--- title: "Managed firewalls: what they protect and where they fail" description: "Managed firewalls for business: what they block, what gets through, why the ISP router is not enough and how to choose one. No-obligation proposal." language: en url: https://www.dataroad-it.com/en/managed-firewall-business-sizing/ source: https://www.dataroad-it.com/en/managed-firewall-business-sizing/ publisher: DataRoad IT (DataRoad - IT Services and Consulting), Portugal --- > Managed firewalls for business: what they block, what gets through, why the ISP router is not enough and how to choose one. No-obligation proposal. # Managed firewalls: what they protect and where they fail At a glance For decision-makers short on time. - 01 A firewall controls who talks to whom; it does not replace antivirus, backup or training. - 02 The ISP router only does basic filtering and can change without notice. - 03 Most intrusions use valid credentials: MFA and time-limited access are decisive. - 04 Without an active subscription and someone reading alerts, the firewall stops protecting. ### In this article Many companies pay for a firewall and remain just as exposed as before. The reason is simple: the equipment only protects what it was configured to protect, while the subscription is active and someone is watching the alerts. **Managed firewalls** solve exactly that. In this guide, DataRoad - IT Services and Consulting explains what a firewall blocks, what gets past it, why the ISP router will not do and how to choose the right model. ## The essentials in 30 seconds - **Function** It defines which systems talk to each other and to the internet; it does not do the job of antivirus, backup or awareness training. - **Operator equipment** Basic filtering, insufficient for a business. - **Main vector** Most successful intrusions use legitimate credentials, not forgotten ports. - **Operation** Expired licences or unread alerts turn the firewall into expensive decoration. ## What justifies investing in a business firewall? Five capabilities an ordinary router does not offer: - **Isolated zones**: guests kept away from the internal network, production machines away from admin workstations; an incident stays contained. - **Traffic analysis**: detection of known attack signatures and behaviours. - **Web filtering**: blocking by category and of recently registered domains, fertile ground for phishing. - **VPN and remote access**: controlled entry for people working off site, without publishing internal services. - **Logs**: reconstructing an incident depends on them. ## Where does a firewall not protect? This is the list where false certainties are born. A firewall does not stop the employee who opens an infected attachment, does not prevent the use of a password circulating in a data leak, does not follow the laptop home and does not return files encrypted by ransomware, that is the backup's job. Today, the most serious attacks come in with a real username and password, obtained through phishing, reuse or a badly configured VPN. The perimeter still matters, but a growing share of the risk no longer passes through it. ## Why is the ISP router not enough? | Criterion | Operator equipment | Managed firewall | | --- | --- | --- | | VLANs and zones | Little or none | Complete | | Rules per person or team | No | Yes | | Usable logs | No | Yes | | VPN with strong authentication | Rudimentary | Yes | | Who changes the configuration | The operator, remotely and without notice | The company and its MSP | At home, that is enough. In a business, having rules that change in a silent update is unacceptable. ## How do you close the remote access door? This is where most security is won or lost. Three rules with immediate return: - **Zero direct publishing** RDP and admin consoles open to the internet are scanned by bots around the clock. - **Mandatory MFA** The measure with the best effort-to-protection ratio; a stolen password is no longer enough. - **Access with an end date** Supplier and former employee accounts forgotten for years are more common than you might think. ## How do you choose the right model? By the number of simultaneous users and, above all, by real throughput with every inspection switched on. Catalogues quote figures measured with security switched off; switched on, the number can drop to a fraction. Check the licensing too: web filtering, IPS and signatures depend on annual subscriptions. When they expire, the box keeps its lights on and stops defending, with no visible warning. ## Which mistakes do we see most often? - **Configure once and never review** Obsolete rules pile up; an annual audit is the minimum. - **Expired licences** The most silent failure of all. - **Everything on the same network** Guests, production, CCTV and office together mean an infection reaches everywhere. - **Logs with no reader** Useful for the post-mortem, useless for prevention. - **Permanent temporary exceptions** The door opened for an outside engineer one Saturday is still there two years later. A firewall is one layer of defence. It pays off when it works together with tested backups, up-to-date patches, MFA and teams trained to spot fraud. ## Next step: a firewall someone is watching DataRoad installs and operates [managed firewalls and cybersecurity](https://www.dataroad-it.com/en/managed-firewall-services-portugal/) within its [managed IT services](https://www.dataroad-it.com/en/managed-it-services-networks-security-cloud/), with alerts followed up and rules reviewed periodically. Request a no-commitment proposal. **More than 10 workstations · support contract · remote, on-site and telephone support.** Call +351 211 459 950 * or write to sales@dataroad.pt. **Call to a Portuguese landline.* Chosen by respected and international companies ★★★★★ 5,0 · 52 Google reviews ★★★★★ 5,0 · 52 Google reviews DataRoad ## Related articles [Managed IT and cybersecurityTeams on the move: securing laptops, phones and public Wi-FiThe real travel risk is an unencrypted lost laptop, not hotel Wi-Fi. With disk encryption, central management, MFA and a controlled connecti…12 October 2026 · 7 min read](https://www.dataroad-it.com/en/managed-cybersecurity-travelling-teams/)[Managed IT and cybersecurityExternal attack surface: what the internet sees of your companyAutomated attacks hunt for vulnerable versions, and company size is irrelevant. In 2025, CERT.PT recorded 3,864 incidents, 40% more than in …12 October 2026 · 5 min read](https://www.dataroad-it.com/en/external-attack-surface-managed-cybersecurity/)[Managed IT and cybersecurityNOC and managed cybersecurity: who watches your SME, and whenThe question is not whether you have a SOC: it is who receives the alert at 10 pm on a Saturday and what they do next. At DataRoad, nights, …12 October 2026 · 6 min read](https://www.dataroad-it.com/en/noc-managed-cybersecurity-sme/)[Managed IT and cybersecurityMicrosoft 365 security: the 10 controls that are yoursIn Microsoft 365, the platform is Microsoft's and the keys are yours. According to Microsoft, MFA and blocking legacy authentication stop mo…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/microsoft-365-managed-cybersecurity-shared-responsibility/)[Managed IT and cybersecurityGDPR and managed cybersecurity: 10 technical controls to proveWithout documented technical measures, a data breach turns from an IT incident into a problem with the regulator. Ten controls in three bloc…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/gdpr-managed-cybersecurity-10-technical-measures/)[Managed IT and cybersecurityExposed passwords: audit your domain and close the door in 5 daysThe risk is not the email appearing in a breach: it is the same password opening a work account. Change what is exposed, MFA on every accoun…12 October 2026 · 5 min read](https://www.dataroad-it.com/en/company-credentials-data-breach-check/)[Managed IT and cybersecurityAsset inventory: the basis of IT estate management and NIS2Without an asset inventory there is no planned renewal, no demonstrable security and no answer to CNCS. NIS2 entities must submit the list o…12 October 2026 · 7 min read](https://www.dataroad-it.com/en/it-asset-inventory-management-nis2/)[Managed IT and cybersecurityBreak-glass accounts in Microsoft 365: your company's insuranceA locked-out admin can leave email, Teams and files unmanaged for days. Break-glass accounts are the reserve administrator you only use when…12 October 2026 · 5 min read](https://www.dataroad-it.com/en/microsoft-365-break-glass-accounts/)[Managed IT and cybersecurityWindows 365 for business: when a cloud PC cuts costsA cloud PC pays off for consultants, seasonal staff, teams without an office and mixed Mac and Windows estates. For video, CAD or weak inter…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/windows-365-business-cloud-pc-costs/) Numbers you can verify **11** years in business **232** clients **< 10 min** average response time **15+** IT vendor certifications **10+** Countries with clients supported **5.0 ★** 52 Google reviews Transparency ## What many providers hide, we publish. [See plans and prices →](https://www.dataroad-it.com/it-unlimited/) - **Prices upfront** Essential from €395/month + VAT, Premium from €750 and Premium 365 from €1,200. - **No lock-in** Annual contract, no lock-in and no joining fees. - **Everything in writing** What is included, the scope and the price, before you sign. - **Support without counted hours** Remote and phone in every plan; on-site support from Premium. Partners and certifications DataRoad · Managed cybersecurity ## One StepAhead of IT. Security is proven over years, not promises. Managed firewalls, MFA, endpoint protection and tested backups, the same standard for every client. - **11** years in business, since 2015 - **Top 5%** SMEs · scoring.pt - **M365** backed up off-site We do **IT** right. DataRoad IT Unlimited ## Does your IT depend on a single person? Documentation, inventory and one contact who answers for everything. [Request a proposal, no commitment →](https://www.dataroad-it.com/en/#contact)+351 211 459 950 **Call to a Portuguese landline · More than 10 workstations · support contract · remote, on-site and phone support[Not sure what you need? Talk to the assistant →](https://www.dataroad-it.com/en/#assistente) --- Versão HTML desta página: https://www.dataroad-it.com/en/managed-firewall-business-sizing/