However, most modern firewalls, including iptables, treat UDP in the same manner as a connection-oriented protocol. If you create a rule allowing UDP traffic in one direction, the firewall will allow associated return traffic.
Let's consider an example. Suppose you decided to allow outbound DNS traffic on UDP port 53. In its state table, the firewall will track any requests that match the rule, and the DNS server's UDP response is then allowed to reach the client.
Without a three-way handshake, however, the firewall doesn't know when to remove the entry from its state table. To accommodate this situation, firewalls usually use a timer that allows return traffic to pass until the connection is inactive for a specified period of time, which is normally a few minutes. Once the firewall reaches that inactivity threshold, it discards the entry from the state table.
Dig Deeper on Network device security: Appliances, firewalls and switches
Related Q&A from Mike Chapple
Examine the important differences between stateful and stateless firewalls, and learn when each type of firewall should be used in an enterprise ... Continue Reading
Explore the differences between wired and wireless network security, and read up on best practices to ensure security with or without wires. Continue Reading
Choosing to encrypt confidential data with AES or DES encryption is an important cybersecurity matter. Learn about the important differences between ... Continue Reading