Published on October 28, 2026 · The mitza.es team
Almost every small business has a firewall without knowing it (the one built into the office router or Windows itself), and almost none knows whether it's properly configured. A badly configured firewall is worse than having none, because it gives a false sense of security. This guide explains what it is, how it works and what a small company really needs.
What a firewall is and what it's for
A firewall is a security system that filters network traffic between your internal network and the outside (usually the internet) according to a set of rules: it lets through what's allowed and blocks the rest. It can be a program (software), a device (hardware) or a cloud service, and its job is to prevent unauthorized access and reduce the attack surface.
Think of a doorman: he checks who comes in and who goes out, and only opens the door to those with permission. He doesn't stop someone with a fake invitation (a phishing email, for example) from walking in through the front door, and that is where part of the confusion about what it protects comes from.
How a firewall works
Every network connection has a source, a destination, a port (the “channel” a service uses) and a protocol. The firewall compares each connection against its list of rules and decides whether to allow or block it. Good practice is to deny by default: everything that isn't expressly allowed gets blocked. For example, outgoing web browsing is allowed and unsolicited incoming connections are blocked.
Types of firewall
They can be classified in two ways: by where they're installed and by how they filter.
By where they're installed
- Network firewall (hardware): protects the whole network from the entry point. It's the one in a professional router, a dedicated appliance (UTM) or a server.
- Device firewall (software): runs on each computer. Windows Firewall (Microsoft Defender Firewall) is on by default and it's best to leave it that way.
- Cloud firewall (FWaaS): you subscribe to it as a service and it filters traffic before it reaches your network; useful with many sites or remote staff.
By how they filter
- Packet filtering: looks at basic data (address, port and protocol). It's fast and simple, but not very “smart”.
- Stateful: also remembers the state of each connection and only admits replies to connections started from inside. It's the reasonable minimum today.
- Proxy or application-level: acts as an intermediary and inspects the content of certain applications.
- Next-generation firewall (NGFW): adds deep traffic inspection, intrusion prevention (IPS), application control and web filtering. It's what's usually sold to businesses.
Web application firewall (WAF): what protects your website
A WAF (web application firewall) is a firewall specific to websites: it analyzes the requests reaching your site and blocks common attempts such as SQL injection or malicious scripts. If you have a WordPress site or an online store, it's a highly recommended layer, above all because flaws in plugins are exploited within days (we cover this in our analysis of a critical WordPress vulnerability). Many hosting providers and protection services include it; check before paying for another one.
Firewall, antivirus and VPN: what each one does
- Firewall: controls which connections come into and go out of the network or the device.
- Antivirus / EDR: detects and stops malicious programs already on a device, even if they got in through an email or a USB stick.
- VPN: creates an encrypted tunnel so you can connect securely to the company network from outside. It doesn't replace the firewall: they complement each other.
A sensible defense combines them. None of them protects against everything on its own.
What a firewall protects and what it doesn't
A well-configured firewall is very good at:
- Preventing access from the internet to devices and services that shouldn't be exposed.
- Limiting which sites and programs the company's devices can connect to.
- Separating networks (guests, cameras, printers, work computers).
And on its own it doesn't protect you from what comes in “by invitation”: a phishing email that convinces someone to hand over their password, an attachment that installs ransomware, a weak password or a compromised cloud account. That is why team training, two-step verification and backups are as important as the firewall.
What firewall does a small business need?
- Up to about five workstations, no server and with cloud services: an up-to-date router, Windows Firewall switched on, wifi properly configured and good passwords are usually enough.
- Between five and fifty workstations, with a server, several sites or remote work: a professional network firewall (UTM or NGFW) with support and updates is advisable, plus a VPN for remote access and network segmentation.
- With your own website or store: add a WAF, either from the hosting provider or from a protection service.
- With sensitive data or regulatory requirements (for example, if the NIS2 regulation applies to you): add centralized logs and periodic review by a professional.
Basic settings that really make a difference
- Change the default credentials of the router or firewall and use a long, unique password.
- Update the firmware regularly: firewalls and routers are themselves attacked.
- Disable remote administration from the internet, or limit it to a VPN or a specific IP.
- Apply “deny by default” to incoming connections and open only what's essential.
- Disable UPnP and close ports that are no longer used.
- Put the guest wifi and connected office devices (cameras, point-of-sale terminals, printers) on a separate network.
- Use a VPN with two-step verification for remote access, instead of opening ports.
- Turn on logs and alerts, and check them from time to time.
- Keep a copy of the configuration so you can restore it.
- Don't turn Windows Firewall off “because it causes problems”: find the specific rule that's causing it.
A firewall needs maintenance too
Edge devices (firewalls, gateways, VPNs) are a priority target because they're exposed to the internet. We've seen it this year with the Citrix NetScaler zero-days and with the Cisco and FortiMail email gateways. The lesson is simple: a firewall that isn't updated is an open door disguised as a lock.
Quick questions
Is Windows Firewall enough for me?
It's a good layer for each device and it should be on, but it doesn't protect the whole network or the devices that aren't running Windows. Use it alongside a network firewall.
Does my internet provider's router already include a firewall?
Yes, a basic one, which blocks unsolicited incoming connections. It usually has few options and doesn't cover needs such as advanced VPNs, segmentation or logs. For an office with several workstations, it falls short.
If I work entirely in the cloud, do I need a firewall?
Less so, but you still need to protect the office network and the devices. What you definitely need are well-protected accounts and independent backups.
How we can help at Mitza
We review your network configuration and your access, and also the security of your website with a website security audit. If you'd like us to look at your case, tell us about it on the contact page.