In many small and medium-sized businesses, internet comes straight from the provider's router into the office, and no extra security device is used because "the router has a firewall". Yet in a setup where computers, servers, cameras and guest devices share one network and remote staff connect in, that is not enough. This article explains what an SME should look at when choosing a firewall.

Why Isn't the Router's Firewall Enough?

A router's basic firewall blocks unwanted incoming connections, but it does not inspect outgoing traffic at application level, does not block malicious sites or known attack patterns, does not let you split the network into segments with rules between them and keeps no detailed logs. A business firewall lets you manage all of this from one point.

6 Criteria That Drive the Choice

  • Number of users and devices: Count not only today's figure but the expected figure in two or three years.
  • Real performance: The top figure in vendor datasheets is often measured with security services off. Compare the figure measured with intrusion prevention, web filtering and antivirus on against your internet speed.
  • VPN needs: The number of remote workers and branch links sets the VPN capacity required. Look for MFA support for VPN logins.
  • Security service licences: Intrusion prevention, web filtering, antivirus and similar services usually run on a yearly subscription.
  • Management and reporting: Who manages the rules, where and for how long logs are kept and how readable the reports are all matter.
  • Continuity: Where an internet outage stops the business, plan two internet lines and, if needed, a second device for high availability.

A General Framework by Size

The thresholds below are not fixed; they shift with your requirements list.

  • Small office (up to about 25 users): A desktop UTM appliance, one or two internet lines, basic VPN and web filtering are often enough.
  • Mid-size (about 25–100 users): A rack-mounted appliance, two internet lines, rules between office, camera and guest networks, per-user VPN and central logging.
  • Multi-branch business or production site: Two devices for high availability, site-to-site VPN, separating the production network (machines, PLCs) from the office network and forwarding logs to a central monitoring system (SIEM).

Licences and Total Cost

A firewall's cost is not just the device price. Security service licences renew every year; with many vendors the device keeps working as a basic firewall when the licence expires, but the continuously updated protection services stop. Compare quotes on total cost over at least three years: device, licence renewals, installation and management. For scope and starting prices, see our article on cybersecurity prices.

Common Installation Mistakes

  • An "allow everything" rule added to ease migration and then forgotten for good,
  • The management interface left open to the internet and used with the default admin account,
  • Device firmware never updated,
  • Logs not kept, or kept but never reviewed,
  • VPN users able to reach the whole network, with MFA not enabled.

Preparing for the Right Choice

Preparing this information before asking for quotes makes the right device easier to choose: a list of users and devices, internet line speeds, number of remote workers and branches, critical applications (ERP, accounting, cloud services) and the current network diagram. A firewall is a core part of a Zero Trust approach; it delivers its real value when planned together with network segmentation and authentication.

After Installation: The First 30 Days

  • Rules are reviewed against real traffic in the first weeks, and overly broad permissions are narrowed.
  • A regular update window is set for the device firmware.
  • The configuration is backed up and refreshed after every significant change.
  • Weekly reports are reviewed: blocked threats, the devices generating most traffic, VPN sessions.
  • Admin accounts are made personal and admin logins are protected with MFA.

Frequently Asked Questions

Which firewall brand do you recommend?

The brand should be chosen by your requirements list, real performance figures, licence cost and local support. It would be wrong to say one brand is best for every business.

What happens if I don't renew the licence?

With many vendors the device keeps working as a basic firewall, but continuously updated services such as intrusion prevention and web filtering stop and protection weakens.

Do we need a firewall if we use cloud applications?

Yes. Internet access for office devices, traffic between network segments and remote access are still managed through the office network. Extra measures for cloud apps complement this protection rather than replacing it.

To work out the right size for your business together, visit our cybersecurity and Zero Trust page and contact us for a free quote.