What is a VPN?
Because remote employees often need to access resources from a wide variety of different networks, anything from completely unsecured public networks, to insulated home Wi-Fi routers, many enterprises want to implement a baseline of encrypted and authenticated access.
How Does a VPN Work?
Here’s the simplest process of how VPNs work:
- Install VPN Client: The user installs the VPN software on their device.
- Authenticate: The employee opens the client and logs in with credentials and multi-factor authentication.
- Create Encrypted Tunnel: The VPN client establishes a secure tunnel to the company’s VPN server using protocols like OpenVPN or IPsec.
- Access Internal Network: User traffic is routed through the company network, allowing access to internal resources.
- Site-to-Site VPNs: Similar tunnels connect different branch networks together.
What is a Firewall?
When a user or device requests a resource from any server, they rely on sending and receiving packets. These packets contain information about:
- What’s being sent
- Who’s requesting or sending it
- What port it’s being sent to
These key data points allow an analyst to determine who should be allowed access.
Firewalls are a type of reverse proxy strategically placed at the network edge or within data centers that enable them to closely monitor any traffic attempting to cross these boundaries. This placement allows the firewall to inspect and authenticate data packets in real-time based on specific criteria.
If a packet does not meet these security standards, the firewall blocks it from entering or exiting the network. Both incoming and outgoing network traffic can be filtered in this way.
Stateless Firewalls
Stateless firewalls assess each packet on an individual basis. They allow for rules like ‘block all incoming traffic on TCP port 22’. The firewall has no internal analysis capabilities, and just assesses each packet for its intended port. A lot of stateless firewalls today come with preconfigured rules that are fairly universal.
This allows for immediate basic protection as soon as the firewall is installed.
Stateful Firewalls
Stateful firewalls are newer, and are internally more complex. A stateful firewall gathers information about each connection that passes through it, creating profiles of “safe” connections based on these data points. When a new connection attempt is made, the firewall compares it to the established attributes of trusted connections.
If the attempt matches these safe qualities, the connection is allowed; otherwise, the firewall discards the data packets. Each packet carries metadata describing the contents of the data it holds.
VPN vs. Firewall: the 4 Key Differences
Since these two tools are used in tandem, here are the 4 key differences laid bare.
#1. Type of Protection
VPNs focus on encrypting any data being sent between users and corporate servers. This prevents snooping and Man in the Middle (MitM) attacks that can arise from compromised WiFi routers. Alongside masking any internet activity from external eyes, it also replaces a device’s real IP address with one belonging to the VPN provider.
Firewall protection is more focused on establishing how users and devices are interacting with resources on an internal network, and then filtering out unauthorized activity.
This makes firewalls a far bigger part of cybersecurity analysts’ day-to-day decision-making and strategy.
#2. Network Location
Client-based VPNs require installation on both the client device(s) and the internal VPN server.
A firewall’s location is much more unique to its overarching organization. Simpler, smaller enterprises sometimes just place one between central devices and the public internet. Larger organizations separate complex networks into smaller, distinct physical or logical network components.
These segments are then protected with firewalls that control traffic between the various internal segments.
#3. Data Encryption
VPNs encrypt Internet activity and replace your device’s real IP address with one belonging to the VPN company.
Firewalls are not able to encrypt internet traffic, and older firewalls can actually struggle with analyzing packets that have been encrypted..
#4. Customizability
VPNs can’t be customized in the same way firewalls are. Options are limited to selecting the best encryption protocol for your use-case, and whether to use features like split tunneling. These allow only some requests to be routed via the VPN provider, and result in lower load on a VPN server.
Full tunnels, on the other hand, guarantee that a VPN’s protection remains across all traffic. Other light VPN configuration is the authentication options, like whether to implement MFA or not.
Ultimately, however, VPN architecture is baked-in.
Firewalls are very customizable. Their rulesets are made of two parts: the trigger conditions, and the action the rule should take upon being triggered. Then, since rules can be compounded and nested together, the end result of each firewall deployment can be drastically unique.
Visibility vs. Encryption: Using VPNs and Firewalls Together
A foundation of secure enterprise traffic is encrypting all sensitive traffic, and applying granular visibility and control when it reaches the firewall. This can seem a bit paradoxical, until you realize that it’s possible to route all VPN tunnels through a Next Generation Firewall (NGFW).
Traditionally, firewalls would have to:
- Break the encryption
- Analyze the contents of each packet
- Re-encrypt the traffic with a new key before the request is sent onward to the intended resource
This isn’t the best approach, and can add to its latency. Nowadays, DPI methods take a more zoomed-out approach to identifying suspicious packets by correlating basic packet info with its metadata.
Through behavioral analysis, DPI can filter network traffic to detect dangerous or suspicious activity based on the actions of the traffic or host within its wider context, rather than relying on the exact contents of each encrypted packet. This allows for faster throughput, but still retains decryption capabilities in case further scrutiny is needed.
Secure Your Network with Check Point Quantum
Check Point Quantum provides next-generation security gateways for your organization’s on-premises, cloud, and hybrid-based resources. Offering market-leading throughput and AI-driven threat detection, Quantum secures your perimeter while also offering remote access VPN capabilities – all in one solution.
Furthermore, our next-generation firewall buyers guide details how a number-one priority for modern firewalls should be their decrease in the number of hours being spent configuring them. This is why Quantum ships with Check Point’s zero-day protection, and allows you to get VPN and firewall capabilities in one fell swoop.
Start with a demo today, and see how Quantum can transform your security capabilities.
Feedback