IT tips for SMBs
SMB firewalls: the settings to review after installation
The box is installed, the Internet works and the project seems finished. Yet an SMB firewall doesn’t stay well suited to the business on its own. A former vendor sometimes keeps its VPN access, a temporary rule becomes permanent or alerts pile up in a mailbox nobody checks. A short periodic review keeps these details from turning into blind spots.
Review SMB firewall rules against a business need
A rule should answer a simple question: who needs to access what, from where and for what reason? Configurations age when exceptions are added without removing the ones that are no longer used. A replaced application, a closed office or retired equipment can leave a port open for no reason.
Start with inbound rules, then look at unusual outbound traffic. For each exception, note an internal owner and a review date. A description like “temporary for the vendor” no longer helps six months later. The service name, the responsible contact and the justification let you decide without guessing.
Also avoid the overly broad rule created to fix a problem quickly. Allowing several networks or services may get the application working, but it often hides the real need. You can first observe the blocked traffic, confirm the destinations you actually need, then tighten access. The page on networking for SMBs explains how the firewall fits into the network as a whole, along with Wi-Fi, switches and remote access.
Close old VPN access and test what remains
The VPN is easy to forget because it’s only visible when someone works remotely. Compare the list of accounts against active employees, consultants and authorized vendors. An employee’s departure should trigger the revocation of their access, even if their main account has already been disabled elsewhere.
Next, check the authentication method. A password alone should be replaced with multi-factor authentication when the platform allows it. Shared accounts make activity harder to trace: it’s better to assign individual access, limited to the resources needed and the length of the engagement.
A real test is more useful than a checked box in the interface. Ask an authorized user to connect from outside, reach the right resource and confirm they can’t see the rest of the network. Also test the recovery procedure for when the phone used for authentication changes.
Schedule updates without causing surprises
Manufacturer patches fix vulnerabilities and stability issues, but an improvised update during business hours can interrupt operations. Define a maintenance window, a person responsible and a simple way to notify the team. Check the release notes when a change affects the VPN, routing or high availability.
Before a major update, back up the configuration and confirm the file can be recovered without depending on the same device. Also note the current version. If a rollback becomes necessary, the team should know which firmware image and which configuration to use, rather than hunting for them during the outage.
Finally, look at the hardware’s support lifecycle. A device can keep routing traffic while no longer receiving the patches it needs. This discussion should happen before support ends, with the budget and time needed to choose, configure and test a replacement.
Make logs and alerts a tool you can actually use
Keeping every log without ever looking at it doesn’t add much value. Instead, choose the events that call for action: repeated VPN failures, administrative sign-ins, rule changes, a blocked device or an exposed service. Alerts should go to a monitored address, with a backup person when the main contact is away.
Also decide how long logs are kept and where they’re stored. Local storage on a small device can be overwritten quickly. A centralized copy makes analysis easier after an incident, but it should match the SMB’s real needs and authorized access. Trigger a test alert on purpose to confirm the message is received and understood.
Separate the guest network and back up the configuration
Guest Wi-Fi shouldn’t provide a path to internal workstations, printers or servers. Confirm the separation in the firewall and test it with a phone connected as a visitor. A network for connected devices may also deserve its own zone when it hosts cameras, displays or equipment that’s hard to update.
The configuration backup completes the review. Keep an encrypted copy after each major change, with the date, model and software version. Limit access to the file, since it can contain sensitive information. Once a year, reread the restore procedure: who holds the manufacturer accounts, where is the file and how do you get the service back up and running?
An SMB firewall review doesn’t need to become a big project. An inventory of rules, a VPN test, an update check, a confirmed alert and a recoverable backup already give a clear picture of the next actions. The goal is to keep the configuration tied to current operations, not to the way things were on installation day.
Every month
Confirm important alerts, VPN failures and unexpected administrative changes.
After a change
Document the rule, name its owner and back up the new configuration off the device.
Every year
Review access, manufacturer support, segmentation and the restore procedure.
Validate the configuration before the next change
If you want to review your firewall’s rules, VPN access, updates or backup, Infotech Canada can assess where things stand and prioritize the fixes. A short meeting helps scope the network, the access you need and who is responsible for what, without replacing what already works.