What a proper small-business router and firewall build looks like

Last reviewed: 18 July 2026

The box your internet provider sent you was built to a price. It gets one network online and that's the whole job. Once you have an office full of staff, a file server, desk phones and visitors wanting the WiFi password, that box is the weakest thing in the building. This page walks through what we actually put in when a small business asks for a proper network: one capable router doing the security work, instead of a pile of gadgets taped together.

Why the ISP box runs out of road

Every device on a default ISP router sits on one flat network. Your accounts PC, the server with your job files, the EFTPOS terminal, the smart TV in the lunchroom and a visitor's laptop can all see each other. If one of them picks up something nasty, nothing stands between it and the rest.

The ISP box also can't do much about it. The firewall settings are shallow, the vendor controls the firmware, and when the connection drops your whole business drops with it. Fine for a house. Not fine for a payroll run.

One capable router, not five gadgets

The fix is not more boxes. It's replacing the ISP router with one business-grade router/firewall and letting it do four jobs at once: internet failover, network separation, call quality, and remote access. One device to configure, one device to back up, one place to look when something misbehaves.

Two internet connections, one brain

A proper router has more than one WAN port, so a second connection — typically a 4G/5G service — sits behind your main one and takes over when the NBN drops. We've covered when failover makes sense (and when load balancing doesn't) in our dual WAN guide, so the short version here: the capable router is what makes failover automatic instead of someone crawling behind a cabinet swapping cables.

Separate networks: the part that actually protects you

This is the heart of the build. The router carves your one physical network into several logical ones — VLANs — and polices the traffic between them:

• Office — staff PCs and laptops. Can reach the server and the internet, nothing else.
• Servers — the file server, backup box, anything holding business data. Accepts connections from the office network on the specific services staff need, and that's all.
• Phones — handsets and the phone system, walled off on their own segment.
• Guest — visitors and staff phones. Internet only. No path to anything of yours.

The payoff shows up on a bad day. A staff laptop that picks up malware from an email can hammer away all it likes; the firewall rules between segments mean it can't reach the EFTPOS gear, can't crawl the server shares it was never allowed to see, and can't touch the phones. You've turned "the whole business is infected" into "one laptop needs rebuilding".

Guest WiFi stops being a risk decision too. Hand out the password freely — the guest segment was designed on the assumption that everything on it is untrusted.

Voice gets a lane

VoIP calls fall apart in a way file downloads don't. A download that pauses for two seconds finishes two seconds later; a phone call that pauses for two seconds sounds broken to the customer on the other end. A capable router prioritises voice traffic, so when someone uploads a huge file mid-afternoon, the calls stay clean and the upload takes slightly longer. Nobody notices the second part. Everybody notices the first.

Remote access done on the router

Staff working from home need a path into the office network. The wrong answer is a remote-control app on the server or a port opened straight to a desktop — both are standing invitations. The right answer is a VPN terminated on the router itself: staff connect with proper credentials, the connection is encrypted, and the router's firewall rules still apply — a home laptop gets exactly the access an office laptop gets, and nothing more. One thing to audit, one thing to switch off when someone leaves.

MikroTik or pfSense?

Two platforms cover almost every small-business build we do:

• MikroTik — router hardware with a serious operating system at a modest price. Suits most offices: compact, low power, and happy doing dual WAN, VLANs, voice priority and VPN all day. The trade-off is an interface with a learning curve; it's a tool for whoever maintains your network, not a Saturday-afternoon project.
• pfSense — open-source firewall software that runs on a small dedicated box. Suits sites with heavier demands: lots of VPN users, stricter inspection, or a business that wants deeper visibility into what's crossing the firewall. More grunt, a bigger box, more to administer.

Both are proven, both are maintained, and both cost far less than the enterprise names while doing the jobs above properly. The honest answer to "which one" is: whichever your IT provider knows inside out, because a well-maintained MikroTik beats a neglected pfSense every time — and vice versa.

What it costs, roughly shaped

The hardware is the small part — typically less than a single desk PC. The real investment is the design and setup time: mapping what you have, deciding who may talk to what, and testing failover before you need it. After that it's a stable, low-touch piece of the network that runs for years. Compare that with one afternoon of the whole office offline, or one incident that hops from a laptop to the server, and the build pays for itself the first time it earns its keep.

The short version: The ISP-supplied router puts your whole business on one flat network with no fallback. One capable router/firewall — MikroTik for most offices, pfSense where demands are heavier — gives you automatic internet failover, separated networks so a compromised device can't reach everything, clean phone calls under load, and remote access that's actually controlled. The hardware is cheap; the design is the value.

General guidance only — every network is different, so get a professional to design and verify yours before relying on it.