Firewall Installation for a Dubai Office: What a Proper Setup Actually Involves

Why the provider's router is not a firewall

Every Dubai office has one: the router supplied with the du or e& line, doing NAT, handing out addresses and passing traffic. It has a feature called a firewall in its menu, and it is not one in any useful sense. It does not inspect what passes through, cannot separate the office into zones, has no intrusion prevention, does not filter web content, and reports nothing. It was built to make the line work, and it does.

A business firewall does the opposite job: it decides what is allowed, inspects what it allows, keeps different parts of the office apart, and tells someone when something is wrong. The CIS Critical Security Controls for small organisations and the CISA #StopRansomware guide both treat a properly configured firewall and network segmentation as baseline controls, not advanced ones. The installation is where those controls are created. Our network security for small business page describes the whole service; this guide is the installation itself.

Choosing the device: size to the line, not the brochure

Firewalls are sold on a throughput figure that is measured with every inspection feature switched off. The number that matters is throughput with intrusion prevention, content filtering and threat inspection enabled, which is far lower and is the figure buried further down the datasheet. Match that to the speed of the internet line with some headroom. A firewall that cannot inspect at line speed will either slow the office down or, worse, be configured with inspection turned off to make it fast again.

Beyond throughput, the choice is about support rather than features. Any of the established business vendors will do for an office of ten to a hundred people, provided the annual security subscription is kept current, firmware is updated and someone reviews the rules. A firewall from a brand the support provider does not work with daily will be configured once and never touched. Port count and Wi-Fi are secondary: the switch handles ports, and office Wi-Fi is better done with proper access points than with the firewall's built-in radio.

• Use the throughput figure with all inspection enabled, matched to the internet line.
• Choose a vendor the support provider manages every day.
• Budget the annual security subscription as part of the cost, not an extra.
• Let the switch provide ports and the access points provide Wi-Fi.

Where it goes: placement and the provider's router

The firewall sits between the provider's router and everything else in the office. The cleanest arrangement puts the provider's router into bridge mode so the firewall holds the public address and does the NAT itself; where the provider will not allow that, the router is left in place with the firewall behind it, and a single rule passes all inbound traffic to the firewall so that nothing is silently handled by the router's own settings. Either way, no device other than the firewall should be connected directly to the provider's router afterwards.

Physically, it belongs in the network cabinet with the switch, on a UPS, with its cables labelled, not on a desk behind a monitor. An office with a second internet line for failover connects both to the firewall and lets it manage the switch-over, which is a configuration item rather than a second device.

The rule set: start from deny, add with reasons

A new firewall usually arrives with a permissive default: everything inside can reach everything outside, and nothing outside can reach inside. That is a reasonable start for the outbound direction and the right one for inbound. The installation then tightens outbound by policy: content categories the office does not want, known malicious destinations, and protocols that have no business leaving a small office. Each rule added gets a comment saying who asked for it and why, because in two years nobody will remember.

Inbound is where discipline matters most. The correct number of inbound rules for a typical Dubai office is zero. Every forwarded port found on the old router, usually a remote desktop or a server reached from home, is a candidate for removal rather than migration. Where something genuinely must be reachable, it is published through a VPN or a cloud broker rather than an open port. Microsoft's Conditional Access is often the better answer for offices whose work lives in Microsoft 365, because it controls who reaches the cloud without exposing the office at all.

Segmentation: staff, guests and the things that should never talk to a laptop

The installation is the moment to stop running the office as one flat network. At minimum, three zones: staff devices, guests, and a device zone for printers, CCTV cameras, access control panels, meeting room screens and anything else with a default password and no security updates. The firewall routes between zones according to rules, which means the guest network reaches the internet and nothing else, and the device zone can be reached by the print server but cannot reach the accounts laptop.

Segmentation is done with VLANs on the switch and matching interfaces on the firewall, which is why the installation needs a managed switch rather than the unmanaged one the office probably has. Wi-Fi is mapped onto the same zones: a staff network with per-user authentication and a guest network isolated from everything. Our office network troubleshooting guide covers what goes wrong when this is skipped, and the office network setup page covers the switch and cabling side.

• Staff zone: laptops and workstations, per-user Wi-Fi authentication.
• Guest zone: internet only, isolated, with a captive portal if the office wants one.
• Device zone: printers, cameras, access control, screens; reachable only where needed.
• Optional server zone: file server or NAS, reachable from staff only on the ports they use.

Remote access: closing the door that was left open

Nearly every office we install a firewall for has at least one port forwarded to something inside, usually created years ago so an owner or an accountant could work from home. It is the exposure attackers scan for, and it is the finding we close first. The replacement is a client VPN on the firewall with multi-factor authentication, so the user proves who they are before the office sees them, or a cloud-based access service that publishes the specific application without opening the office at all.

The choice depends on what needs reaching. A file server or an accounting application on a local server wants the VPN. A team whose work already lives in Microsoft 365 or Google Workspace probably needs no route into the office; their access is governed at the identity layer, and the firewall's job is simply to have no inbound rules. Deciding this during installation, rather than leaving the old forward in place to avoid a conversation, is most of the security benefit of the whole project.

Testing: the checklist before anyone goes home

A firewall installation is finished when the tests pass, not when the lights come on. From the guest network: internet works, the office does not. From the device zone: the printer prints, the camera records, and neither can reach a staff laptop. From a staff laptop: the internet works, blocked categories are blocked, the file server is reachable, and a scan from outside shows no open ports. From home: the VPN connects with MFA, and without MFA it does not. Failover, if there is a second line, is tested by unplugging the first.

Then the human tests. Someone in accounts opens the applications they use every day, because the finance software with the odd port is the thing that breaks on Monday. The meeting room joins a call. A phone connects to the staff Wi-Fi with a personal credential. Each result is written down, because the list of what was tested is what the next engineer reads when something changes.

Documentation and the renewal that everyone forgets

Two documents leave with the installation: a network diagram showing the zones, the addresses and where each device lives, and a rule list with each rule's purpose. Both go into the office's IT documentation, and the firewall's administrator credentials go into a password manager rather than a sticky note in the cabinet. The office network documentation guide sets out the format we use.

The third item is a date. The firewall's security subscription, which drives its threat intelligence, content filtering and intrusion prevention, expires annually. When it lapses the device keeps passing traffic and stops protecting it, silently. The renewal goes in a calendar, and under a managed IT support agreement it is tracked for you along with firmware updates and periodic rule reviews.

What does a firewall installation cost in Dubai?

Two parts. The hardware and its annual security subscription are bought at the vendor's published price and listed on their own line. The installation is project work: scoping, placement, rule set, segmentation, Wi-Fi mapping, remote access, testing and documentation. Listonics quotes that as a fixed scope after a free assessment, and projects run from AED 2,500 to AED 30,000 depending on requirement. A single small office with a straightforward line sits at the lower end; multi-site, dual-line or server-room installations sit higher.

The saving to be suspicious of is the installation that costs almost nothing because it consists of plugging the device in with its defaults. That buys a more expensive router. The value is in the rules, the segments and the tests, and those are what the fixed scope pays for. The cybersecurity for small business guide sets the firewall alongside the other controls a small office needs.

Once it is in and something misbehaves, firewall troubleshooting for a Dubai office walks through what to check before calling anyone. For small hybrid teams in mixed-use towers, where the building often supplies the line, see the Dubai Marina office IT guide.

Frequently asked questions

Written by Srinivasan Ramachandran, Founder, Listonics · Published Sep 25, 2026 · Last reviewed October 13, 2026 · 2,094 words