In many small offices, the only thing standing between the company network and the internet is the router the ISP installed on day one. It works, the Wi-Fi comes on, and nobody touches it again. That box was designed to share an internet connection, not to protect a business that holds customer records, payroll files and access to its bank accounts.
This article explains what a business firewall does that a consumer router does not, what "managed" actually means, and the specific practices that keep a firewall useful over time: ownership, rule hygiene, updates, secure remote access, network segmentation, logging and planning for hardware that reaches end of life. You will finish with a checklist you can use to assess your own setup.
Key takeaways
- An ISP-supplied router is not a business firewall.
- A firewall is only as good as the person who maintains it; "managed" means someone clearly owns it.
- Keep firmware current, review rules regularly and back up the configuration.
- Remote access should go through a VPN with multi-factor authentication, never through open ports.
- Separate guest Wi-Fi and devices from your staff network.
Router or firewall: what is the difference?
A consumer or ISP router does a few things well. It shares one internet connection across many devices, hands out local addresses and blocks unsolicited inbound connections by default. For a household, that is often enough.
A business or next-generation firewall (NGFW) goes considerably further. Example product families include Fortinet FortiGate, Sophos, and the open-source pfSense and OPNsense platforms. These are mentioned as examples only; the right choice depends on your size, budget and who will manage it. What matters is the capabilities:
- Stateful inspection: the firewall tracks each connection and only allows return traffic that belongs to a conversation your network started.
- Application awareness: it can identify traffic by application, not just by port number, so you can allow business tools and restrict others.
- Intrusion prevention (IPS): it inspects traffic for known attack patterns and blocks them.
- Web filtering: it can block known malicious or inappropriate sites by category.
- VPN: a virtual private network gives remote staff an encrypted tunnel into the office network.
- VLAN segmentation: a VLAN (virtual LAN) splits one physical network into separate logical networks, such as staff, guests and devices, with rules controlling what can talk to what.
- Logging: it keeps a record of connections, blocked attempts and administrative changes, which is essential when investigating a problem.
What "managed" really means
Buying a capable firewall is the easy part. The harder part is that firewalls degrade quietly. Rules accumulate, firmware goes out of date, logs fill up without anyone reading them, and the one person who understood the setup leaves the company.
A managed firewall is one where someone, internal or external, explicitly owns the ongoing work: applying updates, reviewing rules, checking logs, backing up the configuration and planning replacements. The word describes an arrangement of responsibility, not a product feature.
Who should own it
For most SMEs without a senior IT person, ownership is the gap. Name one accountable person, even if the technical work is done by a vendor or contractor. That person should know who has admin access, when the last update was applied, where the configuration backup lives, and who to call when something breaks. If your firewall is managed by an outside provider, make sure you still hold the admin credentials and documentation. You should never be locked out of your own network if a vendor relationship ends.
Rule hygiene and updates
Firewall rules define what traffic is allowed. Over time, temporary exceptions become permanent and nobody remembers why a port was opened. Good rule hygiene means:
- Every rule has a clear description, an owner and a reason.
- The default stance is to deny, with specific allow rules for what the business needs.
- Rules are reviewed on a regular schedule, and anything unused or unexplained is removed.
- Changes are recorded: who made them, when and why.
Firmware updates matter just as much. Firewall vendors regularly publish fixes for security flaws, and attackers actively scan the internet for devices that have not been patched. Plan a maintenance window, read the release notes, back up the configuration first, and apply updates promptly, especially those flagged as security fixes.
Remote access, guests and devices
Remote access through VPN with MFA
A common and risky shortcut is opening a port on the router so staff can reach a file server or remote desktop from home. These exposed services are a frequent entry point for attackers. Instead, put remote access behind the firewall's VPN, and require multi-factor authentication (MFA), meaning a second proof of identity such as an authenticator app code, in addition to the password. Remove VPN accounts promptly when staff leave.
Guest Wi-Fi and device segmentation
Visitors, personal phones, CCTV cameras, smart TVs and printers do not need to sit on the same network as your accounting system. Use VLANs and separate Wi-Fi networks so guests get internet access only, and devices can reach only what they need. If one of those devices is compromised, segmentation limits how far the problem can spread.
Logging, alerts and configuration backup
Logs are only useful if someone looks at them, or if alerts are set up to flag the events that matter: repeated failed admin logins, VPN logins from unusual locations, configuration changes, and IPS detections. Decide which events should trigger a notification and who receives it. Make sure logs are kept long enough to be useful in an investigation, since problems often go unnoticed for weeks.
Keep a current configuration backup stored somewhere other than the firewall itself. If the device fails or a bad change locks everyone out, a backup turns a long outage into a short one.
Plan for end-of-life hardware
Every firewall model eventually reaches end of life, after which the vendor stops releasing security updates. Know the end-of-support date for your device and plan the replacement before it arrives. A firewall that can no longer be patched becomes a liability, however well it is configured.
Where to start
Use this checklist to see where you stand:
- Identify what is actually protecting your network today: an ISP router or a business firewall.
- Name one person accountable for the firewall and confirm your business holds the admin credentials.
- Check the firmware version and the device's end-of-support date.
- Review the rule list and remove anything unused or unexplained.
- Close any ports opened for remote access and move remote access behind a VPN with MFA.
- Separate guest Wi-Fi and devices from the staff network.
- Turn on logging, decide which alerts matter, and assign who receives them.
- Back up the configuration and store it off the device.
If you are not sure how your network measures up, Northgate's Cloud & Infrastructure Review looks at your current firewall and network setup and gives you plain-language recommendations, and we can build or reconfigure it in scoped milestones if you want us to. The first step is simple: book a free 30-minute call to discuss your situation.