Networking interview question · Most asked
What's the difference between stateful and stateless firewalls? Give cloud examples.
Summary
A stateful firewall tracks connections and automatically allows reply traffic; a stateless one evaluates every packet independently, so replies need explicit rules to the initiator's ephemeral ports. AWS security groups, Azure NSGs and Google Cloud firewall rules are stateful; AWS network ACLs are stateless.
Longer Answer
Stateless rules must allow return traffic on a wide ephemeral range (1024-65535 on AWS, because Linux, Windows, NAT gateways and load balancers use different ranges). Most teams use security groups for real filtering and keep NACLs as coarse guardrails.
Key Points
- Stateful: replies allowed automatically.
- Stateless: replies need explicit rules.
- SGs/NSGs/GCP firewall = stateful; NACL = stateless.
- Allow 1024-65535 for return traffic in NACLs.
Deep dive: Cloud Networking in Production: The Network ACL That Broke Some Clients
Explanation
What interviewers look for
The return-traffic implication and practical guidance.
More most-asked Networking questions
- How does NAT work, and what are its limits?
- What's the difference between TCP and UDP, and when would you choose UDP?
- What do 502, 503 and 504 errors from a load balancer usually mean?
- What is CIDR notation? How many usable addresses are in a /26, and in an AWS /26 subnet?
- How does DNS resolution work, and what does a record's TTL control?
- What does TLS provide, and how does certificate validation work?
- What happens, at the network level, when you type a URL into a browser and press Enter?
- A service is unreachable. How do you troubleshoot it systematically?