Firewall and VPN
Firewall / Virtual Private Network
What are firewalls and VPNs?
- Firewall = the gatekeeper that filters traffic
- VPN = a secure, encrypted tunnel
- Network security basics
Adopting a firewall and VPN is not about buying equipment; it is a decision to divide your network into trust zones. You have to document where "inside" ends and who may cross that line before you can write even a single rule properly. That is why half of any rollout goes into working with business teams, not configuring devices. Once you lay out the external SaaS the sales team uses, the data your production equipment sends out, and the paths partners take in and out, it becomes clear that an organization with no allow list was effectively allowing everything.
Technically, distinctions matter. Early firewalls that looked only at ports and IPs have evolved into next-generation firewalls (NGFW) that inspect traffic by application and user, and a WAF, which filters web attacks, works at a different layer and cannot be replaced by a firewall. VPNs also differ in use: IPsec permanently links headquarters and branch offices, while SSL VPN lets individuals connect through a client. A full tunnel sends all traffic to the company, raising line costs and latency, while a split tunnel sends only what is needed, which is lighter but reduces the scope of control. Recently, ZTNA (Zero Trust Network Access), which verifies each system individually, has been replacing user VPNs.
The most common misconception in the field is 'we added a VPN, so we're secure.' A VPN encrypts the tunnel, but it does not guarantee that the person entering the tunnel is who they claim to be. A VPN that opens with just an ID and password hands an attacker a highway into your internal network the moment one account is compromised, so multi-factor authentication (MFA) is not optional. The classic firewall incident is the temporary allow rule added with 'let's open it now and clean up later.' Even after testing ends, nobody removes it, and it stays for years. Add the fact that scanning for VPN appliance firmware vulnerabilities begins the day they are disclosed, and an organization that patches only twice a year pays for the equipment and still carries the hole.
Seungtae ParkA hands-on AX instructor who teaches AI business development and marketing automation by building them in practice
Seolyeong ParkGenerative AI and AX training expert with 17 years of hands-on experience and 200+ lectures, helping non-specialists put AI to work right awayFirewalls emerged as a network security technology in the late 1980s, while VPNs developed alongside the demand for remote access and secure communications.
Consider a hypothetical case: Company A, a medical device distributor with 320 employees and annual revenue of about KRW 90 billion (≈ US$67,335,000). VPN accounts created in a rush to enable remote work in 2020 had piled up for four years with no cleanup, and firewall rules had only ever been added as requests came in. When a client audit demanded 'evidence of remote access controls,' the company launched a six-week cleanup.
- When the information security lead pulled the account list, 137 of the 412 active VPN accounts had gone unused for over three months, and 41 were registered to employees who had already left. The lead reported, 'Half of them have no owner.'
- A network manager went through all 802 firewall rules line by line and found 14 any-any rules, with both source and destination left wide open. Nine of them were temporary rules added for testing six years earlier.
- When MFA for all employees was announced, the head of sales pushed back: 'You want me to tap one more thing outside the hospital?' The team let people choose between an OTP app and phone biometrics, and tracked enrollment rates daily for two weeks.
- Five sensitive systems, including the ERP and customer DB, were moved to ZTNA first, while only the internal groupware and file server stayed on the existing VPN, splitting access into two paths.
- Six weeks later, active accounts fell from 412 to 231 and firewall rules from 802 to 390. The company wrote a quarterly account and rule review into its policy and passed the next year's client audit with no findings.