1.3.6

1.3.6  ::  Implement stateful inspection, also known as dynamic packet filtering.  (That is, only “established” connections are allowed into the network).

This is done with iptables.