Stateful filtering preserves in memory the list of existing network connections allowed by the firewall. Each entry in the state table contains multiple parameters that help to identify the connection state.
When the network packet matches with an allow rule, the packet is allowed and a new entry is added to the state table. The subsequent packets are allowed without further verification of the predefined rule sets. When the session is completed or timed out, the entry is removed from the state table.
Stateful filtering automatically tracks the reverse traffic for existing connections eliminating the need for another firewall rule. Firewall performs stateful filtering on TCP, UDP, and ICMP protocols.