A firewall for a small office: the router, the laptops, and what neither one stops

Ireland's National Cyber Security Centre (NCSC) defines a firewall as hardware or software used to prevent unauthorised access to or from a network, and asks small businesses to think of it as a protective barrier between their network and the internet. The UK's National Cyber Security Centre (UK NCSC) puts it in one line: a firewall blocks unwanted connections, usually from the internet, from reaching your device.

Turning on firewalls is one of the basic protections in the NCSC's guide for small businesses, alongside regular updates, anti-malware and encryption, and its checklist asks for firewalls to be enabled on all devices. Its earlier 12 Steps to Cyber Security, written for Irish businesses, lists boundary firewalls among the essentials it calls a minimum baseline for any organisation. In the small business guide, firewalls come under the third of six measures, basic protections; the NCSC's six measures for a small business covers all six.

The UK's Cyber Essentials scheme separates the two. A boundary firewall is a network device that restricts traffic into and out of the network it protects, using rules that allow or block traffic by its source, its destination and the kind of connection. The scheme accepts a firewall or a network device with firewall functionality for that job, and its firewall requirements apply to routers as well as to boundary firewalls. A software firewall runs on one device and protects only that device, wherever it is used.

Its requirements say every device in scope must be protected by a correctly configured firewall, and that a device used on a network the business does not control, such as a public Wi-Fi hotspot, needs its own software firewall. For staff working from home, a router the business gives them is in scope. Any other home router is not, so the firewall controls go on the laptop itself, unless the laptop connects through the business's VPN, in which case its internet boundary is the company firewall, or a virtual or cloud firewall.

Cyber Essentials is a UK scheme, and CyFun, ISO 27001 or Cyber Essentials covers when an Irish business is asked for it. Its requirements are used here because they set out the firewall settings one by one.

For every firewall, a router with firewall functionality included, Cyber Essentials version 3.3, dated April 2026, requires the business to:

Microsoft says Windows Firewall is included with the operating system and enabled by default on all Windows editions. By default it blocks all incoming traffic unless the device asked for it or a rule allows it, and allows all outgoing traffic unless a rule blocks it.

It applies one of three profiles, depending on the network: domain, private or public. The public profile, for networks such as Wi-Fi hotspots, coffee shops, airports and hotels, is designed with higher security in mind, and Windows uses it for any network it does not recognise.

To check it, open the Windows Security app, select Firewall & network protection, choose the network profile, and make sure Microsoft Defender Firewall is On. If an app you need is blocked, Microsoft's advice is to allow that app through the firewall instead of turning the firewall off. The UK NCSC's reason to check at all: a previous user may have turned it off.

On laptops managed with Microsoft Intune, a Windows compliance policy can require the firewall: Intune turns it on and stops users turning it off. What Intune does for a small business covers compliance policies.

Apple's Mac User Guide puts it in System Settings: click Network in the sidebar, then Firewall, and turn it on. Apple says a firewall can protect a Mac from unwanted contact initiated by other computers when it is connected to the internet or a network.

Its options decide what still gets through. Block all incoming connections stops incoming connections to services and apps that are not essential, leaving the basic internet services that let the Mac find services on other computers on the network. Two further settings let built-in software, and downloaded software, signed by a valid certificate authority receive incoming connections without your authorisation. Stealth mode stops the Mac answering probing requests that could reveal it, such as ping, while it still answers authorised apps. And turning on a sharing service, such as file sharing, opens a port in the firewall for that service.

Cyber Essentials advises turning on the firewall that comes with the operating system in preference to a third-party firewall app.

The NCSC's ransomware guide names the common ways an attacker gets into a network: phishing, stolen or guessed credentials, and vulnerabilities in systems exposed to the internet. A firewall decides which connections are allowed in and out. This is what that leaves to other controls.

The NCSC says attackers exploit known vulnerabilities, and in rare cases unknown ones, in systems exposed to the internet, remote access points such as VPNs and remote desktop (RDP) among them, and that some critical vulnerabilities let an attacker run their own code on a device without logging in. The UK NCSC's ransomware guidance, last reviewed in September 2021, says ransomware is increasingly deployed by attackers who got in remotely through exposed services such as RDP, or through unpatched remote access devices.

Their advice, between them:

The first hour of a ransomware attack sets out what to do if one gets through, from disconnecting the infected devices to reporting it to the Gardaí. Two-step sign-in on Microsoft 365 and Google Workspace covers the same second factor for email and the files kept in the cloud.

A router's or a firewall's firmware is its software, and Cyber Essentials counts it as software: its definition includes firewall and router firmware. Its update rules apply to firewalls and routers. The software must be licensed and supported, removed when it is no longer supported, set to update automatically where possible, and updated within 14 days of release where the update fixes a vulnerability the vendor calls critical or high risk, or one scored 7 or above under CVSS version 3, or where the vendor gives no detail of what it fixes.

The NCSC's ransomware guide asks for all hardware and software, particularly edge devices, to be kept up to date with the latest security patches. The UK NCSC asks for security-enforcing devices on the network boundary, such as firewalls and VPN products, to be kept patched, and for automatic updates to be turned on for firmware where possible.

When the maker stops supporting a device, the NCSC's small business guide says it is time to replace it with a more up-to-date alternative.

Each comes from the guidance above. Put them to whoever looks after your network.