a stateful firewall
A basic packet filter judges each packet on its own, like a guard with no memory who must re-decide about every visitor from scratch. That causes a real problem: when your computer makes a request and a reply comes back, the reply is an inbound packet — how does the guard know it's a welcome answer to something you asked for, rather than an unsolicited probe? A stateful firewall fixes this by remembering. It tracks ongoing connections, so it can recognize a packet as part of a conversation you started and treat it accordingly.
It works by keeping a state table of active connections. When your machine opens an outbound TCP connection (the SYN of a three-way handshake to some web server), the firewall records that flow — the source and destination IPs and ports — in its table. When the server's reply arrives, the firewall checks the table, sees it matches an established outbound connection, and allows it through. A packet that doesn't correspond to any tracked connection (an unsolicited inbound packet pretending to be a reply) finds no matching entry and is dropped. For TCP it can even follow the handshake's state to reject packets that don't fit the expected sequence.
Why it matters: statefulness lets a firewall enforce a far more useful and natural policy — 'allow replies to connections we initiated, but block unsolicited incoming connections' — which is exactly what most networks want, and which a stateless filter can only approximate clumsily. Nearly all modern firewalls are stateful. The honest caveat is unchanged from any firewall: tracking connection state is about which packets belong to allowed conversations, not about whether the contents of those conversations are safe. A stateful firewall still won't catch malware delivered inside a connection you legitimately allowed; deep content inspection is a separate job.
Your laptop opens a connection to a web server (outbound SYN). The stateful firewall records the flow. The server's SYN-ACK arrives inbound; the firewall finds the matching entry and lets it in. Later, an attacker sends an unsolicited packet pretending to be a reply — no matching connection exists, so it's dropped.
Remembers your connections, so replies are recognized.
Stateful inspection tracks which packets belong to allowed conversations — it still doesn't read whether the contents are malicious. Connection state is not content inspection; allowed traffic can still carry an attack.