This article was machine-translated from French and is being reviewed. Prices are in Algerian dinars excl. VAT.
A firewall is the equipment or software that decides which connections can traverse your network. Placed between your Internet connection and your workstations, servers, cameras and printers, it applies rules: it allows what is intended and rejects the rest. For an SME, it is the first control point to implement. It is not sufficient on its own, but without it every device connected to the network depends only on its own settings. AsloTech provides and installs MikroTik and Fortinet firewalls, by quote.
In short
- A firewall applies rules to connections between two networks, for example Internet and your local network: it allows what is specified and denies the rest.
- Without a firewall, your servers, recorders and workstations are exposed to automatic scans from the Internet, and nothing limits what leaves your network.
- For an SME, a dedicated network firewall provides a single control point; the Windows firewall on each workstation is complementary, not a replacement.
What is a firewall and how does it work?
A firewall examines each connection according to rules. A typical rule: “allow HTTPS (port 443) from Internet to the web server; deny all access from Internet to the accounting server; allow workstations to access the Internet.” Each rule covers a source, destination, protocol and port, and ends with an action: allow or deny.
Current firewalls are called “stateful.” They remember connections opened from inside and allow the corresponding replies to return. A packet coming from Internet that does not match any known connection or opening rule is denied.
Two policies oppose each other:
- Default deny, allow on a case‑by‑case basis (recommended): everything is closed except what you explicitly open.
- Default allow, deny on a case‑by‑case basis (discouraged): everything is open except what you forbid. Any omission remains open.
NAT and port forwarding
Your box or firewall shares a single public IP address among all your devices: that is NAT (address translation). A useful side effect: an unsolicited connection from the Internet has no internal device designated as destination until you create a port forward. NAT is not a security policy on its own, and each port forward is an open door to an internal device. List your forwards and delete those that are no longer needed.
Simple filtering, next‑generation, UTM
- Stateful filtering: decides based on IP addresses, ports and protocols. It is the foundation present on most professional routers.
- Next‑generation firewall (NGFW): adds application recognition, an IPS (intrusion prevention system that blocks traffic identified as attacks) and web filtering.
- UTM (Unified Threat Management): a device that bundles firewall, VPN, IPS, antivirus and web filtering. These security services generally rely on signatures updated by subscription from the vendor.
Network firewall or host firewall
A network firewall is installed between your network and the Internet: it processes all traffic and is managed in one place. A workstation firewall, such as Windows', protects only the computer on which it runs. The two complement each other. To compare product families, including MikroTik and Fortinet that we provide, read MikroTik or Fortinet: which for an SME.
What are the risks without a firewall?
Access to servers and data
Automated programs constantly scan public IP addresses and test common ports. Four examples: port 22 (SSH, Linux server administration), port 3306 (MySQL database), port 445 (Windows file sharing, SMB) and port 3389 (Windows Remote Desktop, RDP). A service of this type reachable from the Internet with a weak password or an unpatched vulnerability can allow data theft or encryption. For remote work, use a VPN instead of opening these ports. The servers and NAS are the first affected.
Exposed connected equipment
A camera recorder, a time clock or a printer that can be reached via port forwarding, with the original password, are classic targets. If you need to view your cameras remotely, follow the guide on remote access to cameras rather than opening a port. Regulation forbids connecting public structures' CCTV systems and those that film the open space to the public to the Internet (executive decree no. 09‑410 amended by decree no. 16‑61, art. 20 bis); check your situation before opening remote access.
Malware and ransomware
An infected workstation often contacts an external server to receive instructions or send data. A firewall that also filters outbound traffic can limit these exchanges: unnecessary ports closed, known destinations blocked. However, a simple stateful firewall does not inspect file contents. To detect malware, you need antivirus on the workstations and, on the network side, an IPS or DNS/web filtering. Against ransomware, the defense remains backups following the 3‑2‑1 rule.
Botnets and saturation attacks
An infected device on your network (camera, recorder, workstation) can be recruited into a botnet, a set of machines controlled remotely to launch saturation (DDoS) attacks against other sites. Your connection is then used without your knowledge. Conversely, a firewall installed at home cannot absorb an attack that saturates your operator’s link: it controls what comes in, it does not create bandwidth.
Port scans
A firewall can handle an unauthorized packet in two ways: drop it without responding (DROP) or send an explicit refusal (REJECT). DROP delays scanners, but it does not replace closing unnecessary services.
A firewall is also a network management tool
Beyond security, a professional firewall provides useful daily functions:
- Bandwidth control: limit the rate per workstation, service or network so a download does not saturate the line.
- Logging: see which connections were denied, useful for investigating after an incident. On many devices logs stay in memory and disappear on reboot: send them to a log server if you want to keep them.
- Isolated guest Wi‑Fi: a network for visitors without access to your computers (see secured guest Wi‑Fi).
- Remote access and remote sites: a VPN connects your sites or teleworkers via an encrypted tunnel (see enterprise VPN).
- Network separation: with VLANs, cameras, servers and offices are only visible through the firewall (see segment your network with VLANs).
Is a firewall enough on its own?
No. A firewall is part of a security strategy, not the complete strategy. Also plan for:
- Regular updates of workstations, servers and the firewall itself, whose internal software receives security patches. A maintenance contract and preventive maintenance prevent forgetting them.
- Strong passwords and multi‑factor authentication (MFA) for sensitive access.
- Team training on phishing and identity theft.
- An antivirus or antimalware solution on workstations.
- Backups tested, including an offline copy (see the rule 3‑2‑1).
- A backup power supply : a firewall cut by an electricity outage leaves the entire site without Internet or VPN. Plug it in, with the modem and switch, to an UPS.
Why now?
- Attacks are automated and continuous. Any equipment reachable from the Internet is scanned, regardless of company size.
- Remote work multiplies access points. Without VPN or clear rules, ports are opened “for troubleshooting” and never closed.
- Personal data is regulated. The Algerian law no. 18-07 of June 10, 2018 on the protection of personal data requires a data controller to protect that data with appropriate technical and organizational measures. Client files, payroll, camera images: also see the ANPDP obligations for CCTV. AsloTech can help you prepare the procedures with ANPDP; this support is not legal advice.
- A network of SMEs quickly gathers many devices : workstations, printer, cameras, time clock, Wi‑Fi. Without segmentation, compromising one exposes the others.
Next steps
To protect your network, you need a firewall suited to your size and uses. Visit our page network security and firewalls to see how we intervene, or compare the MikroTik, Fortinet and Cisco firewalls to locate your need. You can also read how to segment your network with VLANs to isolate sensitive data.
Frequently asked questions
Is my router or operator’s box a firewall?
The operator’s box or modem almost always contains an stateful firewall and NAT: unsolicited inbound connections are generally blocked. Its limits: few or no outbound traffic rules, no VLANs, VPN often limited, reduced logs, remote management sometimes controlled by the operator. For an SME with servers, cameras or multiple networks, a dedicated firewall placed behind or in place of the box offers more control.
Do you need a firewall even with four computers?
Not necessarily a separate device: if nothing is exposed to the Internet, a properly configured router may suffice. As soon as you have a server, a remotely accessible recorder, guest Wi‑Fi or VPN, a dedicated firewall becomes useful. Automatic scans do not consider company size.
Does a firewall slow down Internet?
Simple stateful filtering adds negligible latency. The limiting factor is device power: IPS, HTTPS traffic inspection and network antivirus consume CPU and reduce throughput. Manufacturer datasheets give several throughputs (firewall alone, with IPS, with VPN): compare the one that matches the functions you will enable.
Who should configure the firewall?
A poorly configured firewall can block useful traffic or leave access open. Entrust the initial configuration to a technician, document the rules and back up the configuration. AsloTech provides and installs MikroTik and Fortinet firewalls, with commissioning and acceptance testing. An administrator from your team can then manage routine additions.
Need an opinion on your site? A technician can come to assess your needs and advise you.