Firewall is not only for large systems
A small business often has the same risks as a large one: email, server, remote access, cameras, guest Wi-Fi and applications that must stay available.
The difference is that rules should remain simple and understandable, without a pile of exceptions that nobody dares to remove.
- Block everything that is not needed
- Open only with a clear purpose
- Comment every rule
- Regular review of old exceptions
What should not be exposed to the internet
Administration of routers, NAS devices, servers, cameras and remote desktop access should not be directly exposed to the internet. If access must exist, it should go through VPN, MFA or restricted sources.
The most common bad sign is a public open port for a service nobody uses or understands.
Separate zones reduce damage
Guest Wi-Fi, cameras, POS devices, servers and user computers do not have to be in the same network. When separated, a problem in one part of the network is less likely to affect everything else.
The firewall between zones should allow only necessary traffic.
What a firewall review looks like
A review starts with configuration export, rule mapping and a check of publicly open ports. Then rules are labeled, obsolete ones removed and order is made logical.
At the end, the company receives a document: what is open, why, who uses it and when it should be reviewed again.