What a Firewall Does (and Why It No Longer Protects Remote Work)
The firewall is still the best-known piece of network security in a small or mid-sized business. It is also the most misunderstood: many companies assume that owning one means they are protected. This guide explains what a firewall actually does, what it cannot do, and how to close the gap without paying twice.
What is a firewall
A firewall is a device or piece of software placed between your network and the outside world that decides which traffic passes and which is blocked, based on rules. In practice it does three things:
- Filters by source, destination and port: for example, allowing outbound web browsing and blocking everything else.
- Tracks connection state: it knows which connections your network started and only lets legitimate replies back in.
- Publishes services: if you have an internal server reachable from outside, the firewall opens and forwards that port (port forwarding).
Modern next-generation firewalls add application inspection, gateway antivirus, web filtering and VPN.
What it protects well
- Stops internal services from being exposed by accident.
- Blocks outbound traffic to known malicious destinations.
- Segments networks: guests, cameras, production and office kept apart.
- Keeps a record of what comes in and goes out.
Where it falls short
The firewall was designed for a world where work happened inside the office. Today there are three obvious gaps:
1. The perimeter is gone. People work from home, from a phone, or from a customer site, and applications live in the cloud. Traffic no longer passes through the firewall.
2. Publishing services means opening ports. The moment you open a port for remote access — SSL VPN, remote desktop, an ERP — that port is scanned daily by bots. A vendor vulnerability or a stolen credential turns that door into the way in.
3. Once inside, trust is total. When someone connects over VPN they usually reach the whole network. If that laptop is compromised, the attacker moves laterally with no resistance.
Firewall + Zero Trust: how they fit together
This is not about removing the firewall. It is about no longer using it for something it was never designed for: remote access.
| Firewall with VPN | Zero Trust access (ZTNA) | |
|---|---|---|
| Ports open to the internet | Yes, required | None: the connection leaves your network |
| Scope of access | The whole network | Only the authorised resource |
| Verification | At login | Continuous: user, device and context |
| Lateral movement | Possible | Blocked by segmentation |
| Maintenance | Your own patches and rules | Managed |
The firewall keeps protecting and segmenting the local network. Remote access moves to ZTNA, with nothing exposed.
What to check in your firewall today
- List every port open to the internet. Each one needs a written reason and an owner.
- Check the firmware version. Critical flaws in VPN-capable firewalls have been among the most exploited entry points in recent years.
- Review "any-any" rules. They usually survive from an old test.
- Separate the guest network and IoT devices from the work network.
- Review who can administer it and whether they use multi-factor authentication.
What changing the model costs
With ConnectaSec, remote access costs from EUR 5 per user per month, with five devices included (mobile, tablet, Windows, Mac or iOS), plus a mandatory dedicated gateway from EUR 40 per month that provides a dedicated IP and per-customer isolation. Compared with renewing firewall VPN licences and the maintenance hours involved, the change is usually cost-neutral or better. You can compare both models on the ConnectaSec platform page.
Frequently asked questions
Does a firewall protect against ransomware? It helps, but it is not enough: most incidents arrive through email, stolen credentials or an exposed remote service.
Can I remove the firewall if I use ZTNA? No. You still need it for the local network and segmentation. What you no longer need are open ports for remote access.
Is an ISP router good enough as a firewall? For a business, no. It offers no segmentation, no logging and no application control.
Want to see what your network looks like with no open ports? Request a demo.