Carrier box or business firewall: what actually filters?
The carrier's box connects the site to the Internet. It does not hold a company's rules: who talks to the till, who administers the server, who isolates guests, who reads a log after an incident. That work belongs to a firewall someone maintains, with an owner and written rules. Fibre speed does not decide it.
Many Riviera SMBs grew up behind the box that came with the link. The day a second site, IP telephony or a line-of-business application is added, the box still 'works' without saying which doors are open. Host Technology, in Tourrettes-sur-Loup, starts from the flow inventory, not from the box model.
What a box filters
A consumer box translates addresses, offers Wi-Fi and sometimes a home firewall with tick boxes. It suits a household. In practice it mixes the director's PC, visitor Wi-Fi and the printer, unless someone has built something else behind it. It has no log you can use six months later, and no named account for the person who opened a port.
The link itself can stay with the carrier: FTTH or FTTO, with or without 4G/5G backup. Changing firewall does not force a change of carrier. The integrator places the company device behind the handoff.
What a business firewall holds
A business firewall applies explicit rules. Host Technology places a next-generation firewall behind the carrier handoff: named rules, VLANs, a log. The guest network does not reach accounting. Voice, if telephony is IP, has its VLAN. Firewall administration is not exposed on the Internet. Each rule has a reason and a name. Logs can answer, after an incident: which machine talked outbound, and when.
ANSSI's IT hygiene guide places segmentation and logging among the baseline measures. A firewall with no owner and no log is not evidence. It is a box that is on. The 18 November 2026 article on NIS 2 says what a customer may already ask. Here we stop at the filter.
The choice is not about speed
- One box, one site, no guest Wi-Fi, no published server: the box can still be enough, until the need is written down.
- As soon as there are guests, a till, a server, IP telephony or a second network, flows are split. That is when the firewall starts.
- As soon as a supplier or an employee leaves, you need to know who can still change a rule. A shared box does not say.
- As soon as a customer asks for evidence, the log and the owner's name matter more than the speed on the brochure.
Host sizes after a visit, from Nice to Monaco. The firewall chosen is the one the team can keep over time, not the one with the most options. A rule nobody understands is a rule that will stay open.
Who changes a rule
The firewall admin account is named. It is not the everyday account, and it is not the carrier's account that delivered the fibre. When Host runs the estate, a rule change is written down: who, what, why. A port opened 'for a fix' with no close date is reviewed. The list of administrators, across equipment, is in the 15 September article.
Detection, EDR or SOC, comes after. A firewall does not see a Microsoft 365 account compromised from outside. It sees the site's flows. The two complement each other. The 15 October article separates antivirus, EDR and SOC.
Sources
ANSSI IT hygiene guide, network segmentation and logging: https://cyber.gouv.fr/publications/guide-dhygiene-informatique. The finding on boxes still sitting in front of a server or guest Wi-Fi comes from Host Technology visits. No speed figure and no market share is claimed here.
FAQ
Should we throw away the carrier's box?
No. It can stay as the handoff of the link. The company firewall sits behind it, and that is what filters internal flows.
Is a carrier business box enough?
It delivers the link and sometimes a simple filter. It does not replace written rules, VLANs and a log someone rereads.
Does the firewall slow the fibre?
A device sized for the site's speed is not felt day to day. The subject is separating flows, not chasing throughput.
Who administers the firewall?
A named account, not a password posted in the technical room. Host holds it when managed IT or the cyber contract says so.
Is the firewall enough for NIS 2?
No. It covers the site filter. Access, a tested copy and detection sit alongside it. The NIS 2 frame is covered on 18 November 2026.