Firewalls for Businesses: Selection and Configuration

"We Have a Firewall" – Is That Enough?

It's one of the sentences I hear most often: "We have a firewall, so we're secure." Usually, it turns out they mean the built-in router from the internet provider. Or a hardware firewall that was installed five years ago and never updated since.

A firewall is the foundation of your IT security. But only if it's properly selected, configured, and maintained. And that's where most SMEs fail.

What a Firewall Really Does

Think of your firewall as the bouncer of your network. It decides which data traffic is allowed in and which stays out. But modern firewalls can do much more:

Packet Filter (the basics)

Checks each data packet against rules: source IP, destination IP, port, protocol. Simple, fast, but easy to circumvent.

Stateful Inspection

Tracks the state of active connections. Detects whether an incoming packet belongs to an existing, legitimate connection or whether someone is trying to sneak in.

Next-Generation Firewall (NGFW)

This is the current standard for businesses. An NGFW can:

• Deep Packet Inspection (DPI): Looks at the content of data packets, not just the addresses
• Application Control: Identifies and controls applications regardless of port
• Intrusion Prevention System (IPS): Detects and blocks known attack patterns
• SSL/TLS Inspection: Also checks encrypted traffic
• URL Filtering: Blocks access to known phishing and malware sites
• Sandbox Analysis: Suspicious files are executed in an isolated environment

Which Firewall for Which Business?

The right firewall depends on several factors:

For Small Businesses (5-20 employees)

Recommendation: Entry-level hardware firewall with UTM features

For Medium Businesses (20-100 employees)

Recommendation: NGFW with Advanced Threat Protection

For Multi-Location Businesses

This gets more complex. You need:

• SD-WAN integration for site connectivity
• Centralized management for all firewalls
• VPN tunnels between locations
• Redundancy for failover

Configuration: The 10 Most Important Rules

A firewall is only as good as its configuration. Here are the fundamental rules every SME should implement:

1. Default Deny – Block Everything, Then Allow

The basic rule: Everything is forbidden unless explicitly allowed. Start with an empty rule list and only add the connections that are truly needed.

2. Network Segmentation

Divide your network into zones:

• DMZ for publicly accessible servers
• Internal LAN for workstations
• Server VLAN for internal servers
• Guest WiFi completely isolated from the corporate network
• IoT Network for printers, cameras, etc.

3. Don't Forget Outbound Filtering

Most people only think about incoming traffic. But filtering outbound connections is equally important: Malware calling home, data exfiltration, or command-and-control communication – all of that happens outbound.

4. Enable DNS Filtering

Block access to known malicious domains. Services like Quad9 (9.9.9.9) or Cloudflare for Teams offer this for free.

5. Set Up Geo-Blocking

If your company has no business relationships with Russia, China, or North Korea, block traffic from these regions. This eliminates a large portion of automated attacks.

6. Keep IPS Signatures Current

The Intrusion Prevention System only detects attacks whose patterns it knows. Daily signature updates are mandatory.

7. Configure SSL/TLS Inspection

Over 90% of web traffic is encrypted. Without SSL inspection, your firewall is blind to this traffic. But note: Banking sites and health portals should be excluded (data protection!).

8. Set Up Logging and Alerting

What you can't see, you can't protect. Configure:

• Log all blocked connections
• Alerts for unusual patterns (e.g., port scans, brute force)
• Regular log analysis (at least weekly)

9. Regularly Update Firmware

Firewall vendors regularly release security updates. Install them promptly – ideally within 48 hours of release.

10. Regular Rule Audits

Every 6 months, you should review all firewall rules:

• Are they still needed?
• Are they too broadly defined?
• Are there overlaps or contradictions?

Common Firewall Configuration Mistakes

In my consulting practice, I see these mistakes repeatedly:

1. "Any-to-Any" rules: Allows everything from anywhere to anywhere – makes the firewall useless
2. No outbound filtering: Only incoming traffic is checked
3. Outdated firmware: Known security vulnerabilities aren't patched
4. Default password not changed: Yes, this still happens
5. No VPN for remote access: Instead, open RDP ports (gateway #1 for ransomware!)
6. No redundancy: If the firewall fails, the business stops

What a Professional Firewall Solution Costs

Transparency on costs:

Sounds expensive? A single ransomware attack through an open RDP port costs on average 20 to 50 times more.

Conclusion: A Firewall Is Mandatory – But Not a Silver Bullet

A professionally configured firewall is the foundation of your IT security. But it's only one building block. Combine it with endpoint protection, regular updates, employee training, and a well-thought-out backup concept.

Need support choosing or configuring your business firewall? We provide vendor-neutral consulting and find the solution that fits your company.