Firewalls and VPNs

The Security Guard Analogy

A corporate building's security guard does not let anyone walk in unchecked. They look at your ID, check if you are on the visitor list, and only then open the door. Tailgaters get stopped. Unknown visitors are turned away.

A firewall is that guard for your network. Every packet arriving at or leaving the network boundary passes through it. The firewall checks each one against its ruleset and decides: allow or deny.

The difference between a good security guard and a great one? The great one does not just check IDs — they understand context, recognize suspicious patterns, and look inside bags when warranted. That is the difference between a basic packet filter and a next-generation firewall.

Firewall Types

1. Packet Filter (Stateless)

The simplest form. Inspects each packet in isolation based on:

• Source/destination IP address
• Source/destination port
• Protocol (TCP, UDP, ICMP)

Limitation: No memory. It cannot tell whether a packet is a legitimate response to a previous request or an unsolicited intrusion. Each packet is judged alone.

2. Stateful Inspection Firewall

Tracks the state of active connections in a state table. It knows which connections were initiated from inside the network and allows only corresponding response traffic.

Connection initiated from 192.168.1.5 → 8.8.8.8:443
→ State table records: (192.168.1.5, port 50234) ↔ (8.8.8.8, 443) ESTABLISHED
→ Response packet from 8.8.8.8 → 192.168.1.5 is permitted automatically
→ Unsolicited packet from 8.8.8.8 to 192.168.1.5 would be dropped

This is the standard for most enterprise perimeter firewalls.

3. Application-Layer Firewall (WAF)

A Web Application Firewall operates at Layer 7. It can inspect HTTP request content — URL paths, headers, body — and block specific attack patterns like SQL injection, cross-site scripting, and path traversal.

A WAF cannot see inside TLS-encrypted traffic unless it performs TLS termination (acting as a proxy).

4. Next-Generation Firewall (NGFW)

Combines stateful inspection with:

• Deep Packet Inspection (DPI) — reads application content
• Application identification (recognizes Zoom, Netflix, BitTorrent by behavior)
• User identity awareness (rules based on who is using the network, not just what IP)
• Integrated IPS
• TLS inspection

NGFWs from vendors like Palo Alto, Fortinet, and Cisco Firepower are the modern standard for serious network security.

ACL: Access Control Lists

Firewalls and routers enforce policy through ACLs — ordered lists of permit/deny rules evaluated top-to-bottom. The first matching rule wins.

Example ACL (simplified Cisco-style):

permit tcp 192.168.1.0/24 any eq 443    # Allow HTTPS outbound from LAN
permit tcp 192.168.1.0/24 any eq 80     # Allow HTTP outbound from LAN
permit udp 192.168.1.0/24 any eq 53     # Allow DNS queries
deny   ip any any                        # Block everything else (implicit deny)

The implicit deny at the end means: anything not explicitly permitted is blocked. This "default deny" posture is fundamental to secure firewall design.

NAT: Network Address Translation

The problem NAT solves: IPv4 provides approximately 4.3 billion addresses. The internet has far more devices than that. NAT allows an entire network of private devices to share a single public IP address.

How it works:

1. Device at 192.168.1.5 sends request to 93.184.216.34:80
2. NAT router rewrites the source to its public IP: 203.0.113.1:40021
3. Server responds to 203.0.113.1:40021
4. NAT router translates back: forwards response to 192.168.1.5

The NAT table maps (public_ip:port) ↔ (private_ip:port) for every active connection.

Private IP ranges (RFC 1918):

These addresses are not routed on the public internet — NAT is required to communicate externally.

VPN: Virtual Private Network

A VPN creates an encrypted tunnel between two endpoints across an untrusted network (typically the public internet). Traffic inside the tunnel is protected from eavesdropping and tampering.

VPN Types

Site-to-Site VPN: Connects two entire office networks. Routers or firewalls at each site maintain the tunnel. All traffic between the offices flows through it as if they were on the same LAN.

Use case: Company headquarters connected to a branch office.

Remote Access VPN: Individual users connect to the corporate network from anywhere — home, hotel, coffee shop. A VPN client on the device establishes an encrypted tunnel to the company's VPN gateway.

Use case: Employee working from home accessing internal servers.

VPN Protocol Comparison

WireGuard is the current best choice for new deployments — dramatically simpler codebase (fewer vulnerabilities), faster performance, and modern cryptography by design.

What a VPN Does and Does Not Protect

What a VPN DOES:

• Encrypts traffic between your device and the VPN server
• Hides your traffic from your ISP or local network observer
• Masks your IP address from websites (they see the VPN server's IP)
• Allows remote access to internal corporate resources
• Bypasses geographic restrictions

What a VPN DOES NOT:

• Make you anonymous (the VPN provider can see your traffic)
• Protect against malware on your device
• Prevent websites from tracking you via cookies, fingerprinting, or login sessions
• Encrypt traffic beyond the VPN server (if the destination is HTTP, it is still unencrypted at that end)
• Replace strong passwords, 2FA, or patched software

A VPN secures the pipe. It does not secure the endpoints.

Split Tunneling

By default, a remote access VPN routes all traffic through the corporate tunnel — including Netflix, personal browsing, and software updates. This wastes corporate bandwidth and adds latency for non-work traffic.

Split tunneling routes only traffic destined for corporate resources through the VPN. All other traffic goes directly to the internet via the user's local connection.

Advantages:

• Reduces load on VPN gateway
• Faster performance for non-work applications
• Lower bandwidth costs

Risks:

• User's internet traffic is unmonitored by corporate security controls
• Malware on the user's machine can reach the corporate network through the tunnel

Most organizations implement split tunneling for performance reasons but supplement it with endpoint security controls.

Key Takeaways

• Firewalls progress from simple packet filters → stateful → application-layer → NGFW
• ACLs enforce policy with an ordered permit/deny list; default deny is the secure baseline
• NAT enables private networks to share a single public IP address
• Site-to-site VPN connects offices; remote access VPN connects individual users
• WireGuard is the modern choice; PPTP is deprecated and insecure
• VPNs secure the tunnel, not the endpoints or the destination