A computer-implemented method, including: in response to a request from a client device, establishing a network tunnel between the client device and a gateway, the gateway implementing a firewall including firewall rules for selectively blocking and allowing network traffic between the client device and one or more network devices in a private network; in response to an update to a policy after establishing the network tunnel, receiving a first token; and in response to receiving the first token, updating at least one of the firewall rules while the network tunnel is active.