In many law firms, accountancy practices, engineering and architecture offices, “network security” means the router the internet provider installed on day one. It works, the connection is there, and nobody touches it again. The point is that a router is not a firewall for a professional office: it is a device designed to bring the internet into a home, not to protect clients’ confidential data.
In this guide we explain, without jargon, what a firewall is, how it differs from a router and when it makes sense to have one.
What is a firewall, in simple terms?
A firewall is a device (or a piece of software) that sits between the office network and the internet and checks every communication, letting through only what the rules allow. Think of it as the doorkeeper of a building: it knows who lives there, knows who is expected and stops anyone who has no reason to come in.
A modern firewall, as well as filtering, can do other useful things:
- separate networks: for example, guest Wi-Fi from the office computers;
- recognise suspicious behaviour, such as a PC trying to contact a server known for spreading viruses (this function is called IDS/IPS, an intrusion detection and prevention system);
- manage remote access securely, through a VPN;
- log what happened, so that it can be reconstructed and demonstrated.
Isn’t the internet provider’s router enough? Here is the difference
The provider’s router has a basic firewall: it blocks unsolicited incoming connections and “hides” the internal computers behind a single address (this is called NAT). It is better than nothing, but that is where it stops.
| Provider’s router | Office firewall | |
|---|---|---|
| Main purpose | Connecting to the internet | Protecting and controlling the network |
| Outgoing traffic | Usually all allowed | Only what is needed |
| Detects suspicious activity | No, or only to a very limited extent | Yes (IDS/IPS, block lists) |
| Alerts someone | No | Yes, if configured to do so |
| Event log | Minimal, often not accessible | Complete and retainable |
| Separate networks (guests, cameras) | Limited | Yes |
| Updates | Depend on the provider | Planned and controlled |
The biggest problem is not technical but practical: nobody is watching. If an office computer gets infected and starts sending data outside, the router lets it happen and nobody receives an alert.
Why this matters precisely for professional offices and small businesses
People often think: “Who would bother attacking a small office?”. The numbers say otherwise.
- In 2025, 507 serious cyber incidents were recorded in Italy, 42% more than the previous year, equal to 9.6% of those recorded worldwide (Clusit Report 2026, published by Clusit, the Italian Association for Information Security).
- According to the Cyber Index PMI 2025 (an index of cybersecurity maturity among Italian small and medium-sized enterprises), around one in four Italian small and medium-sized businesses has suffered at least one attack in the last three years, and around one in three lacks sufficient in-house digital skills.
- The most widespread attacks do not “choose” their victim: they are automated and hit anyone who has left a door open or has an employee who clicks the wrong link (we discuss this in the guide on how to spot phishing).
A professional office also holds clients’ personal and confidential data. The GDPR requires appropriate security measures and the ability to detect a breach and notify it within 72 hours where necessary: we go into this in the article on GDPR security measures and data breaches.
What should a good firewall do for a small office?
For an office of 5-50 people, power matters less than ease of use. These are the functions that really make a difference:
- Closed by default. Everything that is not needed for day-to-day work stays blocked; only what is needed is opened.
- Continuous monitoring. Connections to malicious addresses, repeated attempts to guess a password, an unstable internet line.
- Alerts you can understand. A useful alert says three things: what happened, how serious it is, what you should do.
- No needless noise. Too many alarms are the same as no alarms: after a week nobody reads them any more.
- Keeping a log. Who did what and when: this is the evidence to show a client, a privacy consultant or the Italian Data Protection Authority (Garante per la protezione dei dati personali).
- Staying up to date. A firewall that is not updated is a door with an old lock.
- Separating networks. Guests, printers, cameras and work computers should not be on the same network (see the guide on guest Wi-Fi and IoT devices in the office).
- Enabling secure remote working, with a VPN instead of ports left open to the outside (further reading: VPN and remote working).
What are the alternatives, and their limits?
| Option | Pros | Cons |
|---|---|---|
| Provider’s router only | No cost | No control, no alerts |
| Brand-name firewall bought and managed yourself | Very powerful | Designed for technicians; annual licences are often needed for protections and updates |
| “DIY” device set up by your trusted technician | Inexpensive | Works as long as someone remembers it; usually no monitoring |
| Firewall managed by a service provider | Comprehensive | Fees too high for a small office |
There is no single right choice for everyone. The question to ask is: if something happens tomorrow, who will notice and how will I find out? If the answer is “nobody” or “I don’t know”, there is a problem to solve.
Is a firewall enough on its own?
No. The firewall protects the network, but an office’s security rests on several pillars:
- backups done properly and tested (the 3-2-1 rule), the last line of defence against ransomware;
- strong passwords and two-factor authentication (guide to passwords, MFA and passkeys);
- updates for computers and software;
- people trained to recognise scams and attempts at deception.
To find out where your office stands, we have prepared a 10-question checklist: it takes ten minutes to complete.
How we tackle the problem with Strega Defence
Strega Defence is the solution we are developing in Benevento precisely for those who have no IT department. It is made up of a Box that connects between the office network and the internet and an app for phone and computer.
- The Box shuts what is not needed and watches the traffic.
- When something that matters happens, the alert arrives on your phone, in plain language: what happened, how serious it is, what to do.
- Threats are blocked automatically: you get the explanation, not a technical decision to make, and every action is kept in the log.
- The firewall core is OPNsense, widely used open-source software checked by a large community.
Strega Defence does not promise “total protection”, which nobody can guarantee: it promises to let you always know whether the office is safe, without having to become an IT expert. Find out how Strega Defence works.
Frequently asked questions
Does my internet provider’s router already have a firewall?
Yes, almost all routers have a basic firewall that blocks unsolicited incoming connections. However, it does not check outgoing traffic, does not recognise suspicious behaviour and does not alert anyone: for an office that holds client data, that is not enough.
Does a small office of 5 people really need a firewall?
The number of people matters little: what matters is the data the office holds. The most common attacks are automated and hit anyone who is vulnerable, regardless of size. A well-configured firewall reduces the risk and, above all, lets you notice problems.
Isn’t antivirus enough?
Antivirus protects the individual computer; the firewall protects the network as a whole, including printers, cameras and devices on which antivirus cannot be installed. You need both, because they cover different risks.
Does a firewall slow down the internet connection?
A firewall correctly sized for the number of people and the speed of the line causes no noticeable slowdown in day-to-day work. Slowdowns usually come from undersized or badly configured equipment.
Does having a firewall make the office compliant with the GDPR or NIS2?
No: no product on its own makes an organisation “compliant”. However, a firewall with a log and periodic reports helps demonstrate that appropriate security measures have been adopted, as Article 32 of the GDPR requires, and helps answer the security questionnaires of larger clients.
What is OPNsense?
OPNsense is open-source firewall software, released under the two-clause BSD licence and developed by an international community. Because it is open, its code can be checked by anyone and it does not depend on a single vendor’s closed licences.
Sources and further reading
- Rapporto Clusit 2026 – dati principali (in Italian) — Clusit, 11 March 2026.
- Cyber Index PMI 2025: cresce la consapevolezza digitale delle imprese (in Italian) — Confindustria, March 2026.
- Regulation (EU) 2016/679 (GDPR), official text — EUR-Lex.
- Accendiamo la cybersicurezza: i consigli di ACN per le PMI (in Italian) — ACN, the Italian National Cybersecurity Agency (Agenzia per la Cybersicurezza Nazionale).
- About OPNsense — OPNsense.
Written by Ing. Sergio Florio, founder of Strega Byte, an engineer with over twenty years of experience across research, development and business. Article updated on 11 October 2026.
