Firewall | How to Properly Configure Protection

[Security]

A home network has long since ceased to consist of just a single computer and a router.

Laptops, smartphones, televisions, CCTV cameras, and other devices constantly exchange data with the internet, and every open connection can become a potential entry point for attackers. A firewall helps control this exchange, but its effectiveness directly depends on proper configuration.

Cyber Media examines which settings truly enhance home network security, which rules are best to use in 2026, how to verify that your firewall is working properly, and what mistakes to avoid.

A firewall is a security solution that monitors network traffic and decides which connections to allow and which to block. It operates according to predefined rules, checking incoming and outgoing connections. While antivirus software protects your device from malicious files, a firewall protects the network itself, preventing suspicious traffic from entering or leaving your device.

A firewall helps reduce the risk of the most common network attacks. When configured correctly, it allows you to:

• block unauthorized connections to open ports;
• restrict remote access to devices;
• control outgoing connections of applications;
• prevent exploitation of vulnerable network services;
• contain the spread of malware within your home network.

There are two main types of firewalls. A hardware firewall is built into the router and filters traffic between the internet and the local network. A software firewall runs directly on a computer, laptop, or other device and monitors the network activity of individual applications and processes.

However, a router alone is insufficient for comprehensive protection. It protects the network perimeter but cannot control software behavior on each device. If malware has already invaded a computer or one of the devices has been compromised, a local firewall can block suspicious connections.

Therefore, a combination of a hardware firewall on the router and a software firewall on all devices on the home network is considered optimal today. This design provides multi-layered protection and significantly reduces the attack surface.

A home network typically has more than one firewall, operating at different levels.

The first is the operating system's firewall , the final line of defense on the device itself. In Windows, this is the Windows Defender Firewall (Control Panel → Windows Defender Firewall or wf.msc), in macOS, the "Firewall" section in System Preferences, and in Linux, iptables/nftables or simple wrappers like ufw.

It protects a specific computer, regardless of the network it's connected to.

The second level is the home router's firewall. This is the one most often referred to by the word "firewall": NAT prevents devices from accessing the internet directly from a computer on the local network without an explicitly open port. The settings are located in the router's web interface (the address is something like 192.168.1.1), under "Security," "Firewall," or "Port Forwarding." There you can also view forwarded ports, disable UPnP, and restrict remote access to the admin panel itself.

Modern routers offer significantly more than basic NAT:

• built-in detection of suspicious traffic (IDS/IPS);
• filtering by lists of malicious domains;
• network segmentation via VLANs and guest networks;
• VPN server out of the box.

The more expensive and newer the model, the more features are available without the need for additional equipment. For a typical home network—a few computers, phones, a couple of smart devices, nothing exposed to the internet—a combination of the OS firewall and router is usually sufficient if both are configured carefully.

Additional solutions are needed when the network includes externally accessible services (a home server, NAS, cameras), when the network is large and heterogeneous and requires segmentation, or when detailed visibility into what's happening—logs, alerts, and statistics—is important. In other cases, it's more important not to purchase additional equipment, but to properly configure what you already have—which we'll cover in the next section.

Before changing rules, it's important to get your baseline data in order—otherwise, you risk configuring protection on top of an outdated or incomplete picture of your network.

1. Update your router firmware. Older firmware versions often contain known vulnerabilities and limited firewall functionality—some useful settings may only have appeared in recent releases.
2. Check the network diagram. It's important to understand how many devices are connected to the network, which of them should have access to each other, and which should be isolated. For example, IoT devices shouldn't be able to easily access a work computer.
3. Back up your configuration. Most routers allow you to export your current settings to a file. If something goes wrong, a rollback takes only a minute, rather than requiring you to set up the router from scratch.

These three steps take a little time, but they eliminate most of the risk of "setting it up and breaking it": if something stops working after making changes, you can always roll back to the saved configuration and take your time. Next, we move on to the firewall settings themselves.

For a home network, the basic rule is simple: block all unsolicited incoming connections from the internet, remote router management, and external access to SMB, RDP, cameras, and network storage.

Outgoing traffic can usually be allowed, but it's worth blocking access to known malicious addresses, and creating a separate network for children's and IoT devices without access to the main computers.

There's no universal set of rules that will work for everyone—the network's composition and its purposes vary greatly. However, the steps listed above—with basic incoming connection blocking and moderate outgoing control—cover most typical home network risks and serve as a foundation upon which more detailed configuration can be built.

Any firewall ultimately operates on one of two basic principles: either everything that isn't explicitly blocked is allowed, or everything that isn't explicitly allowed is blocked. This distinction sounds like a technicality, but it determines how vulnerable the network is to devices and services you've forgotten about or weren't aware of.

The first approach—"allow everything except blocked"—is convenient and requires almost no configuration: a new device connects, a new program accesses the network—everything just works. But this convenience comes at a price: any unintended service, any vulnerable program, or compromised IoT device gains access by default, not because someone deliberately allowed it.

The Default Deny principle works the other way around: everything is blocked by default, and access is granted only to connections explicitly defined in the rules. This is significantly more reliable—the network doesn't expand its attack surface on its own; when a new device or service appears, nothing happens "by itself" unless a rule is manually added. The price for this is more initial setup and having to revisit the rules every time something new appears on the network.

The "default deny" mode for incoming connections is almost always advisable, except in cases where the user is deliberately publishing services online, such as hosting a personal website or gaming server. For outgoing connections, this approach is especially relevant in networks with IoT devices, guest networks, and in segments with critical devices, such as NAS storage or home automation systems. This mode can be particularly useful in families with children, when it's important to limit devices' access to external resources.

However, improperly setting the default deny mode can lead to a number of risks. For example, blocking legitimate services (software updates, data synchronization, or VoIP services) often forces the user to temporarily disable the firewall entirely. Equally dangerous are overly broad exceptions, which are created for a quick troubleshooting and then remain in the configuration permanently, effectively negating the very principle of default deny.

Additional risks arise from the lack of logging of blocked connections, as well as errors in the order in which they are applied. For example, an allow rule placed above a deny rule may completely neutralize the restrictive policy.
Click to expand...

For most home networks, the optimal compromise is Default Deny for incoming connections (no one should normally access them from outside) and a more lenient outgoing policy to avoid blocking familiar apps and services. This scenario addresses the main risk—accidental external access—and eliminates the need to manually configure rules for each new device or program every day.

Some home network vulnerabilities arise not from the absence of a firewall, but from convenient features enabled by default that silently expand the attack surface.

UPnP allows network devices to open ports on the router without user intervention—this is convenient for gaming consoles and torrent clients, but it's just as convenient for malware that wants to penetrate the network. If there are no services in the home that truly require automatic port forwarding, it's best to disable UPnP.

Remote router management allows access to the web administration interface from the internet, not just from the local network. This feature is convenient if you need to make adjustments while away from home, but it also makes the router control panel itself a target for brute-force attacks and firmware vulnerabilities. In most cases, it's best to keep it disabled and enable it only when access is truly needed.

Open ports aren't an abstract threat, but a specific list of network access points that should be reviewed periodically. Each open port should be opened deliberately, for a specific service, and not because it was configured that way and then forgotten.

Automatic port forwarding is closely related to UPnP, but it also applies to manual rules that accumulate over time: an application is installed, a port is opened, the application hasn't been used for a while, and the port remains open. It's worth periodically checking the list of forwarded ports against the services actually used. An

unnecessary DMZ is a mode in which a specific device becomes fully accessible from the internet, without any filtering from the router. Sometimes it's enabled to "just get something finicky working" and then forgotten to disable it. A DMZ only makes sense for specific scenarios, such as a test server, and almost never for everyday home devices.

Old protocols and insecure services —Telnet, outdated versions of SMB, WPS on Wi-Fi, and the like—are often enabled by default on routers or devices for the sake of backward compatibility, even though they're no longer needed and contain known vulnerabilities. If no device on the network explicitly requires them, such protocols should be disabled.

Here's a checklist of what to disable first:

• Remote control of the router from the Internet.
• UPnP, unless there are services that actually need it.
• WPS and other legacy Wi-Fi protocols.
• DMZ, if it was enabled "for testing" and forgotten.
• Forwarded ports that do not correspond to the services actually used.

None of these steps require any special knowledge or expensive equipment—just five minutes in the router's web interface and a willingness to honestly determine which features are actually used and which are simply enabled out of habit.

A firewall controls traffic, but it doesn't protect against someone simply connecting to your network directly via Wi-Fi or logging into the router's admin panel with the "admin/admin" password. This is a separate security layer, and without it, even the most careful firewall rules are meaningless—an attacker has no reason to bypass port filtering if they're already inside the network as a legitimate device.

The first thing you should do is change the default passwords for both Wi-Fi and the router's admin panel: a combination like "admin/admin" or the password written on the sticker on the bottom of the device is automatically detected without any hacking. Next, consider the Wi-Fi encryption type: WPA3 is significantly more secure than the outdated WPA2 and especially WEP, and if your router and devices support it, the upgrade is worth it. Where WPA3 isn't available, at a minimum, use WPA2 with modern encryption (AES, not the outdated TKIP).

The guest network deserves special attention: if the router supports it, it's a good idea to move all guests and IoT devices there so they don't have direct access to the main computers and NAS. This complements the VLAN segmentation discussed above, but is available even on budget routers without complex configuration.

It doesn't replace a firewall, but rather works in conjunction with one: the firewall controls what can be done inside and outside the network, while Wi-Fi and router security controls who can actually access the network.

Even when a firewall is generally configured, it's easy to negate its usefulness with a few careless decisions. Here are the most common mistakes.

• Disabling the firewall completely for the sake of convenience. A classic example: something doesn't work the first time, the firewall is temporarily disabled to test, and then forgotten to be turned back on. As a result, the network goes months without basic protection, just for a one-time problem that might not have been the cause at all.
• Overly broad permission rules. Instead of a precise rule like "allow access from a specific address to a specific port," they use a rule like "allow everything from any address" because it's faster and doesn't break anything. The rule really doesn't break anything—it just stops being a rule.
• Ignoring IPv6. Many people continue to configure their firewall only for IPv4, forgetting that IPv6 is already enabled by default for most providers and devices. As a result, IPv4 rules can be strict, while existing IPv6 traffic is not filtered at all.
• Lack of event logs. Without logs, it's impossible to understand what's happening on the network: which connections are being blocked, which devices are behaving unusually, or whether there's been an intrusion attempt. A firewall without logging works, but remains completely silent.
• Conflicting router and OS rules. A router rule allows the connection, but the firewall on the device itself blocks it, or vice versa—and as a result, it's unclear where to look for the cause when something isn't working as intended. Settings at different levels should be consistent and at least roughly documented.

Most of these errors have one thing in common: they don't look like a mistake at the time. The setting is made once, appears to work, and is forgotten—until it turns out that it opened unnecessary access or concealed the real problem.

Mistakes that create a false sense of home network security include the belief that NAT can prevent network attacks or device compromise.

Additional risks arise from the lack of network segmentation, where IoT devices, guest connections, and primary connections are all on the same subnet. An equally common situation is firewall rules that are configured once and not updated when new devices are added.

Other mistakes include relying on router factory settings without checking open ports, focusing only on incoming rules while ignoring outgoing traffic, and using outdated OS versions with known vulnerabilities in the firewall implementation.

The firewall is technically enabled, and the interface displays a green checkmark—but in reality, a specific rule or forgotten setting is merely a decorative element. That's why periodic configuration testing is just as important as the initial setup itself.

A configured firewall is a hypothesis, not a fact. Verifying that the rules are actually working as intended can only be done by external testing, not by relying solely on the settings in the interface.

• Using online services and local utilities. External port scanners show how the network appears from the internet, while local utilities like nmap show what's visible from within the network, between devices. Both views are useful and reveal different things.
• Checking rules after updates. Updating your router firmware or operating system sometimes resets some settings to default values. After any major update, it's worth re-running your key rules to ensure nothing has been reset.

None of these methods replaces the others—a port scanner won't reveal what was happening on the network a week ago, and logs won't tell you what's visible externally right now. Only together do they provide a complete picture.

You should test your firewall from outside your home network, for example, via mobile internet or an external server. Specifically, you should scan the public IPv4 address and separately check IPv6, if used. You should also review the list of open ports, UPnP rules, forwarding, and router logs. After each change, ensure that the required services are running and that unnecessary ones are unavailable externally.

Regularity is more important here than the depth of a single check: a quick monthly audit of ports and logs is more useful than a one-time, exhaustive configuration review that is then forgotten for a year.
If we were to boil down everything written above into a single list of actions, we would get the following checklist:

• update firmware;
• enable firewall;
• block unnecessary incoming connections;
• limit outgoing connections if necessary;
• disable UPnP and remote control;
• close unused ports;
• check logs regularly;
• periodically test open services.

The first steps—updated firmware and an enabled firewall blocking unnecessary incoming connections—are most effective: this blocks most typical attacks with almost no effort. However, this isn't a one-time setup: networks change, firmware resets rules, and ports are forgotten—so periodic testing is just as important as the initial setup.

And a firewall isn't the whole solution, it's just part of it. Equally important are updates, strong passwords, WPA3, and network segmentation—especially placing IoT devices in a separate segment isolated from the main data.