Stateful firewall

A stateful firewall keeps track of the connections passing through it, not just individual packets. When it allows the packet that starts a connection, it records that connection, and later packets that belong to it, including the replies, are let through without being checked against the rules again. This is called connection tracking. A stateless firewall judges every packet on its own, so it needs a rule for each direction of every conversation.

Connection tracking in Nebula

Every Managed Nebula host runs Nebula’s built-in firewall, which is stateful. Each time a packet is allowed, Nebula adds the connection to its connection tracking table, keyed by protocol, addresses and ports. A packet that matches an entry is let through straight away, and the entry’s timer starts again. An entry that sees no traffic expires: by default after 12 minutes for TCP, 3 minutes for UDP, and 10 minutes for anything else, such as ICMP. These are the firewall.conntrack timeouts in Nebula’s config reference.

Tracked connections don’t outlive a rule change. When the rules change, Nebula checks each tracked connection against the new rules the next time one of its packets passes through, and drops the connection if it’s no longer allowed.

Why rules only cover inbound traffic

Because replies ride on tracked connections, firewall rules in Managed Nebula only describe inbound traffic. A rule on the database role that allows TCP 5432 from the webserver role is all the web servers need. Their queries open a connection, and the database’s answers come back on it without a rule on the webserver role.

You attach rules to roles and tags, and each host enforces the rules for its own role and tags on every packet that arrives over the overlay. Connection tracking needs no setup of its own. For a walkthrough, see Creating firewalls using roles and tags.