How to set up and configure a firewall on your business router to block unauthorised access

Summary

This guide helps you troubleshoot and resolve: How to set up and configure a firewall on your business router to block unauthorised access. Follow the steps below to fix the issue.

Common Causes

Your business router almost certainly has a built-in firewall that, when configured correctly, acts as the first line of defence between your office network and the internet. Out of the box, most routers ship with basic protection enabled, but the default rules are rarely tuned for the way Australian small businesses actually operate. Taking an hour to review and tighten those rules can block a significant amount of unwanted traffic, including port scans, brute-force login attempts, and remote access requests from unfamiliar locations.

This guide walks you through accessing your router's firewall settings, understanding the core rule types, and applying a sensible baseline configuration. The exact menu names will vary slightly between manufacturers (TP-Link, Netgear, ASUS, Ubiquiti, DrayTek, and so on), but the underlying concepts apply to virtually every consumer and small-business router on the market.

Quick Fix Steps

If you are short on time, these three actions will dramatically improve your router's security posture in under ten minutes:

1. Log in to your router's admin panel and confirm the built-in firewall is set to Enable (sometimes labelled SPI Firewall or Stateful Packet Inspection).
2. Disable Remote Management (also called Remote Admin or Web Access from WAN) so the admin panel cannot be reached from the internet.
3. Turn off UPnP unless you have a specific device, such as a gaming console or security camera, that genuinely requires it.

Once those are done, you can come back later to add more granular rules.

Detailed Instructions

Step 1: Access your router's admin interface

1. Connect a computer to your router via Ethernet cable or Wi-Fi.
2. Open a web browser and type your router's gateway address into the address bar. Common addresses include 192.168.0.1, 192.168.1.1, or 10.0.0.1. If none of these work, open a Command Prompt (Windows) or Terminal (macOS) and run ipconfig (Windows) or netstat -nr | grep default (macOS) to find the address listed as the Default Gateway.
3. Enter your admin username and password. If you have not changed them, use the defaults printed on the router label.

Step 2: Locate the firewall settings

Most routers group firewall settings under one of the following menus:

• Security → Firewall
• Advanced → Security → Firewall
• Firewall → Settings

Look for options such as SPI Firewall, DoS Protection, and Block WAN Requests. Enable anything that is currently disabled.

Step 3: Disable remote management

Remote management lets someone log in to your router's admin panel from the internet. Unless you specifically need this feature (and very few small businesses do), it should be turned off.

1. Navigate to Administration, Management, or Remote Access.
2. Set Remote Management to Disable.
3. If the option exists, also set the Remote Management Port away from the default (8080 or 8443) — but disabling the feature entirely is the safer choice.
4. Click Save or Apply.

Step 4: Disable UPnP

UPnP (Universal Plug and Play) automatically opens ports on your router when devices on your network request them. It is convenient, but it also allows malware on any device inside your network to open pathways to the internet without your knowledge.

1. Look under Advanced → UPnP or NAT Forwarding → UPnP.
2. Untick or set UPnP to Disable.
3. Save your changes.

Step 5: Review and tighten default firewall rules

Most routers ship with a default inbound policy of "block everything that isn't explicitly allowed," which is exactly what you want. Confirm this is the case:

1. In the firewall section, find Default Inbound Policy or Inbound Filter.
2. Set it to Deny All or Block All.
3. Save the change.

Next, review any existing rules. Delete anything you do not recognise or no longer need. A typical small business should only have inbound rules for services you deliberately host, such as a VPN, web server, or remote desktop gateway.

Step 6: Create rules for services you actually need

If you run services that need to be reachable from the internet, create explicit firewall rules rather than relying on broad exceptions. For each service:

1. Note the internal IP address of the device hosting the service.
2. Note the port number (for example, 443 for HTTPS, 51820 for WireGuard VPN).
3. Create a new rule with the following details:
   • Action: Allow
   • Direction: Inbound (WAN to LAN)
   • Protocol: TCP, UDP, or both, depending on the service
   • Source IP: Any (or a specific range if you know it, such as a supplier's office)
   • Destination IP: The internal IP of the device
   • Destination Port: The service port
4. Save and apply.

Step 7: Enable logging and review weekly

A firewall you never look at is only marginally better than no firewall at all.

1. Find the Logging or System Log section.
2. Enable firewall logging and, if offered, set the log to send a copy to a syslog server or an email address you check regularly.
3. Schedule a weekly 10-minute review. Look for repeated blocked connections from the same IP address, which can indicate someone probing your network.

Step 8: Save, back up, and document

1. Once everything is configured, save your settings.
2. Export the configuration file (usually under Administration → Backup/Restore) and store it somewhere safe, such as a password manager or a secured cloud folder.
3. Write a short note describing what each custom rule does and why it exists. Six months from now, you will thank yourself.
4. Schedule a quarterly reminder to review the configuration, especially after any staff or service changes.

Still Having Issues?