Firewall types compared for your business

For a small site without its own servers or remote access, the firewall function built into the router is often enough. Once several network segments, VPN access, cameras or a guest network come into play, a dedicated firewall appliance is needed, and with higher risk a UTM or next-generation system. Which class fits depends less on budget than on the number of segments, how critical the systems behind it are, and who maintains the rule set over time.

The three classes at a glance

A router with a firewall function, a dedicated firewall appliance, and a UTM or next-generation firewall don't primarily differ by brand – they differ by what they're built for. An off-the-shelf router with a firewall function filters based on addresses and ports, usually within a single network with no real segmentation. A dedicated appliance is purpose-built for filtering and routing between multiple network segments and brings its own processing power for that. A UTM or next-generation system builds on that appliance and adds capabilities like intrusion prevention, application recognition or web filtering, all within a shared rule set.

• Router with firewall function: simple packet filtering, usually one network, aimed at small sites with modest requirements
• Dedicated firewall appliance: purpose-built hardware for routing and filtering between multiple segments, without the extra features of a UTM system
• UTM/next-generation firewall: an appliance plus intrusion prevention, application recognition, web filtering and central reporting in one system

Performance vs. feature set: where the difference really shows

Every additional check a firewall runs on traffic costs processing power. Plain packet filtering by address and port is cheap, which is why even simple routers often achieve passable throughput here. Once a firewall inspects the content of packets – for intrusion prevention or application recognition in a UTM system, for example – the processing load rises noticeably, and actual usable throughput with those features switched on can sit well below the advertised figure. That's not a flaw in the hardware; it's a property of the method: deeper inspection needs more processing power, regardless of vendor. When choosing a system, what matters less is a single throughput figure from a datasheet, and more the throughput with the specific features you actually plan to run switched on.

Licensing models: what's behind subscriptions vs. one-time purchase

A router with a firewall function is usually bought once, with no ongoing licence cost – in exchange, its filtering stays at basic-feature level. Dedicated appliances and UTM systems usually split the hardware, bought once, from the running services, which are subscription-based: signature updates for intrusion prevention, current categories for web filtering, threat data for application recognition. If that subscription lapses, the hardware keeps working, but the security-relevant features go stale – a point that's easy to miss during budget planning because it only becomes visible after the purchase.

• Hardware purchased once; security services (signatures, categories, threat data) usually run on an active subscription
• Clarify subscription term and auto-renewal before buying, not at the first invoice
• Check which features still work without an active subscription, and which don't

Maintenance effort: who keeps the system current?

A simple router rarely needs attention, but there's also little to attend to – an occasional firmware update is usually enough. A dedicated appliance or a UTM system asks for more: regular signature updates, a rule set that grows with the number of segments, and for UTM features specifically, an occasional check that web filtering or application recognition still lets the intended services through and doesn't block legitimate ones. This effort can be handled in-house or through a support contract – what matters is that it's actually planned for, rather than fading away after installation. If you don't want to maintain the network and backup yourself alongside the firewall, it usually makes more sense to outsource ongoing management as a whole.

To size the maintenance effort realistically, think beyond the initial install to ongoing operation over several years: how often does the network change – new sites, new applications, new groups of staff – and how quickly does the rule set keep up? A UTM system loaded with features doesn't help much if nobody looks at it again after setup. Conversely, a powerful appliance isn't worth it if there's no internal time to maintain it – a support contract with an external partner is then often the more realistic answer than reaching for the next bigger box.

When is a router firewall enough?

For a single small site with no servers of its own, no cameras, and no remote access for staff, a good router firewall can be enough – provided it isn't left untouched forever. But as soon as a guest network needs to be separated from the business network, a camera system is added, or staff access via VPN, real segmentation becomes necessary, which a simple router usually can't deliver cleanly.

When do you need a dedicated appliance or a UTM system?

With multiple network segments, multiple sites, or systems whose failure would genuinely stop operations, a dedicated appliance becomes a sensible foundation. Whether you also need UTM features like intrusion prevention or web filtering depends on the risk: businesses handling sensitive customer data, running several distinct user groups on the network, or regularly allowing remote access, benefit from the extra inspection. A business running a purely self-contained production network with no internet access for the machines on it often doesn't need that depth in full – that's also part of an honest assessment.

Another indicator is the number of sites that need to be connected to each other. Once several branches are meant to be linked through a shared network rather than each running in isolation, you need devices that can centrally manage and secure those connections – a simple router firewall usually can't do that with reasonable effort. The rule stays the same: the right class follows from the actual structure of the business, not from whichever device happens to be the most powerful one on the market right now.

How NDVDL chooses the right firewall and runs it

NDVDL doesn't start with the device but with your business: we look on site at which network segments, sites, remote access paths and critical systems there are. That leads to a written proposal with the right device class, the subscriptions that come with it, and a reason why a bigger class isn't needed – or why it is.

After installing the firewall and setting up the segments, we look after it on an ongoing basis: updates and signatures, rule set reviews, subscription renewals and monitoring. Everything is documented, you have one fixed point of contact, and you don't have to remember when which licence expires.