Limitations
Firewalls. The pocketknife for enforcing computer security

Generally placed at the border of a private network, a firewall is unable to control internal exchanges. It therefore remains ineffective against internal attacks.

Whether maliciously or for practical reasons, an employee may wish to bypass the filtering performed on the company firewall by creating a tunnel. The equipment used to create the tunnel should be placed on either side of the firewall. In this way, if the firewall limits itself to filtering IP and TCP headers (§ 5