These three mechanisms are often lumped together because all can sit 'in the middle'. Their jobs differ. A firewall enforces traffic policy, a proxy relays application-level or other traffic on behalf of a client, and a VPN creates an encrypted tunnel between endpoints or networks. Understanding what information each can see is the key.
Remember the shape, not the sentence
“A firewall is a security gate, a proxy is an intermediary receptionist, and a VPN is a private tunnel through a public building.”
Firewalls
A firewall can filter using addresses, ports, protocols, state and application context depending on its design. Stateful firewalls track connection state so return traffic can be handled differently from unsolicited packets.
Proxies
A forward proxy acts on behalf of clients. A reverse proxy acts on behalf of servers and can provide TLS termination, load balancing, routing, caching and access control.
VPNs
A VPN encapsulates traffic inside a tunnel that provides confidentiality/integrity and a virtual network relationship. Encryption alone does not guarantee that every destination or endpoint is trustworthy.
See the mechanism before you memorize it
One diagram, one causal story, one reconstruction task.
Firewalls, VPNs, proxies: what each one really filters — causal map
Firewall
Observe packet/flow attributes and apply allow/deny policy.
Forward proxy
Client sends traffic to an intermediary that makes the outbound request.
Reverse proxy
External clients reach an intermediary that selects an internal backend.
VPN
Endpoints encapsulate traffic through an encrypted tunnel.
Draw the idea yourself
Rebuild the core flow on a real canvas before moving to the worked walkthrough.
Walk the system
Firewall
Observe packet/flow attributes and apply allow/deny policy.
Forward proxy
Client sends traffic to an intermediary that makes the outbound request.
Reverse proxy
External clients reach an intermediary that selects an internal backend.
VPN
Endpoints encapsulate traffic through an encrypted tunnel.
Policy
Security still depends on identity, routing, endpoint controls and application authorization.
Choose by visibility
The most useful question is not 'where is the box?' but 'which endpoint terminates the protocol and what metadata can it inspect?'
Firewall → addresses/ports/state/application context
Proxy → relay at an application/protocol boundary
VPN → encrypted tunnel between tunnel endpointsWhat usually goes wrong
Close the tab. Rebuild it from memory.
Read the question, answer aloud, then reveal.
What is a reverse proxy?Reveal answer
An intermediary that represents backend servers to clients and can terminate TLS, route requests, balance load and enforce policy.
What does a stateful firewall add?Reveal answer
It can make decisions based on connection state, not only isolated packets.
What does a VPN fundamentally provide?Reveal answer
A protected tunnel between tunnel endpoints, carrying encapsulated traffic over another network.
Make this idea travel.
Connect it next to: network-attacks-defense • troubleshooting • network-toolkit.