Firewall Architectures, From Packet Filters to Zero Trust

Articles · July 2026 · Ioannis (John) Konstas

"Firewall" names a job — decide what traffic is allowed — not a single technology. The generations differ by how deep they look, and each added depth in response to attacks the previous generation couldn't see. Understanding them by what they actually inspect explains both their strengths and why the perimeter model eventually gave way to zero trust.

Generation 1 — packet filters

The original firewall inspects each packet in isolation against static rules: source/destination IP, port, protocol. Fast and stateless — and blind to context. It can't tell a legitimate reply from an unsolicited packet crafted to look like one, because it has no memory of what came before. Still useful as a coarse first filter (ACLs on a router), never as the whole answer.

Generation 2 — stateful inspection

The leap that defined firewalls for two decades: track the state of connections. By maintaining a table of active flows, a stateful firewall knows that an inbound packet belongs to a connection the inside initiated, and rejects packets that don't fit any known conversation. This single idea killed whole classes of spoofing and is why "allow established/related" is the backbone of nearly every ruleset. A minimal stateful policy in nftables:

table inet filter {
  chain input {
    type filter hook input priority 0; policy drop;

    ct state established,related accept   # the stateful core
    ct state invalid drop                 # no matching flow -> gone
    iif "lo" accept
    tcp dport { 22, 443 } ct state new accept
    ip protocol icmp accept
  }
}

It still operates mostly at Layers 3-4: it knows the connection is valid, not what's inside it.

Generation 3 — proxy / application-layer firewalls

A proxy firewall terminates the connection itself and opens a second one to the destination, so nothing flows end-to-end without inspection. Because it understands the application protocol (HTTP, SMTP), it can enforce rules on content — block a malformed request, strip a dangerous method, hide internal structure. The cost is latency and per-protocol complexity, which is why proxies live where deep control justifies it (web gateways, email security) rather than on every hop.

Generation 4 — next-generation firewalls (NGFW)

The NGFW fuses stateful inspection with application awareness and identity, adding:

• Application identification — recognizing the app regardless of port, so "block port 80" becomes "block this application for this user group."
• User identity — rules by directory user/group, not just IP.
• Integrated IPS — signature and behavioral intrusion prevention inline.
• Deep packet inspection, including TLS inspection where policy and privacy allow.

This is the enterprise perimeter device of the last decade. But notice what it needed to stay relevant: identity and application context — precisely because IP-and-port stopped describing reality once everything moved to HTTPS and the cloud.

Why the perimeter dissolved

Every generation above assumes a meaningful inside and outside. Cloud workloads, SaaS, and remote work erased that boundary — your "inside" now runs in three clouds and ten thousand laptops. When there's no perimeter to stand on, a perimeter firewall guards a wall with no ends.

Generation 5 — zero trust

Zero trust replaces "trusted network" with "never trust, always verify." Every request — user or service — is authenticated, authorized, and encrypted based on identity and device posture, regardless of network location. The firewall didn't disappear; it distributed and abstracted:

• Identity-aware proxies gate application access per request, per identity — the Generation-3 proxy idea, reborn around identity instead of network position.
• Microsegmentation puts a stateful policy between every workload, so a breach in one service can't roam — Generation-2 statefulness, applied east-west at fine grain.
• Cloud-delivered security (SASE/SSE) moves NGFW and proxy functions to the edge, close to users wherever they are.

The throughline: zero trust didn't discard firewalls, it took each generation's core idea — statefulness, application awareness, proxying — and re-anchored them to identity rather than to a network edge that no longer exists.

How to think about it today

Firewalls evolved by looking deeper — from packets, to connections, to content, to identity. Zero trust is the recognition that with the perimeter gone, identity is the only edge left to inspect.

← All articles

Research and direction by Ioannis (John) Konstas; compiled and finalized with AI assistance.