Firewall and VPN Hardening: An SME Checklist

In a small business network, the firewall is usually the only device facing the internet directly. For anyone looking in from outside, it is also the first door. Yet what we find on site is remarkably consistent: the appliance is new, the licence is current, but the management panel answers from the outside, VPN users have nothing but a password, and the account of someone who left two years ago is still enabled.

With those three together, an attacker does not need to look for a vulnerability. They start with a password list harvested from an unrelated breach, and once a login works, they walk in as a legitimate user. In the logs this looks like an ordinary VPN session. Nobody sees an alert, because technically nothing has gone wrong.

The checks below are vendor neutral. FortiGate, Sophos, Palo Alto, MikroTik or pfSense — the menu names differ, the work does not.

1. Take the management interface off the internet

If the web panel and SSH answer on the WAN side, every scanner on the internet can see them. Management should be reachable from the internal network or over the VPN, and nowhere else.

• Disable HTTPS and SSH management on the WAN interface.
• If it cannot be disabled, restrict it by source address to known office and technician addresses.
• Changing the management port is not a control on its own. A port scan finds it within minutes; the change only reduces noise.
• If you use the vendor's cloud management portal, that account's password and second factor matter as much as the appliance's. Where the device cannot be reached, the portal often can.

2. Make the second factor mandatory on the VPN

A password is no longer proof of identity. Work e-mail addresses appear in breach dumps year after year, and the odds that one of those passwords is also in use on your VPN are not small.

• Use an authenticator app or push approval. SMS is the last resort.
• Allow no exceptions — not for administrators, not for directors, not for the account someone keeps "in case of emergency". A single exception invalidates the rule.
• Device-to-device links such as branch tunnels or camera feeds should use certificates, not a user account.
• Where possible, combine it with a device certificate: the right password, the right code and a known machine. Compromising all three is a different order of difficulty.

3. Count the accounts: who, why, until when

The user list on a firewall quietly turns into an archive. An account nobody deletes is a door nobody watches.

• Disable leavers' accounts on their last day, and tie that step to the HR process rather than to someone remembering.
• Avoid shared accounts. If nobody can say who is behind "accounting" or "office", nobody can answer questions after an incident either.
• Delete vendor default accounts and the temporary accounts created during installation.
• Keep administrators down to two or three people. In a network where everyone is an administrator, nobody is accountable.
• Review the account list quarterly. It takes twenty minutes; postponed, it stretches into years.

4. Least privilege and segmentation

• A VPN user should reach the servers they actually work on, not the whole network. A rule whose destination is "any" is an assumption, not a permission.
• Put cameras, printers and production equipment on their own VLAN. Their firmware is the least frequently updated software on the network.
• Keep guest Wi-Fi fully separate, with no route to the company network.
• Separate server management interfaces (iDRAC, iLO, hypervisor consoles) from the user network.

Segmentation pays off a second time during a ransomware incident: an infected machine reaches its own segment instead of the entire estate. That boundary often decides the length of the outage.

5. Update on a schedule, with a backup

• Subscribe to the vendor's security advisories and set a monthly maintenance window. Updates happen when you plan them, not when you are caught out.
• Export the configuration before every update.
• An appliance past its support date receives no patches. It is no longer a firewall; it is a box that forwards traffic.
• Postponing updates to avoid disruption is riskier than the disruption itself once a critical advisory lands and you have to patch in a hurry.

6. Keep logs and set alerts

• These should raise an alert: bursts of failed logins, a new administrator account, a configuration change, a new port forward, and VPN logins at unusual hours or from unusual countries.
• Ship logs off the device. If the appliance is compromised, the evidence stored on it goes with it.
• Even logs nobody reads have value: after an incident they are the only thing that answers when it started. Keep at least six months.

7. Configuration backup and rollback

• Export the configuration after every change and store it with a date and a note on what changed.
• Encrypt the backup file. It contains passwords, keys and VPN secrets, which makes a plain-text copy a more attractive target than the firewall itself.
• When hardware fails, a current configuration backup turns hours of downtime into minutes.

The twelve-point checklist

Check	How to verify it
Management interface closed to the internet	Try to open the panel from outside the office; it should not answer
Management restricted by source address	Source addresses are written into the rule
Second factor mandatory on the VPN	Try a password-only login with a test account; it should fail
No exempt accounts	No user in the list is missing a second factor
Leavers' accounts disabled	Compare against the last twelve months of departures
No shared or default accounts	Every account maps to a named person
Administrator count kept low	Two or three people, with written justification beyond that
VPN users reach only the servers they need	No rule with "any" as its destination
Cameras, printers and production gear on a separate VLAN	Try reaching a camera directly from an office PC
Appliance current and still supported	Check the model and firmware against the vendor lifecycle table
Logs shipped off the device, alerts configured	Confirm a test login produces an alert
Configuration backup current and encrypted	Check the date of the last export and where it is stored

How Yamanlar Bilişim helps

Your own team can work through this list; most of it is a day's work. If you would rather bring someone in, our sequence is: document the current firewall and VPN configuration, report in writing which of the points above are open, then apply the hardening and roll out the second factor. Segmentation and log design sit within our network infrastructure work, hardening and monitoring within enterprise cyber security.

Frequently asked questions