Network filtering controls which packets can cross a network boundary. Stateless filtering evaluates each packet independently using attributes such as source and destination addresses, protocol, and source and destination ports. Stateful filtering maintains a connection or flow table and considers whether a packet belongs to an existing permitted exchange. The critical difference is memory of traffic context, not simply whether a control supports allow or deny rules.
Consider a client opening an HTTPS connection from TCP port 51000 to a server on TCP port 443. A stateful filter that permits the connection can recognize the server's response to the client's port 51000 without requiring a separate rule authorizing a new connection in that direction. A stateless filter needs rules that permit the relevant packets in both directions. Allowing destination port 443 in both directions is insufficient because the response has source port 443 and destination port 51000. Production rules must accommodate the actual ephemeral port ranges used by clients and intermediaries.
Cloud platforms apply these approaches at different enforcement points. In AWS, security groups provide stateful filtering for associated network interfaces. They contain allow rules, and rules from multiple attached security groups are combined; an absent allow results in denial rather than an explicit deny rule. Return traffic for permitted flows is automatically allowed even when the opposite-direction rules would not independently allow it. This does not authorize unrelated connections initiated in the reverse direction.
VPC network access control lists, or network ACLs, provide stateless filtering at subnet boundaries. They support allow and deny rules, evaluate each direction separately, and use the first matching rule in ascending rule-number order. For an internet client reaching a web server, the subnet's ACL must permit inbound HTTPS requests and outbound responses to client ephemeral ports. A broad allow placed before a specific deny can make that deny ineffective. Security groups and network ACLs must both permit traffic where they apply; an allow in one does not override a block in the other.
AWS Network Firewall combines stateless and stateful inspection within a routed firewall deployment. Its stateless engine evaluates traffic first and can pass it, drop it, or forward it to the stateful engine. A stateless pass bypasses stateful inspection, so forwarding actions and default actions must match the inspection design. Route tables must steer the intended traffic through the firewall, and stateful inspection requires symmetric routing through the appropriate firewall endpoint so both directions share connection context.
Stateful filtering simplifies return-path rules but introduces connection-table capacity, idle-timeout behavior, and routing considerations. UDP can also be tracked using flow attributes and timeouts despite lacking TCP's connection handshake. Stateless filtering avoids connection-state maintenance, but its reverse-direction rules can require wider port ranges and cannot establish that a packet is genuinely a response merely from its header fields. Neither approach inherently provides encryption, application authentication, or full payload inspection.
When troubleshooting, trace the forward and return paths separately, checking routes, addresses after translation, ports, rule order, and every applicable control. Use VPC Flow Logs and firewall logs as evidence, recognizing that flow logs do not capture packet payloads. Test new connections after rule changes because tracked sessions may persist until their state expires. Amazon Inspector identifies software vulnerabilities and unintended network exposure; it does not enforce packet-filtering rules and cannot replace a security group, network ACL, or firewall.
Amazon VPC
AWS Network Firewall
Amazon Inspector