In summary<\/p>\n
- \n
- A firewall controls who talks to whom<\/strong> \u2014 it does not replace antivirus software, backups, or staff training.<\/li>\n
- The ISP router is not an enterprise firewall.<\/strong> It does basic filtering and little else.<\/li>\n
- Most successful attacks log in using valid credentials<\/strong>, not through an open door \u2014 hence the importance of well-executed remote access.<\/li>\n
- A firewall no active subscription and no one reading the alerts<\/strong> it's expensive equipment for very little return.<\/li>\n<\/ul>\n<\/div>\n
\nIn this article<\/p>\n
- \n
- What does a firewall do<\/a><\/li>\n
- What it doesn't do<\/a><\/li>\n
- Why the operator's router doesn't reach<\/a><\/li>\n
- Remote access: where everything is decided<\/a><\/li>\n
- How to size and choose<\/a><\/li>\n
- Frequent errors<\/a><\/li>\n<\/ol>\n<\/div>\n
Few pieces of equipment are bought with as much conviction and configured with as little attention as a firewall. You install it, plug it in, and assume the company is protected. In practice, the protection a firewall provides depends almost entirely on how it was configured and who looks at it afterwards.<\/p>\n
What does a firewall do<\/h2>\n
A firewall controls the traffic entering and leaving the company network, deciding what passes and what is blocked. In a modern enterprise firewall, this control goes well beyond opening and closing ports:<\/p>\n
- \n
- Network segmentation<\/strong> \u2014 to separate the guest network from the internal network, or the production equipment from the office workstations, so that a problem in one place doesn't reach the rest.<\/li>\n
- Content inspection<\/strong> - analyse traffic for known attack patterns.<\/li>\n
- Navigation filtering<\/strong> \u2014 block website categories and newly created domains, which are a classic vector for fraud.<\/li>\n
- Secure remote access<\/strong> \u2014 to provide controlled access to those outside, without exposing internal systems to the internet.<\/li>\n
- Registration<\/strong> \u2014 to know what happened, which is worth its weight in gold after an incident.<\/li>\n<\/ul>\n
![\"A](\"https:\/\/www.dataroad.pt\/wp-content\/uploads\/2026\/08\/DataRoad_IG_ciberseguranca-v2.png\")
A firewall only protects what it is configured to inspect \u2014 the rest passes through.<\/figcaption><\/figure>\n What it doesn't do<\/h2>\n
This part is as important as the previous one, because it explains most of the false senses of security.<\/p>\n
A firewall it does not stop someone from opening a malicious attachment<\/strong> received by email. It doesn\u2019t stop a reused password being used by someone else. It doesn\u2019t protect laptops when they leave the office. And it doesn\u2019t recover anything \u2014 if data is encrypted by ransomware, it\u2019s the backup that brings it back, not the firewall.<\/p>\n
\nMost serious incidents are not blocked by a firewall.<\/strong> They log in using valid credentials \u2014 obtained through fraud, password reuse or misconfigured remote access. The firewall protects the perimeter; nowadays, a large part of the risk no longer passes through the perimeter.<\/p>\n<\/div>\n
Why the operator's router doesn't reach<\/h2>\n
The equipment the operator installs carries out basic filtering and does its job in a home. In a business, it lacks the things that matter: segmentation, per-user or per-group policies, usable logging, regular updates, and the capability for controlled remote access.<\/p>\n
There is still a detail that goes unnoticed: the operator's router is managed by the operator. The rules can change in a remote update without anyone warning \u2014 which is acceptable at home and not in a business infrastructure.<\/p>\n
Remote access: where everything is decided<\/h2>\n
If there is one point where it is worth focusing attention, it is this. The way people access systems from outside determines a large part of the company's real risk.<\/p>\n
Three rules that prevent most problems:<\/p>\n
- \n
- No internal services exposed directly to the internet.<\/strong> Remote working environments and admin panels accessible from anywhere are the target of permanent automated attacks.<\/li>\n
- Two-factor authentication, always.<\/strong> It is the single measure with the best balance between effort and protection. A stolen password is no longer enough.<\/li>\n
- Expiring access.<\/strong> Third-party suppliers and former employees retain active access for years with a frequency that surprises anyone conducting a review for the first time.<\/li>\n<\/ul>\n
How to size and choose<\/h2>\n
Two variables dominate the sizing: the number of concurrent users<\/strong> and a bandwidth with active inspection<\/strong>. This second one is the one that generates surprises \u2014 many devices advertise flow rates that are only achieved with the safety functions turned off. With inspection turned on, the actual performance can be a fraction of that.<\/p>\n
It is also advisable to confirm the licensing model. The features that give value to a modern firewall \u2014 filtering, inspection, signature updates \u2014 depend on annual subscriptions. When these subscriptions expire, the device keeps running but stops protecting, without anything visible happening.<\/p>\n
Frequent errors<\/h2>\n
- \n
- Fit and forget.<\/strong> Rules accumulate, become obsolete and nobody removes them. An annual review of the rules is basic hygiene.<\/li>\n
- Let the subscription expire.<\/strong> It is the quietest mistake on this list.<\/li>\n
- Do not segment.<\/strong> Guests, production equipment, CCTV cameras and workstations on the same flat network mean that a problem reaches everything.<\/li>\n
- Nobody reading the alerts.<\/strong> Equipment for logging incidents that no one consults serves to reconstruct what went wrong \u2014 not to prevent it.<\/li>\n
- Temporary rules that stay.<\/strong> That open door for a supplier on a Saturday tends to still be open two years later.<\/li>\n<\/ul>\n
A firewall is a layer, not a solution. It works well when accompanied by tested backups, up-to-date patches, two-factor authentication and people who know how to recognise a scam attempt.<\/p>\n
DataRoad implements and manages firewalls and IT security for businesses<\/a>, integrated into IT management<\/a> and with continuous monitoring of alerts.<\/p>\n
\nA chat before making a decision<\/p>\n
Whether you\u2019re tackling a specific problem, planning a move or simply looking for a second opinion, we always start in the same way: by understanding your situation before making any suggestions. No obligation, no jargon and no catalogues.<\/p>\n
- Let the subscription expire.<\/strong> It is the quietest mistake on this list.<\/li>\n
- Two-factor authentication, always.<\/strong> It is the single measure with the best balance between effort and protection. A stolen password is no longer enough.<\/li>\n
- Content inspection<\/strong> - analyse traffic for known attack patterns.<\/li>\n
- What it doesn't do<\/a><\/li>\n
- The ISP router is not an enterprise firewall.<\/strong> It does basic filtering and little else.<\/li>\n