Guides
Part of Network security for small business: separation, router settings, and quarterly checks
Network security setup night: kit, tests and the way back
Run a network security setup as a change window: what to have ready, the test that ends each step, and the rule for rolling back when a test fails.
One rule prevents most of the bad afternoons: never change the network from a device that depends on the change you are making. Sit on a wired port, keep a second way to reach the router, save the configuration before each step, and move one device before you move the rest.
Setting up is a change window, not a configuration project: kit, order, a test that ends every step, and a way back when one fails. It assumes the planning in network security is done, so you know which groups of devices exist and which may talk to which.
What to take away
- Export the configuration before every step, and label the file with the step number.
- Move one device into each new segment and test it before moving the others.
- Do the whole thing out of hours with a written way back, and stop if a test fails.
Before you touch anything
Gather six things before the first login, because each one answers a failure that is hard to fix from inside it. The wired laptop heads the list: when you change the wireless, you do not want to be on the wireless.
- A wired laptop plugged straight into the router or switch.
- A second administrator who knows the login and can reach the console if you lock yourself out.
- A phone with mobile data, for testing from outside and for looking things up when the internet goes away.
- The current configuration, exported. If the router cannot export its settings, photograph every page.
- A list of every device with a fixed address or a forwarding rule: printers, cameras, door controllers, the accounting server.
- A window of time when nobody is working.
The exported configuration is what turns a failed step into a short detour instead of a rebuild. Label each file with the step number so the right one is to hand when a test fails, and save again after every step, however small the step felt.
The evening in order
Each step ends with a test and a saved configuration, and the save is not optional because the step was small. Lowest risk goes first, so the early steps show how the equipment behaves before you touch anything that can lock people out.
Order of operations
- Take control of equipment
- Create guest network
- Segment undefendable devices
- Secure wireless
- Restrict inbound list
- One way in
- Name filtering
| Step | What changes | Pass means | If it fails |
|---|---|---|---|
| 1. Equipment | New administrator passwords, remote administration off, firmware updated one device at a time | Each device accepts its new login, remote administration is off, the version changed | Wait longer and do not power cycle mid-update; if access is lost, restore the previous configuration |
| 2. Guest network | Client isolation, a passphrase that is not the staff one, no route inside | A phone on guest cannot open the printer page and can reach the internet | Check isolation is on for that network, not only the main one |
| 3. Device segment | Printers, cameras, screens and building equipment on their own network, one printer first | It prints from a work laptop and cannot open a work file share | Check the one allowed port before opening more |
| 4. Wireless | WPA3 where every device supports it, otherwise WPA2 with a long random passphrase | One laptop joins on the new passphrase and prints | Fall back to WPA2 for that device only, not for all |
| 5. Inbound list | Every forwarding rule accounted for, unowned ones and remote desktop removed | From a phone on mobile data, nothing answers | Look for a second forwarding page or a default rule |
| 6. One way in | A VPN or identity-aware path with a second factor | A test user connects, reaches what they should, and is dropped when disabled | Check session timeout, since many boxes keep sessions alive |
| 7. Name filtering | One device first for a day, then the router | A known test page is blocked and ordinary sites load | Confirm the device is not using its own resolver |
| 8. Write it down | Segment per device, rules in sentences, export locations, date | The notes match the live configuration and the device list | Correct the notes or export before calling the setup complete |
Firmware goes one device at a time, and the reboot finishes before the next is touched. The router's wireless settings deserve the same care. The National Institute of Standards and Technology's NIST Special Publication 800-153, Guidelines for Securing Wireless Local Area Networks (WLANs), covers the reasoning behind the wireless choices.
Moving devices is where the evening can break things, which is why the fixed-address list matters: those printers, cameras and controllers are what break when segments appear. Change the staff passphrase while everyone is out, and write down who needs the new one.
The final export belongs somewhere that is not on the network you just configured, for the reason backup and recovery gives about copies stored where the thing they protect can reach them. Check it opens from outside the network before you call the step done.
When a test fails
If a test fails and the cause is not obvious in ten minutes, import the previous export and stop. Come back another evening.
A half-finished segmentation is worse than none, because the drawing and the network no longer match and nobody knows which one is true. Stopping costs an evening. Carrying on costs a network nobody can describe.
- Read the last column of the run sheet for that step and try the one fix it names.
- If ten minutes pass without an obvious cause, import the export saved before the step.
- Stop, note which test failed, and book another evening.
Rollback rule
Test failed and cause not obvious in ten minutes?
import previous export and stop
continue to next step
Faults that appear after segmentation, with the first check for each, are laid out in network security troubleshooting. Read it before the evening, so the first check is already familiar when a test fails at nine at night.
After the evening
Keep the saved exports and write the next check date in a calendar. Configuration decays because nothing prompts anyone to look. The network security features are grouped by the question each answers, which gives the calendar entry its checklist.
Put the router administrator account under the same protection as any other privileged login. That is the argument in identity and access: the account can now change who talks to whom across the business.
One more habit worth forming that night is to keep firmware updating on a schedule you chose rather than waiting for a reason. The United States Cybersecurity and Infrastructure Security Agency's Update Business Software guidance applies to the box in the cupboard as much as to laptops, and the setup evening is the moment the schedule gets set or never does.
Common questions
Can we do this on a consumer router?
Often the first five steps, sometimes the sixth. Where the box has no VLAN support, the device segment becomes a second physical router, or a reason to buy something better. Do the steps it can do first; they are the ones that matter most.
What if a device will not work on its own segment?
Find the single port it needs and allow only that between the two segments. If the manufacturer cannot say which port, put the device on the guest network rather than back among the work machines.
Should we do everything in one evening?
Only if every test passes. Steps two, three and five are each worth an evening on their own if that is what it takes. The order matters more than the speed.
Who else needs to know?
Whoever runs incident response needs the drawing and the export location, because the network map is the first thing they will want on a bad day.
