Business firewall vs the router your internet provider sent

What the supplied router actually does

A typical supplied router does several jobs in one box: it connects to the fibre or wireless service, hands out addresses to devices, provides Wi-Fi and runs a basic firewall that blocks unsolicited incoming connections. That last point matters; it is not nothing. For a home or a sole trader it is reasonable protection, especially when combined with good security on each device.

Where it falls short is everything a business needs on top. Settings are limited, logs are minimal or missing, firmware updates depend on the provider, and the admin password is sometimes printed on a sticker on the back. Many providers also keep remote management access to their routers, which is useful for their support team but means the device is not entirely under your control.

What a business firewall adds

A business firewall, sometimes called a next-generation firewall or unified threat management appliance, inspects traffic in much more depth. It can block known malicious websites and servers, filter categories of content, detect intrusion attempts, and identify which applications are using your connection. Many check files for malware as they pass through and use threat intelligence feeds that update constantly.

It also gives you structure. You can create separate networks for staff, guests, phones and cameras, with rules about what each can reach. It can provide a secure VPN for remote staff, manage two internet connections for failover, prioritise video and voice calls, and keep detailed logs that show what happened when something goes wrong.

Visibility when something goes wrong

When the office reports that the internet is slow, a business firewall can show which device or application is using the bandwidth. When a staff laptop is infected, logs can show what it contacted and when. When a supplier asks whether a suspicious login came from your office, you can check. Without those records, you are guessing.

This visibility is increasingly expected by cyber insurers and larger customers, who may ask what perimeter protection you have and whether you can investigate incidents. A home router rarely satisfies those questions; a properly configured and monitored firewall usually does. Logs are only useful if they are kept long enough, so check how many days the firewall stores and whether it can send them to a separate service for safekeeping. Thirty to ninety days of history is a reasonable target for most small offices.

Subscriptions and ongoing costs

Most business firewalls have two costs: the hardware and a security subscription that provides threat feeds, web filtering, malware scanning and firmware support. When the subscription lapses, the box usually keeps routing traffic but loses its smart protection, which leaves you with an expensive basic router. Budget for the subscription for the whole life of the device, typically three to five years.

Size the firewall for your internet speed with security features turned on, not the headline speed on the box. Inspecting traffic takes processing power, and a model that handles a gigabit with nothing enabled might manage far less once filtering and scanning are on. Hardware and subscriptions are quoted in writing first, so you can see the full lifetime cost before committing.

How the two work together

In many installations the supplied router is either removed or set to a simple pass-through mode, and the business firewall takes over routing, security and Wi-Fi management. On fibre connections, the firewall can often connect directly to the fibre terminal in the building. On some services the provider's equipment has to remain, and the firewall sits behind it.

Either way, Wi-Fi on the supplied router should normally be switched off, so you do not have two competing wireless networks with different security. Access points connected to a managed switch behind the firewall then provide all the Wi-Fi under one set of rules. Keep the supplied router boxed and labelled if you remove it, because the provider may want it back at the end of the contract or need it for testing.

Is it worth it for a small office?

For a sole trader working from home, a well-configured supplied router plus strong device security is often enough. For an office with staff, client data, remote workers, payment systems or regulatory obligations, a business firewall is a sensible baseline, alongside multi-factor sign-in, patched devices and backups. The right answer depends less on head count than on what you hold: client records, health information, financial data and payment details all raise the stakes.

A firewall is only as good as its configuration and upkeep. Rules need reviewing, firmware needs updating and alerts need someone to read them. If nobody is going to look after it, consider a managed firewall arrangement where that care is part of the service rather than an occasional afterthought.