewalls: Stateless vs Stateful vs NGFW | AP Cybersecurity
Firewalls Explained: Stateless vs Stateful vs Next-Gen (+ ACLs)
A firewall allows or denies network traffic based on rules. Topic 3.4 covers the firewall types (stateless, stateful, next-generation) and how an access control list (ACL) decides what gets through.
Contents
The three firewall types
A stateless firewall filters each packet on its own, based on fixed rules (such as source, destination, and port), without remembering past traffic. A stateful firewall tracks the state of connections, so it can allow return traffic for a connection it already approved.
A next-generation firewall (NGFW) has both capabilities plus more, such as application awareness and intrusion-prevention features. More capability generally means more inspection of each packet.
A firewall allows reply traffic for a connection the internal user started, but blocks unsolicited inbound traffic. Which type is this?
Reveal answer
A stateful firewall. It tracks connection state, so it recognizes the reply as part of an approved connection while blocking unrelated inbound traffic.
Stateless = per-packet, no memory. Stateful = tracks connections. NGFW = both plus extra inspection.
How ACL rules work
A firewall enforces an access control list: an ordered set of rules that allow or deny traffic. Rules are checked in order, and the first matching rule applies, so rule order changes behavior. A typical rule specifies the direction of traffic along with source, destination, and port.
Placement matters too: each network segment and each point of data ingress and egress should have appropriate firewall rules, which ties firewalls to segmentation.
An ACL has an 'allow all' rule above a 'deny database access' rule. What happens to database traffic?
Reveal answer
It is allowed. Rules are checked in order and the first match applies, so the broad allow rule matches first and the later deny is never reached. Order must be fixed.
From stateless to next-gen
Early firewalls filtered packet by packet. Stateful firewalls that track connections became standard, and next-generation firewalls now add application awareness and intrusion prevention to the same device.
More capability means more inspection per packet.
Key Terms
| Firewall | A control that allows or denies network traffic. |
| Stateless | Filters each packet against fixed rules. |
| Stateful | Tracks connection state to allow replies. |
| ACL | An ordered list of allow and deny rules. |
| NGFW | A firewall with stateful, stateless, and added features. |
Match It Up
Common Mistakes
Confusing stateless and stateful
Stateless filters each packet alone; stateful tracks connection state.
Ignoring ACL rule order
Rules apply first-match, so order changes the outcome.
Thinking a firewall inspects content by default
Basic firewalls filter by header fields; deep inspection is an NGFW feature.
Placing firewalls only at the perimeter
Each segment and ingress/egress point should have appropriate rules.
Check for Understanding
Frequently Asked Questions
Get in Touch
Whether you're a student, parent, or teacher — I'd love to hear from you.
Just want free AP CS resources?
Enter your email below and check the subscribe box — no message needed. Students get daily practice questions and study tips. Teachers get curriculum resources and teaching strategies.
Message Sent!
Thanks for reaching out. I'll get back to you within 24 hours.
Prefer email? Reach me directly at [email protected]