Cyber Security Controls Demystified Part 4 - Packet Filtering Firewall

In this episode, we break down what a Packet Filtering Firewall is, how it works at the most fundamental level of network security and why it still plays an important role in modern cyber security architectures despite being one of the oldest firewall technologies in existence. 

Duration: 0:20:36

Visit https://www.wecyberyou.com for more cyber security education, resources and awareness content like this. 

Thank you for listening. 
WeCyberYou! Team

Transcript

SPEAKER_00 0:00

Um imagine for just a second that you were running the door at like the most exclusive high traffic nightclub in the entire world.

SPEAKER_01 0:07

Okay, well that sounds stressful already.

SPEAKER_00 0:09

Right. But there is a massive catch here. You have to check the ID of every single person who wants to come in or leave in less than a microsecond.

SPEAKER_01 0:18

Oh wow. Good luck with that.

SPEAKER_00 0:20

Yeah. And one more thing. Every time you blink, you get complete amnesia.

SPEAKER_01 0:25

Like, what?

SPEAKER_00 0:26

You forget everyone you have ever met, even the person you just let inside a split second ago, completely gone from your memory. So how do you possibly decide who gets in and who gets blocked?

SPEAKER_01 0:38

I mean, it sounds like an absolute nightmare scenario for running a nightclub. But that, you know, that amnesiac bouncer actually forms the bedrock of how we secure modern computer networks.

SPEAKER_00 0:48

Welcome to the WeCyber U Unlocked Podcast. And just a quick reminder if you are new here, go ahead and hit that follow button and definitely visit WeCyberU.com for more deep dives into the tech that runs our world.

SPEAKER_01 0:59

We've got some great stuff on there.

SPEAKER_00 1:00

We really do. But today, our mission for this deep dive is to figure out how this uh this flawed, forgetful technology, which is known as the packet filtering firewall or the stateless firewall, how it still acts as the invisible bouncer for networks worldwide.

SPEAKER_01 1:16

And it is a incredibly critical topic to explore for you listening because the stateless firewall is, well, it's one of the earliest firewall designs out there. It operates primarily at what we call the OSI network layer, which is layer three, and the transport layer, layer four.

SPEAKER_00 1:31

Aaron Powell, which sounds super old school.

SPEAKER_01 1:33

Aaron Powell It does. It might sound like ancient history and internet years, but it is far from obsolete. You really can't grasp how modern complex cybersecurity works until you understand the you know the raw mechanics of this foundational layer.

SPEAKER_00 1:45

Aaron Powell Okay, let's unpack this because before we can figure out how this firewall stops threats, we need to understand exactly what it is looking at, right?

SPEAKER_01 1:53

Absolutely.

SPEAKER_00 1:53

Aaron Powell We throw the word data around constantly, but for you listening right now, when you send an email or load a web page or even just stream this audio, that data does not travel across the internet in one giant solid block.

SPEAKER_01 2:06

Aaron Powell No, not at all.

SPEAKER_00 2:07

Aaron Powell It gets shattered into like thousands of tiny independent units called packets.

SPEAKER_01 2:12

Aaron Powell That's a great visual. I mean, on your end, your device reassembled everything so the audio plays smoothly. But out in transit on the internet wires, it is just a chaotic, high-speed stream of these fragmented packets.

SPEAKER_00 2:25

Aaron Powell So imagine a single packet is a physical letter you were dropping in the mail. That letter has two distinct parts.

SPEAKER_01 2:31

Okay.

SPEAKER_00 2:32

First, you have the envelope itself. That has all the routing metadata on the outside, the return address, the destination address, the zip code. We call this the header.

SPEAKER_01 2:41

Right, the header.

SPEAKER_00 2:42

Then you have the actual letter folded up inside the envelope. That's the information you actually care about reading. We call that the payload.

SPEAKER_01 2:49

And that analogy maps perfectly to the technology. And this really brings us to the crucial imitation of the stateless firewall.

SPEAKER_00 2:56

Which is.

SPEAKER_01 2:57

It only looks at the outside of the envelope.

SPEAKER_00 2:59

Just the header.

SPEAKER_01 3:00

Just the header. It does not care at all about the payload inside. It simply will not open the envelope to see if the letter contains a friendly greeting or, you know, a malicious computer virus.

SPEAKER_00 3:10

Aaron Powell, so it's totally blind to the content.

SPEAKER_01 3:12

Completely blind. I mean it is making its entire security judgment based strictly on the routing information printed on the outside.

SPEAKER_00 3:18

Okay, so if it is like legally blind to the actual letter and can only read the envelope, how is it deciding what to do with it without slowing down the entire digital mailroom?

SPEAKER_01 3:30

Aaron Powell Well, it uses something called an access control list. You'll usually hear it referred to as an ECL.

SPEAKER_00 3:35

Ah, so this is the bouncer's clipboard.

SPEAKER_01 3:37

Spot on the clipboard. These firewalls usually sit right at the boundaries of a network. Think of like the perimeter routers connecting an office building to the broader internet. Okay. Yeah. They are armed with this ACL, which is essentially a really rigid, predefined rule book. As each packet arrives, the firewall checks the header against a specific set of criteria.

SPEAKER_00 3:58

Aaron Powell I want to make this tangible for the listener though. What exact metadata is it pulling off that envelope?

SPEAKER_01 4:04

Aaron Powell So it looks at four main things. First, where is the packet from? That's the source IP address. Second, where is it going? That's the destination IP. Third, it checks the source and destination ports.

SPEAKER_00 4:16

Aaron Powell Let's pause on ports for a second because that definitely trips people up.

SPEAKER_01 4:19

It does, yeah.

SPEAKER_00 4:20

If the IP address is, say, the street address of an apartment building, the port is the specific apartment number inside, right?

SPEAKER_01 4:26

Aaron Powell That is a brilliant way to frame it. So a server has thousands of these apartment doors or ports designated for different services.

SPEAKER_00 4:34

Aaron Powell You mean example.

SPEAKER_01 4:36

Sure. So if you are browsing the web securely, that traffic is expected to go to port 443, which handles HTTPS. Got it. But on the other hand, it might look for traffic headed to port 23, which handles Telnet. And Telnet is a very old, unencrypted, and highly insecure protocol.

SPEAKER_00 4:53

Right, we don't want that.

SPEAKER_01 4:54

Exactly. And finally, the fourth thing it checks is the protocol type itself. Is this a TCP connection, a UDP stream, or an ICMP ping request?

SPEAKER_00 5:04

Aaron Powell Okay, let's do a quick ELI5 explain protocol. Like I'm five on those protocols because that alphabet soup can get confusing fast.

SPEAKER_01 5:12

Aaron Powell Fair enough. So TCP is like sending a certified letter.

SPEAKER_00 5:15

Okay.

SPEAKER_01 5:16

The sender and the receiver have to verify delivery. It is highly reliable.

SPEAKER_00 5:20

And UDP.

SPEAKER_01 5:20

UDP is more like a paper boy throwing a newspaper onto your porch from a moving bicycle. Nice. You hope it gets there, but nobody is stopping to check signatures. It's used for things that need to be fast, like live video streaming.

SPEAKER_00 5:34

Aaron Powell And the last one, ICMP.

SPEAKER_01 5:37

ICMP is basically just a sonar ping. It's one computer saying, Hey, are you awake? And the other replying, Yes, I am.

SPEAKER_00 5:43

So the firewall is reading these metadata fields, the IPs, the ports and protocols, and running them through a logic tree. And looking at our notes for this deep dive, that logic tree is shockingly simple.

SPEAKER_01 5:56

It really is.

SPEAKER_00 5:57

It processes top down like this. Rule number one, does this envelope match an allow rule on my clipboard? Yeah. If yes, forward it, open the door. Exactly. If it didn't match an allow rule, we move to step two. Does it match a deny rule? If yes, drop it into the trash. And step three, what if no rule applies at all? Then you hit the default policy, which in any secure environment is going to be a default deny. When in doubt, kick them out.

SPEAKER_01 6:22

You have the exact workflow there. To give you a concrete example from the research, an ACL rule set might literally read Rule 1, allow TCP traffic from any IP address to port 443.

SPEAKER_00 6:33

Which lets normal secure web traffic into the building.

SPEAKER_01 6:35

Right. But the next rule might say: Rule two, block all traffic to port 23. That shuts down anyone trying to use that insecure Telnet protocol. Okay. A third rule could say, rule three, block all ICMP traffic from the outside. That stops external hackers from pinging your network just to map out which computers are currently turned on.

SPEAKER_00 6:56

The firewall just goes down this list rule by rule, top to bottom. And honestly, if you are listening to this right now on a cell connection, your packets are passing through a stateless ACL at your provider's edge router, literally millions of them a second, just to get this audio to your device.

SPEAKER_01 7:10

The sheer volume is staggering. And because it is only checking metadata against a simple text list, decisions are being made in a fraction of a microsecond.

SPEAKER_00 7:19

See, here is where I have to push back a bit. Okay. Because in technology, speed almost always comes at a massive cost. Processing millions of packets in microseconds is phenomenally fast. What corners is this firewall cutting to achieve that kind of velocity?

SPEAKER_01 7:36

The corner it cuts is memory, which brings us to the core concept of why it is called a stateless firewall in the first place. Exactly. The defining characteristic of this system is that it maintains zero state. It has no memory of past events.

SPEAKER_00 7:51

None at all.

SPEAKER_01 7:52

None. It does not track active connections. It doesn't understand login sessions or web browsing flows. It doesn't maintain a connection table of who is talking to whom. Every single packet is judged in total isolation.

SPEAKER_00 8:05

Aaron Powell Why is memory such a bottleneck, though? Why not just give the firewall a little bit of RAM so it can remember what it did like a second ago?

SPEAKER_01 8:12

Because memory tracking is incredibly computationally expensive. For a firewall to remember a conversation, which is what we call stateful inspection, it has to create a massive spreadsheet in its active memory.

SPEAKER_00 8:23

Like a ledger.

SPEAKER_01 8:24

Right. Every time a new connection starts, it writes down computer A is talking to server B on port 443. Okay. For every single packet that arrives after that, the firewall's processor has to pause, search that massive spreadsheet, find the matching entry, verify the context, and then make a decision. Oh wow. Doing that for 10 million packets a second requires massive, expensive processors and huge amounts of RAM. A stateless firewall skips the spreadsheet entirely. It just looks at the clipboard, looks at the envelope, and says yes or no.

SPEAKER_00 8:57

Okay. That makes sense from a hardware perspective. Yeah. But from a functional perspective, I want to make sure you and I are on the same page and that you, listening, can visualize the real world consequence of this.

SPEAKER_01 9:08

Sure. Let's do a scenario.

SPEAKER_00 9:09

Let's say I try to connect to my bank's secure website.

SPEAKER_01 9:11

Okay.

SPEAKER_00 9:12

I send a packet out from my laptop saying, hey, let's start an HTTPS connection. My stateless firewall looks at the envelope, sees port 443, says, okay, that's allowed, and sends it out.

SPEAKER_01 9:22

Yep. So far, so good.

SPEAKER_00 9:23

The bank server gets it and replies with my encrypted account data. That return packet hits my firewall. Are you telling me the firewall looks at the returning data and goes, Who are you? I've never met you. Because it literally forgot my initial request sent a millisecond ago.

SPEAKER_01 9:40

What's fascinating here is yes, that is exactly what happens. It evaluates that return packet entirely on its own merits, completely blind to the fact that you just asked for it.

SPEAKER_00 9:50

Aaron Powell That seems like it would fundamentally break the internet. I mean, if if it forgets I asked for the data, how does the bank's reply actually get back to my laptop?

SPEAKER_01 9:58

Trevor Burrus, Jr. It requires incredibly careful and honestly sometimes risky configuration by network administrators.

SPEAKER_00 10:05

How so?

SPEAKER_01 10:06

Because the firewall doesn't remember outbound requests, the administrator has to write a permanent rule on the clipboard that says allow all inbound traffic from any high-numbered port just to ensure return traffic can make it back through.

SPEAKER_00 10:18

Wait, wait, but by opening up all those ports permanently, you are leaving massive holes in your defense. Yep. You are essentially telling the bouncer to let anyone in, as long as they were wearing a certain color shirt, without verifying if they're actually part of the party.

SPEAKER_01 10:32

It is a massive structural weakness. You might allow inbound packets without ever verifying the context of the conversation.

SPEAKER_00 10:39

So if this technology has total amnesia and it only looks at the outside of the envelope, it must be incredibly easy to fool. Let's get into the fatal flaws here. If I'm a hacker and I know you are running a stateless firewall, how am I exploiting those blind spots?

SPEAKER_01 10:57

Well, the most obvious method is IP spoofing.

SPEAKER_00 10:59

Okay, let's break down the mechanics of that. If the firewall literally doesn't remember a packet from a microsecond ago and it can't look inside the envelope, couldn't an attacker just grab a pen and write a fake return address on the outside of the envelope?

SPEAKER_01 11:12

That is exactly what IP spoofing is. In a more advanced, stateful system, the firewall watches the entire TCP handshake, that certified mail process we talked about earlier. Right. It watches the two computers actively verify each other's identities before opening the door, but a stateless firewall doesn't track handshakes.

SPEAKER_00 11:29

Aaron Powell Because it has no memory.

SPEAKER_01 11:30

Right. It just looks at the return address seal of the header. If the hacker alters their packet header to say, I am coming from the CEO's trusted internal IP address, the stateless firewall has no mechanism to verify if that is true.

SPEAKER_00 11:43

It just looks at the fake name tags and says, Welcome back, boss, and waves them right through.

SPEAKER_01 11:47

Absolutely. It just waves them through. But the flaws get much worse when we talk about what is hiding inside the envelope.

SPEAKER_00 11:54

Oh, right. The payload.

SPEAKER_01 11:55

Because there is no payload inspection, a stateless firewall is completely oblivious to application layer attacks.

SPEAKER_00 12:02

Aaron Powell Like in SQL injection.

SPEAKER_01 12:03

Exactly. Let's explain what that actually looks like to the firewall. An attacker decides to tarnet your customer database. They craft a standard web request addressed to your web server on port 443. Okay. The stateless firewall checks the header, destination port 443, that's our web server, allowed. It forwards the packet.

SPEAKER_00 12:23

But it never opens the envelope to read the letter inside. And the letter inside doesn't say please load the home page. The letter says command delete the entire user database.

SPEAKER_01 12:33

And by the time the database server reads that malicious payload, the firewall has already gone back to checking the next packet. Wow. It is equally blind to cross-site scripting or XSS attacks, where hackers embed malicious code into web pages to steal user data, or malicious API requests, or actual destructive malware hidden right there in the payload.

SPEAKER_00 12:55

Because of this, stateless firewalls are basically useless against advanced persistent threats APTs.

SPEAKER_01 13:01

Totally uses. That's a fair question.

SPEAKER_00 13:39

If it is so deeply flawed, why did you say at the beginning that it remains a vital building block? Let's balance the scales here. What are its undeniable strengths?

SPEAKER_01 13:49

Well, consider the alternative. If you try to deeply inspect every single piece of data hitting your network, your network will literally grind to a halt. The advantages of the stateless firewall all stem directly from its simplicity. Because it isn't doing heavy memory tracking and it isn't opening envelopes to read payloads, its resource consumption is almost zero.

SPEAKER_00 14:10

Oh, so it doesn't need a massive power-hungry processor or expensive RAM to do its job.

SPEAKER_01 14:15

Right. And because it operates on a straightforward text-based logic tree, it is incredibly easy to configure.

SPEAKER_00 14:22

No PhD required.

SPEAKER_01 14:23

Exactly. You do not need a team of high-level security analysts to set up a basic access control list. Furthermore, it is incredibly cost-effective.

SPEAKER_00 14:32

Which companies love.

SPEAKER_01 14:33

Whoa, they love it. You don't have to buy a dedicated $50,000 security appliance to get stateless filtering. This capability is usually built natively into the basic routers and network switches a company already owns.

SPEAKER_00 14:45

So it basically serves as the ultimate triage tool. It's cheap, it's lightning fast, and it weeds out 90% of the obvious internet background noise, the automated scanners, the bulk ping requests without breaking a sweat.

SPEAKER_01 14:59

That's it. It handles the sheer volume of noise so your expensive equipment doesn't have to.

SPEAKER_00 15:03

So for you listening right now, if you look around your home or your office, where is this fast but flawed technology actually operating at this very second?

SPEAKER_01 15:13

Oh, you are almost certainly using one right now. The basic filtering on your home Wi-Fi router relies heavily on stateless packet filtering to block random inbound internet traffic.

SPEAKER_00 15:23

Makes sense.

SPEAKER_01 15:23

Embedded systems and IoT devices, think about the smart thermostat on your wall, or a connected baby monitor, they often rely on stateless filtering because their tiny internal chips just don't have the computing power for anything heavier.

SPEAKER_00 15:36

And what about in massive corporate environments?

SPEAKER_01 15:38

In the corporate enterprise world, you will find stateless firewalls acting as the primary perimeter ACLs on massive heavy-duty network switches. They sit at the very edge of the corporate boundary, absorbing and filtering massive volumes of raw traffic from the open internet.

SPEAKER_00 15:55

Just swatting away the easy stuff.

SPEAKER_01 15:57

Yep.

SPEAKER_00 15:58

But and this is the absolute key to modern cybersecurity architecture.

SPEAKER_01 16:02

Yep.

SPEAKER_00 16:02

You never ever use a stateless firewall alone anymore.

SPEAKER_01 16:06

Never.

SPEAKER_00 16:06

Because if you do, you are leaving your servers wide open to that SQL injection bomb we talked about earlier.

SPEAKER_01 16:12

Exactly. If we connect this to the bigger picture, modern security is built entirely upon the layered defense concept.

SPEAKER_00 16:18

Okay.

SPEAKER_01 16:19

The stateless firewall is just the outermost wall of the castle.

SPEAKER_00 16:22

And this is where it gets incredibly cool. Because looking at our deep dive research, the stateless firewall isn't working alone. It is backed up by an absolute all-star team of security tools.

SPEAKER_01 16:33

It really is.

SPEAKER_00 16:33

Let's run down the gauntlet. If a malicious packet somehow sneaks past our fast amnesiac bouncer at the front gate, what does it run into next?

SPEAKER_01 16:41

The very next layer it hits is usually a stateful firewall.

SPEAKER_00 16:45

Ah. The bouncer that actually remembers faces.

SPEAKER_01 16:48

Right.

SPEAKER_00 16:49

The stateful firewall creates that memory spreadsheet. It tracks active connections, so it knows if you actually requested that returning web page, and it will only let the reply back in if it matches an open session in its memory.

SPEAKER_01 17:03

But remember, even a traditional stateful firewall might not open the envelope, it just verifies the flow of the conversation.

SPEAKER_00 17:10

Aaron Powell, which is why the packet then hits the next generation firewall or the NGFW. These act like the heavy-duty security guards. They actually open the envelope.

SPEAKER_01 17:18

They do. They perform deep packet inspection, look at the payload itself, and understand application behavior to see if the letter contains a virus.

SPEAKER_00 17:26

And it doesn't stop there.

SPEAKER_01 17:27

No, we can take it even further. Depending on the environment, the traffic might then pass through a web application firewall, a WAF.

SPEAKER_00 17:34

The WAF is essentially a highly specialized bodyguard assigned specifically to protect the web server.

SPEAKER_01 17:40

Spot on. It operates all the way up at layer seven, the application layer scanning for those complex SQL injections and cross-site scripting payloads that the stateless firewall was blind to.

SPEAKER_00 17:50

Plus, you also have intrusion prevention systems where IPS acting like digital detectives.

SPEAKER_01 17:56

Yes. They actively scan the network traffic against a massive, constantly updated database of known criminal fingerprints, looking for exploit signatures.

SPEAKER_00 18:06

And sitting over all of this, directing traffic, we increasingly have zero trust architectures. The philosophy there is that absolutely no one is trusted by default, regardless of whether they are sitting outside the network in a coffee shop or plugged directly into the wall inside the corporate headquarters.

SPEAKER_01 18:23

You have to prove who you are at every single step.

SPEAKER_00 18:26

When you look at that entire ecosystem, the role of the stateless firewall makes perfect sense. It thins the herd.

SPEAKER_01 18:33

That's the perfect way to put it. You do not want your highly advanced next generation firewall wasting its expensive CPU cycles, dropping basic automated ping sweeps from the internet. Right. You let the fast, cheap technology handle the massive bulk of the traffic at the perimeter, saving the heavy computing power for analyzing complex targeted threats deeper inside the network.

SPEAKER_00 18:54

It really is a gauntlet. I mean, you have to survive the fast bouncer, then the smart bouncer with a memory, then the deep cover investigator checking your luggage, and finally the bodyguard at the VIP room.

SPEAKER_01 19:04

And the stateless firewall is just the guy on the sidewalk checking for a ticket.

SPEAKER_00 19:08

Just checking the ticket. It does one specific job and it does it at blistering speeds. It does. Let's bring this all together for you. The packet filtering firewall, the stateless firewall, is the speedy, lightweight, amnesiac bouncer of your network.

SPEAKER_01 19:22

Yep.

SPEAKER_00 19:22

It is entirely rule-based using an access control list. It only looks at the routing metadata on the outside of the envelope, and it completely lacks the intelligence or the memory to spot modern complex threats on its own. But because it is so incredibly fast and cheap to run, it remains a vital load-bearing pillar in a much larger layered security strategy.

SPEAKER_01 19:45

It is the ultimate proof that sometimes doing a very simple task very quickly is exactly what a complex system needs to survive.

SPEAKER_00 19:52

Absolutely. Well, thank you so much for taking this journey with us today on the Wii Cyber U Unlocked Podcast. As always, please hit that follow button on the channel and do not forget to visit WeCyberU.com for more deep dives into the technology shaping our world.

SPEAKER_01 20:05

And before we go, consider this provocative shift happening right now. As modern internet traffic becomes increasingly encrypted end-to-end, meaning the payload inside the envelope is mathematically locked and hidden from almost everyone in the transit chain, including our own advanced firewalls. Right. Does the outside of the envelope suddenly become our most valuable source of truth once again? Even as we build incredibly advanced deep inspecting security tools, are we slowly returning to a reality where we are forced to judge a packet entirely by its cover?