Perimeter security: firewalls, VPNs and proxy servers

For decades, network security was imagined as a castle: a strong wall around the company network, with a gate where traffic was inspected. The wall was the perimeter, and firewalls, VPNs and proxies were its gates and guards. The castle model is now incomplete, because people work from homes, trains and cafés and data lives in the cloud. But its three tools are still everywhere, and understanding what each really does is essential.

Firewalls: deciding what may pass

NIST’s guidance on firewalls describes them as devices or programs that control the flow of network traffic between networks or hosts that have different security postures. In practice a firewall compares each connection with a set of rules and allows or blocks it. Firewalls have grown more capable over time:

Network firewalls and host-based firewalls

A network firewall sits at the edge of a network, in a router or a dedicated appliance, and protects every device behind it. A host-based firewall runs on each computer and protects that computer wherever it goes. The two answer different questions. A network firewall sees addresses and ports but cannot reliably tell which program on which laptop opened a connection. A host-based firewall knows exactly which app is connecting, and it keeps working when the laptop leaves the office for an airport lounge.

macOS includes a built-in application firewall, but it only controls incoming connections. Outgoing traffic, the direction in which apps send your data away, is not filtered by default. Outbound host firewalls fill that gap. FireAI, for example, runs as an Apple Network Extension content filter: it sees each app’s outgoing and incoming connections, identifies the app by its code signature, and lets you allow or block it per destination, with an on-device AI explaining what each connection is for.

VPNs: an encrypted tunnel, not an invisibility cloak

A virtual private network creates an encrypted tunnel between your device and a VPN server. Companies use VPNs so remote staff can reach internal systems as if they were in the office, typically using IPsec or modern protocols such as WireGuard. Consumer VPN services route all your traffic through their servers, which hides it from the local network (useful on untrusted Wi-Fi) and hides your real IP address from the sites you visit.

• A VPN protects traffic between you and the VPN server from the network in between.
• It does not stop an app on your computer from sending your data wherever it wants; it just carries that data through the tunnel.
• It moves trust: the VPN provider can now see what your local network used to see.
• It does not remove tracking by accounts, cookies or apps you are logged into.

Proxy servers: an intermediary that speaks for you

A proxy receives your request and makes it on your behalf. A forward proxy sits in front of users, often in companies, to filter websites, cache content and log access. A reverse proxy sits in front of servers, spreading load and shielding the servers behind it. Anonymising proxies and the Tor network hide the user’s address from the destination. Unlike a VPN, a proxy usually handles specific applications or protocols rather than all traffic.

From castle walls to zero trust

The weakness of the castle model is that everything inside the wall is trusted. One phished laptop or one compromised supplier account puts the attacker inside, where movement is easy. Modern architectures follow zero trust principles, described by NIST in SP 800-207: no device or user is trusted just because of where it sits on the network, and every access is checked. In that world the perimeter shrinks to each device and each identity, and host-based controls matter more than ever.