Firewall Security Best Practices for Small Businesses

The firewall is the security boundary between your office network and the internet, and the traffic cop between internal networks. It is also one of the most targeted devices in any small organization, because an outdated or misconfigured edge device can give attackers a direct path inside. These best practices are what we apply in our networking and IT infrastructure services.

Why does firewall security still matter in a cloud-first world?

Even when email and files live in Microsoft 365, the office firewall protects everything physically on site, enforces segmentation and controls remote access. Internet-facing edge devices, including firewalls and VPN gateways, are a recurring target for attackers, and vendors regularly publish urgent security fixes for them. A firewall that is unsupported, unpatched or full of legacy rules can undermine an otherwise solid security program.

Which firewall should a small business use?

Use a business-grade next-generation firewall (NGFW) from a vendor with a clear support lifecycle and active security subscriptions. Avoid ISP-supplied routers as your security boundary and consumer routers in any business setting.

Selection criteria:

How should firewall rules be designed?

Start from default-deny and add only documented, least-privilege rules. Every rule should answer who, what, where and why.

Rule design principles

1. Default-deny inbound. Block all unsolicited inbound traffic. Publish services through a reverse proxy, cloud service or ZTNA rather than port forwarding wherever possible.
2. Control outbound too. Allow staff networks general web access with filtering, but restrict IoT and guest networks to only what they need.
3. Default-deny between VLANs. Permit only specific flows, such as staff to printers on print ports, rather than allowing all internal traffic.
4. Be specific. Use defined source and destination objects, ports and applications instead of "any".
5. Document every rule. Include the owner, business reason, ticket reference and review or expiry date in the rule description.
6. Order rules deliberately. Place specific rules above general ones and remove shadowed rules that never match.
7. Avoid temporary rules that become permanent. Set expiration dates where the platform supports them.

What does a segmented inter-VLAN policy look like?

The firewall enforces segmentation planned during network design. A simplified small-office policy:

How should the firewall itself be hardened?

Hardening protects the firewall from being the point of compromise.

• ☐Running a vendor-supported model and current recommended firmware
• ☐Subscribed to vendor security advisories, with a process to patch critical issues quickly
• ☐Management interfaces (HTTPS, SSH) disabled on the WAN side, reachable only from a management network or via cloud management
• ☐Default admin account renamed or disabled, with named admin accounts and MFA
• ☐Unused services disabled, including UPnP, unused VPN types and legacy protocols
• ☐Strong, current encryption settings for VPNs
• ☐Configuration backed up automatically after each change and stored securely off the device
• ☐Admin credentials stored in an organization-owned password vault

How should remote access be handled?

Require MFA for any VPN, and plan to move toward zero trust network access. Traditional SSL or IPsec VPNs authenticated only by password are a common entry point for attackers.

• Integrate VPN authentication with your identity provider, such as Microsoft Entra ID, using SAML or RADIUS with MFA
• Limit VPN users to the networks and applications they need, not the whole internal network
• Use split tunneling so Microsoft 365 and SaaS traffic goes directly to the internet
• Consider replacing VPN with zero trust network access, which publishes specific applications without exposing a VPN gateway

Which security services should be enabled?

Enable the protections included in your subscription and tune them to avoid disruption.

What logging and monitoring are needed?

Logs are essential for investigating incidents, and many small offices have none. Send firewall logs off the device to a cloud management platform, syslog server or security information and event management (SIEM) system, and retain them long enough to investigate. Alert on admin logins, configuration changes, VPN logins from unusual locations and IPS detections, and make sure someone is responsible for responding.

How do cloud firewalls fit in?

Cloud workloads need their own network controls, such as Azure network security groups and Azure Firewall, AWS security groups and AWS Network Firewall, or Google Cloud firewall policies. The same principles apply: default-deny, least privilege, logging and review. See AWS security best practices and GCP security best practices, and for connecting offices to cloud networks, hybrid cloud networking.

What does a quarterly firewall review cover?

• ☐Firmware current and device within support
• ☐Rules with zero hits reviewed and removed or justified
• ☐Broad "any" rules tightened
• ☐Expired temporary rules removed
• ☐Admin accounts and VPN users reviewed against current staff
• ☐Security subscriptions active
• ☐Configuration backup verified
• ☐Logs being received and retained

What should nonprofits consider?

Nonprofits often run public or client Wi-Fi and youth programs, so web filtering and strict guest isolation matter. Security subscriptions are recurring costs, so budget for them alongside hardware rather than letting them lapse, which silently disables key protections. Some vendors offer nonprofit pricing.

Next steps

Pair this guide with the broader IT security checklist for small businesses. Desai InfoTech can review your firewall configuration, clean up rules and manage firmware and monitoring on an ongoing basis; contact us for a firewall review.