notesonly.in

One notebook for every subject — open it anywhere.

Log in

Firewalls and VPN Basics: Complete Beginner's Guide

EngineeringTry the interactive 3D model →

A firewall is a security device that inspects network traffic and blocks or allows it according to a rule list, sitting between a trusted internal network and the untrusted internet. A VPN (Virtual Private Network) is an encrypted tunnel across the internet that makes a remote device behave as if it were plugged directly into the private network.

This matters because every device on the internet is constantly probed by attackers. Firewalls are the first line of defense, silently dropping malicious connection attempts. VPNs protect data on untrusted networks — like café Wi-Fi — and let employees securely reach office resources from home. Together they are the two most common network security tools in existence.

Key Concepts

  • Packet filter: the simplest firewall; allows or blocks packets by IP, port, and protocol.
  • Stateful inspection: tracks active connections and allows return traffic only for connections the inside initiated.
  • ACL (access control list): the ordered rule list; first match wins, with an implicit deny-all at the end.
  • NAT: translates private internal addresses to one public address, hiding the internal network.
  • DMZ: a separated zone for public servers (like a company website) between the internet and the internal network.
  • Tunneling: wrapping private-network packets inside encrypted internet packets.
  • VPN types: site-to-site (connects whole offices), remote-access (connects one laptop or phone), built with protocols like IPsec, SSL/TLS, or WireGuard.

How It Works

  1. A firewall processes rules top to bottom for each packet: it compares the packet's source, destination, ports, and connection state against each rule and applies the first matching rule's action (allow or deny); anything matching nothing hits the final implicit deny.
  2. Stateful firewalls additionally remember outbound connections, so replies come back without explicit allow rules.
  3. A VPN works differently: VPN software on your device encrypts each packet, wraps it in a new packet addressed to the VPN server, and sends it across the internet; the server unwraps, decrypts, and forwards it into the private network — and the return path is encrypted the same way.
  4. To anyone watching the café Wi-Fi, the traffic is unreadable noise between you and one VPN server.

Worked Example

A company firewall guards web server 10.0.0.5. Its ACL:

  • Rule 1: deny any traffic from blocked attacker IP 203.0.113.45.
  • Rule 2: allow TCP to 10.0.0.5 port 443 (HTTPS) from anywhere.
  • Rule 3: allow TCP to 10.0.0.5 port 22 (SSH) only from admin network 10.0.0.0/24.
  • Rule 4 (implicit): deny everything else.
  1. Packet A — from 203.0.113.45 to 10.0.0.5:443 → matches Rule 1 first → denied, even though Rule 2 would allow it. Order matters.
  2. Packet B — from 198.51.100.7 to 10.0.0.5:443 → skips Rule 1, matches Rule 2 → allowed (a customer's HTTPS visit).
  3. Packet C — from 198.51.100.7 to 10.0.0.5:22 → matches no rule 1–3 → implicit deny. SSH stays closed to the internet.
  4. Packet D — from 10.0.0.9 to 10.0.0.5:22 → matches Rule 3 → allowed (admin login).

Four packets, four different fates — all decided by ordered first-match rules.

Common Misconceptions

  • "A firewall makes me 100% safe." It blocks network attacks, but not phishing emails, malicious downloads you approve, or infected USB drives.
  • "A VPN makes me anonymous." A VPN hides traffic from local snoopers and your ISP, but the VPN provider itself can see it — and websites still track you with cookies.
  • "More rules mean more security." Bloated rule lists cause mistakes; a short, reviewed list with default-deny is safer.

Real-World Applications

  • Corporate perimeter firewalls and home router firewalls.
  • Cloud security groups on AWS and other providers.
  • Employees working from home over VPN and travelers securing café Wi-Fi.
  • Companies linking branch offices with site-to-site VPNs.

Firewalls enforce ordered allow/deny rules — first match wins, default deny — while VPNs encrypt a tunnel that extends the private network anywhere. The four-packet trace shows rule order deciding everything. Use both, keep rules short, and remember neither replaces careful user behavior.

Related blogs