Browse the site
Services
Who We Serve
Problems We Solve
Across India
Guides & Resources
Questions
Blog
Profiles
Company
Call Get a quote
Services · F

Do You Still Need a Firewall if Your Staff Work from Phones?

A firewall still matters, but the perimeter it defends no longer exists as a single edge. Staff work from phones, cloud applications terminate traffic far from your office, and the internal network now includes home routers and mobile hotspots. A firewall that only filters the office edge is therefore a partial control. The 2026 answer is a layered one: deny-by-default egress and ingress rules on the firewall, equivalent filtering on the cloud firewall and at the identity layer, and network segmentation that limits what a compromised laptop can reach.

Key takeaways

  • Cloud services and mobile devices have dissolved the single network edge that perimeter firewalls were designed to defend.
  • Egress filtering matters more than ingress filtering now, because malware and command-and-control traffic leave the network rather than arriving at it.
  • CERT-In requires 180 days of log retention, and firewall logs are usually the first evidence set an investigator requests.
  • The 'internal' network for most Indian SMEs includes home routers and hotspots, so segmentation must be defined by device role rather than by physical location.
  • A firewall rule review at AAVETech is fixed-price at roughly Rs 12,000 to Rs 30,000 per tester-day plus 18% GST, with a retest included.

As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.

What is the firewall actually protecting now?

Less than it used to, and the honest scope is three things. First, it constrains inbound exposure: a rule that exposes a management interface or an old line-of-business application to the internet is the kind of mistake that shows up in a penetration test every year. Second, and increasingly more valuable, it constrains egress, so that a compromised workstation cannot reach arbitrary destinations, and command-and-control traffic is visible rather than invisible. Third, it produces the log trail that a forensic investigation and a CERT-In report depend on. Anything else, such as assuming the firewall stops an attacker who has credentials, is a category error: the firewall enforces a network policy, and identity now carries most of the access decision.

How did cloud and mobile break the perimeter?

Three changes did it. SaaS moved the server side off your network, so the office firewall no longer sits between your data and the internet. BYOD and mobile hotspots put staff devices on networks you do not control, and mobile operating systems update themselves outside your patch window. And SaaS providers now publish their own allowed-IP ranges, which turns the edge firewall into a set of narrow, changeable rules rather than a perimeter. The practical consequence is that an 'internal' address range now includes a home router and a 5G hotspot. Any segmentation design that depends on an IP range meaning 'trusted' is already broken, and it should be rewritten in terms of device identity, role and managed status.

Which firewall rules should a business review first?

Work down a priority list. Any inbound rule open to 0.0.0.0/0 on a management, database or file-sharing port is a candidate for immediate closure. Any inbound rule that has been there since a migration and no longer has a matching business owner is a candidate for deletion, because unowned rules are how old exposures survive. Then look at outbound: unrestricted outbound on user subnets lets a compromised endpoint reach anywhere, which is what makes malware resale and command-and-control traffic possible. Then check logging: is traffic being recorded, is it retained for 180 days as CERT-In requires, and is it shipped to a central place the firewall administrator cannot delete? A rule that is not logged is a rule you cannot investigate.

Is a next-generation firewall worth it for a small Indian business?

Sometimes, and the deciding question is not throughput, it is what else you will have. A branch office appliance with good application visibility and a managed rule review can be worth it. But for a 20-person firm the higher-leverage purchases are a cloud-native firewall with identity-aware policies, endpoint detection and response on every laptop, and a small segmentation design that separates staff devices from servers and finance systems. AAVETech scopes that as a network penetration test plus a segmentation design, delivered as a fixed-price engagement in 5 to 10 working days, with a written report and a retest after your fixes.

Where the 2026 perimeter actually sits, by layer
LayerWhat it now protectsCommon failure
Identity layerWho the request is fromShared accounts and stale sessions
Cloud firewallTraffic into and out of cloud estatesDefault-allow rules left untouched
Edge firewallPhysical office ingress and egressUnowned legacy rules open to the internet
Network segmentationLateral reach after a compromiseTrust by IP range rather than device role
Endpoint controlsWhat runs on the deviceNo EDR, unknown executables allowed

What are the common questions about F?

Do You Still Need a Firewall if Your Staff Work from Phones?
A firewall still matters, but the perimeter it defends no longer exists as a single edge. Staff work from phones, cloud applications terminate traffic far from your office, and the internal network now includes home routers and mobile hotspots. A firewall that only filters the office edge is therefore a partial control. The 2026 answer is a layered one: deny-by-default egress and ingress rules on the firewall, equivalent filtering on the cloud firewall and at the identity layer, and network segmentation that limits what a compromised laptop can reach.
Is ingress or egress filtering more important in 2026?
Egress. Modern intrusions usually arrive through a phished credential, a malicious file or a supply-chain dependency rather than through a scanned open port, so the traffic that matters is what leaves your network to command-and-control infrastructure. Blocking unapproved egress also stops data leaving once a device is compromised.
How long should firewall logs be kept?
At least 180 days, which is the retention CERT-In requires for logs under its directions, and longer where an incident is under investigation. Firewall logs should be shipped to a central store that the firewall administrator cannot alter, which is what makes them admissible.
How do I segment a small company network that has no IT team?
Use virtual networks and host firewalls rather than physical ones. Put servers on one segment, finance and payment systems on another, office and guest devices on a third, and put the enforcement in the cloud firewall and on the endpoints. The design can be done in days and costs far less than the incident it prevents.
How much does a firewall and segmentation review cost?
At AAVETech a fixed-price network penetration test and segmentation review runs at roughly Rs 12,000 to Rs 30,000 per tester-day plus 18% GST, with a 5 to 10 working day turnaround and the retest included. Retainer clients are engaged within 4 hours for emergencies and 12 hours otherwise.
What does a good firewall rule look like?
A named business owner, a documented justification, the narrowest source and destination that works, a defined logging requirement, and an expiry date. A rule with no owner, no justification and no expiry is how an exposure from a 2019 migration is still open in 2026.

Get a straight answer on this

Send us your current firewall rule export and we will return a fixed-price rule review, a segmentation design and a written scope.

Send us the details See pricing

Last reviewed: 24 October 2026. Information on this page is general guidance, not legal advice. Prices are indicative bands for a typical scope and are confirmed in a written quote before any work begins.