A firewall decides which traffic gets into your office network and which traffic leaves it. Set up well, nobody notices it. Set up badly, it looks like protection while letting the wrong things through: a default admin password, a rule someone added for a vendor years ago, firmware that has not been touched since the day it was installed.
This guide covers the main types of firewalls, which one an office of 5 to 250 people actually needs, how to configure it step by step, a sample rule set you can compare with your own, and the habits that keep it secure after install day. It is written for office managers and in-house IT staff in the Greater Toronto Area, but the advice applies to any business network. If you are still deciding whether you need a firewall at all, start with why a firewall is a must-have for any business.
What a firewall does
Every connection that passes through a firewall is checked against a list of rules, from the top down. Each rule names a source, a destination and a service, for example staff computers going to the internet over HTTPS. The first rule that matches decides what happens. If no rule matches, the connection is dropped. That last behaviour is called default deny, and it is the most important setting on the box.
Business firewalls are also stateful. They remember the connections your staff start, so replies come back in automatically while unrequested traffic from the internet stays out. A next-generation firewall then goes further: it recognizes applications, checks traffic against known attack patterns, filters websites by category and blocks domains known to host malware.
What a firewall will not do
A firewall cannot stop someone typing their password into a convincing fake login page, and it does nothing for a laptop on hotel Wi-Fi unless that laptop’s traffic comes back through the office or a cloud security service. It is one layer. Multi-factor authentication, endpoint protection, patching and backups cover the gaps, which is why we treat the firewall as one part of a wider security setup rather than the whole of it.
Is the router from your internet provider a firewall?
Partly. The router your provider installed hides your internal addresses behind one public address and blocks unrequested inbound connections. That helps, but it usually cannot split your network into separate zones, filter what leaves the office, inspect traffic for threats or keep logs you can investigate later. Our explainer on routers, modems and switches sorts out which box does what.
The main types of firewalls
“Type” can mean two different things: how deeply the firewall examines traffic, and where it runs. The table covers both, starting with the simplest.
| Type | What it checks | Where you see it | Limits |
|---|---|---|---|
| Packet-filtering | Source and destination address, port and protocol of each packet | Access lists on routers and switches | No memory of connections and no view of content |
| Stateful inspection | Everything above, plus whether the packet belongs to a connection already in progress | The baseline in every business firewall today | Cannot tell which application is talking or what it is sending |
| Circuit-level gateway | Whether a session was set up properly, without reading the data inside it | Rarely sold alone; built into proxies and larger firewalls | Once the session is up, the data passes unchecked |
| Application-level gateway (proxy) | The full content of the traffic, with the proxy making the connection on the user’s behalf | Web proxies and secure email gateways | Slower, and each protocol needs its own proxy |
| Next-generation firewall (NGFW) | Connection state plus the application, the user, intrusion attempts, malware and website categories, including inside encrypted traffic | The edge firewall in most offices of 5 to 250 people | Needs a yearly security subscription; inspection lowers throughput |
| Web application firewall (WAF) | Requests to a website or web app, looking for attacks such as SQL injection and cross-site scripting | In front of websites, client portals and APIs | Protects one application, not your office network |
| Cloud firewall (FWaaS) | Traffic from users wherever they are, inspected in the provider’s cloud | Remote and hybrid teams, several small sites | Monthly per-user cost and depends on the internet connection |
| Host-based firewall | Traffic in and out of one computer, such as Windows Defender Firewall | Every laptop and server, especially away from the office | Set device by device unless managed centrally |
You will also see small-office boxes sold as UTM, short for unified threat management. It is an older name for a firewall bundled with antivirus, web filtering and VPN. UTM and NGFW products now overlap almost completely, so compare the features and the subscription rather than the label. If you are weighing free software such as pfSense or OPNsense against a commercial appliance, our guide to open-source firewalls for business covers the trade-offs.
Hardware, software or cloud: what an office actually needs
For most offices of 5 to 250 people the answer has three parts: a next-generation firewall appliance at the internet connection, the built-in firewall switched on for every computer, and a VPN or cloud security service for people who work away from the office.
Offices of 5 to 50 people
One appliance is usually enough, sized for your internet speed with its security features turned on. Fortinet FortiGate, Cisco Meraki and Ubiquiti UniFi gateways are common choices at this size. Budget for the yearly security subscription as well as the hardware, because without it the intrusion prevention, web filtering and malware signatures stop updating.
Organizations of 50 to 250 people
At this size an outage costs more than a second unit, so a high-availability pair makes sense: two firewalls that share one configuration and take over from each other if one fails. Add segmentation between departments and servers, send logs to a central system, and bring in a second internet line from a different provider. With more than one location, the SD-WAN features on the same firewalls can link the sites and steer traffic over whichever line is healthier.
How to size a firewall
Do not buy on the biggest number on the datasheet. The headline firewall throughput assumes every security feature is off. Look for the figure labelled threat protection or NGFW throughput, and the SSL inspection figure if you plan to decrypt traffic. For a 1 Gbps fibre line, choose a model that handles about 1 Gbps with threat protection on, then leave room to grow. Check how many VPN users it supports and the vendor’s end-of-support date before you order, so you are not buying a model that is about to be retired.
How to configure a firewall, step by step
Order matters. Secure the firewall itself first, then build the network around it, then write the rules.
1. Update the firmware before anything else
Firewalls and VPN gateways have become one of the main ways attackers get in. Verizon’s 2026 Data Breach Investigations Report found that 31% of breaches now start with an exploited software vulnerability, ahead of stolen passwords. In the 2025 edition, edge devices and VPNs were the target in 22% of vulnerability exploitation, up from 3% the year before, and only about 54% of those vulnerabilities were fully fixed during the year (SecurityWeek summary). Install the vendor’s current recommended firmware before the firewall goes live, and subscribe to its security advisories so you hear about the next problem the day it is published.
2. Lock down administrative access
- Rename or disable the default admin account, and give each administrator a named login of their own.
- Use long, unique passwords and turn on multi-factor authentication for every admin account.
- Never let the management page be reached from the internet. Allow it only from a management network or a short list of internal addresses.
- Use HTTPS and SSH only, and set a short idle timeout.
Attackers count on these basics being skipped. In October 2026, researchers described a campaign that broke into exposed Fortinet and Palo Alto Networks firewalls and VPN gateways using known vulnerabilities and common username and password combinations, exposing more than 70,000 credentials.
3. Split the network into zones
On a flat network, anything that gets in can reach everything. Separate zones, built as VLANs and joined only through the firewall, keep a compromised printer or a visitor’s phone away from your file server. A typical office needs:
- Staff computers
- Servers and storage
- Phones (VoIP)
- Printers, cameras and other devices that cannot run security software
- Guest Wi-Fi, with internet access only
- Management, for the firewall, switches and access points themselves
The Canadian Centre for Cyber Security’s baseline controls for small and medium organizations make the same point: isolate internet-facing servers, put a firewall between Wi-Fi and the rest of the network, never connect public Wi-Fi to the corporate network, and wall off point-of-sale systems. Our guides to VLANs and business Wi-Fi security cover the switch and access point side.
4. Deny by default, in both directions
Inbound, almost nothing should be allowed. Usually that means your VPN and little else. Outbound is where many offices are too generous. An “allow everything out” rule lets malware reach its control server and lets a cheap camera send video wherever its manufacturer chose. Allow what each zone needs, such as web traffic for staff and only the provider’s addresses for phones. Send DNS through the firewall or a filtering service so domains known to be malicious are blocked, which the Cyber Centre baseline also recommends.
5. Write rules that explain themselves
- Give every rule a clear name and a comment: who asked for it, why, and the date.
- Be specific. Name the source, destination and service instead of using “any”.
- Put narrow rules above broad ones, because the first match wins.
- Use address groups such as “Accounting PCs”, so one change updates every rule that uses them.
- Finish with a deny rule that logs, so you can see what is being blocked.
6. Set up remote access the safe way
Staff working from home should connect through a VPN with multi-factor authentication, which is also what the Cyber Centre baseline asks for. Give each VPN group access only to the systems it needs. Never open Remote Desktop (port 3389) or file sharing to the internet, and avoid port forwarding for anything people could reach over the VPN instead. If most of your team works outside the office, a cloud security service that inspects traffic wherever people are may suit you better than sending everything back through the office. Our article on next-generation VPNs compares the options.
7. Turn on the protection you are paying for
On many firewalls, the security features do nothing until you apply them to your rules. Turn on intrusion prevention, application control, web filtering and malware scanning, then tune them over the first couple of weeks as false positives show up. TLS inspection, which decrypts web traffic so the firewall can see inside it, catches more but takes care: it needs a certificate on every device, banking and health sites should be excluded, and staff should be told it is in place.
8. Send logs somewhere you will see them
A firewall’s own log fills up and overwrites itself. Forward logs to a syslog server or the vendor’s cloud service and keep at least 90 days, longer if your insurer or industry requires it. Set alerts for the events that matter: admin logins, configuration changes, VPN logins from unexpected countries and critical intrusion alerts.
9. Back up and document the configuration
Export the configuration after every change and store it off the device. Keep a short record of the internet circuit details, public IP addresses, admin accounts, licence expiry dates and the reason behind any unusual rule. If the firewall dies on a Monday morning, that record is the difference between an hour of downtime and a day.
10. Test it from the outside
Scan your public IP address from an outside connection and confirm that the only open service is the one you meant to open. From the guest Wi-Fi, try to reach a staff computer or printer and make sure you cannot. Test the VPN with a real user account, and if you have a high-availability pair, unplug one unit during a quiet hour to prove failover works.
A sample rule set for a 25-person office
Here is the shape of a sensible rule base for a small office with a file server, hosted phones, a few printers and guest Wi-Fi. Your services will differ, but the pattern holds: specific allow rules, then one deny rule that logs everything else.
| # | Rule | From | To | Service | Action |
|---|---|---|---|---|---|
| 1 | VPN in | Internet | Firewall VPN | IPsec (UDP 500, 4500) | Allow, with MFA |
| 2 | Admin access | Management zone | Firewall | HTTPS, SSH | Allow |
| 3 | Staff web | Staff, VPN users | Internet | HTTP, HTTPS | Allow, with web filtering and IPS |
| 4 | DNS | All internal zones | Firewall DNS filter | DNS (53) | Allow |
| 5 | Files and servers | Staff, VPN users | Servers | SMB (445), Remote Desktop (3389) | Allow |
| 6 | Phones | Phones | VoIP provider | SIP and RTP, provider’s ports | Allow |
| 7 | Printing | Staff | Printers | IPP (631), raw printing (9100) | Allow |
| 8 | Guest Wi-Fi | Guest Wi-Fi | Internet | HTTP, HTTPS | Allow, internal zones blocked |
| 9 | Clean-up | Any | Any | Any | Deny and log |
Rule 5 allows Remote Desktop only inside the network and over the VPN, never from the internet. A real office adds a handful more for things like time servers, software updates and video calls, each one as narrow as the ones above.
Keeping a firewall secure after install day
Patch on a schedule, and faster when it matters
Check for firmware updates every month. When the vendor publishes a critical advisory for an internet-facing feature such as the VPN, treat it as urgent and patch within days, not at the next maintenance window.
Review the rules every quarter
Remove rules that have not matched traffic in months, temporary rules that quietly became permanent, and anything that allows “any” to “any”. Check the VPN user list at the same time. Accounts for people who leave should be disabled the day they go, not at the next review.
Keep the subscriptions current
When the security subscription lapses, threat signatures and filtering lists stop updating. Depending on the vendor, the firewall either keeps running with stale protection or stops passing traffic once a grace period ends. Put the renewal date in the same calendar as your domain and Microsoft 365 renewals.
Replace hardware before support ends
Every model has an end-of-support date, after which the vendor releases no more security fixes for it. Plan the replacement a few months ahead, so the swap happens on your schedule rather than after an incident.
Control changes
Limit who can change the firewall, save a backup before and after each change, and record the change in the rule comment. When something breaks after a change, that trail tells you exactly what to undo.
Common firewall problems and how to fix them
A website or app is suddenly blocked
Search the firewall and web filter logs for the user’s address at the time it failed. Usually a category or application rule is catching it. Add a narrow exception for that site or app rather than switching the filter off.
The internet got slower after the new firewall went in
Check the firewall’s CPU load and its throughput with security features on. If it runs near its limit, especially with TLS inspection enabled, the model is undersized for your line. Turning features off one at a time for a short test shows which one costs the most.
The VPN works in the office but not from home
Check whether the office’s public IP address has changed, whether the user’s home router or a hotel network blocks the VPN’s ports (IPsec uses UDP 500 and 4500), and whether the VPN certificate has expired. Many business VPNs can also run over TCP port 443, which gets through most networks.
Phone calls drop or have one-way audio
A firewall feature called SIP ALG rewrites call setup traffic and often breaks hosted phone systems, so many VoIP providers recommend turning it off. Also check that the phone zone’s rules match the provider’s published addresses and that UDP session timeouts are not closing calls early.
Nobody knows who changed a setting
That usually means a shared admin login. Give each person their own account, turn on the audit log, and compare configuration backups to see exactly what changed and when.
Getting a second opinion on your firewall
If the person who set up your firewall has moved on, or nobody can say when the firmware was last updated, a review is the place to start: firmware, admin access, zones, rules, VPN and logging. Our network and firewall team does this for offices across Toronto, Mississauga, Vaughan and the rest of the GTA, on Fortinet FortiGate, Cisco and Ubiquiti UniFi equipment. If you would rather have patching, monitoring and rule reviews handled every month, that is part of our managed IT services.