Secure firewall configuration for businesses

What a firewall actually protects

A firewall controls traffic entering, leaving, or moving between different segments of a corporate network. It evaluates connections against predefined rules and permits only necessary communication. This can include employee internet access, connections to cloud platforms, server-to-server communication, VPN connections for remote users, and access to specific systems by external vendors.

The key word here is "necessary." In many companies, configuration settings accumulate over years: a port left open for a legacy application, a temporary rule for a vendor, broad access for a test environment, or an exception made during an emergency incident. When these rules go unreviewed, temporary solutions become permanent, thereby increasing the attack surface.

Modern firewalls may also offer additional features such as intrusion prevention, web content filtering, application control, antivirus traffic scanning, and VPN protection. While useful, these features do not compensate for poorly defined core rules. An insecure access policy does not become secure simply because an additional feature has been enabled.

The principle behind a secure firewall configuration

The most reliable approach is "deny by default": everything is blocked unless there is a specific business reason to allow it. This does not mean that employees will be hindered in their work; rather, it ensures that every instance of permitted access has an owner, a purpose, and a defined scope. For example, if an external partner needs to access an accounting system, the rule should not permit access from the entire internet to the whole internal network. Best practice dictates limiting access to a specific source, a specific VPN connection, a designated user or group, a specific system, and the necessary port. The more precise the rule, the easier it is to control and audit.

There is a balance to be struck here. An overly strict configuration, implemented without an understanding of business processes, can disrupt critical operations. Conversely, overly broad rules compromise security. Therefore, configuration should not be a one-off technical task but a coordinated process involving the IT team, system owners, and management.

Start with a map of traffic and systems

Before creating or removing rules, it is essential to understand what the organization actually uses. This includes internet connections, office locations, cloud resources, servers, Wi-Fi networks, VPN users, IP telephony, cameras, printers, and guest devices. Not every device is equally critical, and not every device requires the same level of access.

It is useful to identify systems that handle personal data, financial information, customer records, or production processes. These systems carry a higher risk of unauthorized access, requiring particularly precise rules. Such visibility also supports compliance with GDPR, ISO 27001, and NIS2 requirements, where applicable to the organization.

Segment the network based on risk

A flat network allows a problem in one device to easily spread to others. If an infected laptop has unrestricted access to a file server, an accounting system, and backups, the consequences can be severe.

Segmentation limits this risk. Workstations, servers, guest Wi-Fi networks, IP phones, IoT devices, and video surveillance systems should be logically separated whenever the architecture allows. The firewall permits only necessary connections between these segments; for instance, guests should not see internal resources, and cameras do not need access to financial systems.

Segmentation requires planning and, at times, investment in appropriate network infrastructure. In return, it limits an attacker's lateral movement and makes it easier to contain an incident.

Rules that often create vulnerabilities

Several types of settings warrant special attention. They are often created with good intentions but remain unchecked after changes to the environment.

The first issue involves "Any-to-Any" rules—permissions allowing traffic from any source to any destination and service. While convenient for troubleshooting, they are unsuitable as a permanent policy. The second issue concerns services exposed to the internet, particularly Remote Desktop Protocol (RDP), administrative interfaces, file services, and outdated web applications. If such access is unavoidable, it must be secured via VPN, multi-factor authentication, and source-based restrictions.

The third issue involves exceptions to traffic inspection. Sometimes a specific application requires a particular configuration, but every exception must be documented, approved, and periodically reviewed. The fourth issue is the retention of default factory or shared administrative access. Firewall management must be restricted to authorized administrators only, conducted via a secure channel and using individual accounts.

Access Management Is Part of Security

Good policies are insufficient if administrative access to the device is weak. Using individual accounts makes it possible to track who made a change and when. Shared passwords create problems not only for security but also for accountability in the event of an incident.

Multi-factor authentication should be the standard for administrative access whenever the platform supports it. Access to the management interface should not be exposed to the internet unless there is a clear need. In most cases, a more secure model involves management via a dedicated administrative network or a secure VPN.

Updates are equally important. A firewall is a critical system, yet it too has an operating system, vulnerabilities, and software dependencies. Postponing updates without a risk assessment can leave an organization exposed to known attacks. At the same time, updates should be planned, tested (where possible), and implemented with a fallback plan to avoid unnecessary downtime.

Logs, Monitoring, and Incident Response

Firewall logs are often retained but left unused. This results in missed opportunities to spot valuable information: multiple failed login attempts, unusual connections to external addresses, inter-segment communication outside normal operations, or a sudden spike in blocked traffic.

Effective monitoring does not mean having someone manually read every single log entry. This entails establishing specific signals and thresholds, as well as assigning responsibility for reviewing them. Critical events must trigger a timely check rather than simply being logged in a record that is examined only after a problem arises.

A clear process for managing changes is also essential. Every new rule requires a formal request, a business justification, a technical description, approval, and a scheduled review date. In the case of emergency changes, documentation may be completed retroactively, but it must not be skipped entirely. This ensures the organization understands the reason for a specific access right and can confidently revoke it when it is no longer needed.

How often should the configuration be reviewed?

There is no one-size-fits-all timeframe for every company. Organizations with frequent application updates, a large remote workforce, or numerous external integrations require more frequent reviews. For most firms, it is prudent to analyze rules on a quarterly basis, while also conducting immediate reviews following any significant change—such as opening a new office, adopting a new cloud service, switching vendors, implementing an ERP system, or setting up a new VPN configuration.

Reviews should look beyond merely identifying obviously dangerous rules. They should verify whether rules are active and in use, check for duplicate settings, ensure descriptions are clear, confirm that access is restricted to the minimum necessary level, and validate alignment with current business processes. Unused rules should be removed in a controlled manner, following a dependency check.

In a managed environment, this process is integrated with proactive monitoring, change management, and periodic reporting. This gives management a clear picture of the security posture, while the in-house IT team is not left to shoulder the constant task of monitoring configurations, updates, and alerts alone.

Firewall security is not a matter of a single setting, but of discipline in day-to-day operations. When access is justified, the network is segmented, changes are controlled, and events are monitored, the company reduces risk without sacrificing productivity. The best next step is to verify the configuration against the actual activity of people and systems, rather than against assumptions made at the time of implementation.