You already have a firewall, it's built into your router, and for most small offices and shops that's enough as long as the router is updated and set up right. You don't need to buy a separate firewall appliance with a yearly license. A cheap router set up right beats an expensive one left on defaults, and the money you save is better spent on two-step login for email, updates on every computer, and staff who know what a phishing email looks like.
What the firewall in your router does, and what it doesn't
The firewall's main job is simple. Machines out on the internet can't start a conversation with the computers inside your office. When someone on your staff opens a website, the replies come back in. When something on the internet tries to reach your computers on its own, it gets dropped.
What it can't do is read most of what your staff let in. Email, websites and cloud apps are encrypted, so the firewall only sees that the traffic is allowed, not what's inside it. That's why a firewall won't stop a phishing email. The email shows up, someone clicks the link, types their password into a fake login page, and the firewall never had a say.
Two-step login on email does more against that. Even if someone gives away their password, the attacker still needs the code from their phone. CISA, the federal cyber agency with a regional office here in Seattle, names phishing in its small business guidance as the usual way attackers get in and puts two-step login on email near the top of the list of things to do. If you only do one thing after reading this, do that one.
So when people ask me if they need a firewall, the honest answer is that they need the one they have to be working, and they need the stuff around it more.
The settings matter more than the box
A properly set-up router has the default admin username and password changed, remote management turned off, and guest Wi-Fi kept separate from the business network and not connected to it. That's straight from the FTC's advice to small businesses, and it's short on purpose. None of it needs new hardware.
For the Wi-Fi itself, the FTC says at least WPA2. I'd keep it to WPA2, or WPA2/3 if something in the office needs it. iPhones may say the network has weak security on WPA2, because it's getting dated, but it's not easy to break.
Printers and security cameras should be on their own network too, separate from the computers. Keeping them apart means a cheap device can't be a way into the machines that hold your files and accounts.
The other part is that a firewall isn't set-and-forget. Someone should look at the settings now and then, see what's been opened up over time, and close what nobody uses anymore.
When the router you have isn't enough
Most of the time the question isn't whether you have a firewall. It's whether the router it runs on is still in shape. These are the cases where it's time to replace it:
- The maker stopped updating it. If there's no new firmware, it's not getting fixed when problems are found. The FBI said routers from 2010 or earlier likely don't get updates anymore. This is one thing you can check yourself: look up your model and see whether the maker still posts updates for it.
- You're still on the box the internet provider handed you and nobody has logged into it since. That usually means the default password and remote settings were never touched.
- You're in a regulated field. Tax preparers and lenders fall under the FTC Safeguards Rule, and medical offices face a proposed HIPAA update that hasn't been finalized yet. Check what your requirements ask for, and bring it up with whoever handles your IT support so the network matches.
- Someone works on an office computer from home. That connection should go through a VPN, never straight to the internet.
Washington law adds a reason not to put this off. If a breach exposes unsecured personal information, you have to notify the affected Washington residents within 30 days of finding it, and the Attorney General too if it's more than 500 Washington residents.
If one of those fits, the router is the piece to replace, and it should be planned with the rest of your network: where it sits, what's plugged into it, and which devices go on which network.
What a replacement costs, and the license catch
A small office doesn't need an enterprise box. The UniFi Cloud Gateway Ultra, for example, lists at $129, handles intrusion prevention at up to 1 Gbps, and has the firewall, separate networks and VPN built in. That covers a gigabit fiber line. Its larger threat signature set is a paid add-on, but the box works without it.
Many of the business firewalls you'll see recommended sell their protection as a yearly license. Let it lapse and parts of it stop working. Not every brand works that way: Netgate doesn't charge by feature, and Firewalla has no monthly fee for its standard features.
Whatever you look at, ask one question before you buy: what stops working if you stop paying the license? If the answer is "the part you bought it for," that's a cost every year, not a one-time purchase.
The basics go a long way: a properly configured firewall, security updates applied on schedule, endpoint protection on each computer, separate networks for guests and for devices like printers and cameras, and staff who know what a phishing email looks like. We put those in place and keep them maintained. We start by learning your setup: the network, the computers and accounts in use, how backups are handled, and what's been causing problems. From there we recommend a plan and put it in writing.
Have questions about your project? Contact us for a free estimate.
