Yeah, that's a VPN. It "tunnels" your data past the firewall and directly into the internal network on the other side.
A good firewall setup should keep most anyone out of getting in. A NAT usually does a decent job, but NATs are NOT firewalls and they are not designed with lots of security in mind. There are ways around a NAT.