Who this is for
This guide, How to choose a firewall for a small business, is for the person who has to pick the firewall, not just approve it. That could be a founder, an IT generalist, an office manager with technical help, or a part time network admin. The setting is a small office, a clinic, a shop, or a professional firm with one to three sites and no security team on staff.
You will get the most from it if you have a working network now and the current firewall is aging, out of support, or missing features you need. It also fits a new office build where the firewall is part of the first IT order.
It is not a guide to replacement timing or switch planning, and it doesn't cover data center firewalls or regulated high security designs. Use it to turn a vague need for better security into a short list of requirements you can send to suppliers.
Before you begin
Collect facts before you look at products. Write down the speed of each internet circuit, both download and upload, and the number of people and devices on a busy day. Count phones, laptops, printers, cameras, card terminals, and guest devices. Note any servers or cloud services that staff reach from outside.
Draw the network on one page. Show the internet handoff, the firewall, switches, Wi-Fi access points, guest network, and any public facing services. Mark which groups need to talk to each other and which must stay apart. This drawing becomes your sizing and rule design input.
Decide who will run the firewall after install. Ask who changes rules, who reviews logs, and who is on call when the internet fails at 7 a.m. If no one owns it, choose a simpler model with a managed service option or a clear support contract.
Check the current device too. Note model, firmware version, license end date, and support status. If it still works, you may keep it as a spare or for a lab, but don't plan a new design around an unsupported box.
The checklist
Use the same requirements document for every supplier. Ask for written answers, not verbal assurances. Score each item as must have, nice to have, or not needed. That score keeps the conversation on your needs.
Sizing is where most small business firewall buys go wrong. The big number on the box is often raw firewall throughput with no security services turned on. Ask for the number with intrusion prevention, application control, and TLS inspection enabled at your circuit speed.
Then work the list below. It covers network fit, security features, operations, and the commercial terms that decide the real cost over five years.
- Confirm the firewall can inspect traffic at your full internet speed with intrusion prevention and application control turned on, and ask for the test method in writing, including the traffic mix.
- Check concurrent sessions and new sessions per second against your busiest hour, not against a typical day.
- List every network zone you need, such as staff, guest, servers, printers, voice, and card payment devices, and confirm the firewall supports VLANs and separate security zones for each.
- Decide if you need two internet providers, and if so, require dual WAN with failover and policy routing, then test what happens when the primary link drops.
- Confirm site to site VPN support with IPsec and remote access VPN for staff, including MFA and per user access rules.
- Ask whether application control, intrusion prevention, antivirus, and web filtering are included in the base license or cost extra, and get the renewal term in writing.
- Check how firmware updates are delivered, whether you can schedule them, and find the published end of support date for the model.
- Require named admin accounts, MFA for admin login, role based permissions, and an audit log you can send to syslog or a SIEM.
- Ask what logging is included, how long it is kept, and whether you can export logs without buying a higher tier.
- For guest Wi-Fi, confirm captive portal, client isolation, and bandwidth limits are built in.
- Ask for a written quote that separates hardware, subscriptions, support, and installation, and state what still works if a subscription lapses.
- Request a proof of concept unit or a guided demo using your real rules, VPN client, and ISP handoff, and test a config restore.
- Ask for support hours, the escalation path, warranty terms, advance replacement, and how long the model will stay in stock.
What good looks like
A good choice feels slightly boring. You can name the person who owns it, the circuits it protects, and the rules that must exist on day one. The supplier answers sizing questions with a test method, not a slogan. The quote separates hardware from subscriptions and support.
The rule set should be small and readable. Staff get the access they need. Guest traffic is isolated. Public services sit in a segment with only the ports they need open. Logs go somewhere you can search, and alerts reach a person, not a shared inbox nobody reads.
You should be able to restore a backup config, update firmware on a schedule, and fail over to a second link without a call to support. If the firewall needs a cloud account to boot, know that before you buy. The same applies to license renewals: put the end date in a calendar with a named owner.
Good support is measurable. You get a portal, a case number, and a response time that matches your business hours. For a small office, next business day may be fine. If card payments or phones depend on the link, ask for faster coverage and keep a spare power supply.
What to do next
Write a one page requirements sheet from the checklist. Include circuit speeds, user and device counts, zones, VPN needs, logging destination, and must have features. Send it to two or three suppliers and ask for the same proof of concept.
Score the answers before you look at a demo. A low score on sizing, license terms, or support should remove a product from the short list. Then run a pilot on a spare circuit or after hours. Test a rule change, a VPN login, a firmware update, and a restore.
Plan the cutover. Back up the old config. Keep a console cable and out of band access ready. Schedule the change for a quiet window and tell staff. Keep the old firewall until the new one has run for a week.
If you need a current inventory before you size anything, the Hardware and endpoint review from Cloudverg is a fixed price $4,500 over two weeks, and it includes a written report and a 60 minute readout. It is one option among others. You can also do the inventory in a spreadsheet if you have the time.
Frequently asked questions
What throughput rating should I look for in a small business firewall?
Match the rating to your internet circuit speed with intrusion prevention, application control, and TLS inspection turned on. Raw firewall throughput is usually much higher than the number you will see in production. Ask the supplier for the test method and the size of the test traffic.
Do small businesses need a firewall subscription?
Most business firewalls need a subscription for security signatures, firmware fixes, and support. Without it, features may keep running but the protection goes stale. Ask what stops working when the subscription lapses before you sign.
Can a consumer router work as a firewall for a small office?
It can pass traffic for a tiny office with no guest network, no remote access, and no payment devices. It usually lacks separate zones, useful logs, MFA for admin login, and a support path. Use one only when the risk and the recovery plan are clear.