Firewalls for Small Businesses: Do You Need One and What It Does

The ISP router is not a security device

Most small offices, clinics and shops run on the router their internet provider installed. It connects to the internet and blocks unsolicited incoming connections, which is useful, but it gives little control over what happens inside the network, keeps almost no useful logs, and is often left with default settings. A business firewall sits between that connection and your network and enforces your rules.

What a business firewall adds

• Network separation: staff, guests, CCTV and devices on separate VLANs with rules between them.
• Secure remote access: a VPN for staff working from home and for viewing cameras without port forwarding.
• Web and application filtering: block malicious and unwanted sites, and limit bandwidth-heavy apps.
• Threat protection: intrusion prevention and malware filtering on subscription-based models.
• Dual-ISP failover: two internet lines from different providers, switching automatically if one fails.
• Logging and reports: who connected, when, and to what — essential after an incident.

Logs and the CERT-In directions

Under CERT-In’s directions of April 2022, service providers, intermediaries, data centres, body corporates and government organisations in India are required to report specified cyber incidents to CERT-In within six hours of noticing them, to keep ICT system logs securely for 180 days within India, and to synchronise system clocks with the NTP servers of NIC or NPL (or servers traceable to them). How these duties apply to a particular small business is a question for your legal or compliance advisor, but a firewall that keeps accurate, time-synced logs is the practical starting point.

Who needs one

• Any office with more than a handful of staff, or with accounts, HR or customer data on its computers.
• Clinics and diagnostic centres handling patient information.
• Shops and showrooms with billing systems and CCTV on the same internet line.
• Businesses that offer guest Wi-Fi.
• Anyone whose staff work remotely and need access to office systems.

Sizing and licensing

Firewalls are sized by throughput with security features switched on, not by the headline figure on the box. A 50-person office on a 300 Mbps line needs a model that can inspect traffic at that speed. Most business firewalls sell security features as a yearly subscription; budget for renewal, because a firewall whose subscription has lapsed loses much of its protection.

A typical small-office setup

• Two internet lines from different providers into the firewall, with automatic failover.
• Separate VLANs for staff, guests, CCTV and devices.
• VPN accounts for staff who work remotely.
• Web filtering and threat protection subscriptions active.
• Logs kept with accurate, synchronised time.
• Admin access limited to named people, with two-factor login.

What a firewall does not do

A firewall does not replace strong passwords, two-factor authentication, updated software, backups or staff awareness. Many attacks today arrive as convincing emails, payment-change requests or even cloned voices on the phone. Treat the firewall as one layer in a set of habits.

Quick answers