What Is a Firewall and Do Small Businesses Need One?

Every device connected to the internet gets knocked on. Automated scanners sweep the internet around the clock looking for open doors: a remote desktop port left exposed, an old camera with a default password, a router admin page reachable from outside. A firewall is the bouncer that decides who gets in.

Most small businesses already own a firewall without knowing it. It is built into the router your internet provider installed and into Windows and macOS. The real question isn’t “do we have one?” but “is it switched on, configured sensibly and still getting updates?” This guide answers that in plain English.

What a firewall does

A firewall sits between 2 networks, usually your office network and the internet, or between a single computer and everything else, and checks traffic against a set of rules. Traffic that matches an allowed rule passes. Everything else is dropped.

The US Cybersecurity and Infrastructure Security Agency (CISA) describes firewalls as protection against outside attackers that shields your computer or network from malicious or unnecessary traffic. CISA’s tip on firewalls for home and small offices also makes a practical point: deciding to use a firewall matters more than which type you choose.

A firewall typically looks at:

• Where traffic comes from and where it is going (IP addresses)
• Which door it uses (ports, such as 443 for HTTPS)
• Which protocol it speaks (TCP, UDP)
• Whether it belongs to a conversation you started (connection state)
• Which application it belongs to (on more advanced firewalls)

The safest default rule is simple: block unsolicited inbound connections and allow only what you need.

The main types of firewalls

Firewall technology has grown in layers. The US National Institute of Standards and Technology covers the core technologies, including packet filtering, stateful inspection, application proxies and host-based firewalls, in its Guidelines on Firewalls and Firewall Policy (SP 800-41 Revision 1). Here is how the common types compare today.

Hardware vs software firewalls

CISA notes that hardware firewalls are useful for protecting multiple computers, and that software firewalls built into operating systems should be enabled for extra protection even if you have an external firewall. The two work together. The network firewall protects the office as a whole. The host firewall protects each laptop when it leaves the office and connects to hotel, airport or coffee shop Wi-Fi.

Do small businesses need a firewall?

Yes. Every business with an internet connection needs at least 2 layers:

1. A network firewall at the edge, between your internet connection and your office devices.
2. Host firewalls turned on for every computer.

What changes by business size and risk is how sophisticated the network firewall should be.

• Solo or very small office (1 to 5 people), mostly cloud apps: A modern business-grade router with a stateful firewall, kept updated and configured correctly, is often enough, together with host firewalls on every device.
• Growing office (5 to 50 people), handling payment, health or financial data: A dedicated business firewall or UTM appliance adds intrusion prevention, web filtering, VPN and logs you can review. Many owners have a managed IT service provider run it.
• Remote or hybrid team: Cloud-delivered firewall and secure web gateway services follow users wherever they work. This fits naturally into a zero trust security approach.
• You run your own website or online store on your own servers: Add a web application firewall, often offered by your hosting provider or content delivery network. See our guide to what a CDN is for how these services sit in front of a site.

Key takeaway: The firewall you already have is only useful if it is on, updated and set to block unsolicited inbound traffic. A cheap firewall configured well beats an expensive one left on factory settings.

What a small office actually needs to configure

Here is the configuration that matters most for a typical small office. You can do most of it from your router or firewall’s admin page in an afternoon.

On your router or network firewall

• Change the admin password from the default to a long, unique one stored in a password manager.
• Turn off remote administration from the internet unless your IT provider needs it, and then restrict it to specific addresses.
• Block unsolicited inbound traffic. This is usually the default on stateful routers. Don’t add port forwarding rules unless you know exactly why.
• Never expose remote desktop (RDP) directly to the internet. CISA’s ransomware guidance lists exposed RDP and other internet-facing services as common ways attackers get in. Use a VPN or a secure remote access service instead.
• Disable UPnP (Universal Plug and Play) if you don’t need it, since it lets devices open ports on their own.
• Separate guest Wi-Fi from the business network so visitors and smart gadgets can’t reach your computers or point-of-sale system.
• Turn on automatic firmware updates or check for updates monthly.
• Enable logging and, if possible, email alerts for blocked attacks or admin logins.

On every computer

• Windows: Open the Windows Security app and check Firewall & network protection. Microsoft lists 3 network profiles: domain, private and public. Make sure the firewall is on for all 3, and mark coffee shop or hotel networks as public. Microsoft warns that turning the firewall off could make your device more vulnerable to unauthorized access, and suggests allowing a specific app through rather than disabling it.
• Mac: Go to System Settings > Network > Firewall and make sure it is turned on. Use Options to control which apps can accept incoming connections.

Watch out for old firewalls

A firewall is itself an internet-facing device, and attackers target them. CISA has warned that edge devices such as firewalls, routers, VPN appliances and wireless access points are attractive targets because of their reach into an organization’s network. In February 2026, CISA issued Binding Operational Directive 26-02, requiring federal civilian agencies to inventory and replace end-of-support edge devices on a staged timeline. The directive applies only to federal agencies, but a joint fact sheet from CISA, the FBI and the UK’s National Cyber Security Centre strongly encourages all organizations to follow the same approach.

For a small business, the lesson is practical: if your router or firewall no longer gets security updates from its manufacturer, replace it. Check the vendor’s support page for an end-of-life date, and put the replacement in your budget before it expires. That old ISP router in the back closet counts too.

What a firewall can’t do

A firewall is one layer, not a complete security program. It won’t stop:

• Phishing emails that trick staff into handing over passwords or approving logins.
• Stolen passwords used to sign in to cloud apps like email and accounting software, which never pass through your office firewall at all.
• Malware someone runs themselves, such as a fake invoice attachment.
• Data that leaves through allowed channels, such as a compromised account uploading files over HTTPS.

That is why a firewall works best alongside multifactor authentication, encryption, regular updates, endpoint protection and tested backups. Our guide to ransomware protection shows how those layers fit together.

Where to start: a 6-step firewall plan

1. Find your firewall. Identify your router or firewall model and who manages it: you, your internet provider or an IT provider.
2. Check support status. Look up the model on the manufacturer’s website to confirm it still receives firmware updates.
3. Lock down admin access. Change the default password, turn off remote admin and enable automatic updates.
4. Review inbound rules. Remove port forwarding rules you can’t explain, and close any exposed RDP.
5. Split your networks. Put guests, smart TVs and cameras on a separate Wi-Fi network. If you are upgrading your network gear, compare mesh Wi-Fi and a traditional router first.
6. Turn on host firewalls. Confirm the firewall is on for every Windows and Mac computer, and add this check to your onboarding steps for new devices.

Then add the firewall to your broader small business cybersecurity checklist so it gets reviewed at least once a year.

Conclusion

A firewall is a set of rules that decides which network traffic gets through, and every small business needs one at the office edge and on every computer. You don’t need the most advanced model on the market. You need one that is supported, updated, configured to block unsolicited inbound connections and backed by host firewalls on every device. Get those basics right, and you close the doors automated attackers try first. For quick definitions of terms like NGFW and UTM, visit our glossary.

Sources

• CISA: Understanding Firewalls for Home and Small Office Use — what firewalls do, hardware vs software firewalls
• NIST: SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy — firewall technologies and policy recommendations
• CISA: BOD 26-02, Mitigating Risk From End-of-Support Edge Devices — risks of unsupported firewalls and edge devices
• CISA: #StopRansomware Guide — exposed RDP and internet-facing services as initial access vectors
• Microsoft: Firewall and network protection in the Windows Security app — Windows firewall network profiles and settings
• Apple: Change Firewall settings on Mac — turning on the macOS firewall