Small business firewall: features, licensing, and sizing

A business firewall sits between your office network and the internet and decides what traffic is allowed through. Beyond what an ISP router does, it can inspect traffic for known attacks, block dangerous websites, separate your network into zones, give remote staff a secure way in, and keep logs you can review later. The two things most buyers miss are the ongoing subscription that many models depend on, and the fact that a firewall’s real speed with security features switched on is far lower than the headline number on the box.

What does a business firewall do that an ISP router does not?

The router your internet provider supplies already does one firewall-like thing: it blocks unsolicited connections from the internet, because of how address sharing (NAT) works. That is useful, and it is also where most ISP routers stop.

Capability	Typical ISP router	Business firewall
Blocks unsolicited inbound connections	Yes	Yes
Intrusion prevention (IPS): recognizes and blocks known attack patterns	No	Yes
Web and DNS filtering: blocks known malicious or unwanted sites	Rarely	Yes
VLANs and rules between zones (staff, guest, cameras, payments)	Limited or none	Yes
Secure remote access (VPN) with per-user accounts	Rarely	Yes
Searchable logs and alerts	Minimal	Yes
Second internet connection with automatic failover	Rarely	Common
Published support lifecycle and regular security updates	Varies	Yes

CISA’s plain-language explainer, Understanding Firewalls for Home and Small Office Use, is a good short read on the basics. It also makes a point worth repeating: default settings are typically less restrictive, so a firewall that was plugged in and never configured is doing less than its owner assumes.

Which firewall features matter for a small office?

Not every feature on the datasheet is worth paying for. These are the ones that change outcomes for a small office:

• Intrusion prevention (IPS). Compares traffic against a regularly updated list of known attack signatures and blocks matches.
• DNS and web filtering. Stops devices from reaching known phishing and malware sites. We cover this in more depth in our guide to DNS filtering for small business.
• VLAN support with rules between zones. This is what makes network segmentation possible: guest Wi-Fi, cameras, and payment terminals each get their own zone, and the firewall controls what may cross between them.
• Secure remote access. A built-in VPN with individual user accounts and multi-factor authentication. See secure remote access options for a small office.
• Automatic security updates and a published end-of-support date. The firewall faces the internet all day. CISA’s ransomware guidance tells organizations to keep VPNs and network infrastructure devices updated with the latest patches.
• Logging and alerts. Enough history to answer “what happened at 2 p.m. last Tuesday”, and an email alert when the internet connection fails over or the device goes offline.
• Central or cloud management. Lets whoever supports you check status and apply updates without visiting the office.

What about inspecting encrypted traffic?

Most web traffic is encrypted (HTTPS), so a firewall sees where a connection is going but not what is inside it. TLS inspection (also called SSL inspection) lets the firewall decrypt, scan, and re-encrypt that traffic. It works, but it has real costs: a certificate must be installed on every computer, some apps and websites break and need exceptions, banking and health sites are normally excluded for privacy, and it is the most demanding feature for the hardware. Many small offices reasonably leave it off and rely on DNS filtering plus good endpoint protection on each computer instead. It is a decision to make deliberately, not a box to tick.

How do firewall licensing and subscriptions work?

This is the part that surprises buyers. There are two broad models.

Subscription-dependent security. With most traditional security vendors (Fortinet, SonicWall, Sophos, WatchGuard, Palo Alto Networks and others), the hardware is one purchase and the security services are a subscription bought for one, three, or five years. The subscription is what feeds IPS signatures, web filtering categories, and malware scanning. These products are generally sold through resellers and quoted per deal, so there is no single public price to compare. Before buying, ask the seller:

1. What is the total cost over three and five years, hardware plus subscription?
2. What exactly stops working if the subscription lapses: signature updates, firmware downloads, cloud management, vendor support?
3. What is the published end-of-support date for this model?
4. Is the renewal price fixed, or quoted again at renewal time?

No required subscription. Some vendors include their security features in the hardware price. Firewalla, for example, states on its product page that there is “no monthly fee for standard features”. Netgate appliances ship with pfSense Plus software included. Ubiquiti’s UniFi gateways include intrusion prevention and are managed from the same controller as UniFi switches and access points.

Neither model is better in every case. Subscription products usually come with broader filtering categories, vendor support contracts, and compliance reporting. No-subscription products cost less over time and cannot lapse. The mistake is comparing only the hardware price.

How do you size a firewall for your internet speed?

Every firewall datasheet lists several throughput numbers, and they differ enormously. Fortinet’s FortiGate 40F datasheet is a clear example from a widely used small-office model:

Measurement on the FortiGate 40F datasheet	Throughput
Firewall throughput (basic packet forwarding)	5 Gbps
IPS throughput	1 Gbps
Threat protection throughput (firewall, IPS, application control, and malware protection on)	600 Mbps
SSL inspection throughput	310 Mbps

The same box is a 5 Gbps device or a 310 Mbps device depending on what you ask it to do. On a 1 Gbps fiber connection with every protection enabled, it becomes the slowest link in the chain. That is not a flaw in the product. It is how all of these devices work, and it is why sizing matters.

A practical method:

1. Find your internet plan’s download speed (and check whether you plan to upgrade in the next few years).
2. Decide which security features you will actually turn on.
3. Choose a model whose throughput with those features on meets or exceeds your internet speed, with some headroom.
4. Ignore the largest number on the datasheet unless you plan to run the device as a plain router.

Other vendors publish similar breakdowns. Netgate, for instance, lists both best-case test traffic and a more realistic mixed-traffic (IMIX) figure for each appliance.

What does a small business firewall cost?

Only some vendors publish prices. These are list prices from the vendors’ own stores as of September 2026, for hardware only:

Device	Published price	Vendor-stated performance
Ubiquiti Cloud Gateway Ultra	$129	1 Gbps routing with IPS on
Ubiquiti Cloud Gateway Fiber	$279	10G-class gateway with 2.5 GbE switch ports
Netgate 2100 with pfSense Plus	$369	964 Mbps firewall (best-case test), 249 Mbps with mixed traffic
Firewalla Gold SE	$519	2 Gbps packet processing, no monthly fee for standard features

For reseller-sold brands, ask for a written quote that shows hardware and subscription separately for the full term. Setup is a separate cost with any product: the rules, VLANs, remote access, and alerting are what turn the hardware into protection.

Does a firewall replace antivirus and other security tools?

No. CISA puts it directly: firewalls “primarily help protect against malicious traffic, not against malicious programs”, and they do not help if someone installs malware by opening an attachment. A laptop at home or in a coffee shop is not behind the office firewall at all.

A firewall is one layer. The others are endpoint protection on each computer, multi-factor authentication on email and remote access, tested backups, and prompt updates. If most of your work happens in cloud apps such as Microsoft 365, identity controls matter as much as the network edge. Our guide to zero trust security for small business explains that model.

When do you not need a dedicated firewall?

A two- or three-person office that works entirely in cloud apps, has no server, no cameras, no payment terminals on the network, and no compliance obligations can be reasonably served by a current, supported router that receives automatic updates, combined with DNS filtering, endpoint protection, and MFA on every account.

A dedicated firewall becomes worthwhile when any of these apply:

• You accept cards on network-connected terminals. See our PCI DSS guide.
• You handle health, financial, or legal records.
• You have a server, network storage, cameras, or door systems on site.
• Staff need to reach office systems from outside.
• You offer guest Wi-Fi in the same space as business systems.
• A cyber insurance application asks about network security controls.

Common mistakes

• Buying on the headline throughput number. Size by throughput with security features on.
• Letting the subscription lapse unnoticed. Put the renewal date on a calendar with a 60-day warning.
• Leaving the default configuration. No segmentation, default admin account, management page reachable from the internet.
• Exposing services to the internet for convenience. Port forwards for remote desktop or camera viewing are a common way in. Use a VPN or a zero trust access tool instead.
• Running hardware past its end-of-support date. After that date the vendor stops fixing security flaws in it.
• Nobody reviews it. Rules accumulate, alerts go to an old email address, and firmware falls behind.

Common questions

Is the firewall built into Windows or macOS enough?

It is useful and should stay on, but it protects only that one computer. It does not protect printers, cameras, or phones, does not separate guests from business systems, and does not give you a single place to see what is happening on the network. It complements a network firewall.

How often should a firewall be replaced?

Go by the vendor’s published end-of-support date, not by age alone. Look up your exact model on the vendor’s lifecycle page. Plan the replacement before that date, and sooner if your internet speed has outgrown the device’s throughput with security features on.

Can a business owner set up a firewall without help?

Some products are designed for it, and a careful owner can get a basic setup working. The parts that are easy to get wrong are rules between VLANs, remote access, and alerting. If you do it yourself, test from the guest network that you cannot reach business devices, and confirm that automatic updates are actually on.

Does a firewall slow down the internet?

Only if it is undersized. A firewall whose threat protection throughput exceeds your internet speed adds no delay you would notice. One that is rated below your plan speed with features on will cap your speed at its own limit.

Do remote employees need the office firewall?

It only protects devices inside the office. Remote staff are protected by what is on their laptop and their accounts: endpoint protection, updates, MFA, and a secure way to reach office systems when they need them.

How Coastal Growth Co. can help

We can identify what is at the edge of your network today, check its support status and configuration, and recommend a firewall sized for your connection and the features you will use, including the multi-year cost. We also handle installation, VLANs, remote access, and alerting as part of our network and security services, or look after it over time under managed IT. Scope and price are agreed first. Contact us to start.