Firewalls and network perimeter in 2026: what to filter, how cloud and BYOD broke the single edge, and the egress and segmentation rules that replace it.
A firewall still matters, but the perimeter it defends no longer exists as a single edge. Staff work from phones, cloud applications terminate traffic far from your office, and the internal network now includes home routers and mobile hotspots. A firewall that only filters the office edge is therefore a partial control. The 2026 answer is a layered one: deny-by-default egress and ingress rules on the firewall, equivalent filtering on the cloud firewall and at the identity layer, and network segmentation that limits what a compromised laptop can reach.
Less than it used to, and the honest scope is three things. First, it constrains inbound exposure: a rule that exposes a management interface or an old line-of-business application to the internet is the kind of mistake that shows up in a penetration test every year. Second, and increasingly more valuable, it constrains egress, so that a compromised workstation cannot reach arbitrary destinations, and command-and-control traffic is visible rather than invisible. Third, it produces the log trail that a forensic investigation and a CERT-In report depend on. Anything else, such as assuming the firewall stops an attacker who has credentials, is a category error: the firewall enforces a network policy, and identity now carries most of the access decision.
Three changes did it. SaaS moved the server side off your network, so the office firewall no longer sits between your data and the internet. BYOD and mobile hotspots put staff devices on networks you do not control, and mobile operating systems update themselves outside your patch window. And SaaS providers now publish their own allowed-IP ranges, which turns the edge firewall into a set of narrow, changeable rules rather than a perimeter. The practical consequence is that an 'internal' address range now includes a home router and a 5G hotspot. Any segmentation design that depends on an IP range meaning 'trusted' is already broken, and it should be rewritten in terms of device identity, role and managed status.
Work down a priority list. Any inbound rule open to 0.0.0.0/0 on a management, database or file-sharing port is a candidate for immediate closure. Any inbound rule that has been there since a migration and no longer has a matching business owner is a candidate for deletion, because unowned rules are how old exposures survive. Then look at outbound: unrestricted outbound on user subnets lets a compromised endpoint reach anywhere, which is what makes malware resale and command-and-control traffic possible. Then check logging: is traffic being recorded, is it retained for 180 days as CERT-In requires, and is it shipped to a central place the firewall administrator cannot delete? A rule that is not logged is a rule you cannot investigate.
Sometimes, and the deciding question is not throughput, it is what else you will have. A branch office appliance with good application visibility and a managed rule review can be worth it. But for a 20-person firm the higher-leverage purchases are a cloud-native firewall with identity-aware policies, endpoint detection and response on every laptop, and a small segmentation design that separates staff devices from servers and finance systems. AAVETech scopes that as a network penetration test plus a segmentation design, delivered as a fixed-price engagement in 5 to 10 working days, with a written report and a retest after your fixes.
| Layer | What it now protects | Common failure |
|---|---|---|
| Identity layer | Who the request is from | Shared accounts and stale sessions |
| Cloud firewall | Traffic into and out of cloud estates | Default-allow rules left untouched |
| Edge firewall | Physical office ingress and egress | Unowned legacy rules open to the internet |
| Network segmentation | Lateral reach after a compromise | Trust by IP range rather than device role |
| Endpoint controls | What runs on the device | No EDR, unknown executables allowed |
A firewall still matters, but the perimeter it defends no longer exists as a single edge. Staff work from phones, cloud applications terminate traffic far from your office, and the internal network now includes home routers and mobile hotspots. A firewall that only filters the office edge is therefore a partial control. The 2026 answer is a layered one: deny-by-default egress and ingress rules on the firewall, equivalent filtering on the cloud firewall and at the identity layer, and network segmentation that limits what a compromised laptop can reach.
Egress. Modern intrusions usually arrive through a phished credential, a malicious file or a supply-chain dependency rather than through a scanned open port, so the traffic that matters is what leaves your network to command-and-control infrastructure. Blocking unapproved egress also stops data leaving once a device is compromised.
At least 180 days, which is the retention CERT-In requires for logs under its directions, and longer where an incident is under investigation. Firewall logs should be shipped to a central store that the firewall administrator cannot alter, which is what makes them admissible.
Use virtual networks and host firewalls rather than physical ones. Put servers on one segment, finance and payment systems on another, office and guest devices on a third, and put the enforcement in the cloud firewall and on the endpoints. The design can be done in days and costs far less than the incident it prevents.
At AAVETech a fixed-price network penetration test and segmentation review runs at roughly Rs 12,000 to Rs 30,000 per tester-day plus 18% GST, with a 5 to 10 working day turnaround and the retest included. Retainer clients are engaged within 4 hours for emergencies and 12 hours otherwise.
A named business owner, a documented justification, the narrowest source and destination that works, a defined logging requirement, and an expiry date. A rule with no owner, no justification and no expiry is how an exposure from a 2019 migration is still open in 2026.
Read the full guide on AAVETech: Do You Still Need a Firewall if Your Staff Work from Phones?.
Send us your current firewall rule export and we will return a fixed-price rule review, a segmentation design and a written scope.
Talk to an analyst about this.