Sound familiar?
- Nobody knows the router's admin password
- Port forwards were set up years ago and nobody remembers why
- Remote staff connect using Remote Desktop straight over the internet
- The firewall shows a licence or support subscription has expired
- VPN connections drop or will not connect after a broadband change
- Your ISP has replaced the router and the old settings have gone
Key facts
- Firewalls are one of the five Cyber Essentials technical controls
- Default admin passwords must be changed and remote admin access disabled or locked down
- Exposed RDP (port 3389) is one of the most common ransomware entry points
- Firewall and router firmware counts as software that must be patched within 14 days for high and critical fixes under Cyber Essentials
- The Cyber Security Breaches Survey 2025/2026 found 74% of UK businesses have network firewalls
- Rule reviews and changes: £45 an hour + VAT; new hardware installs quoted
What a firewall does for a small office
Your firewall sits between your office network and the internet. Its job is simple: let out what staff need, let in only what you have deliberately allowed, and block everything else. In many small offices that job is done by the broadband router your ISP supplied. In others there is a dedicated business firewall from a vendor such as Fortinet, Sophos, WatchGuard, Ubiquiti or DrayTek.
Either can be secure, but only if it is configured properly and kept up to date. The problems we find are rarely the hardware itself. They are old port forwards, default passwords, admin pages reachable from the internet and firmware that has not been updated in years.
Our firewall review
We connect remotely, with your permission, and check:
- Admin access: default password changed, admin interface not exposed to the internet, MFA on cloud management where supported.
- Inbound rules and port forwards: each one documented with a reason, or removed. RDP (3389), SMB (445) and old camera or NAS ports are top of the list.
- Firmware: current, supported, with security fixes applied. End-of-life devices flagged for replacement.
- VPN: modern protocol (IPsec IKEv2, WireGuard or SSL VPN with MFA), no shared accounts.
- Guest Wi-Fi: separated from the office network.
- UPnP: switched off unless something genuinely needs it.
- Logging: enabled, so if something happens there is a record.
You get a short written list of what we changed and what still needs a decision.
Signs your firewall needs attention
- The admin page still shows the vendor's default login, or the password is on a sticker on the box.
- The firmware version is more than a year old, or the vendor's website lists the model as end of life.
- Security subscriptions such as web filtering, intrusion prevention or antivirus scanning show as expired, so those features have quietly stopped.
- There are port forwards to IP addresses that no longer exist on your network.
- CCTV recorders, NAS boxes or printers are reachable from the internet.
- Your broadband speed dropped after enabling a feature, because the device cannot inspect traffic at your line speed.
Any of these is a reason to book a review. Old CCTV recorders in particular are regularly found exposed with default passwords.
Replacing exposed Remote Desktop
Port-forwarding Remote Desktop to an office PC is still common, and it is one of the main ways ransomware gangs get into small businesses. Automated scanners find open RDP within hours and start guessing passwords. We replace it with a safer route: a VPN with MFA, a remote desktop gateway, or a cloud approach such as Microsoft 365 with OneDrive and SharePoint so staff do not need to reach the office PC at all. See home working IT support and ransomware recovery.
Firewalls and Cyber Essentials
Firewalls are one of the five technical controls in Cyber Essentials. The requirements expect every in-scope device to sit behind a correctly configured firewall, with the default administrative password changed, inbound rules approved and documented, unneeded rules removed promptly, and the admin interface not accessible from the internet unless there is a clear business need protected by MFA or an IP allow list. Laptops used outside the office need their software firewall switched on too. We check all of this as part of Cyber Essentials readiness.
Pricing and new installs
Firewall reviews, rule changes, firmware updates and VPN fixes are charged at £45 an hour + VAT and are usually done remotely. If your router is end of life or you need a proper business firewall, we will recommend suitable options and give you a quote for supply and installation before any work starts. If installation needs someone on site, we tell you upfront. For wider network problems, see network support and broadband and router support.
What it costs
Support plans from £25 a month + VAT, or £45 an hour + VAT for one-off fixes. Pick a plan if you want it looked after every month, or pay by the hour for a one-off job.
Essential
Keep it updated, backed up and watched.
- Website software updates (core, plugins, themes) applied and checked
- Daily backups
- Uptime monitoring
- Security monitoring
Business
Updates plus an hour of fixes every month.
- Everything in Essential
- 1 hour of fixes or changes every month
- Priority support
Complete
Website and your team's IT, covered.
- Everything in Business
- 3 hours of fixes or changes every month
- IT and Microsoft 365 helpdesk for your team
No plan? The first 30 minutes are the minimum charge, then we bill in 15-minute blocks.
Frequently asked questions
Is my broadband router a firewall?
Most business and consumer routers include a basic stateful firewall that blocks unsolicited inbound traffic. That is often enough for a very small office if the admin password is changed, firmware is current and no unnecessary ports are forwarded. Larger offices usually benefit from a dedicated business firewall. dijitul can advise which you need.
Why is open Remote Desktop dangerous?
Remote Desktop exposed directly to the internet is found by automated scanners within hours, then attacked with password guessing and known exploits. It is a common ransomware entry point. dijitul replaces it with a VPN protected by MFA or a cloud-based setup so nothing sensitive is exposed.
How often should firewall firmware be updated?
Check for updates at least monthly and apply security fixes promptly. Cyber Essentials expects high and critical updates for router and firewall firmware to be installed within 14 days of release. If the device no longer receives updates, it should be replaced. dijitul can manage this for you.
Can you configure our firewall remotely?
Yes, in most cases. With your permission and the admin credentials, dijitul reviews and changes firewall settings remotely at £45 an hour + VAT. If a new device needs installing or cabling needs changing, we tell you upfront and quote the site visit.
Which firewall should a small business buy?
It depends on staff numbers, internet speed, VPN needs and budget. dijitul looks at how you work, then recommends a model and licence that fits, explaining any annual subscription for security updates and filtering. Supply and installation are quoted before you commit.
Related
Get it fixed
One-off fixes are £45 an hour + VAT. You'll know the likely cost before we start.