As long as you want to hear back from the server you send a packet to, you’ll always be able to “reverse tunnel” into a firewall. This is because source ports are ephemerally allocated, which is a necessity unless you want to have a maximum of one HTTP connection at a time.

That said, a proper firewall implementation would only allow traffic back to a source port that is in the routing table as having an established connection. But that’s a stateful firewall (vs. stateless) and comes with its own set of complexities.

physical is bad enough. Logical is the horror part

Networks change all the time. You don’t want to rerun cable everyday.

You can configure a router to not use a path, even though that path physically exists.