Firewalls began as packet filters in the late 1980s, then gained connection tracking, then application-level awareness in the early 1990s, and later moved onto hosts and into cloud platforms. Each step answered a specific weakness in the one before. The dates below come from a general reference and should be checked against the original papers before you cite them.
What was the first generation?
The packet filter is the first reported type of network firewall. It checks each packet against an access-control list and then discards it, rejects it or forwards it. It can look at source and destination addresses, protocol and ports.
NIST's firewall guide (SP 800-41 Revision 1) describes the same design: older firewalls that were only packet filters were essentially routing devices with access control, called stateless inspection firewalls because they do not track the state of each flow. They cannot associate multiple requests in a single session with each other. They also do not care about packet content.
According to the Wikipedia article on firewalls, the first published paper on firewall technology came in 1987, from engineers at Digital Equipment Corporation, and Bill Cheswick and Steve Bellovin at AT&T Bell Labs then built a working model. These details were not confirmed against a primary source, so treat them as a pointer for further reading.
What did connection tracking add?
The same article places the second generation in 1989 and 1990, at AT&T Bell Laboratories, under the name circuit-level gateways. These remember which addresses and ports belong to a conversation, so the firewall can examine an exchange rather than isolated packets.
NIST describes the result as stateful inspection: it improves on packet filters by tracking connection state and gaining awareness of the transport layer. NIST adds that packet filtering sits at the core of most modern firewalls, although few products sold today do stateless filtering alone.
When did application awareness arrive?
The Wikipedia article dates the Firewall Toolkit to October 1993, written by Marcus Ranum, Wei Xu and Peter Churchyard. The point of application-layer filtering is that the firewall understands protocols such as FTP, DNS and HTTP. That lets it spot an unwanted service running on a nonstandard port, or an allowed protocol being abused.
NIST's guide covers this family as application-proxy gateways, where the firewall terminates the connection and makes a new one on the client's behalf, and as web application firewalls for HTTP traffic. The same article says that by 2012 the term next-generation firewall referred to wider inspection at the application layer, including intrusion prevention and user identity.
How did firewalls spread beyond the perimeter?
Two shifts followed. Firewall functions moved onto hosts as software, and then workloads moved to clouds, where addresses change constantly. Kubernetes documentation now describes NetworkPolicy, which selects pods by label and is enforced by the network plugin, with all traffic allowed until a policy applies.
A constructed way to read the sequence: imagine one rule, "allow web traffic to the app server." A packet filter allows port 443 from anywhere. A stateful firewall allows replies only to connections the server's clients started. An application firewall checks that what arrives on 443 is really HTTP. A cloud policy says "pods labeled frontend may reach pods labeled api on 443," and the rule survives a redeploy.
What stayed the same?
The core job did not change: decide which traffic may cross a boundary. Rule hygiene stayed the hard part too. NIST's guide spends considerable space on policy, because a firewall is only as good as its ruleset.
How to check or apply this
- Identify which generation each of your controls belongs to: packet filter, stateful, application aware or label based.
- Match each to the threat it handles. A stateless filter does not stop an attack carried inside allowed traffic.
- Review rulesets on a schedule and remove unused rules.
- For clusters, confirm the network plugin enforces policy before relying on it.
- For dates you intend to publish, read the original sources, not a summary.
Quick check
What is a stateless packet filter?
A firewall that checks each packet against rules for addresses, protocol and ports without tracking the connection it belongs to. NIST describes these as the most basic form of firewall.
Are packet filters obsolete?
Not entirely. NIST says packet filtering is at the core of most modern firewalls, but few products sold today only do stateless filtering.
Sources
- NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy
- Kubernetes documentation, Network Policies
- Wikipedia, Firewall (computing), used for dates, unverified against primary papers
Last reviewed: 18 October 2026.
