Firewall Setup for Small Office Default Deny Inbound and VPN Instead of Open Ports
A firewall with open ports is a door with the key left in it. The correct office firewall setup is simple: deny everything inbound by default, and let remote staff in through a VPN - never through an open port.
By Technical AnshuWindows 10 / 11Small Office IT
Watch the complete IT security setup in the video - all four layers shown step by step
The biggest firewall mistake in small offices is not buying the wrong box. It is port forwarding - opening a hole in the firewall so someone can reach a PC, a camera system or a server from the internet. Every open port is scanned by automated bots within hours of going live, and weak passwords on exposed services are guessed around the clock. This page sets the firewall up the way it should be: default deny inbound, nothing exposed, remote access through VPN only.
WHAT THE INTERNET SEES - BEFORE AND AFTER
BEFORE Port 3389 (RDP) OPEN - bots guessing passwords 24x7
Port 8080 (camera) OPEN - default camera password
Port 445 (file share) OPEN - never acceptable
AFTER All inbound ports CLOSED - default deny
Remote staff VPN tunnel only, with MFA
Office work Unaffected - outbound stays open
Port scan results before and after the fix. Example rule list - your office ports may differ, the principle does not.
1
Set the Default - Deny Everything Inbound
Outbound traffic is what your staff creates - browsing, email, updates - and the firewall allows it by default. Inbound traffic is strangers knocking. The safe rule is default deny inbound: if no rule you wrote allows a connection in, it is refused. Most office routers already behave this way until someone adds port-forwarding rules, which is why step one is an audit, not a purchase.
Log in to the router or firewall admin page and list every port-forwarding, DMZ and remote-management rule
Delete every rule nobody can explain - an unexplained rule is a vulnerability, not a convenience
Turn OFF the DMZ host option completely; it exposes one PC entirely
Disable router remote management from the internet (WAN-side admin access)
2
Replace Open Ports With a VPN
The usual reason ports get opened is remote work - the owner wants the office PC or Tally server from home. The correct tool is a VPN: the staff member first connects into the office network through an encrypted tunnel, then uses Remote Desktop or file shares exactly as if sitting in the office. Nothing is exposed to the open internet except the VPN itself, which is built and patched for exactly that job.
Use the VPN built into your firewall or router, or a simple modern option like WireGuard or Tailscale
Give every remote user their own VPN account - never one shared login for the whole office
Turn on MFA (an authenticator code) for VPN logins wherever supported
When someone leaves the company, delete their VPN account the same day
3
Close the Back Doors Nobody Remembers
Firewalls also get bypassed quietly from inside. Old DVR and camera systems phone home through vendor cloud apps with default passwords. A forgotten second router adds a second, unmanaged door. Guest Wi-Fi bridged to the office LAN lets a visitor's infected phone reach your file server.
Change default passwords on cameras, DVRs, printers and every network device
Put cameras and IoT devices on a separate network or VLAN where your firewall supports it
Keep guest Wi-Fi strictly separate from the office LAN
Update firewall and router firmware on a schedule - the door itself gets bugs too
4
Test Your Own Door
Finish by checking yourself. From outside the office (phone data, not office Wi-Fi), confirm the office public IP shows no open services - your firewall's own logs and any port-scan tool your IT provider uses will show this. And write down every rule that remains, with the reason next to it. If a rule has no written reason, it does not stay.
Red line: never expose Windows file sharing (port 445) or an unpatched Remote Desktop directly to the internet, even for one day, even with a strong password. Ransomware gangs specifically hunt these two doors. VPN first, always.
Watch the Full Video
See the complete security setup live - firewall, endpoint, antivirus and backup, all in one video.
Will closing all inbound ports break our office work?
No. Normal office work - browsing, email, updates, cloud apps - is outbound traffic started by your own PCs, and it keeps working. Default deny only stops strangers from starting connections into your office.
We need the camera DVR visible from home. What is the safe way?
Put the DVR on the office network without any port forwarding, and view it after connecting through the office VPN. Also change the DVR admin password and update its firmware - camera systems are a favourite entry point.
Is the router from our internet provider good enough as a firewall?
For a very small office it can be a starting point if its password is changed, firmware is current, and no ports are forwarded. The moment you need VPN accounts per user, network separation or proper logs, a dedicated firewall is the honest upgrade.
This guide is based on the Complete IT Security Setup video by Technical Anshu - stuck on any step, ask in the video comments and you will get a reply.