Where the name comes from
In a building, a firewall is a wall built to slow the spread of fire from one section to another. Network engineers borrowed the word for a system placed between two networks, usually a private one and a larger, less trusted one, which decides which traffic may pass. The aim is the same: when something goes wrong on one side, contain it.
Why the need appeared
In the early days of networks such as ARPANET, most of the connected machines belonged to universities, laboratories and defense contractors, and users were largely known to each other. Security rested on trust. That attitude became harder to keep as the number of connected sites grew through the 1980s, and the Morris worm of November 1988 showed that a flaw in a few widely used programs could ripple across thousands of machines. Administrators began asking whether they could stop unwanted traffic at the edge instead of hardening every machine.
First generation: packet filters
The earliest approach was the packet filter. Data on networks is split into small units called packets, each with a header listing the sender’s and receiver’s addresses and the kind of service requested. A filter sits on a router and compares each packet’s header to a list of rules: allow mail to this server, block connections from that address, drop anything aimed at a certain port.
Reports and papers from the late 1980s, including work at Digital Equipment Corporation and at AT&T’s Bell Laboratories, describe filtering of this kind, and early commercial routers also had filtering features. Exactly who deserves credit for the first firewall is not clearly settled, partly because several groups were doing similar things at the same time.
Packet filters had advantages. They were fast and cheap, and they did not require changes to users’ machines. They also had limits. They looked at each packet in isolation, so they could not tell whether an arriving packet was a reply to a request made from inside, or an attempt to sneak in. Rule lists could also become long and error-prone.
Second generation: proxies and gateways
Application gateways, or proxies, took a different path. Instead of letting traffic pass straight through, a proxy server accepted the connection itself, examined the request at the level of the application, such as a mail message or file transfer, and then opened a separate connection to the real destination. Internal machines never spoke directly to the outside.
Work at Digital Equipment Corporation around 1990-1991 by Marcus Ranum and colleagues is often cited as an early example, and free toolkits released in the early 1990s helped administrators build their own. Bill Cheswick and Steven Bellovin, researchers at Bell Labs, wrote about their experience in a 1994 book on firewalls and internet security. Cheswick’s account of watching a persistent intruder in a deliberately exposed test machine, from 1992, became a popular example for why monitoring matters.
Proxies offered finer control and better logging, but they were slower, needed software for each type of service, and could lag behind new applications.
Third generation: stateful inspection
The next idea was to give the filter a memory. A stateful inspection firewall keeps a table of the connections it has seen. When an inside user opens a connection to a web server, the firewall records it and allows the matching reply packets back in. Packets that do not belong to any known connection can be discarded. This gave much of the protection of a proxy at nearly the speed of a packet filter.
Early circuit-level work at Bell Labs and commercial products in the early 1990s moved in this direction, and by the middle of the decade stateful firewalls had become the common choice for companies connecting to the internet. As web browsers made internet access routine in offices, a firewall at the connection point became standard practice.
Personal and host firewalls
As home broadband and always-on connections spread in the late 1990s and 2000s, attacks reached individual computers directly. Operating systems began to include a software firewall that ran on the machine itself, restricting which programs could accept incoming connections. Many home routers also came with a basic firewall, usually doing network address translation, which, as a side effect, hides internal machines from direct contact. Worms that spread by connecting to open ports, such as Slammer in 2003, helped make these defaults widespread.
Modern gateways
Over time, firewalls absorbed other functions. Newer devices inspect the contents of traffic, not just headers, recognize applications even when they use unusual ports, check traffic against lists of known malicious sites, and sometimes decrypt and re-encrypt connections to look inside. Vendors use a number of overlapping labels for these, and the boundaries between categories are not always sharp.
The idea of a single perimeter has itself weakened. People work from home, data lives in cloud computing services and many devices connect through mobile networks, so a gateway at the office door covers less than it once did. Modern designs often place filtering rules close to each application or user, a pattern sometimes called zero trust, instead of relying only on the edge.
What a firewall cannot do
A firewall is not a complete defense. It cannot stop a user from opening a malicious attachment that arrives through an allowed channel, and it does little against an attacker who already has a valid password. It works best as one layer among others, including software updates, access controls and monitoring. The history of the firewall is, in a way, a history of this realization: each generation solved the weaknesses of the one before and revealed new ones.