A firewall usually blocks certain "ports" which are paths or routes for incoming data to access certain applications on a network. But certain ports always have to be left open for certain things to come in.

As a basic example, if I want users to access my web site, I have to leave open the port for http. (I think it's port 80) So http traffic can come in (but only http) port 80.

The way in would be to use port 80 with something disguised as http traffic, for example. Then, bingo, you're in. This is why many viruses spread through email - most of us use POP3 or SMTP to access our mail. SMTP is port 25 and POP3 I think is 110. So email along with a virus (or whatever) will come in through those ports. This is why many viruses are spread through emails.

When you access a web page, you are merely locating a computer somewhere. You may type www.elitefitness.com, but you are locating a specific computer. The "name".com is a domain name, and the computer that is hosting the site (the web server) has an IP address. Your ISP has something to resolve or translate that domain name into the proper IP address.

SO then you are "into" the computer hosting the web site. The web server is outside the firewall, so you can get to it, but the rest of the network is inside the firewall, where only certain traffice is permitted.

If you can fool the firewall into thinking you are this traffic, you can get in.