What Is a Network Firewall and How It Protects an Office
Basics3 minInnovialabs editorial team
In short
A firewall decides which traffic may enter and leave the office network based on rules; for a small office the foundation is blocking all inbound connections by default and allowing remote access only through a VPN.
The short answer
A firewall is a device or program at the edge of a network that inspects every connection and decides whether to allow it, block it or log it. Decisions follow rules: where traffic comes from, where it goes, which port and which protocol.
In an office, the firewall sits between the internet and the local network, and sometimes between internal segments too — for example, separating guest Wi-Fi and cameras from work computers.
How it works: three generations
Packet filtering. The simplest approach: each packet is checked on its own against addresses, ports and protocol. Fast, but the firewall cannot tell whether a packet belongs to an allowed conversation.
Stateful inspection. The firewall remembers established connections in a state table. When an office computer opens a website, the reply is allowed because it belongs to a known connection. Unsolicited inbound traffic is dropped. This is the standard for modern routers and firewalls.
NGFW (Next-Generation Firewall). Adds higher-level features on top of stateful inspection:
- application awareness — a rule like "block torrents" instead of "close a port";
- IPS — an intrusion prevention system that looks for signs of known attacks;
- URL and website category filtering;
- user identity — rules for groups of employees rather than IP addresses;
- TLS inspection — checking encrypted traffic (requires installing a certificate on devices and careful handling of privacy).
Router-built-in vs dedicated firewall
| Router firewall | Dedicated firewall / NGFW | |
|---|---|---|
| Basic stateful protection | Yes | Yes |
| Segmentation (VLANs, guest network) | Often, depends on model | Yes |
| IPS, application and URL filtering | Rare or basic | Yes, often by subscription |
| VPN for staff | On some models | Yes, usually more flexible |
| Logs and reports | Minimal | Detailed |
| Best for | Small office without sensitive data | Office with servers, remote staff, security requirements |
The key question is not "which box" but whether you have rules and who maintains them. A well-configured router beats an expensive NGFW left on default settings.
Baseline rules for a small office
- Deny all inbound connections by default. Open only what is genuinely needed.
- Never forward RDP, SSH, or NAS and camera web interfaces to the internet. Remote access goes through a VPN only.
- Separate guest Wi-Fi from the work network so guests see only the internet.
- Put cameras, printers and IoT devices in their own segment — they are rarely updated.
- Disable management of the router and firewall from the internet and change the default admin password.
- Restrict outbound traffic, at least for servers: they rarely need access to the whole internet.
- Update firmware regularly — vulnerabilities in network gear are found all the time.
- Turn on logging and review blocked and allowed connections from time to time.
Common mistakes
- An "allow all" rule added "temporarily". Temporary rules live for years.
- Port forwarding instead of a VPN for one employee's convenience.
- A flat network where a guest laptop and the accounting server share one segment.
- Believing the firewall protects against everything. It will not stop a phishing email an employee opens, or weak passwords.