How does a packet filter (Generation 1) decide whether to forward or drop a packet, and at what OSI layer does it operate?
A packet filter looks at each packet in isolation at OSI Layer 3 (Network) and decides based on header fields — IPs, ports, protocol, TCP flags. No memory of previous packets, no understanding of conversations.
* Stateless packet-filter decision flow over header fields. *
The decision criteria (Entscheidungsgrundlagen für Paketdurchlass):
| Field | Used for |
|---|---|
| Source IP | "From this address?" |
| Destination IP | "To this address?" |
| Protocol (TCP, UDP, ICMP) | "What kind of traffic?" |
| Source port (TCP/UDP) | "From which service?" |
| Destination port (TCP/UDP) | "To which service?" |
| TCP flags (SYN, ACK, etc.) | "Connection start? In progress?" |
| ICMP type/code | "Echo request? Time exceeded?" |
The OSI placement:
Layer 7 Application ← ← (NGFW / WAF)
Layer 4 Transport ← ← (Stateful FW)
Layer 3 Network ← ← Packet filter operates HERE
Layer 2 Data Link
Layer 1 Physical
The packet filter operates at L3 but reads L4 fields too (ports, flags) — the strict OSI separation isn't honored, since security needs port info.
Where they came from — routers with ACLs:
[Internet] ─→ [Router with packet-filter ACL] ─→ [LAN]
"Drop incoming SYNs to TCP/22"
"Allow established connections back"
The first firewalls were just routers with access control lists — Cisco IOS ACLs on routers from the early 1990s. Dedicated FW appliances came later.
Filter sets ("Filtersätze"):
Rules are organized into ordered sets, evaluated top-down. The first matching rule wins. This is universal across all firewall generations and is the reason rule order matters more than rule count.
Tip: When you debug firewall issues, the rule that's blocking you is rarely the last rule — it's usually an earlier "broader" rule matching first. Always read the rule list top-to-bottom from the perspective of the packet.
Go deeper:
ICMP (Wikipedia) — the ICMP type/code fields a packet filter keys on (echo, time-exceeded).- Access-control list (Wikipedia) — the router-ACL origin of packet filtering and the inbound/outbound rule model.