Firewall Troubleshooting for a Dubai Office: Symptoms, Causes and What to Check First

Is it really the firewall? Start with the pattern, not the box

When the internet stops in an office with no IT team, the firewall gets blamed first. It is the one device everyone knows is there to block things, so when something is blocked it looks guilty. In our experience it is the cause less often than the provider's line, the Wi-Fi or a name resolution fault.

Ask three questions before touching anything. Is one person affected, one application, or everyone? Did it stop at a precise moment, or has it been getting worse for days? And did anything change: a new internet line, a new printer, a software update, a staff member who left, a renewal that fell due? The answers sort the fault into a layer, and the firewall is only one of those layers.

A useful rule: a firewall fault usually affects a category of traffic for everyone, because rules apply to the whole network or a whole zone. One laptop that cannot reach anything is rarely a firewall problem. Everyone able to browse but nobody able to use the VPN is a much better candidate. If the pattern points away from the firewall, our guide to office network troubleshooting covers the Wi-Fi and cabling side in more depth.

Firewall troubleshooting for a Dubai business: ten minutes of checks before you call anyone

None of these require logging into the firewall. They need a laptop, a phone and a look inside the comms cupboard. Do them in order and write down what you find, because the notes are exactly what your IT provider will ask for.

If everything upstream looks healthy, a site opens by address but not by name, or everyone can browse but one service is dead for the whole office, the firewall moves to the top of the list. That is the point to stop and gather evidence rather than start changing settings.

• Look at the provider's router or fibre terminal. If the internet or line light is red, off or flashing in an unfamiliar pattern, the fault is upstream of the firewall and the call goes to the ISP, not to IT.
• Look at the firewall itself: a power light, a link light on the port facing the router and one on the port facing the switch. A dark port is a cable or a dead interface, not a rule.
• Switch a phone from Wi-Fi to mobile data and open the same site or app. If it works on mobile data and not on the office network, the fault is inside the office or on its line.
• On a wired desktop, open a site by name, then one you know by its address. If the address works and the name does not, it is a DNS problem: sometimes the firewall's filter, just as often the router or the ISP's resolver.
• Check whether new devices can join. If a phone joins the Wi-Fi but shows connected with no internet, the DHCP pool may be full, which has nothing to do with firewall rules.
• Check the firewall's subscription date if anyone has the portal login or the renewal invoice. A lapsed subscription changes behaviour on many models and is the most common firewall cause we find.

When it is not the firewall: the usual suspects

The usual suspects are faults reported to us as firewall problems that turn out to be something else. Each has a quick test a non-technical person can run, and each has a different owner, which matters because calling the wrong one wastes the day.

The Microsoft case is misread so often it deserves a note. If someone cannot sign in to Microsoft 365 from the office but can from home, the instinct is that the firewall is blocking Microsoft. It is far more likely to be a Conditional Access policy or a device that has fallen out of compliance, and the message on screen usually says so. For a line fault, du and e& can see the state of your line in a way your IT provider cannot.

The firewall faults that actually recur in Dubai small offices

When the firewall is the cause, it is nearly always one of a short list. We see the same four faults across offices of five to two hundred people, and knowing them lets you ask the right question before an engineer arrives.

One smaller fault is worth a mention. SIP ALG, a feature meant to help VoIP phones through NAT, is on by default on many devices and causes one-way audio and dropped calls; turning it off fixes more phone complaints than any other single change.

The subscription lapsed

Business firewalls carry an annual subscription for threat intelligence, web filtering and support. When it expires, behaviour changes by vendor: some stop updating signatures quietly, some disable filtering, and some start blocking categories they can no longer classify, which looks like random sites failing. Because the renewal was often paid by a previous IT provider or a finance person who has since left, nobody connects the date to the symptom.

A rule was changed and nobody wrote it down

Someone allowed a port for a new CCTV recorder, tightened web filtering after a phishing scare, or blocked a streaming site, and a week later the accounting software stopped syncing or the card terminal lost its connection. The change was reasonable; the side effect was not predicted, and because it was not recorded, the link between the two is lost. This is the fault that takes longest to find and is the easiest to prevent.

Remote access broke after the line or address changed

VPN and remote desktop depend on the office's public address. When the ISP changes a line, swaps the fibre terminal, moves the office to a dynamic address or puts it behind carrier-grade NAT, every rule that pointed at the old address stops working. Staff working from home notice first, usually on a Monday morning. The fix is simple, but only if someone knows the address changed; the symptom alone looks like a dead VPN service.

The device is too small for the line it is now on

Offices upgrade their internet line and keep the firewall sized for the old one. With inspection enabled, a firewall's real throughput can be a fraction of its headline figure, and the office pays for a fast line it never sees. The symptom is slowness nobody can pin to a time of day, stalled downloads under load and video calls that degrade when the office is full. The sizing logic is in our firewall installation guide; the troubleshooting clue is that the slowness disappears when the office is quiet.

Why switching it off to test is dangerous

At some point someone will suggest bypassing the firewall to see if the problem goes away. It feels like a clean experiment. It is not, for three reasons.

First, it exposes the office. With the firewall out of the path, every device sits on the internet with only its own operating system's protection, and anything reachable from outside is now reachable without inspection. Scanning of UAE address space is constant, and a few minutes is enough for an exposed remote desktop port to be found. The UAE Cyber Security Council publishes guidance for small organisations for exactly this reason: the perimeter control is not optional, even briefly.

Second, it rarely isolates the fault. Removing the firewall also removes its DHCP, DNS, NAT and VPN roles, so devices lose their addresses, names stop resolving and remote staff drop off. Whatever happens next says little about the original problem. Third, putting it back is not always clean; the office can spend the afternoon on a self-inflicted outage.

If an engineer genuinely needs to test with the firewall out of the path, it is done for a single device, on a single port, for a few minutes, with the rest of the office still protected.

What to send your IT provider so the fix is fast

The difference between a one-hour fix and a two-day one is usually the quality of the first message. Internet not working, please check firewall, leads to a visit, a round of questions and a second visit. A message that answers the questions in advance often leads to a remote fix:

Photographs help more than people expect. A photo of the comms cupboard with the lights visible lets an engineer spot a dark port, an unplugged cable or an unfamiliar device before leaving their desk. If you have the network diagram from the original installation, attach it.

• Who is affected: one person, one department, one floor, everyone, or remote staff only.
• What is affected: all internet, one site or app, VPN, printing, phones, a card terminal. Name the service.
• Since when: the first time anyone noticed, as precisely as possible, and whether it is constant or intermittent.
• What changed in the past two weeks, however unrelated it seems: a new line, a new device, a tidy-up, a renewal, a leaver.
• What you have tried: the checks above and their results, including the lights on the router and the firewall.
• The exact error: a photo of the screen, the block page or the message in the app. The word error on its own is not an error.
• Access: who holds the firewall login and the ISP account details, so the engineer is not waiting for a password while the office is down.

Documentation that prevents the next one

Nearly every firewall fault we are called to has one root cause behind the technical one: nobody could say what the firewall was supposed to be doing. Rules without comments, an address nobody wrote down, a renewal date in a departed colleague's inbox. Documentation converts a half-day investigation into a five-minute lookup.

This is the same discipline the CIS Critical Security Controls describe under inventory and secure configuration, scaled down to what a small office can maintain. Our network documentation guide covers the full set; for the firewall, the rule list, the renewal date and the change log matter most.

• A rule list with a one-line reason for every rule and the date it was added. A rule with no reason is a candidate for removal.
• The public address or addresses, the ISP account number and the support line, in one place the office manager can reach.
• The subscription and licence renewal dates in a shared calendar, with a reminder a month ahead and a named owner.
• A simple diagram showing the ISP equipment, the firewall, the switch and the access points, with which port connects to what.
• A change log: date, who, what changed, why. Three lines per entry is enough, and a note of where the configuration backup lives.

The honest boundary: what an IT provider fixes and when the vendor must be involved

A general IT provider like us handles most firewall problems: licence renewals, rule corrections, address changes, remote access rebuilds and replacing a device that is too small. We do this as part of network and Wi-Fi work, and as part of a wider cybersecurity review when the fault has exposed a gap. Remediation of this kind sits within our normal project range of AED 2,500 to AED 30,000 depending on what is found.

There is a boundary, and it is worth being clear about it. When the device itself is faulty, when a firmware release has a known bug, or when a feature contradicts the vendor's own documentation, the vendor's support has to be involved. They hold the firmware, the hardware replacement process and the engineering escalation path. A good IT provider knows where that line is, opens the vendor case with the evidence already gathered, and stays on it so the office is not left managing a ticket it did not raise. We do not claim partner status with any firewall vendor; what we bring is the diagnosis, the configuration and the follow-through.

If your office is in the middle of a problem now, run the ten-minute checks, write down the results and send them to us. If it is not, the better time to read the documentation section is before the next one.

Frequently asked questions

Written by Srinivasan Ramachandran, Founder, Listonics · Published Oct 7, 2026 · Last reviewed October 11, 2026 · 2,682 words