The Birth of the Firewall: How Networks Learned to Say No
From packet filters at DEC and Bell Labs to the first commercial firewalls and stateful inspection, here is how the firewall became the first line of defence.
The word firewall comes from buildings, where a fire-resistant wall is built to stop a blaze spreading from one section to another. Network engineers borrowed the term in the late 1980s for a similar idea: a barrier between a trusted network and an untrusted one. The Morris worm of 1988 gave the idea urgency, and within a few years firewalls had gone from research projects to products.
Why networks needed a barrier
In the early internet, most computers were open to any other. Machines on a university network trusted each other by default, and it was normal to leave services such as remote login and file sharing available to anyone who could reach them. That worked in a small community. After the Morris worm showed what a single flaw could do across thousands of machines, administrators began to ask whether every internal machine really needed to be reachable from the whole network.
Steven Bellovin, a researcher at AT&T Bell Laboratories, published an influential paper in 1989 on security problems in the TCP/IP protocol suite. It described weaknesses in the design of the protocols that the network ran on, and it made the case for controlling traffic at the boundary.
Packet filters
The first generation of firewalls were packet filters. A router or gateway examined each packet of data as it passed, looking at the source address, the destination address and the port, and applied a list of rules to decide whether to allow it. Researchers at Digital Equipment Corporation, including Jeff Mogul, described this style of access control in the late 1980s, and others at the company and elsewhere built working versions.
Packet filters were fast and simple. They had limits. They looked at one packet at a time and did not understand what conversation it belonged to, so an attacker could often disguise traffic to slip through.
Proxy gateways
A second approach used application-level proxies. Instead of letting outside traffic reach the inner machine, a proxy server on the firewall received the connection, examined it, and made a fresh connection inward on behalf of the user. At AT&T Bell Labs, researchers including Bill Cheswick built gateways of this kind, and Cheswick described a secure internet gateway design in the early 1990s. A commercial product based on the proxy idea, the DEC SEAL, written by Marcus Ranum and others at Digital in 1991, is often called one of the first commercial firewalls.
Cheswick also made a notable contribution to the history of defence in 1991 by letting a real intruder wander through a deliberately limited machine, and then writing it up in a paper titled "An Evening with Berferd". It is an early honeypot story, and a good read.
Stateful inspection
The third generation tracked connections. A stateful firewall remembers that an internal machine opened a conversation with an outside server, and allows the returning packets that belong to it, while blocking unsolicited traffic from outside. The approach combined the speed of packet filtering with a better understanding of context. In 1994 the Israeli company Check Point released FireWall-1, which popularised stateful inspection and became a market leader through the decade.
In 1994 Cheswick and Bellovin also published the book Firewalls and Internet Security, which gave administrators a practical guide and fixed the concept in the industry's vocabulary.
Generations at a glance
| Type | What it checks | Weakness |
|---|---|---|
| Packet filter | Addresses and ports of each packet | No memory of the connection |
| Proxy gateway | Application-level content | Slower, needs support for each service |
| Stateful firewall | Packets plus connection state | Cannot see inside encrypted web traffic |
| Web application firewall | HTTP requests and their contents | Needs careful tuning |
One more idea from this period deserves mention: the demilitarised zone, or DMZ. Administrators learned to place public-facing servers, such as web and mail servers, in a separate segment between the internet and the internal network. If one of them was compromised, the attacker would still face another barrier before reaching the internal machines. The principle, that systems exposed to the public should be isolated from systems holding private data, is just as sound for a small business today as for the large organisations that first used it.
Beyond the perimeter
Firewalls made the perimeter idea famous: a hard shell and a soft inside. Over time, that model proved too simple. Laptops moved between networks, staff worked from home, services moved to the cloud, and attacks arrived through web pages and email, which a firewall must allow. Modern thinking, often called zero trust, assumes that no network location is safe on its own, and verifies each request.
The lesson for site owners today
A firewall is still essential, but it is only a layer. It decides which doors are open. It does not check whether what comes through an open door is harmless. Your website must accept web traffic on ports 80 and 443, so a network firewall will let attacks that target your application straight through.
- Close every port and service you do not need.
- Put a filtering layer in front of your site, such as a CDN with web protections.
- Keep your application and its extensions updated, since the firewall will not fix them.
- Limit who can reach your admin pages.
If you need full control of your own server, a VPS is the usual next step.
Where this fits with your hosting
Cloudflare CDN is available on sites hosted with Zebra Hosting, adding a filtering layer in front of your origin. Read about it on the CDN page, and if you run your own server on a VPS, you can configure your own firewall rules in full.
