In short
Managed firewall services cover choosing the right firewall, setting it up, writing and cleaning up its rules, segmenting the network with VLANs, hardening the device and looking after it afterwards. CybUp is vendor-neutral and delivers firewall management services remotely to companies anywhere: new set-ups, configuration reviews and rule optimisation on FortiGate, pfSense, MikroTik and similar devices.
What is a firewall and why does a company need one?
A firewall is the device or software that decides which traffic may pass between your company network and the internet, and between the different parts of your own network. A connection that is not allowed cannot get in, and it cannot get out either.
A company needs one because the router your internet provider supplies was not built for this job. It shares out the connection; it does not control who can reach which server, keep the guest Wi-Fi apart from the accounting server, or govern how branches and remote staff connect to head office. A properly configured firewall handles all of that and records what happened in its logs. We review your current set-up free of charge and tell you in writing what you need.
What does firewall consulting cover?
Firewall consulting covers the whole life of a firewall, from choosing the right device to keeping the rules in order years later. For a company opening a new office it means a needs assessment and a firewall installation from scratch. For a company that has run the same device for years it means reviewing the existing firewall configuration, clearing out redundant rules and closing gaps.
Some firewall installers are tied to one vendor and answer every question with the same box. We are vendor-neutral. The choice comes down to your user count, internet lines, branch layout, remote access needs and how much your team can realistically manage.
- Needs assessment and vendor/model selection
- New installation or migration from an existing device
- Firewall rule review and rule optimisation
- VLAN-based segmentation and guest network separation
- Hardening of management access and firmware
- Logging, monitoring and scheduled maintenance
Which firewall should I buy?
The short answer: one that meets your needs and that your team can actually manage. A few typical cases make this clearer.
Companies with several branches that want security services such as IPS, web filtering and application control in one interface often choose FortiGate; those security services come as an annual subscription. If you want flexibility, an open-source base and a free hand in choosing hardware, pfSense is a strong option. In small offices and branches, MikroTik devices handle routing and basic firewalling economically, although they take more know-how to configure. Sophos, Palo Alto and Check Point are also on the table, each with its own strengths.
When sizing a model, ignore the headline “firewall throughput” figure on the datasheet and look at the figure with IPS and SSL inspection switched on. Once those services are enabled, real capacity drops noticeably. We work through these numbers with you at the selection stage and give a reasoned recommendation as part of the free review.
How do you configure a firewall properly?
A sound firewall configuration starts from default deny: only the traffic you need is allowed and everything else is dropped. Netgate’s firewall rule best practices for pfSense recommend the same approach, and the principle holds for every vendor.
In practice every rule has a source, a destination, a service and a description. Instead of an “anything from LAN to anywhere” rule, the user network gets the ports for web, email and business applications, and servers are reachable only on the ports they need. Every service exposed to the outside (VPN, web server, remote desktop) has to justify itself. We do not recommend exposing RDP directly to the internet; remote access goes through a VPN.
The last step of an installation is documentation. At handover you keep the rule table, address objects, VLAN plan and management access details in writing. If another team takes over tomorrow, they should be able to see what is open and why.
“A default deny strategy for firewall rules is the best practice. Firewall administrators should configure rules to permit only the bare minimum required traffic for the needs of a network, and let the remaining traffic drop with the default deny rule built into pfSense® software.”
Why do firewall rules need reviewing and optimising?
Because firewall rules pile up and nobody deletes them. A port opened for a project stays open after the project ends; an old server’s IP is handed to a new device and the old rule still lets traffic through to it. The pfSense documentation illustrates this with the “we removed that server six months ago” example and recommends reviewing rules at regular intervals.
Take a distribution company with 120 users and three branches. Over four years nearly 300 rules have built up on its FortiGate. Some get no traffic at all, some never match because a broader rule above them shadows them, and a few are “any-any”. A rule review starts with hit counters and logs. Unused rules are disabled first, watched for a while and only then deleted. Broad rules are narrowed and similar rules are merged with address and service groups. The result is a shorter rule table that is easier to read and to audit.
“The shorter a ruleset, the easier it is to manage. Long rulesets are difficult to work with, increase the chances of human error, tend to become overly permissive, and are significantly more difficult to audit.”
How does network segmentation improve firewall security?
Segmentation stops an attacker who compromises one device from spreading across the whole network. Users, servers, guest Wi-Fi, IP cameras, printers and management interfaces go into separate VLANs, and traffic between them is controlled by firewall rules.
The Personal Data Security Guide issued under KVKK, Türkiye’s Personal Data Protection Law (Law No. 6698), also gives restricting access between network components, or separating them, as an example measure where personal data is processed. An accounting or HR server sitting in the same broadcast domain as the guest network is, from this point of view, an easy gap to fix.
What does firewall hardening involve?
The firewall is a target in its own right; critical vulnerabilities are published from time to time in the management and SSL VPN interfaces of security appliances. Hardening starts by shutting off internet access to the management interface, so the device is managed only from specific IPs or a separate management VLAN. The default admin account is disabled, and named personal accounts are used instead, with two-factor authentication where possible.
Unused services are switched off, firmware is upgraded to the vendor’s recommended stable release and one person is made responsible for tracking updates. On MikroTik this means allowing access to the device only from the LAN in the RouterOS input chain; on FortiGate the same result comes from local-in policies and trusted hosts. For a fuller checklist, the CIS Benchmarks provide reference configurations for most vendors.
What does a firewall security audit check?
Our audit is a configuration review of your existing device; it is not a certified compliance audit or a penetration test. We go through the rule table, NAT and port forwarding, VPN settings, management access, firmware version, logging and backup status one by one.
You end up with a list of findings ranked by risk and a recommended change for each. If you prefer, we apply the changes during a maintenance window. Pairing the review with a vulnerability scan of your external surface gives a definite answer to “is the port we think is closed actually closed?”
What do our managed firewall services include?
Our managed firewall services keep the device maintained after installation: planned firmware updates, configuration backups, tracking licence and subscription expiry dates, applying new rule requests through change records and reviewing the rule table at set intervals.
Collecting logs in one place and spotting anything unusual is part of maintenance too. Events such as a line outage, high CPU load or a VPN tunnel dropping can be fed into Zabbix monitoring. These firewall management services are delivered over secure remote access for companies anywhere; when hardware has to be installed, we work on site anywhere in Türkiye.
Does Turkish Law No. 5651 require firewall logs?
If your company provides internet access to staff or guests in Türkiye, the access record obligation in Law No. 5651 may apply to you, and the firewall is where those records are collected. Article 2 of Law No. 5651 defines a “collective use provider” as anyone who gives people the means to use the internet at a particular place for a particular period. Article 7 requires all collective use providers, commercial or not, to take the measures set by regulation for keeping access records of that use.
How long and in what form the records must be kept is set out in the implementing regulation, so confirm with your legal adviser which obligations apply to your company. On the technical side, we send the firewall’s DHCP, user session and traffic logs to a central log server outside the device and protect them against tampering. Putting guest Wi-Fi on its own VLAN behind an authenticated captive portal also makes it easier to match an IP address to a user later.
What you receive
- A reasoned vendor and model recommendation (for new installations)
- An installed, hardened firewall running the current stable firmware
- Annotated rule table, VLAN and IP plan
- Configuration review report and findings list for existing devices
- Before/after comparison of the rule optimisation
- Configuration backup and management access document
How we work
- 1
Free review
We talk through your network, your current device and your requirements, review an export of the existing configuration and send a written quote.
- 2
Design
The rule logic, VLAN plan, remote access method and management access are agreed on paper and sent for your approval.
- 3
Installation or clean-up
The new device is configured or the existing rules are reworked; cutover happens in a maintenance window that does not interrupt work.
- 4
Testing and verification
User and server access is tested, and the external IPs are scanned to confirm that only the planned services are open.
- 5
Documentation and maintenance
Documentation is handed over; if you wish, periodic maintenance and rule reviews are scheduled.
Frequently asked questions
What does firewall consulting include?
It covers needs assessment and device selection, installation, writing and cleaning up rules, segmentation, hardening, logging and periodic maintenance. Depending on what you need, a review of the existing configuration can also be a consulting engagement on its own.
Which firewall brand should we choose?
It depends on your user count, branch layout, the security services you want and who will manage the device. FortiGate, pfSense, MikroTik and Sophos each have scenarios where they fit. In the free review we listen to your requirements and give a reasoned recommendation.
Can you clean up our existing firewall without replacing it?
Yes. If your device is still within vendor support and has enough capacity, there is no need to buy a new one. We carry out rule optimisation, hardening and segmentation on the existing device.
Will the internet go down during installation?
There is a short outage at the moment of cutover. We schedule it outside working hours or at the weekend and work with a quick rollback plan to the old configuration. Rule clean-up work can usually be done without any downtime.
Does a firewall security audit replace a formal audit?
No. What we do is a configuration review that produces a technical findings report. When a certified audit or a penetration test report is required, that work is carried out by authorised organisations; our report can be used to prepare for it.
Do you work remotely?
Yes. Reviews, rule clean-ups and ongoing management are done over secure remote access, for companies in Türkiye and abroad. For installations that involve mounting new hardware or cabling, we work on site anywhere in Türkiye; most of the design and configuration is still done remotely.
Can you do this for a company outside Türkiye?
Yes. Configuration reviews, rule optimisation and managed firewall services are delivered over secure remote access, and our team works in English. For a new installation, your own staff or local supplier mounts the device and we configure it remotely.
Do we need a firewall maintenance and support contract?
It is not mandatory, but we recommend it. Critical vulnerabilities in security appliances are published regularly, and a missed firmware update is a direct risk. Maintenance covers updates, backups, licence tracking and periodic rule reviews.
What should we look for in a managed firewall services provider?
First, check that the provider is vendor-neutral; one tied to a single brand will recommend the same box for every need. Second, it should size models on throughput measured with IPS and SSL inspection switched on. Third, it should hand over an annotated rule table, a VLAN plan and management access documentation. Fourth, it should offer a maintenance plan for firmware updates and periodic rule reviews. That is how CybUp runs firewall projects.
What drives firewall pricing?
On the hardware side it comes down to the number of users and internet lines, the throughput you need with IPS and SSL inspection switched on, the annual UTM licences for services such as IPS, web filtering and antivirus, and whether high availability (HA) calls for a second unit. On the service side it depends on the scope: the number of branches and VPNs, the VLAN design, the size of the current rule table and whether the job is a new set-up or a clean-up. We send a written quote after reviewing the scope; the review is free.
Sources and official documentation
- Netgate pfSense: Firewall Rule Best Practices
- MikroTik RouterOS: Building Advanced Firewall
- CIS Benchmarks
- KVKK: Personal Data Security Guide (Technical and Administrative Measures), April 2025, in Turkish
- Law No. 5651 on Regulating Internet Publications and Combating Crimes Committed Through Them (mevzuat.gov.tr, in Turkish)