top of page
Search

Firewall Configuration: Guide for UK Homes & SMBs

A lot of people in Sheffield are in the same spot right now. The broadband is working, the Wi-Fi reaches most rooms, the card machine connects, the laptops get online, and the router has a little firewall ticked on by default. It feels sorted.


Then we see what happens in the workshop when “sorted” turns out to mean “left exactly as it came out of the box”. A home PC gets hit after a risky port was left open for months. A small office keeps getting strange login prompts because remote access was exposed to the internet. A printer, NAS box, smart TV, and two old laptops are all talking across the network with far more freedom than they need.


That's where proper firewall configuration matters. Not in a dramatic, enterprise-only way. In a practical, everyday way that stops ordinary mistakes becoming expensive ones.


Table of Contents



Why Your Default Firewall Settings Are Not Enough


The most common mistake isn't turning the firewall off. It's assuming the default setup is “secure enough” just because the internet provider supplied it that way.


A black wireless router on a wooden office desk next to a laptop and a potted plant.


Default settings are built for easy installation, fewer support calls, and broad compatibility. They aren't built around your actual devices, your working habits, or the apps you've added over time. That gap is where trouble starts. One forwarded port for a games console, one old admin password, one unused service left on, and your network becomes much easier to probe than it should be.


The wider UK picture shows why this matters. In the UK, 43% of businesses and 28% of charities experienced a cyber security breach or attack in the last 12 months, and 88% of data breaches stemmed from human error, often tied to misconfigured rules or default settings that didn't block unauthorised traffic according to the UK government's Cyber Security Breaches Survey.


Practical rule: A firewall that's merely switched on is not the same thing as a firewall that's properly configured.

For home users, the usual problem is convenience features left enabled because nobody explained the trade-off. For small firms, it's often a network that grew bit by bit. A till, a cloud backup tool, remote desktop access, a CCTV recorder, a guest Wi-Fi network, and a few staff mobiles all get added over time, but the firewall rules never get cleaned up to match.


If you want a clear primer before changing anything, this guide to Understanding firewalls gives a useful plain-English overview of what they do. It helps to think of firewall configuration as deciding who can knock, who gets through, and which doors should never have been opened in the first place.


Good security also isn't just about one device at the edge of your network. The habits around backups, account control, malware prevention, and device hardening all support it. Our own advice on data security best practices for everyday users fits into the same picture. A solid router setup is part of a system, not a magic shield.


Understanding Your Network's Layered Defences


Most homes and small offices already have more than one firewall. They just don't think of them that way.


A diagram illustrating three layers of network security defenses including router, operating system, and application firewalls.


The easiest way to picture it is like a building with several controlled doors. Your router is the main entrance. Your computer's operating system firewall is the locked office inside. Application controls are the keycard permissions on individual rooms. If one layer is too open, the others still help. If all of them are lax, problems spread fast.


The router is your perimeter


The router firewall sits between your network and the internet. Its main job is to block unsolicited inbound traffic unless you've specifically allowed it. That's why users can browse the web safely without manually approving every website connection.


This is also where many risky features live. Port forwarding, Universal Plug and Play, remote administration, and guest network settings usually sit in the router interface. If those are left loose, the outer wall develops holes.


A lot of consumer routers use stateful inspection, which means they track whether traffic is part of an existing legitimate connection rather than treating every packet in isolation. If you want a simple explanation of how that works in practice, this article on stateful firewall explained is worth a read.


The device firewall protects each machine


Windows and macOS both include built-in firewalls. These matter because they make decisions at the device level, not just the network edge.


That means if one laptop joins a public Wi-Fi network, or if a device inside your own network behaves badly, the computer still has its own controls. It can allow file sharing at home but block it on a public connection. It can stop a random app from listening for inbound traffic. It can restrict remote access to what is needed.


Here's a useful visual explanation before getting into settings:



Application controls add the fine detail


Some security tools and operating systems go a level deeper by managing traffic per application. That's handy when the browser needs access, but a rarely used utility doesn't. It's also useful when one office PC needs a line-of-business program to communicate across the network, but the rest don't.


Layered defence works best when each layer has a narrow job and none of them are trusted to catch everything alone.

For a home user, that often means this simple stack:


  • Router firewall: Blocks broad inbound threats from the internet.

  • Windows or macOS firewall: Limits what each device accepts.

  • Application permissions: Stops software from getting more access than it should.


For a small business, add one more idea. Keep different kinds of devices from mingling more than necessary. Staff laptops, guest Wi-Fi, CCTV, printers, and smart devices don't all need the same level of trust. Good firewall configuration isn't just about blocking attackers from outside. It's also about reducing movement inside your own network if one device goes wrong.


Securing Your Router and Operating System Firewalls


The most effective changes are usually the boring ones. They don't look flashy in a settings menu, but they close the gaps we see most often on real home and small business networks.


Harden the router first


Start with the admin side of the router, not the Wi-Fi name. If the default administrator credentials are still in place, or if the password is weak and reused elsewhere, fix that first. A strong unique admin password matters more than cosmetic changes.


After that, check the features that open doors automatically or make management available from outside your home or office.


  • Disable remote administration unless you actively use it: If you don't need to manage the router from outside the building, don't leave that path available.

  • Turn off UPnP if you can live without it: UPnP is convenient because devices can request port openings automatically. It's also one of the most common reasons people have no idea why a port is open.

  • Review port forwarding entries: If you don't recognise a rule, don't assume it's important. Verify what needs it, then remove what doesn't.

  • Check guest network separation: Guests should get internet access, not visibility of shared folders, office machines, or backup devices.

  • Install firmware updates: Security fixes often arrive this way, and older routers are notorious for being left untouched for years.


A lot of households have at least one forgotten rule from an old camera app, a games console, a smart hub, or a remote access experiment. Those stale entries are common in Sheffield homes, especially where internet services have changed but the same router has stayed in service.


Tighten Windows Defender Firewall


Windows Defender Firewall is good, but many people only interact with it when a pop-up appears and they click “Allow” to get rid of it.


That's where bad habits creep in. When Windows asks whether an app should be allowed on private or public networks, the choice matters. A home network you control is different from café Wi-Fi, hotel internet, or shared workspace access. If an app only needs local access in your office, don't approve it for public networks as well.


A practical Windows check looks like this:


  • Confirm the firewall is enabled for all profiles: Private, public, and domain where relevant.

  • Review allowed apps: Remove permissions for software you've uninstalled or no longer use.

  • Treat public as strictly public: Keep file sharing and discovery tighter there.

  • Be wary of broad allowances: If a rule permits an app everywhere, ask whether that's really necessary.


For people who want a broader Windows-focused security checklist alongside firewall settings, secure your network in the AI era gives extra context on hardening the platform around the firewall itself.


Workshop note: The Windows firewall isn't the enemy when something stops working. It's often the first sign that an app is asking for more access than it should.

Malware prevention still matters here too. A firewall can restrict traffic, but it won't fix risky downloads, fake browser prompts, or rogue attachments by itself. That's why our guidance on how to prevent computer viruses sits alongside firewall hardening rather than replacing it.


Check the macOS firewall properly


Mac users often assume they're covered because macOS has a reputation for being safer out of the box. Safer doesn't mean immune, and the built-in firewall still deserves attention.


The first job is confirming it's enabled. After that, look at which services and applications are allowed inbound connections. Screen sharing, file sharing, remote login, and similar options are useful when intentional. They're risky when forgotten.


A sensible macOS approach is less about constant tweaking and more about refusing needless exposure:


  • Keep sharing services off unless needed

  • Allow specific apps rather than whole categories of access

  • Review settings after installing remote support, file transfer, or media server tools

  • Recheck after major operating system updates


For both Windows and macOS, the best rule is simple. If you don't know why something needs inbound access, don't approve it until you've checked. Most everyday apps work perfectly well making outbound connections only.


Creating Effective Rules and Managing Ports


This is the point where firewall configuration stops being a checkbox and becomes a policy. The strongest setup usually starts by denying what isn't explicitly required.


Start with default deny


A default-deny stance means traffic is blocked unless a rule allows it. That feels stricter at first, but it's far safer than allowing broad access and trying to tidy it up later.


That approach matters because a strict default-deny policy combined with granular access control lists can reduce unauthorised access incidents by approximately 78%, and audits often reveal that 65% of UK organisations with data breaches had failed to remove obsolete rules within the mandated quarterly review cycle according to Palo Alto Networks' firewall best practices summary.


For a home user, that usually means only opening a port if there is a clear purpose and a clear owner. For a small office, it means defining which device, which service, and which source should be allowed, instead of creating one wide rule for convenience.


Build rules around real needs


A good rule is narrow. It names a service, limits who can reach it, and exists for a reason somebody can explain.


Bad rule:


  • Allow remote access from anywhere: Easy to set up, hard to defend.


Better rule:


  • Allow remote access only from a trusted source and only to the required device and service: More effort, far less exposure.


The same logic applies to game servers, CCTV apps, NAS boxes, and remote desktop tools. If a device only needs one service reachable, don't open several. If one machine needs access, don't allow the whole subnet. If something is temporary, note that and remove it later.


If a rule doesn't have an owner, a purpose, and a review date, it tends to outlive the reason it was created.

Here's a simple reference point for common services.


Port

Service

Default Action

Notes

80

Web traffic

Block inbound unless you intentionally host something

Most home and small business users don't need to expose a website from their own premises

443

Secure web traffic

Block inbound unless there is a specific hosted service

Commonly needed outbound, rarely needed inbound on a basic setup

3389

Remote Desktop

Avoid exposing directly

If remote access is needed, restrict it tightly and prefer a safer access method

22

SSH

Block unless you actively manage a device with it

Useful for administration, risky when left internet-facing

445

File sharing

Block inbound

This should not be open to the internet on normal home or SME networks

53

DNS

Allow only where the service role is clear

Usually handled by the router or approved resolver, not random devices


Remove old rules before they remove your security


Old firewall rules are one of the least glamorous problems and one of the most dangerous. They're easy to ignore because everything still works. That's exactly why they linger.


We see this pattern all the time with:


  • Retired software: A program was uninstalled, but the firewall exception remains.

  • Old devices: A NAS, printer, or DVR was replaced, but its port forwarding stayed behind.

  • Temporary remote support: Access was opened for a one-off fix and never closed.

  • Merged networks: Home office kit and family devices ended up on the same network with broad permissions.


Reviewing rules doesn't need to be complicated. Ask four questions for each one: what is it for, who needs it, is it still used, and can it be narrowed? If you can't answer those cleanly, the rule probably needs changing or deleting.


When to Upgrade to a UTM or Next-Gen Firewall


A standard broadband router is fine for many homes and very small setups. It's usually enough when your needs are simple, your devices are few, and you don't have staff, remote access requirements, or compliance pressure.


What a basic router does well


A decent consumer or ISP router can handle the basics. It blocks unsolicited inbound traffic, provides Wi-Fi, and may offer straightforward port forwarding, guest networking, and basic logging. For a family home or a sole trader with one laptop and a printer, that can be perfectly reasonable.


A comparison infographic between basic router firewalls and advanced UTM or Next-Gen firewall solutions for businesses.


The trouble starts when the network becomes important to operations rather than just internet access. That's when you notice the limits. Basic routers don't usually give you strong central control, rich reporting, detailed policy options, or broader security tools in one place.


Signs your business has outgrown it


The business case for a UTM or Next-Generation Firewall is straightforward. If downtime hurts, if staff need secure remote access, if you handle customer data, or if you need clearer visibility into what's happening on the network, a basic router often stops being enough.


You'll usually feel the need for an upgrade when one or more of these apply:


  • You need better web filtering: Useful when staff devices should reach business tools but not every category of site.

  • You want centrally managed VPN access: Especially when hybrid working is now normal.

  • You need clearer policy by user, device, or zone: Guest traffic, office PCs, VoIP phones, and CCTV shouldn't all sit under one loose rule set.

  • You want one box to cover more jobs: Intrusion prevention, antivirus features, VPN, and reporting are often bundled in UTM or NGFW platforms.


The market has moved this way for a reason. The UK firewall market for small businesses is dominated by NGFW and UTM devices, with Fortinet holding a significant market share, and the market is projected to reach $5.14 billion by 2026 according to TrustRadius firewall market analysis. That doesn't mean every small business needs enterprise gear. It does show that many firms have realised the all-in-one router supplied with broadband isn't enough once the network becomes business-critical.


If your company is reaching that point, proper IT support for small business environments usually matters as much as the hardware itself. The box only helps if somebody keeps the policies sensible, reviews logs, and removes drift over time.


Firewall Testing Maintenance and Local Support


A firewall isn't a one-off job. Good settings decay when networks change and nobody revisits them.


A simple maintenance rhythm


The easiest way to keep control is to make reviews routine rather than reactive. A short recurring checklist does more good than a big annual panic.


  • Review rules regularly: Remove anything you no longer need and tighten anything that's broader than necessary.

  • Check firmware and operating system updates: Routers, Windows devices, and Macs all need current security fixes.

  • Look at logs for patterns: Repeated blocked connection attempts, unusual outbound traffic, or sudden permission prompts are worth attention.

  • Revisit remote access settings: Temporary exceptions have a habit of becoming permanent.

  • Retest after adding new kit: Cameras, NAS devices, smart home hubs, printers, and business software can all alter the risk picture.


A quiet network isn't always a safe network. Sometimes it only means nobody is checking the logs.

How to test without overcomplicating it


You don't need a full security lab to do basic validation. Start by confirming the expected behaviour matches reality. If a service should only work internally, test it from outside and make sure it isn't reachable. If a machine shouldn't accept inbound connections on public networks, verify that profile is set correctly.


A basic external port scan from a trusted testing service can help show whether your network looks closed from the outside. Internal checks matter too. Make sure devices that shouldn't talk to each other can't do so freely. If you change one rule, test the exact app or service it affects rather than assuming success because the internet still works.


If all this feels a bit much, that's normal. Firewall configuration becomes fiddly quickly, especially when older devices, remote access tools, business software, and smart equipment all share the same connection.



If you're in Sheffield and want someone local to review it properly, Steel City IT can help with practical network hardening for home users and small businesses. We can check router settings, clean up old rules, tighten Windows and Mac firewall permissions, and make sure your setup is secure without breaking the tools you need every day.


 
 
bottom of page