Packet filtering

Packet filtering is one of the basic techniques a firewall uses to control network traffic and keep systems away from things that should not reach them.

The firewall sits as a barrier, evaluates every packet of data entering or leaving a network, and lets it through or drops it according to rules defined in advance.

The result is control over what flows where, which is the first thing you want before worrying about anything more sophisticated.

How it works

Packet inspection. Every packet travelling through the firewall is examined against criteria such as source and destination IP address, port number and protocol, to decide whether it matches an allowed pattern.

Filtering rules. The rules are the instructions that tell the firewall how to treat each kind of traffic. Allow traffic from these addresses, block these protocols, permit this port and nothing else.

Stateful and stateless. There are two kinds. Stateful filtering tracks the state of each connection and decides in the context of that conversation, so a reply to a request the firewall already saw is treated differently from an unsolicited packet. Stateless filtering evaluates each packet on its own, with no memory of what came before. Stateful is what almost everything uses now, and the distinction still matters because it changes what an attacker can do with a crafted packet.

A worked example

An organisation runs a firewall in front of its internal network.

Rules are set to allow web browsing on port 80 and mail on port 25.

Connection attempts from unknown addresses or to unknown destinations are blocked.

An employee tries to reach a malicious site from a machine on the internal network.

When the packet carrying that connection request arrives at the firewall, the rules are applied: the destination is unknown, so the packet is dropped and the connection never happens.

Packet filtering and the firewall

Packet filtering is a technique, and the firewall is the thing that implements it, usually alongside several others.

A modern firewall does more than look at headers: it identifies applications, inspects TLS, checks reputation and enforces policy per user. Packet filtering is the layer underneath all of that, and it is still the layer that decides whether a packet gets to be looked at in the first place.

Why the distinction is worth keeping: a rule set written only in terms of addresses and ports is blind to anything that arrives on a permitted port, which today is most things. Port 443 is open everywhere, and traffic that speaks HTTPS to a host that resolves correctly passes every packet filter ever written. That is not a criticism of the technique, it is the reason egress filtering and application layer controls exist on top of it.