A single uncontrolled access can be enough to endanger inventory management, email, telephony, or production data. Anyone who Creating a firewall concept for small and medium-sized enterprises (SMEs) wants, therefore, more than one device connected to the internet. The deciding factor is a comprehensible plan that protects real business processes, does not slow down operations, and establishes clear responsibilities in an emergency.

A firewall is not a one-time purchase, but a central building block of the IT security architecture. It controls which connections are permitted between the internet, the corporate network, cloud services, branch offices, and individual network areas. For it to perform this task reliably, rules, responsibilities, and technical foundations must work together seamlessly.

Why standard rules are not enough for SMEs

Many companies rely on the standard configuration of the router or firewall appliance. As a first line of defense, this is better than an open network, but it rarely reflects their own infrastructure. Web shops, remote access, external service providers, POS systems, machine controls, and Cloud applications each place different demands on availability and access.

An overly broad rule following the pattern „approve first so that it works“ creates unnecessary attack surfaces. Conversely, an overly restrictive configuration can disrupt workflows, for example when employees cannot access specialized applications or a branch office can no longer exchange data with headquarters. An effective concept evaluates both sides: security and operational capability.

Especially in medium-sized businesses, IT has often grown organically over the years. New applications were added, branch offices connected, and individual permissions set up for service providers. Without documentation, no one later knows reliably why a rule exists or whether it is still needed. This is precisely where a firewall concept creates transparency and a reliable basis for decision-making.

Creating a firewall concept for SMEs: The inventory assessment

At the beginning is not the choice of a manufacturer, but the look at the existing environment. Internet connections, IP ranges, servers, clients, WLANs, cloud connections, and locations are recorded. Just as important are the applications that must be accessible from the outside or require special communication paths.

In the process, it is worth specifically naming critical processes: Which systems are indispensable for revenue, production, or customer service? Where is personal data located? Which services may only be interrupted briefly in the event of an outage? These questions help prioritize security measures according to business relevance rather than treating every connection the same.

External access must also be included in the inventory. Remote maintenance by software vendors, access from home office workstations, and administrative access by service providers must be clearly separated and governed in a traceable manner. A permanently open remote maintenance port is not a viable solution. Better options include time-limited access permissions, secure VPN connections, and multi-factor authentication, if the service in use supports it.

Make data flows visible

A data flow diagram does not have to be a complicated architecture diagram. However, it should traceably show which system communicates with which goal, via which protocols, and for what reason. For a web server, this can be HTTPS from the internet, for example. For a database server, on the other hand, direct internet access should generally be excluded.

This transparency also prevents firewall rules from being created based solely on ports. An open port may be technically necessary, but only for specific source networks, target systems, and time periods. The more precisely a rule describes this context, the lower the risk of an unintended exposure.

Network segmentation limits damage

Not every device in the company needs access to every other device. Clear segmentation separates areas with different security requirements. This minimizes the impact if a workstation, an IoT device, or a user account is compromised.

Sensible separations frequently occur between workstations, servers, guests, telephony, administration, and production-related systems. For example, a guest Wi-Fi network may offer access to the internet, but must not receive a connection to file storage or printers on the internal network. Devices such as cameras, time-tracking terminals, or building automation systems also frequently belong in separate network zones.

For publicly accessible services, a demilitarized zone, or DMZ for short, is recommended. Systems such as web or mail gateways are located there, separated from the internal server network. If such a service is attacked, the separation makes direct access to internal data more difficult. Whether a DMZ is implemented physically, virtually, or via separate firewall zones depends on size, requirements, and existing infrastructure.

Rules based on the principle of „as little as possible, as much as necessary“

A good firewall policy follows the principle of least privilege. The starting point is a restrictive baseline: connections are only allowed if there is a documented business or technical need for them. Blanket rules like „internal traffic can go anywhere externally“ are convenient, but lack control and logging.

Every rule should contain at least source, destination, service, direction, purpose, responsible person, and review date. A comprehensible description is not administrative overhead without benefit. It helps during outages, audits, personnel changes, and security incidents. Rules without an owner or without a recognizable purpose should be reviewed and removed if possible.

Special attention is warranted for inbound permissions from the internet. If a service needs to be publicly accessible, it should be secured, kept up-to-date, and continuously monitored. Administration interfaces should not be freely accessible from the internet. Access is better provided via a secured management access or a VPN with clearly assigned user accounts.

Integrate VPN, cloud, and branch offices cleanly

Hybrid infrastructures have long been standard in small and medium-sized enterprises. Applications run partly in the company's own server room, in German data centers, or as a cloud service. Employees work remotely, and multiple locations require secure data exchange. The firewall concept must explicitly take these transitions into account.

Site-to-site VPNs connect locations securely, but they do not replace access control. Even within a VPN, only the network segments actually required should be accessible. The same applies to mobile employees: successful login should not automatically open up the entire corporate network. Role-based permissions and separate access for administration, specialized applications, and general office work are significantly more controllable.

When using cloud services, it must be checked which data is transmitted, where it is processed, and which fixed destination addresses or interfaces are required. Dynamic cloud environments can make traditional IP-based rules more difficult. In such cases, features like DNS- or FQDN-based rules, centralized identity services, and clean documentation are particularly valuable.

Logging and monitoring make protection verifiable

A firewall only provides permanent protection if its behavior is monitored. Logs show rejected access attempts, suspicious connection attempts, and unexpected data streams. Not every event needs to be evaluated manually right away. The crucial factor is to prioritize relevant alerts and assign responsibilities for the response.

Effective monitoring includes the status of the firewall itself, the availability of VPN connections, unusual login attempts, and changes to rule sets. At the same time, alerting must remain manageable. Anyone who is notified about every harmless message will eventually miss the truly critical alert.

For many SMEs, a managed operation is sensible because security alerts do not only occur during office hours. 24/7 monitoring, standardized escalation procedures and dedicated points of contact provide operational reliability. GS Webservices supports companies in this regard with customized infrastructure and security solutions based at data centers in Germany.

Schedule changes, updates, and emergencies firmly

Even the best configuration loses its effectiveness if security updates are not applied or changes are made without being reviewed. The policy should therefore specify who evaluates and deploys firmware and signature updates, how configuration backups are created, and how changes are approved. For particularly critical environments, a maintenance window with a fallback plan is recommended.

Equally important is an emergency procedure. What happens in the event of a firewall failure, an incorrect rule change, or the suspicion of an attack? What is needed are current contact persons, access options for authorized administrators, secured Configuration backups and clear steps for recovery. A plan that’s stored only in a file on an inaccessible server won’t help in an emergency.

Companies should review their policies, user access, and network segmentation at least once every six months. These reviews must reflect any new applications, changes in service providers, or servers that are no longer needed. In the event of significant changes to the infrastructure, an immediate review is advisable.

The next logical step

Start with a joint meeting between management, IT, and the heads of the key business units. Capture not only the technology, but also the processes that cannot tolerate unplanned downtime. This results in a firewall concept that does not end up as a rigid document in the archive, but reliably accompanies your infrastructure as the company grows and requirements change.