Every device in a small business that connects to the internet — computers, phones, printers, even the point-of-sale terminal — is reachable from the outside world. Most of that outside traffic is harmless: customers visiting your website, suppliers sending invoices, software checking for updates. Some of it is not: automated scans looking for open doors, fake login attempts, and malware trying to slip in unnoticed.
A firewall is the guard at that door. It watches the traffic coming in and going out of your network and decides what is allowed through, based on rules you or your software set. It does not replace antivirus software or good passwords, but without it, everything else has to work much harder. Here is what a firewall actually does, in plain language, and how a small business can use one.
A Firewall Is a Filter, Not a Wall
The name suggests a solid wall, but a firewall works more like a security checkpoint. Every piece of data that travels over the internet is broken into small packets, and each packet carries information about where it came from, where it is going, and which service it is for — email, web browsing, file sharing, and so on.
The firewall inspects those packets against its rules. Traffic that matches a trusted pattern, such as a reply to a website you just visited, is allowed through. Traffic that does not match, such as an unexpected connection attempt to a service you never use, is blocked and logged. Legitimate work keeps flowing; the rest never reaches your computers.
That filtering happens in both directions. A good firewall also watches outgoing traffic, which matters when a device is already infected: malware often tries to send stolen data out or contact its operator, and a firewall that blocks unexpected outgoing connections can stop that call home.
The Two Kinds You Already Have
Most small businesses already have two layers of firewall protection without buying anything extra.
The first is the network firewall built into your router. It sits between your office network and the internet and blocks unsolicited incoming connections by default. That single box is the reason a random scanner on the internet cannot simply connect to the computer on your desk. The risk is that it only protects what is behind it — a laptop taken home or to a café is outside its protection.
The second is the software firewall built into Windows and macOS, and into most business antivirus products. It runs on each individual computer and controls which programs on that machine are allowed to send or receive data. If a new program suddenly tries to connect to the internet, the software firewall asks you first. Together, the router firewall and the device firewall cover the office and the road.
A third option, a dedicated hardware firewall or a cloud firewall service, makes sense when a business has several employees, remote workers, or sensitive customer data. It adds central control, detailed logs, and rules that apply to everyone at once, instead of relying on each device being set up correctly.
What a Firewall Actually Stops
A firewall is best at stopping the noisy, automated attacks that target every small business on the internet. Bots constantly scan for open ports — the numbered doors that services use — and try common passwords against them. A firewall that leaves only the ports you actually need open, and blocks the rest, makes those scans bounce off harmlessly.
It also stops direct attacks on services you did not mean to expose. File sharing, remote desktop, and database ports should never be reachable from the internet, yet many are, simply because nobody closed them. A firewall closes them by default.
What a firewall does not stop is just as important to understand. It cannot tell whether an email attachment is safe, whether a website you clicked is a convincing fake, or whether a password was typed into the wrong login page. That is why phishing was covered separately: the firewall guards the network door, while training, passwords, and updates guard the people and the software behind it.
Setting One Up: Five Practical Steps
For most small businesses, setting up a firewall is a short checklist, not a project.
- Leave the router firewall on. It is on by default on most routers. If someone turned it off while troubleshooting, turn it back on, and change the router’s own admin password from the factory default.
- Keep the device firewall on everywhere. Check that the built-in firewall is enabled on every work computer, including laptops that leave the office. One unprotected laptop on public Wi-Fi can undo the office firewall entirely.
- Close what you do not use. If you do not run a public web server or remote desktop, those ports should stay closed. On a router this usually means no port forwarding rules except the ones you can name and justify.
- Update the firmware. Router and firewall software gets security fixes like everything else. Check for firmware updates every few months, or set the router to update automatically if it offers that option.
- Read the log occasionally. You do not need to study it daily, but a quick look after setup — and whenever something feels off — shows what is being blocked and whether a device inside your network is making strange outgoing connections.
None of these steps requires an IT department. If you use a managed IT provider, ask them to confirm the first three in writing; if you do it yourself, the router’s admin page and your operating system’s security settings are where it all lives.
Firewall, VPN, Antivirus: How They Fit Together
These three tools are often confused because they all relate to security, but they do different jobs. The firewall controls which traffic can enter or leave your network. A VPN, covered earlier, encrypts your connection so nobody on the network between you and your destination can read it. Antivirus inspects files and programs on your device for known malware.
Think of it as a building: the firewall is the doorman who decides who gets in, the VPN is the armored car that carries your messages through a rough neighborhood, and the antivirus is the security guard inside who checks what people are carrying. A small business needs all three working together — and a firewall is the cheapest, most basic layer to get right first.
Conclusion
A firewall will never be the most exciting part of running a small business, and that is exactly the point: when it is set up correctly, you forget it is there. It quietly turns away the automated scans and stray connection attempts that hit every business on the internet, day after day, and leaves your team free to work.
Check today that your router firewall and your device firewalls are on, that no port is open without a reason, and that the firmware is up to date. It takes less than an hour, it costs nothing extra, and it is the foundation every other security measure stands on.