Security

Firewalls for Small Business: What You Need vs. What You're Sold

Firewall shopping subjects small businesses to two opposite cons: "the ISP router is fine" (it isn't) and "you need the enterprise appliance with the four-figure annual license" (you probably don't). Here's the honest middle.

What the ISP box doesn't do

The router your internet provider supplied routes traffic. A business firewall controls it: inspecting flows, blocking known-malicious destinations, separating internal networks, terminating VPNs, prioritizing voice, and logging what happened when you need to know. The gap between those two jobs is where breaches live.

Features that earn their keep

• Stateful inspection and sensible rules: the baseline — only invited traffic gets in.
• VLAN support: the firewall is where your network segments (staff, voice, guest, cameras) get enforced.
• VPN with MFA: remote access done right, replacing the exposed remote-desktop habit that feeds ransomware.
• QoS: voice first in line — your phone quality depends on this box.
• Threat/content filtering: blocking known-bad sites and obvious malware paths; useful, keep expectations calibrated.
• Dual-WAN failover: the same box that protects you keeps you online when the primary ISP drops.

What's usually overkill at small scale

Per-seat security license bundles priced for 500 users, intrusion-prevention tuning nobody will maintain, and features that only shine with a full-time security team. An unmaintained "advanced" firewall is worse than a maintained simple one — complexity you don't manage is attack surface.

Configuration beats brand

Most firewall failures we're called to fix aren't hardware failures — they're any-to-any rules left from install day, remote management open to the internet, firmware years stale, and no one holding the admin password. The unglamorous disciplines are the security.

Our approach

We deploy business-grade firewalls (Ubiquiti gateways for most sites) configured with segmentation, VPN, QoS, and failover — then maintain them, because a firewall is a practice, not a purchase. If you can't name who last updated yours, that's the assessment to book.