The attack, as the server sees it
Attacks start with mapping. The server first sees a sweep: a ping (an ICMP echo request) sent to every address in 203.0.113.0/24. Hosts are expected to answer pings (RFC 1122), and nothing filters them here, so its echo reply marks 203.0.113.10 as alive.
Next come SYN probes: requests to open a TCP connection, sent to ports 22, 80, 443 and 3306. To the server each looks exactly like a real visitor’s first packet, so with no firewall checking, every one is delivered.
The server’s TCP answers every SYN, as RFC 9293 says. SYN-ACK means open: a program listens there. RST means closed: nothing listens, but a machine is here. Silence, or an ICMP “unreachable” error, would mean filtered: something blocked the probe.
Now the scanner has a map: SSH on 22 and HTTPS on 443 talk to anyone. Each exposed service is a program strangers can reach; one weak password or unpatched bug there is a way in. Fewer open ports, fewer doors.
The scan meets a firewall
Now the defender turns on a firewall in front of the server: a box that checks every packet before letting it through. The scanner sends the same four SYNs, to ports 22, 80, 443 and 3306 on 203.0.113.10.
The firewall reads each packet’s 5-tuple: protocol, source and destination address, source and destination port. It checks rules from the top, and the first match decides. A packet no rule matches falls to the hidden last rule, deny all: default deny.
The SYN to port 443 matches rule 1, allow HTTPS from anyone, so it reaches the server, which answers with a SYN-ACK (“yes, let’s connect”). The scanner learns one thing: a web server listens on 443.
Port 22 skips rule 1 and fails rule 2, which allows SSH only from the office network 198.51.100.0/24. Ports 22, 80, 3306 fall to deny all and are dropped without a reply. The scan now sees only 443; the rest read as filtered.
Stateful
A real visitor, 192.0.2.7, sends a SYN to port 443. Rule 1 allows it, and because this firewall is stateful (it remembers connections) it writes the connection in its state table: both addresses, both ports.
The server’s SYN-ACK heads back out. No rule needs to mention it: the firewall finds the matching row in its state table and lets it through. Every later packet of this connection passes the same way, until it closes or goes idle.
A stateless filter (an ACL, access control list) keeps no table, so it often lets in anything marked as a reply. The attacker forges one to port 3306. The stateful firewall finds no row and drops it.
Layers
The server runs its own host firewall too. The network firewall guards everything behind it at one edge; the host firewall guards one machine, even from devices inside the same network that never pass the edge. Two layers, one policy.
A home router’s NAT drops unsolicited packets only because no translation row matches. That is a side effect: port forwarding, automatic port opening (UPnP) and IPv6 without NAT open paths it never checks. A firewall decides on purpose, rule by rule.
The packets and rules, field by field
;; step 1/13 · sweep · scan
;; scanner → server
ICMP 192.0.2.66 → 203.0.113.1 … 203.0.113.254 type 8 echo request
one probe per address: who is there?
ICMP 203.0.113.10 → 192.0.2.66 type 0 echo reply ← live host
why it was answered: RFC 1122 §3.2.2.6 says hosts MUST answer
echo requests (many still drop them); nothing filtered it
what the defender sees: one source touching many addresses
in a short time, the fingerprint of a sweep
a sweep may use TCP probes instead; any answer, even a RST,
proves a machine is at that address
Dropping silently is the usual choice for internet-facing rules. A firewall may instead reject (answer with a RST or an ICMP error), which is friendlier for honest clients but tells a scanner the firewall is there. Because the first match wins, put specific rules above broad ones. A broad allow placed first makes every rule below it dead.