# Carrier box or business firewall: what actually filters?

The carrier's box connects the site to the Internet. It does not hold a company's rules: who talks to the till, who administers the server, who isolates guests, who reads a log after an incident. That work belongs to a firewall someone maintains, with an owner and written rules. Fibre speed does not decide it.

Many Riviera SMBs grew up behind the box that came with the link. The day a second site, IP telephony or a line-of-business application is added, the box still 'works' without saying which doors are open. Host Technology, in Tourrettes-sur-Loup, starts from the flow inventory, not from the box model.

## What a box filters

A consumer box translates addresses, offers Wi-Fi and sometimes a home firewall with tick boxes. It suits a household. In practice it mixes the director's PC, visitor Wi-Fi and the printer, unless someone has built something else behind it. It has no log you can use six months later, and no named account for the person who opened a port.

The link itself can stay with the carrier: FTTH or FTTO, with or without 4G/5G backup. Changing firewall does not force a change of carrier. The integrator places the company device behind the handoff.

## What a business firewall holds

A business firewall applies explicit rules. Host Technology places a next-generation firewall behind the carrier handoff: named rules, VLANs, a log. The guest network does not reach accounting. Voice, if telephony is IP, has its VLAN. Firewall administration is not exposed on the Internet. Each rule has a reason and a name. Logs can answer, after an incident: which machine talked outbound, and when.

ANSSI's IT hygiene guide places segmentation and logging among the baseline measures. A firewall with no owner and no log is not evidence. It is a box that is on. The 18 November 2026 article on NIS 2 says what a customer may already ask. Here we stop at the filter.

## The choice is not about speed

- One box, one site, no guest Wi-Fi, no published server: the box can still be enough, until the need is written down.
- As soon as there are guests, a till, a server, IP telephony or a second network, flows are split. That is when the firewall starts.
- As soon as a supplier or an employee leaves, you need to know who can still change a rule. A shared box does not say.
- As soon as a customer asks for evidence, the log and the owner's name matter more than the speed on the brochure.

Host sizes after a visit, from Nice to Monaco. The firewall chosen is the one the team can keep over time, not the one with the most options. A rule nobody understands is a rule that will stay open.

## Who changes a rule

The firewall admin account is named. It is not the everyday account, and it is not the carrier's account that delivered the fibre. When Host runs the estate, a rule change is written down: who, what, why. A port opened 'for a fix' with no close date is reviewed. The list of administrators, across equipment, is in the 15 September article.

Detection, EDR or SOC, comes after. A firewall does not see a Microsoft 365 account compromised from outside. It sees the site's flows. The two complement each other. The 15 October article separates antivirus, EDR and SOC.

## Sources

ANSSI IT hygiene guide, network segmentation and logging: https://cyber.gouv.fr/publications/guide-dhygiene-informatique. The finding on boxes still sitting in front of a server or guest Wi-Fi comes from Host Technology visits. No speed figure and no market share is claimed here.

## FAQ

### Should we throw away the carrier's box?

No. It can stay as the handoff of the link. The company firewall sits behind it, and that is what filters internal flows.

### Is a carrier business box enough?

It delivers the link and sometimes a simple filter. It does not replace written rules, VLANs and a log someone rereads.

### Does the firewall slow the fibre?

A device sized for the site's speed is not felt day to day. The subject is separating flows, not chasing throughput.

### Who administers the firewall?

A named account, not a password posted in the technical room. Host holds it when managed IT or the cyber contract says so.

### Is the firewall enough for NIS 2?

No. It covers the site filter. Access, a tested copy and detection sit alongside it. The NIS 2 frame is covered on 18 November 2026.

- [Cybersecurity: firewall, access, segmentation](https://www.hosttechnology.fr/en/cybersecurity)
- [Network, fibre and firewall](https://www.hosttechnology.fr/en/network)
- [Who still administers the consoles](https://www.hosttechnology.fr/en/resources/comptes-administrateur-prestataires-pme)
- [Antivirus, EDR or SOC](https://www.hosttechnology.fr/en/resources/antivirus-edr-soc-pme)