How to Set Up a Firewall: 6 Steps for Home and Business

Updated September 2026. We rewrote this guide with current steps for Windows, macOS, Linux and home routers, plus a six-step process for business firewalls based on NIST SP 800-41, CIS Controls v8.1 and recent CISA guidance. Outdated vendor quotes and a 2019 Gartner prediction were removed.

A firewall decides which network traffic is allowed in and out, based on rules you set. Setting one up well comes down to three ideas: block everything you don’t need, protect the firewall itself, and keep the rules and firmware up to date. This guide starts with the quick setup most people need, then walks through a full configuration for an office or business network.

Firewalls also need protecting themselves. Verizon’s 2026 Data Breach Investigations Report found that exploited vulnerabilities were the most common way attackers got in, at 31% of breaches, and VPNs, firewalls and other edge devices were frequent targets (Verizon DBIR). A badly configured or unpatched firewall can become the way in.

Quick answer: how to set up a firewall

1. Turn on the firewall that’s already there. Windows, macOS and most Linux distributions include one, and every home router has a basic one.
2. Update firmware and change default passwords before the firewall goes live.
3. Set a default-deny rule for incoming traffic and allow only the services you need.
4. Close remote admin access from the internet, or restrict it to a VPN and specific IP addresses.
5. Turn on logging so you can see what gets blocked and spot problems.
6. Test the rules, back up the configuration and review it on a schedule.

Set up the firewall on your computer

Host-based firewalls protect a device even on hotel, airport or coffee-shop Wi-Fi. CIS Controls v8.1 lists them as basic safeguards for both servers (4.4) and end-user devices (4.5), with a default-deny approach (CIS).

Windows 11

1. Open Start, search for Windows Security and select Firewall & network protection.
2. Check that the firewall is On for Domain, Private and Public networks.
3. Mark untrusted networks (like public Wi-Fi) as Public. Windows applies stricter rules to that profile.
4. Use Allow an app through firewall only for apps you trust and recognize. Remove old entries you no longer use.

Microsoft’s Windows Security firewall guide explains each setting. Businesses usually manage these rules centrally with Intune or Group Policy instead of on each PC.

macOS

1. Choose Apple menu > System Settings > Network > Firewall and turn it on.
2. Click Options. Turn on stealth mode so your Mac doesn’t answer probes such as ping.
3. For maximum protection on untrusted networks, choose Block all incoming connections. Turn it off again if you need file or screen sharing.

See Apple’s guide to blocking connections with the macOS firewall.

Linux (Ubuntu and Debian with UFW)

UFW (“uncomplicated firewall”) is a simple front end for the Linux packet filter. On a server you reach over SSH, allow SSH before you enable the firewall so you don’t lock yourself out:

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
sudo ufw enable
sudo ufw status verbose

Add rules only for services the machine actually offers, such as sudo ufw allow 443/tcp for a web server. Ubuntu’s firewall documentation covers more options.

Set up the firewall on your home router

Your router’s built-in firewall blocks unsolicited traffic from the internet by default. Most of the work is closing the extra doors manufacturers leave open. The NSA’s home network guidance recommends the same basics:

• Log in to the router’s admin page or app, update the firmware and turn on automatic updates if available.
• Replace the default admin password with a long, unique one.
• Turn off remote management (admin access from the internet), UPnP and WPS unless you have a specific need.
• Remove old port-forwarding rules. Each one exposes a device inside your network.
• Put smart-home devices and visitors on a guest network so they’re separated from your computers.
• Replace routers that no longer get security updates. In 2025 the FBI warned that criminals were taking over end-of-life routers and renting them out as proxies for cybercrime (FBI IC3).

For Wi-Fi settings such as WPA3, see our guide to wireless network security.

How to configure a business firewall in 6 steps

These steps apply to any network firewall, whether it’s a hardware appliance, a virtual firewall or a cloud firewall. They follow the lifecycle in NIST SP 800-41, the U.S. government’s firewall guidance (NIST). If you’re still choosing a device, our comparison of hardware vs. software firewalls explains the trade-offs.

Step 1: Secure the firewall itself

• Install the latest firmware before connecting it to production, and subscribe to the vendor’s security advisories.
• Delete or disable default accounts and replace default passwords.
• Give each administrator a named account with only the permissions they need, and require multi-factor authentication for admin logins.
• Allow management only from an internal management network or VPN, never from the open internet. CISA’s Binding Operational Directive 23-02 requires federal agencies to remove internet-exposed management interfaces for this reason (CISA).
• Turn off unencrypted management protocols such as Telnet and plain HTTP. Use SSH and HTTPS.

Step 2: Plan zones and IP addressing

Group systems into zones based on how sensitive they are and who needs to reach them. A typical layout:

• Internet-facing (DMZ): public web servers, mail gateways and similar systems.
• Internal servers: databases, file servers and business applications. Databases shouldn’t be reachable directly from the internet.
• User networks: employee laptops and desktops.
• Guest and IoT: visitors, cameras, printers and other devices that are hard to secure.
• Management: the network your admins use to manage infrastructure.

Assign each zone its own subnet and VLAN, then map zones to firewall interfaces. More zones mean better separation but more rules to maintain, so start simple.

Step 3: Write access rules (ACLs) with default deny

• End every rule set with an explicit deny all rule, and log what it blocks.
• Make each allow rule as narrow as possible: specific source, destination and port. Avoid “any-any” rules.
• Filter outbound traffic too. Limiting which systems can reach the internet, and on which ports, makes it harder for malware to call home or send data out.
• Add a short comment to every rule saying who asked for it, why and when it should be reviewed.

Step 4: Turn on security features and logging

Most current firewalls are “next-generation” firewalls that can do more than filter ports: application control, intrusion prevention (IPS), web filtering and TLS inspection. Turn on what you’ll actually monitor, and disable services you don’t need, such as a DHCP server when another device already does that job. Send logs to a central log server or SIEM and sync the clock with NTP so timestamps line up during an investigation. If you handle card data, PCI DSS 4.0.1 has specific rules for network security controls and logging.

Step 5: Test before and after going live

• Scan from outside your network to confirm only the expected ports are open. Nmap is the standard free tool; see our list of cybersecurity tools for others.
• Test from each internal zone to confirm traffic between zones is blocked where it should be.
• Include the firewall in penetration tests and vulnerability scans.
• Back up the working configuration to a secure location so you can restore it quickly after a failure.

Step 6: Manage it in production

• Patch quickly. Firewalls and VPN gateways are prime targets. In September 2025 CISA issued Emergency Directive 25-03 ordering federal agencies to find and fix compromised Cisco ASA and Firepower devices after attackers exploited zero-day flaws (CISA). Check CISA’s Known Exploited Vulnerabilities catalog for your firewall model.
• Review rules on a schedule, at least every six months. Remove unused, duplicate and overly broad rules.
• Use change control: every change should be requested, approved, documented and reversible.
• Watch the logs for repeated blocked connections, unexpected outbound traffic and admin logins.
• Replace end-of-life hardware before vendor support ends.

Common firewall setup mistakes

For more settings to check, see our guide to the best firewall settings. A firewall is one control among many; our cybersecurity controls and cybersecurity checklist guides show where it fits. To keep up with new firewall and VPN vulnerabilities as they’re disclosed, sign up for the CyberExperts Daily Brief, a short weekday email.

Frequently asked questions

Sources

• NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy: csrc.nist.gov
• CIS Critical Security Controls v8.1 (Safeguards 4.4 and 4.5): cisecurity.org
• Verizon, 2026 Data Breach Investigations Report: verizon.com
• CISA, Binding Operational Directive 23-02: Mitigating the Risk from Internet-Exposed Management Interfaces: cisa.gov
• CISA, Emergency Directive 25-03: Identify and Mitigate Potential Compromise of Cisco Devices: cisa.gov
• CISA, Known Exploited Vulnerabilities Catalog: cisa.gov
• NSA, Best Practices for Securing Your Home Network (2023): media.defense.gov
• FBI IC3, Cyber Criminal Proxy Services Exploiting End of Life Routers (May 2025): ic3.gov
• Microsoft, Firewall and network protection in the Windows Security app: support.microsoft.com
• Apple, Block connections to your Mac with a firewall: support.apple.com
• Ubuntu Server documentation, Firewalls: documentation.ubuntu.com

George Mutune

I am a cyber security professional with a passion for delivering proactive strategies for day to day operational challenges. I am excited to be working with leading cyber security teams and professionals on projects that involve machine learning & AI solutions to solve the cyberspace menace and cut through inefficiency that plague today's business environments.