What a firewall does, and what it does not
A firewall controls which traffic may pass between networks, such as your LAN and the internet. A business-grade firewall adds VPN, intrusion prevention, web and application filtering, and logging. It does not replace patching, endpoint protection or sensible passwords, and a misconfigured firewall can be worse than none because it creates false confidence.
Types you will meet
| Type | What it adds | Typical fit |
|---|---|---|
| Stateful firewall | Tracks connections; allows or blocks by address, port and protocol | Very small networks, simple edges |
| UTM (unified threat management) | One box with firewall, VPN, IPS, web filtering, antivirus, often easier management | Small and mid-size offices |
| NGFW (next-generation firewall) | Application awareness, user identity, deeper inspection, richer policy and reporting | Mid-size and larger, multi-site, tighter control |
| Cloud-managed firewall | Central cloud console, simple multi-site rollout and updates | Branches, retail, distributed teams |
| WAF (web application firewall) | Protects a specific web application from web attacks. A different job | Organisations hosting public applications |
Reading the throughput numbers
The headline figure on a datasheet is usually raw firewall throughput with no security features. Turn on intrusion prevention, application control and TLS inspection, and real throughput can fall sharply. Look for the vendor's threat-protection or NGFW throughput, and size to your internet speed with headroom.
- Firewall throughput: best case, features off
- Threat-protection throughput: with IPS, application control and malware scanning
- VPN throughput: matters for remote staff and branches
- Concurrent sessions and new sessions per second: matter for many users and CCTV or cloud traffic
- Interfaces: enough ports and SFP uplinks, plus a dedicated port for each ISP
Designing the rules
- Start from default deny and allow only what is needed
- Create zones: LAN users, servers, guest Wi-Fi, CCTV and IoT, DMZ for public services
- Allow by user or group and application where the firewall supports it, not by IP alone
- Never leave an any-any rule in production
- Do not forward ports directly to NVRs, printers or remote desktop. Use VPN with MFA instead
- Give each rule a name, an owner and a review date
- Log denied traffic and review it
Remote access and VPN
- Prefer a VPN with multi-factor authentication over exposed remote-desktop ports
- Use modern protocols (IPsec/IKEv2, WireGuard where supported, current SSL-VPN builds) and keep the firewall firmware current
- Give remote users access only to what they need, not the whole LAN
- Site-to-site VPNs need non-overlapping subnets. Plan addressing early
- Plan failover: a second ISP and automatic fail-back
Hardening checklist
- Change default admin credentials; use named admin accounts with MFA
- Restrict management access to a dedicated management network or VPN
- Update firmware on a schedule and subscribe to vendor security advisories
- Disable unused services and unneeded WAN-facing management
- Turn on logging; send logs to a separate system; keep them as long as policy requires
- Back up the configuration after every change and store it off the device
- Document the network diagram, rules and exceptions
- Review rules at least twice a year and after every major change
- Test failover and VPN recovery
Common mistakes
- Using the ISP router as the only perimeter
- Buying on datasheet throughput, then enabling inspection and discovering the box is too slow
- Leaving the firewall on its original firmware for years
- A flat network where a compromised PC can reach servers and cameras
- Shared admin passwords
- No tested configuration backup
India context
If you must retain logs or report incidents under CERT-In Directions, make sure your firewall logs are kept long enough and have synchronised time. Camera and biometric systems should sit on their own network segment. Confirm any specific compliance obligations with a qualified adviser.
Key takeaways
- Size on threat-protection throughput, not the headline number
- Segment: users, servers, guests, CCTV/IoT
- No open ports to NVRs or remote desktop: use VPN with MFA
- Backups of configuration and a review date for every rule
References and further reading
General information for orientation; it is not legal or professional advice. Specifications, products and regulations change, so verify current details before acting. Product names belong to their owners and are mentioned only as examples.