Network, VPN and firewall
reviewed rule by rule.
We review how your network is segmented and exposed, using configuration exports and diagrams you choose to share, and give you a written report of firewall rule, VPN, DNS, Wi-Fi, logging and firmware findings, ranked by what to fix first.
Who it is for
Organisations with an office or datacentre network that has grown over time, whose firewall rules nobody fully owns, or that depend on a VPN for remote access and want an independent check.
What we review
- Network map and segmentation. what is on which network: users, servers, printers, guest and any operational devices, and where one flat network carries all of them.
- Firewall rule hygiene. any-to-any rules, unused or duplicate rules, rules with no owner or reason, and review dates. NIST’s guidelines on firewalls and firewall policy are a reference for the checklist.
- Exposed services. inbound port forwards and published services. CISA advises not exposing remote desktop services on the web; our network ports reference helps identify what each port is for.
- Remote access and VPN. how people authenticate, whether MFA is required, who has access, unused accounts, client and gateway versions, and what a VPN user can reach.
- Administrative access. whether device management interfaces are reachable from user networks, who can administer them and how those accounts are protected.
- DNS and DHCP. internal DNS design and forwarders, DHCP scopes and reservations, address plan and overlaps, using the subnet and CIDR tools for the inputs.
- Wi-Fi. SSID inventory, how users and devices authenticate (shared key or per-user), guest isolation and what each network can reach.
- Logging and monitoring. what the firewall and VPN log, how long logs are kept, where they are sent, time synchronisation and who looks at them.
- Firmware and support status. model, firmware version and vendor support status for firewalls, switches and access points, and whether vendor security advisories are reviewed.
- Configuration backup and change. whether device configurations are backed up and how rule changes are requested, approved and recorded.
- Resilience. internet connection and firewall redundancy, and what happens when one fails.
What you get
A written report, delivered through the channel agreed in the quote. It contains:
- An executive summary in plain language
- A segmentation summary and a list of exposed services
- Findings with severity and the evidence behind each one
- A rule clean-up list for the firewall owner
- A fix-first list, a 30/60/90-day plan, and a list of what was not checked
See the format in the fictional report sample (sample, fictional data).
What we need from you
- A named contact with authority over the network
- Exports or screenshots named in the scope, such as firewall rule listings, VPN settings, a network diagram, Wi-Fi settings and device firmware versions (secrets removed)
- A list of sites and internet connections
How it works
- Send an enquiry. Tell us the question. Keep credentials and customer data out of it.
- Agree the written scope. We propose scope, fee and timing in writing. Nothing starts until both sides accept it.
- We review what you choose to share. We read only the exports and diagrams in the agreed scope. We do not scan your network or connect to your devices.
- You get a written report. It says what was checked, what was not, and suggested next steps.
- Any change is approved separately. A report does not authorize changes; anything that changes needs its own written approval.
See what the report looks like: Read a fictional report sample (sample, fictional data). How we handle your information: Trust and data handling.
What we need from you. A named contact with authority, and a small set of evidence you choose to share through a channel we agree in writing first. Please do not send credentials, access tokens or customer exports through the enquiry form.
What we do not do. We do not scan your network, log in to devices, change rules or firmware, or test your VPN. This is not a penetration test, and we give no security guarantee.
What needs separate approval. Any rule, firmware, VPN or Wi-Fi change, any scan or live test, and any follow-up check after changes.
Questions before an enquiry
Do you scan our network?
No. We review exports and diagrams you share. A scan or test needs a separate scope, written authority and agreed timing.
Will you change our firewall rules?
No. The report lists what to change and in what order. Your team or a separate scope makes the changes.
Which firewall vendors do you cover?
Any, from the exports you can share. Vendor-specific advice follows the vendor’s own documentation; check current vendor documentation.
Do exports contain secrets?
They can. The scope agrees what to remove before sharing. Never email passwords, pre-shared keys or private keys.
Does this cover cloud networks?
Not in depth. For Azure networks see the Azure landing zone and cost review; for AWS see the AWS review.
Free tools, reading and vendor documentation
- Network ports reference (free)
- Subnet guide (free)
- IPv4 subnet calculator (free)
- CIDR overlap checker (free)
- Microsoft 365 mail flow troubleshooting
Microsoft documentation (opens in a new tab). Product behaviour and licensing change, so check current Microsoft documentation before acting:
Ready to start?
Tell us what you need. We reply to confirm fit and to propose scope, fee and timing in writing.