Stateful or stateless filtering
A firewall can remember connections or judge each packet on its own. The choice shapes both what you can express and how it behaves under pressure.
Stateful: it remembers
A stateful firewall tracks each connection, so return traffic for a connection you allowed is permitted automatically. It is the sensible default for a server: you allow outbound, and the replies just work, without writing rules for both directions. This tracking is conntrack, and it is what most firewalls do by default.
Stateless: it judges each packet
A stateless filter looks at each packet in isolation against fixed rules, keeping no table. It cannot say "this is the reply to something I allowed", so you write both directions explicitly. In return it holds no state — which is exactly what you want at very high packet rates or against a flood designed to exhaust a state table.
Using both
The common pattern is stateful for ordinary server rules and stateless, early drops for obvious garbage and spoofed packets before they ever reach the state table. Under a SYN flood the state table is the target, so dropping statelessly up front protects it. We filter the worst at the network edge before it reaches you.
Still stuck? Mail support@novogara.com — an engineer answers, at any hour. Back to the knowledge base