Affiliate Disclaimer: Some links in this article are affiliate links. This means if you click a link and make a purchase, SecVerse may earn a small commission — at no extra cost to you. We only recommend tools we genuinely believe in and that we consider useful for your cybersecurity learning journey. Our editorial opinions are never influenced by affiliate relationships.
Introduction :
In the previous article covered the protocols that carry your data across a network — HTTP, FTP, SSH, SMTP, and more. Knowing how data moves is only half the picture. This article covers firewalls VPN cybersecurity fundamentals — the mechanisms that decide whether that data is allowed to move at all, and where each one breaks under real-world pressure.
The most sophisticated firewall I ever tested was bypassed in under two hours. Not through a zero-day exploit. Not through advanced custom tooling. Through a misconfigured rule that someone had added years earlier and never reviewed.
The rule was allowing outbound connections on port 443 — HTTPS — to any destination. It was there because HTTPS was considered safe. What the person who added the rule did not consider was that HTTPS is just TCP on port 443. And you can tunnel almost anything through TCP on port 443.
That is the lesson that firewalls teach: they are only as strong as their rules. A firewall with correct rules is one of the most effective security controls in existence. A firewall with incorrect rules gives you a false sense of security while leaving the real gaps wide open.
This is Part 4 of the networking series. We cover firewalls, VPNs, and the mechanisms that control how traffic flows through and around networks.
Firewalls VPN Cybersecurity: What a Firewall Actually Does
A firewall is a network security device — hardware, software, or both — that monitors and controls incoming and outgoing network traffic based on rules. It sits between networks (or between the internet and an internal network) and decides what is allowed to pass and what is blocked. Of every control covered in firewalls VPN cybersecurity work, the firewall’s rule set is the one attackers probe first.
Every firewall decision is based on rules. The rules define: which source addresses, which destination addresses, which ports, which protocols, and which direction of traffic is allowed or denied.
Firewall Rule Logic
| Rule Element | What It Controls | Example |
|---|---|---|
|
Source IP |
Where the traffic is coming from. |
Block all traffic from 192.168.100.0/24 (untrusted subnet) |
|
Destination IP |
Where the traffic is going. |
Allow traffic only to 10.0.0.50 (the web server) |
|
Protocol |
TCP, UDP, ICMP, etc. |
Allow only TCP connections (not raw UDP to this destination) |
|
Port |
The source or destination port. |
Allow TCP port 443 (HTTPS) to the web server |
|
Direction |
Inbound (into the network) or outbound (leaving). |
Block inbound TCP on port 23 (Telnet) |
|
Action |
ALLOW, DENY, DROP |
DROP silently discards (attacker doesn’t know). DENY sends rejection. ALLOW passes. |
|
State |
Is this part of an established connection? |
ALLOW packets that are part of established, related connections |
Types of Firewalls
| Type | How It Works | Strengths | Weaknesses | Use Case |
|---|---|---|---|---|
|
Packet Filtering (Stateless) |
Inspects each packet individually against a rule set. No memory of previous packets. |
Simple, fast, low resource usage. |
Cannot detect multi-packet attacks. Does not track connection state. |
Basic perimeter filtering. Legacy environments. |
|
Stateful Inspection |
Tracks the state of active connections. Knows if a packet is part of an established session. |
Can block out-of-state packets. Much harder to spoof. |
More complex. Higher resource usage. |
Standard for most modern firewalls. |
|
Application Layer (L7) |
Inspects traffic at the application layer. Understands HTTP, DNS, FTP content. |
Can block specific applications. Deep packet inspection. |
Resource intensive. Encryption makes DPI harder. |
Corporate firewalls, next-gen firewalls (NGFW). |
|
Next-Generation Firewall (NGFW) |
Combines stateful inspection, L7 filtering, IDS/IPS, and threat intelligence. |
Most comprehensive. Can identify applications, not just ports. |
Expensive. Complex to configure correctly. |
Enterprise environments. |
|
Web Application Firewall (WAF) |
Specialized for HTTP/S traffic. Protects web applications. |
Blocks SQLi, XSS, CSRF, and other web attacks. |
Only protects web traffic. Can be bypassed by obfuscation. |
Any organization running public web applications. |
Common Firewall Misconfigurations — What Attackers Look For
| Misconfiguration | What It Allows | How It Is Found |
|---|---|---|
|
Any/Any rules |
Traffic from any source to any destination. Completely open. |
Review firewall rules. Audit logs for unusual outbound connections. |
|
Outbound HTTPS to any |
Allows tunneling data out over port 443. Very common. |
C2 tools, DNS tunneling, and data exfiltration often use this. |
|
Overly permissive internal rules |
Internal systems can reach each other without restriction. Enables lateral movement. |
Network segmentation assessment. |
|
Default allow policies |
Firewall allows everything not explicitly blocked. Opposite of defense in depth. |
Policy audit. Should be default DENY. |
|
Rule sprawl |
Hundreds of old rules from decommissioned systems never cleaned up. |
Rule audit. Old rules often expose retired IP ranges or services. |
|
No egress filtering |
Only inbound traffic is controlled. Outbound is unrestricted. |
Attackers can exfiltrate any data on any port. |
VPNs — Encrypted Tunnels Across Untrusted Networks
A VPN (Virtual Private Network) creates an encrypted tunnel between two points. Data traveling through that tunnel cannot be read by anyone intercepting it. This is used both for privacy and for secure remote access to corporate networks.
| VPN Type | How It Works | Common Use | Security Note |
|---|---|---|---|
|
Remote Access VPN |
Client software connects to a VPN gateway. All client traffic routes through the tunnel to the corporate network. |
Remote workers. Secure access to internal resources. |
Split tunneling — only corporate traffic through VPN, other traffic direct — can leak user activity. Full tunneling routes everything through VPN. |
|
Site-to-Site VPN |
Two networks connected permanently through an encrypted tunnel. Appears as one network. |
Connecting office locations. Branch offices to headquarters. |
Misconfigured routing can allow movement from one site into the other. Key management is critical. |
|
SSL/TLS VPN |
VPN tunnel carried over HTTPS (port 443). Client is often browser-based. |
Used in environments where other VPN ports are blocked. |
Because it uses port 443, it can be difficult to block and easy to hide malicious traffic in. |
|
Modern, fast, open-source VPN protocol with a small codebase. |
Increasingly used in modern deployments. Privacy-focused use cases. |
Smaller attack surface than OpenVPN or IPSec due to minimal code. Default UDP port 51820. |
|
|
Protocol suite for securing IP communications. Used in many site-to-site VPNs and some remote access VPNs. |
Enterprise site-to-site connectivity. |
Complex configuration. Weak implementation of IKE (key exchange) has historical vulnerabilities. |
VPN Security Issues Attackers Look For
| Issue | What It Means |
|---|---|
|
Split tunneling misconfiguration |
Only corporate traffic goes through VPN. Personal traffic bypasses it. Attacker can see non-VPN traffic. |
|
Weak authentication |
VPN using only username/password with no MFA. Brute force or credential stuffing. |
|
Outdated VPN software |
Known CVEs in VPN gateways. Pulse Secure, Fortinet, Palo Alto — all have had critical RCE vulnerabilities. |
|
Exposed management interface |
VPN admin panel accessible from the internet. Direct attack surface. |
|
Leaked VPN credentials |
Phishing for VPN credentials is a primary initial access technique. Credentials = full internal network access. |
Network Segmentation — Defense in Depth at the Network Level
Network segmentation divides a network into separate zones with controlled access between them. A properly segmented network limits what an attacker can reach even after compromising one system.
| Zone | What It Contains | Access Rules |
|---|---|---|
|
DMZ (Demilitarized Zone) |
Public-facing servers: web servers, mail servers, DNS servers. |
Internet → DMZ allowed (specific ports). DMZ → Internal network blocked or very restricted. |
|
Internal Network |
Internal → DMZ allowed. Internal → Internet via proxy or firewall. No direct internet access. |
Implement SPF (authorized sending IPs), DKIM (cryptographic signature), DMARC (policy enforcement). |
|
Server Segment |
Databases, application servers, file servers. |
Only specific internal systems may communicate with servers. No workstation-to-database direct access. |
|
Management Network |
Network devices, servers accessible via SSH/RDP. |
Only administrators from specific IPs. No access from workstations. |
|
Guest Network |
Visitor WiFi. |
Internet access only. Cannot reach internal network at all. |
Lateral movement — how attackers move from their initial foothold to higher-value targets — is made significantly harder by proper segmentation. If a workstation in the user segment cannot directly reach the database server, an attacker who compromises that workstation must first find a way to cross the segment boundary.
My Experience — The Misconfigured Rule That Opened Everything
The firewall bypass I described at the beginning of this article is not an isolated story. It is, unfortunately, a common one.
The organization had invested in a commercial next-generation firewall with all the features. Threat intelligence feeds. Application-layer inspection. IDS integration. They paid significantly for it.
But the rule that allowed outbound HTTPS to any destination had been added by a departing engineer who needed a temporary workaround for a legacy application. Temporary became permanent. The engineer left. The rule stayed.
When I demonstrated the bypass — tunneling a reverse shell through HTTPS on port 443 directly out through the firewall — the security team’s first question was: “how did you get past the NGFW?”
The answer: I did not get past it. I walked through the door someone had left open.
Firewalls are tools. Tools require maintenance. Rule reviews, default policy audits, egress filtering checks — these are not one-time activities. They are ongoing operational disciplines.
Recommended Resources
| Resource | Type | Best For | Link |
|---|---|---|---|
|
Hacking: The Art of Exploitation |
Book |
Firewall bypass techniques at the packet level |
|
|
CompTIA Network+ Study Guide |
Book |
Firewall and VPN fundamentals from first principles |
|
|
Cisco CCNA 200-301 Official Cert Guide |
Book |
ACLs, NAT, and network security configuration in depth |
|
|
SecVerse Cisco Learning Path |
Resource |
Full CCNA roadmap including firewall and VPN configuration |
|
|
SecVerse Fortinet Learning Path |
Resource |
Fortinet NSE path — hands-on firewall configuration |
Final Thoughts
Firewalls and VPNs are not magic boxes that make a network secure. They are tools that implement rules. The security they provide is exactly equal to the quality of those rules — nothing more, nothing less. That is the whole of firewalls VPN cybersecurity practice in one sentence.
Understanding how they work means you can build better rules, find the gaps in existing ones, and understand exactly what an attacker will do when they encounter each type of control.
What's Coming Next
This completes Month 2 of the SecVerse Foundation Series. TCP/IP, addressing, protocols, firewalls, VPNs, and segmentation — you now have the full networking foundation every cybersecurity professional needs. Month 3 shifts to the operating system layer. Article 9 starts with how an OS actually works and why that matters for security, before moving into Linux, Windows, Bash, and virtualization.
“This article contains affiliate links. See our full disclaimer policy.”
