Many companies have a firewall, but its rules were written years ago, a few “temporary” exceptions have stayed open forever, and nobody knows exactly what is reachable from outside. These ten rules provide a secure, defensible baseline for a small or midsize business firewall.
1. Default: Deny Everything
The last rule on your firewall should be “anything not explicitly allowed is blocked,” for inbound traffic and, as far as possible, for outbound traffic too. Every allowed connection should have a clear reason.
2. No Management Panel Exposed to the Internet
The management panels of your firewall, router, switches, server iLOs, cameras and storage should never be reachable from the internet. Remote management should happen only over VPN.
3. Never Expose Remote Desktop (RDP) Directly
Leaving the RDP port open to the internet, even on a non-standard port, is one of the most common ways ransomware gets in. Remote staff should connect through VPN first and only then access their computer or server.
4. Restrict Inbound Access by Source
If a service must be reachable from outside, for example for a branch connection or a contractor, restrict access to that party’s specific IP address, not the entire internet.
5. Public Services in a DMZ
Place servers that must be visible from the internet, such as a web server or mail server, on a separate network (DMZ). If such a server is hacked, the attacker has no direct access to the internal network.
6. Control Outbound Traffic Too
Most malware, once inside, connects back to the attacker’s servers. Limiting servers’ outbound traffic to what is necessary, such as Windows updates and specific services, makes this harder. Servers rarely need unrestricted web browsing.
7. Set Rules Between Internal Segments Too
A firewall is not just the internet boundary. If your network is segmented with VLANs, traffic between segments should also pass through the firewall: users reach only the required server ports, and cameras and guests have no access to the internal network.
8. Every Rule Needs a Description and an Owner
For every rule, note why it was created, who it is for and when. Record “temporary” rules with an expiration date. Three months later, these notes will show which rules can be removed.
9. Logging and Alerts
Enable logging for important rules, especially denied access to sensitive services and logins to management panels. Repeated failed login attempts or unusual outbound traffic should trigger an alert, not just sit in a log.
10. Updates and Periodic Review
Keep your firewall firmware up to date; firewall and VPN vulnerabilities are prime targets for attackers. Review your rules every three to six months: remove unused rules, narrow broad access, and back up the firewall configuration.
Suggestion: after making changes, use a port scanning tool from outside your network to check which ports are actually open. The results are often surprising.
Conclusion
A good firewall depends less on the brand and price of the device than on the right rules and regular maintenance. If you are not sure what parts of your network are reachable from the internet, ITPlus724 engineers can assess it and rewrite your firewall rules for your company.