Small businesses sometimes think that a firewall is mainly intended for large companies with hundreds of employees and their own servers.

That is not true.

Even a company with just a few employees often has today:

• laptops with business data;
• Microsoft 365;
• Wi-Fi;
• printers;
• smart TVs or conferencing devices;
• cameras or access control;
• VoIP telephony;
• IoT equipment;
• guests using Wi-Fi.

What Does a Firewall Do?

A firewall monitors network traffic between different networks.

In a simple business network, the firewall usually sits between:

The firewall determines which network traffic is allowed or blocked.

Depending on the chosen product and configuration, a professional firewall can do much more.

• block unwanted incoming connections;
• monitor outgoing traffic;
• separate different network segments from each other;
• isolate guest Wi-Fi from the business network;
• detect suspicious traffic;
• block malicious websites or network connections;
• provide VPN or other secure connections;
• record and monitor network activity;
• enforce rules between different devices and network zones.

But My Internet Router Already Has a Firewall, Right?

Often yes.

Your internet provider’s router or modem usually already includes basic functionality that blocks unwanted connections from the internet.

For a very simple situation, this can form a first layer of security.

A standard router is usually designed to provide internet access. A business firewall is designed to control, segment, secure, and monitor network access.

When Can a Simple Router Be Enough?

Imagine a particularly simple environment:

• one or two employees;
• no servers or NAS;
• no incoming network connections;
• all business applications are cloud-based;
• all laptops are professionally managed and secured;
• no IoT or production network;
• no special network segmentation needed;
• no guests working on the same network.

In such a limited environment, a well-configured router combined with strong endpoint and cloud security may be sufficient.

When Do We Strongly Recommend a Professional Firewall?

As soon as a business network becomes somewhat more complex, the added value quickly increases.

For example, when you:

• have multiple employees;
• use business Wi-Fi and guest Wi-Fi;
• have printers, cameras, telephony, or other network equipment;
• use servers, NAS systems, or local applications;
• want to separate different network zones from each other;
• need external access to internal systems;
• want central monitoring and logging;
• want more control over what network devices may access;
• value continuity and professional support.

Network Segmentation Is at Least as Important as the Firewall Itself

A classic small business network sometimes looks like this:

That is simple, but not ideal.

If one device is compromised, an attacker may try to reach other systems on the same network.

With network segmentation, you can, for example, provide separate zones for:

• business devices;
• servers;
• telephony;
• cameras;
• IoT;
• guest Wi-Fi.

The firewall then determines which traffic between those zones is allowed.

But We Work Entirely in Microsoft 365

That often reduces the need to make internal servers accessible from the internet, but does not make network security redundant.

Microsoft 365 does not automatically secure:

• your local Wi-Fi;
• printers;
• cameras;
• IoT devices;
• VoIP equipment;
• local network connections;
• traffic between devices in your business network.

Moreover, a good modern security architecture consists of multiple layers.

These measures do not simply replace each other. They complement each other.

Zero Trust Does Not Mean "No More Firewall"

With Zero Trust, a device or user is not automatically trusted just because they are behind the business firewall.

However, that does not mean network security disappears.

On the contrary: modern Zero Trust architectures use network controls, among other things, to:

• segment networks;
• limit lateral movement of attackers;
• control connections between network zones;
• block unwanted communication;
• make network activity visible.

What Can a Modern Business Firewall Offer Extra?

Depending on the manufacturer, licence, and configuration, a modern firewall can offer additional security features besides classic firewalling.

For example:

• intrusion prevention;
• detection of suspicious network traffic;
• web and DNS filtering;
• application control;
• secure VPN connections;
• geographical restrictions;
• central logging;
• alerting and monitoring;
• segmentation between VLANs and network zones.

A Firewall Must Be Professionally Configured

Buying a professional firewall and connecting it is not enough.

The security value mainly arises from the right architecture and configuration.

For example, it must be determined:

• which network segments are needed;
• which devices may communicate with each other;
• which connections to the internet are allowed;
• which external access is necessary;
• which security services must be enabled;
• which logs and alerts must be monitored;
• how updates and firmware are managed;
• what happens when the firewall fails.

Is a Cheap Firewall Then Enough?

The price or size of a firewall says little on its own.

A small organisation usually does not need a device designed for thousands of users.

But the device must fit:

• your internet speed;
• the number of users and devices;
• the desired security features;
• VPN or private access needs;
• the number of network segments;
• the required availability;
• the expected growth.

Do I Need Two Firewalls?

That depends on how important the internet connection is for your business operations.

When almost everything runs via Microsoft 365 and other cloud applications, a faulty firewall can mean the entire office is without internet.

For organisations that can hardly operate without internet, redundancy can therefore also be relevant.

Think, for example, of:

• two firewalls in high availability;
• a second internet connection;
• 4G or 5G failover;
• a combination of these measures.

A Firewall Does Not Make Your Business Invulnerable

Here too: 100% security does not exist.

A firewall can monitor and block a lot of network traffic but does not protect against every possible attack.

For example, a user can:

• give their password to a phishing website;
• approve a fraudulent MFA request;
• open a malicious document;
• consciously ignore a security warning;
• send confidential information to the wrong person.

That is why cybersecurity always consists of multiple layers of defence.

So: Do I Need a Firewall as a Small Business?

Not Sure What Your Business Needs?

You don’t have to decide yourself as a business owner which firewall, security services, VLANs, or network rules you need.

A good network architecture must connect to the entire IT and security environment of your business.

In Summary