Secure firewall configuration for businesses

What a firewall actually protects

A firewall controls traffic entering, leaving, or moving between different segments of a corporate network. It evaluates connections against predefined rules and permits only necessary communication. This can include employee internet access, connections to cloud platforms, server-to-server communication, VPN connections for remote users, and access to specific systems by external vendors.

The key word here is "necessary." In many companies, configuration settings accumulate over years: a port left open for a legacy application, a temporary rule for a vendor, broad access for a test environment, or an exception made during an emergency incident. When these rules go unreviewed, temporary solutions become permanent, thereby increasing the attack surface.

Modern firewalls may also offer additional features such as intrusion prevention, web content filtering, application control, antivirus traffic scanning, and VPN protection. While useful, these features do not compensate for poorly defined core rules. An insecure access policy does not become secure simply because an additional feature has been enabled.

The principle behind a secure firewall configuration

The most reliable approach is "deny by default": everything is blocked unless there is a specific business reason to allow it. This does not mean that employees will be hindered in their work; rather, it ensures that every instance of permitted access has an owner, a purpose, and a defined scope. For example, if an external partner needs to access an accounting system, the rule should not permit access from the entire internet to the whole internal network. Best practice dictates limiting access to a specific source, a specific VPN connection, a designated user or group, a specific system, and the necessary port. The more precise the rule, the easier it is to control and audit.

There is a balance to be struck here. An overly strict configuration, implemented without an understanding of business processes, can disrupt critical operations. Conversely, overly broad rules compromise security. Therefore, configuration should not be a one-off technical task but a coordinated process involving the IT team, system owners, and management.

Start with a map of traffic and systems

Before creating or removing rules, it is essential to understand what the organization actually uses. This includes internet connections, office locations, cloud resources, servers, Wi-Fi networks, VPN users, IP telephony, cameras, printers, and guest devices. Not every device is equally critical, and not every device requires the same level of access.

It is useful to identify systems that handle personal data, financial information, customer records, or production processes. These systems carry a higher risk of unauthorized access, requiring particularly precise rules. Such visibility also supports compliance with GDPR, ISO 27001, and NIS2 requirements, where applicable to the organization.

Segment the network based on risk

A flat network allows a problem in one device to easily spread to others. If an infected laptop has unrestricted access to a file server, an accounting system, and backups, the consequences can be severe.

Segmentation limits this risk. Workstations, servers, guest Wi-Fi networks, IP phones, IoT devices, and video surveillance systems should be logically separated whenever the architecture allows. The firewall permits only necessary connections between these segments; for instance, guests should not see internal resources, and cameras do not need access to financial systems.

Segmentation requires planning and, at times, investment in appropriate network infrastructure. In return, it limits an attacker's lateral movement and makes it easier to contain an incident.

Rules that often create vulnerabilities

Several types of settings warrant special attention. They are often created with good intentions but remain unchecked after changes to the environment.

The first issue involves "Any-to-Any" rules—permissions allowing traffic from any source to any destination and service. While convenient for troubleshooting, they are unsuitable as a permanent policy. The second issue concerns services exposed to the internet, particularly Remote Desktop Protocol (RDP), administrative interfaces, file services, and outdated web applications. If such access is unavoidable, it must be secured via VPN, multi-factor authentication, and source-based restrictions.

The third issue involves exceptions to traffic inspection. Sometimes a specific application requires a particular configuration, but every exception must be documented, approved, and periodically reviewed. The fourth issue is the retention of default factory or shared administrative access. Firewall management must be restricted to authorized administrators only, conducted via a secure channel and using individual accounts.

Access Management Is Part of Security

Good policies are insufficient if administrative access to the device is weak. Using individual accounts makes it possible to track who made a change and when. Shared passwords create problems not only for security but also for accountability in the event of an incident.

Multi-factor authentication should be the standard for administrative access whenever the platform supports it. Access to the management interface should not be exposed to the internet unless there is a clear need. In most cases, a more secure model involves management via a dedicated administrative network or a secure VPN.

Updates are equally important. A firewall is a critical system, yet it too has an operating system, vulnerabilities, and software dependencies. Postponing updates without a risk assessment can leave an organization exposed to known attacks. At the same time, updates should be planned, tested (where possible), and implemented with a fallback plan to avoid unnecessary downtime.

Logs, Monitoring, and Incident Response

Firewall logs are often retained but left unused. This results in missed opportunities to spot valuable information: multiple failed login attempts, unusual connections to external addresses, inter-segment communication outside normal operations, or a sudden spike in blocked traffic.

Effective monitoring does not mean having someone manually read every single log entry. This entails establishing specific signals and thresholds, as well as assigning responsibility for reviewing them. Critical events must trigger a timely check rather than simply being logged in a record that is examined only after a problem arises.

A clear process for managing changes is also essential. Every new rule requires a formal request, a business justification, a technical description, approval, and a scheduled review date. In the case of emergency changes, documentation may be completed retroactively, but it must not be skipped entirely. This ensures the organization understands the reason for a specific access right and can confidently revoke it when it is no longer needed.

Which firewall fits which business scenario

The most useful approach is to compare solutions according to the environment, not according to marketing brochures. For a company with 20 people and one office, the priorities are different from those of an organization with several locations, local servers and sensitive customer data.

For a small office with limited IT resources

Here, solutions with easy centralized management, good factory security and predictable licenses work best. If the device requires a lot of manual settings and constant tuning, the total cost of ownership increases quickly. In this segment, a convenient interface, basic SD-WAN, a stable VPN and good visibility into who is doing what are valuable.

The compromise is usually in the depth of control. Some more affordable platforms offer decent basic protections, but limit advanced policies, granular application control or detailed reporting. For an office without an in-house IT team, this may be acceptable, as long as the risk is properly assessed.

For companies with stricter security requirements

When there is sensitive data, external regulatory requirements, contractual commitments to customers or the need for an audit trail, a firewall must offer more than basic filtering. Here, sandboxing, SSL inspection, detailed logging, role-based administration and reliable integration with SIEM or other monitoring systems are already important.

This class of solutions often costs more and requires more careful implementation. However, if the organization works with financial data, medical information, industrial systems or external access from multiple third parties, the lower cost of the device may turn out to be the most expensive savings.

For hybrid and distributed work

Many companies can no longer rely on all users being behind a central office firewall. In such cases, a consistent policy between office, home access and cloud applications should be considered. Some manufacturers do a good job of this through cloud management and common policies for users, regardless of where they work.

Here, weak solutions are quickly apparent. If VPN clients are unstable, if access to Microsoft 365 or other SaaS platforms is delayed due to inappropriate inspection, or if policies differ between locations, productivity suffers directly.

When is it time to replace the current firewall

Several signals are clear. The device is out of manufacturer support, there are no current security updates, policies have been accumulated chaotically for years, VPN connections are unstable or performance drops when security features are activated. Another indicator is the lack of adequate logs and reports, especially if the company is preparing for an audit, certification or new contractual requirements.

There is also a quieter scenario - everything works, but no one is sure how it is set up, who has access and what would happen in the event of an incident. This is also a risk. In such a case, a configuration review often reveals outdated rules, open services, and unnecessarily broad exceptions.

For organizations looking to reduce operational risk, the most sensible approach is to start the assessment from business needs, not brand. How critical is connectivity, how sensitive is the data, how many people work remotely, what are the accountability requirements, and who is responsible for day-to-day management. Only then does the choice of a specific platform come into play.

The goal is not just a new device, but controllable protection that can be maintained in a disciplined manner. The right choice doesn’t make the loudest noise in a presentation, but creates peace of mind in the day-to-day work when the business doesn’t have time for interruptions.

How often should the configuration be reviewed?

There is no one-size-fits-all timeframe for every company. Organizations with frequent application updates, a large remote workforce, or numerous external integrations require more frequent reviews. For most firms, it is prudent to analyze rules on a quarterly basis, while also conducting immediate reviews following any significant change—such as opening a new office, adopting a new cloud service, switching vendors, implementing an ERP system, or setting up a new VPN configuration.

Reviews should look beyond merely identifying obviously dangerous rules. They should verify whether rules are active and in use, check for duplicate settings, ensure descriptions are clear, confirm that access is restricted to the minimum necessary level, and validate alignment with current business processes. Unused rules should be removed in a controlled manner, following a dependency check.

In a managed environment, this process is integrated with proactive monitoring, change management, and periodic reporting. This gives management a clear picture of the security posture, while the in-house IT team is not left to shoulder the constant task of monitoring configurations, updates, and alerts alone.

Firewall security is not a matter of a single setting, but of discipline in day-to-day operations. When access is justified, the network is segmented, changes are controlled, and events are monitored, the company reduces risk without sacrificing productivity. The best next step is to verify the configuration against the actual activity of people and systems, rather than against assumptions made at the time of implementation.

In a new network the firewall and the separate networks (VLANs) are planned from the start - see office network setup.

Let's talk about protecting your network: we will review your firewall rules and access and suggest the best solution and price. See information security for businesses or let's talk about your needs directly.