[ SRE_ARENA ]
← BACK TO ROADMAP
FIREWALLS & NETWORK SECURITY

Zero Trust: Assume the Call is Coming from Inside the House

Visualization: 1. Stateful vs Stateless Firewalls
DOWNLOADING CONCEPT: 1. STATEFUL VS STATELESS FIREWALLS...
Stateless Firewalls (Network ACLs)
  • ↳These evaluate every single packet independently.
  • ↳If you allow inbound traffic on port 80, the firewall allows the packet in.
  • ↳But when the server tries to reply, the outbound packet is blocked unless you explicitly write a rule allowing outbound traffic on ephemeral ports (1024-65535).
  • ↳AWS Network ACLs are stateless.
Stateful Firewalls (Security Groups / iptables)
  • ↳These remember connections.
  • ↳If a TCP packet comes in on port 443, the firewall records it in a state table.
  • ↳When the server replies, the firewall checks the state table, recognizes it as a response to an allowed inbound request, and automatically lets it out.
The Asymmetric Routing Trap
  • ↳If a packet enters via Router A (stateful firewall) but the server routes the response out via Router B, Router B has no memory of the connection in its state table.
  • ↳It drops the response.
  • ↳This is a nightmare to debug.
▲ LIVE INCIDENTYou can SSH into the bastion host, but the bastion host cannot reach the internet to download updates.
sre@arena:~/firewalls-networking
sre@arena:~$ aws ec2 describe-security-groups --group-ids sg-01234abcd