ACLs: Stateless, rule by rule, every time
An ACL (Access Control List) is an ordered list of permit and deny rules, matched from top to bottom, first match wins, with an implicit deny at the very end for anything that matched nothing. A standard ACL matches only on source address; an extended ACL can also match destination address, protocol, and port. What an ACL has no memory of is prior traffic: a reply packet has to match its own explicit rule going the other direction, or it gets blocked, even if it's just the response to a request the same device already sent.
Stateful firewalls: Remembering the conversation
A stateful firewall tracks connection state, TCP's handshake progress, or a simple timeout-based session for UDP (User Datagram Protocol) and ICMP (Internet Control Message Protocol), which don't have a handshake at all. Once an outbound connection is permitted and recorded, its return traffic is automatically allowed without needing a separate explicit rule for the reply direction. That's what makes a simple "allow outbound" policy actually usable in practice.
| Stateless ACL | Stateful firewall | NGFW | |
|---|---|---|---|
| Tracks connections | No | Yes | Yes |
| Return traffic | Needs its own explicit rule | Automatically permitted for established connections | Automatically permitted for established connections |
| Sees inside encrypted traffic | No | No | Yes, via SSL/TLS decryption |
| Acts on the application itself | No | No | Yes, up to Layer 7 |
| Typical device | Router ACL | Dedicated firewall, or a Layer 3 switch with firewall features | Dedicated NGFW appliance, software, or cloud service (FWaaS) |
Extended ACLs sometimes offer an established keyword, permitting a packet if its ACK bit is set. It's a limited, cruder approximation of statefulness, just checking one bit rather than tracking real connection state, and it exists specifically because plain ACLs have no memory of their own to rely on otherwise.
Next-generation firewalls (NGFW): Beyond stateful inspection
A traditional firewall, stateful or not, makes its decisions from the outside of a packet in: source and destination address, port, protocol, and connection state. A Next-Generation Firewall (NGFW) builds on all of that and adds something a plain stateful firewall never had: the ability to look at what's actually riding inside the connection, and act on that too.
The practical difference is which OSI layers each one can act on. A stateless ACL and a stateful firewall both stop at roughly Layer 4, addresses, ports, and connection state. An NGFW reaches all the way up to Layer 7, the application itself, which is what lets it tell "this is port 443 traffic" apart from "this is specifically a file-sharing app tunneling over port 443," something a port number alone could never reveal.
Key features
Each of these adds a different kind of visibility a stateful firewall alone doesn't have.
Deep Packet Inspection (DPI)
Instead of stopping at header fields, DPI reads the actual contents of a packet's payload, looking for malware signatures, suspicious patterns, and protocol misuse that never shows up in an address or a port number.
Application awareness and control
An NGFW identifies which specific application generated a given flow, even when that application deliberately uses a non-standard port or tunnels itself inside another protocol to blend in. Policy can then be written per application ("block this file-sharing app") instead of per port, which a port-based ACL can't express at all.
Intrusion Prevention System (IPS)
An integrated IPS watches traffic for known vulnerability signatures, protocol anomalies, and exploitation attempts, and can drop or reset a connection the moment it recognizes one, not just log it after the fact.
Threat intelligence integration
NGFWs pull in live feeds of known-malicious IP addresses, domains, and file signatures, so a brand-new attack pattern discovered elsewhere on the internet this morning can already be blocked here this afternoon, without waiting for a manual rule update.
SSL/TLS decryption
Most traffic today is encrypted (see TLS/SSL Handshake), which normally hides everything above Layer 4 from inspection entirely. An NGFW can sit as a trusted intermediary, decrypt the traffic, inspect it, then re-encrypt it before forwarding, so DPI and IPS still have something to actually look at.
This is also the mechanism that lets an NGFW enforce an HTTP-to-HTTPS redirect policy: since it can see the plaintext request before re-encrypting it, it can recognize a client requesting the insecure http:// version of a site and force that connection over to https:// instead, or flag it when a site fails to redirect on its own.
URL filtering
Enforces policy by category or specific address, blocking known-malicious or simply out-of-policy destinations before a connection to them is even allowed to complete.
User-based policy
Traffic can be mapped to a specific signed-in user or group, not just an IP address, so policy travels with a person across whatever device or address they're currently using instead of being tied to a fixed IP.
Deployment types
| Type | Runs as |
|---|---|
| Hardware-based | A dedicated physical appliance inline on the network |
| Software-based | Installed on an existing server or network device, using its own CPU and memory |
| Cloud-based (FWaaS) | Firewall-as-a-Service, hosted and operated in the cloud rather than on premises |
An NGFW's Layer 7 visibility is built on top of everything covered above, not instead of it. It still tracks connection state like a stateful firewall, and a plain ACL or stateless rule still has its place as a fast, simple first filter before traffic ever reaches the more expensive Layer 7 inspection.