Q:

Why can hackers get in network using tunneling?

I can't hack but I like to read about it. From my readings (securityfocus, exploit-db, owasp, etc...) it appears that hackers can actually get in a network using tunneling ; I'm not from a network background but tunnelling is mostly for VPN right ? (Yes !)
What I mean is writen here at offensive security OSCP on the right (bullet point number 6)
So that would mean that even a firewall can't block them. How is that possible ? Is that the reason why when they find a new exploit on a software they can just get in the network and from there have fun exploiting the zero day ?

A:

Tunnelling to bypass firewall filtering means that an attacker uses a "trusted" protocol in order to exfiltrate data from the victim machine. 
For example, an attacker can inject exfiltrated data into a lookup DNS requests sent to a fake dns server controlled by him. 
Victim machine--->DNS REQUEST--->FIREWALL--->Attacker FAKE DNS Server 
You can reach the same goal with different protocols, think about maleware with a gmail account as C&C.

