Which device tracks the state of active connections in order to make a decision to forward a packet through?

A wireless access point primarily connects wireless clients to the wired network and typically operates at Layer 2 without tracking connection states for security forwarding decisions.

A firewall, specifically a stateful firewall, maintains a connection state table to track active sessions. It examines the initial packets of a connection (e.g., TCP handshakes) and, if permitted by its rules, creates an entry. Subsequent packets belonging to that established connection are then permitted or denied based on the tracked state, enabling robust security policy enforcement.

A wireless LAN controller manages and configures multiple access points but does not track the state of individual active network connections for packet forwarding decisions in the security context described.

A router forwards packets based on destination IP addresses and its routing table (Layer 3) and generally does not track the state of active connections for security filtering unless it has integrated firewall capabilities.