Network Security
Firewalls, Deeper Than the Basics
Cybersecurity Fundamentals introduced firewalls as traffic rules. Here's what a rule actually looks like, and the one distinction that matters most: stateless vs stateful filtering.
A stateless firewall checks each packet in isolation against its rule list, every single time, with no memory of what came before. A stateful firewall tracks active connections, so once it's allowed the first packet of a legitimate connection, it automatically allows the return traffic for that same connection without re-checking every rule. Almost every modern firewall, including the one built into your OS, is stateful, it's both faster and more secure, since it can spot traffic that doesn't belong to any connection it actually opened.
# A typical stateful firewall rule, in a common plain-English style:
ALLOW tcp port 443 from any # let HTTPS traffic in from anywhere
ALLOW tcp port 22 from 10.0.0.0/24 # SSH, but only from this internal network
DENY all all from any # block everything else by defaultThe order matters: rules are usually checked top to bottom, and the first match wins. That final DENY-all rule is called a default-deny policy, explicitly blocking anything not already allowed above it, rather than hoping nothing dangerous was missed.