What Does a Sophos Firewall Actually Do for a Small Business?

The core job: controlling traffic in and out

At its most basic, a firewall sits between the office network and the internet and decides what traffic is allowed through, in either direction. Rules define which services can be reached from outside, which internal systems can talk to which other systems, and what gets logged along the way.

On a consumer router this is a handful of simplistic settings. On a business firewall it is a rule set that can be tuned precisely to the business: allowing the point-of-sale system to reach its payment processor while blocking it from reaching the general office network, for example.

Segmentation: keeping different systems apart

One of the most valuable things a business firewall does is create separate zones, often called VLANs, and control traffic between them. Guest Wi-Fi, staff devices, security cameras, and VoIP phones can each sit on their own segment so that a problem on one does not automatically spread to the others.

This ties directly into the topic covered in our article on network segmentation for small businesses: the firewall is the device that actually enforces those boundaries once the network is designed with separate zones.

Web and content filtering

Business firewalls typically include the ability to filter web categories, blocking known malicious sites, phishing domains, and categories the business decides are inappropriate for a work network. This reduces the chance that a staff member lands on a compromised site by accident, but it is not a substitute for security awareness training.

VPN for remote access

Most business firewalls include built-in VPN capability so staff working from home or on the road can connect back to office resources securely. This is one option among several for remote access; the trade-offs against newer Zero Trust approaches are covered in our article comparing VPN and Zero Trust network access.

Intrusion prevention and traffic inspection

Beyond simple allow/deny rules, business firewalls run intrusion prevention systems (IPS) that inspect traffic patterns for known attack signatures, such as attempts to exploit a vulnerable service. This catches some automated attacks that a basic router would let straight through.

What a firewall does not solve

• It does not stop a phishing email that convinces a staff member to hand over a password.
• It does not protect a laptop once it leaves the office network and connects elsewhere, which is why endpoint protection still matters.
• It does not back up data, so ransomware that reaches a file server still requires a recovery plan.
• It does not manage itself: rules need periodic review, and firmware needs to stay current.
• It cannot fix weak Wi-Fi coverage or capacity issues, which is a separate design problem covered in our business Wi-Fi design guide.

Why the model of firewall matters

A consumer router marketed for home use and a business firewall appliance are not the same category of device, even when both technically "do firewalling." The difference in how much control, visibility, and reliability each offers is significant enough that we cover it separately in our comparison of business firewalls versus consumer routers.

Frequently asked questions