The first generation of firewalls was only simple layer 3 device with multiple interfaces and access list applied in/out direction on the interface, during the same era the routers was supporting also the stateless access lists, so on that days what is the point of using the firewall in the place of the router while they almost give the same security benefits

  • 1
    Routers can get very slow when they have to evaluate access lists (as the packets need to hit the router CPU). This is not true for all filter rules and hardware models, but it was true for more sophisticated rules (even before stateful)
    – eckes
    Aug 17, 2017 at 0:09

2 Answers 2


The first generation of firewalls was only simple layer 3 device

I don't think this is true. Contrary to routers the first generation of packet filter firewalls already worked at layer 4, i.e. they could filter TCP and UDP traffic by port number already and thus selectively allow access to specific services like SMTP (port 25) or HTTP (port 80).

The most important difference between these stateless packet filter firewalls and the current stateful versions is that stateful has the concept of connections while stateless had not. This means especially that with a stateful firewall it is possible to accept incoming packets matching outgoing connections while with stateless firewalls this is not possible.

Because of this a stateless firewall offers not a lot protection for hosts which work as a client, i.e. which are the source of outgoing connections. But it is useful for hosts which only work as a server, i.e. where only connections from outside gets accepted on selected ports. And even today it can make sense to not always track the state for such incoming connections because state tracking needs more resources both in memory and processing time.

  • You are comparing statefull firewall with stateless firewalls,but my question regarding the difference between stateless firewalls and the traditional router access-lists
    – Mr.lock
    Mar 19, 2017 at 17:21
  • What is a "router access list"? Mar 19, 2017 at 20:39
  • And: what do you mean with "router", in the first place? If it's just router as in IP routing, it is stateless and has no filtering capability (other than the network-mask and individual address-based routing table), and then there's no question, since you're now asking "why would someone use a firewall if they need a firewall". If it means "NAT router, such as found in home broadband access devices and as boundary between corporate networks and the internet": those are stateful firewalls, and there's no question, because you're now comparing stateful firewalls with stateful firewalls Mar 19, 2017 at 20:42
  • 1
    @Mr.lock: I was first comparing stateless firewalls with routers, i.e. layer 4 filtering with layer 3 forwarding. And I showed where these stateless firewalls are useful and where stateful firewalls are more useful. The comparison with stateful firewalls was done to not only show the abilities but also the limitations of stateless firewalls. Mar 19, 2017 at 22:28
  • @ Marcus Müller, most of the routers has the capability of configuring packet filters based on the stateless access-list which is was the same capability of the stateless firewalls so during that days what is the befits of using stateless firewall while the routers have the same
    – Mr.lock
    Mar 20, 2017 at 3:52

You might be underestimating the hardware limitations of those days. In the early to mid 90s Ethernet used hubs and coax. Switches and VLANs weren't in use, so networks were broken up in subnets and segmented on physical hubs to reduce broadcast traffic. Sometimes even bridges were used. (Remember bridges?) If you wanted to move data from one segment to another, often from one floor to the next, it needed to go through a router. Routers needed to be very fast.

By comparision, WAN links were slow. 64kbps, 128kbps ISDNs, sometimes T1s. Firewalls were implementing NAT, port forwarding, and protocol 'fixups' were early implementations of stateful inspection. It was very difficult to securely implement FTP or even DNS without such fixups. Other firewall features such as inter-site VPNs were unique to Firewall equipment.

See a bit of history of the PIX https://en.wikipedia.org/wiki/Cisco_PIX

I'm sure extended ACLs did get used as firewalls when people were on a budget, but it may have been a short time when this was necessary as equipment improved very, very quickly in those days. The lack of application protocol inspection would have meant putting some of your systems outside the extended ACL or makeshift firewall. E.g., NTP, DNS, FTP...

I remember configuring a small ISP back in 1997 and they didn't have a firewall. We had a Linux box plugged into our ISDN. It was our dial-in gateway, our web-server, email server, etc. I don't believe even ipchains was mature at that point, much less replaced with iptables. If you wanted a port down, the solution was to not have a service listening on it.

This said, I never configured large networks in the 90s. I mostly played with the old routers and firewalls in the early 2000s out of curiousity.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .