Perimeter Defence Audit for Australian SMBs: Firewall Cleanup, VPN Hardening and DMZ Setup This Week

Perimeter defence is no longer just “buy a firewall and forget it.” For most Australian small and mid-sized businesses, the exposed edge now includes a firewall, VPN, cloud apps, remote staff, SaaS admin panels, RDP habits, managed service provider access, and sometimes a NAS or camera system that was “temporarily” opened to the internet three years ago.

The good news: you do not need a six-month transformation project to improve your border defence. With a focused one-week audit, business owners can remove the most dangerous exposures, improve resilience against ransomware operators, and align practical controls with the ASD Essential Eight and NIST SP 800-41 firewall guidance.

1. Start With a One-Week Perimeter Map

Before changing rules, identify what your business actually exposes to the internet. Many SMB breaches start with something basic: an old VPN appliance, exposed RDP, a forgotten port forward, a firewall rule labelled “temporary,” or a vendor account with broad access.

This week, create a one-page perimeter map covering:

• Internet connection type and public IP addresses
• Firewall or router model, firmware version and support status
• Open inbound ports and port forwards
• VPN users, groups and authentication method
• Remote admin paths for IT providers
• Public services such as email, web apps, NAS, cameras, VoIP and remote desktop gateways
• Cloud access tools such as Cloudflare Tunnel, Tailscale, Microsoft Entra, Google Workspace and SaaS admin portals

Use the firewall interface, your ISP portal and an external scan from a trusted admin location to compare expected exposure against actual exposure. The aim is not to run a penetration test; it is to find the obvious “why is that open?” problems.

For many SMBs, common findings include TCP 3389 for RDP exposed directly, SSL VPN enabled for all staff, old firewall firmware, broad “allow any” outbound rules, no geo-blocking, no logging on deny rules, and former staff still present in VPN groups.

A practical target is simple: by Friday, every inbound rule should have a named owner, business reason, source restriction, destination, expiry date if temporary, and logging decision.

2. Clean Up Firewall Rules and Border Configuration

Firewall rule cleanup is one of the highest-return perimeter tasks. Most SMB firewalls accumulate years of rules from vendors, migrations, phone systems, remote work changes and emergency fixes.

Start with these rule audit actions:

• Export the running firewall configuration before making changes.
• Review inbound NAT and port-forward rules first.
• Disable, do not delete, questionable rules for a short observation period.
• Remove rules for former vendors, old phone systems, legacy servers and unused VPN pools.
• Replace “any source” inbound rules with specific source IP ranges where possible.
• Move specific rules above broad rules.
• Add descriptions with ticket numbers or business owners.
• Enable logging on high-risk allows and default denies.
• Confirm there is an explicit deny-all rule at the end of inbound policy.
• Review outbound rules for servers, not just inbound traffic.

For Fortinet FortiGate deployments, SMBs commonly use FortiGate 40F, 60F or 70F appliances, depending on office size, throughput and security subscription requirements. A small office deployment may sit around AUD $900-$2,500 for hardware plus security services, while a multi-site setup with support can move toward AUD $3,000-$5,000. Enable FortiGuard updates, IPS profiles for exposed services, SSL inspection where appropriate, admin MFA, restricted management access and alerting for configuration changes.

For pfSense, the cost profile is different. A Netgate appliance or small business firewall hardware may land around AUD $500-$1,500 before support, making it attractive for technically capable businesses or MSP-managed environments. The trade-off is operational discipline: pfSense can be excellent, but only if updates, backups, rule reviews, VPN settings and monitoring are maintained properly.

Common firewall misconfigurations that leave SMBs exposed include:

• Firewall admin interface reachable from the internet
• Port forwards to internal servers without source restrictions
• “Any-any” rules added during troubleshooting and never removed
• No MFA for firewall administration
• Old firmware because “it still works”
• No alerting when rules change
• VPN users placed on the same network as servers
• Guest Wi-Fi bridged into business LAN
• Public IP camera, NAS or remote desktop exposure

NIST SP 800-41 is useful here because it treats firewalls as policy enforcement points, not magic boxes. The control is only as good as the ruleset, change process, logging and placement.

3. Harden VPN Access Before Attackers Find It

VPN remains a major perimeter risk for SMBs because it concentrates remote access into one externally reachable service. Attackers know this, and they routinely target SSL VPN portals, old firmware, weak passwords and accounts without MFA.

This week, business owners should ask: “If one staff password is stolen, what can the attacker reach through VPN?”

Your minimum VPN posture should include:

• MFA for every VPN user, including admins and vendors
• Immediate removal of former staff and inactive accounts
• Separate VPN groups by role, not one flat access group
• No shared VPN accounts
• Device posture checks where available
• Strong logging of successful and failed logins
• Lockout or rate-limiting for repeated failures
• Current firmware on VPN appliances
• Restricted access from VPN to only required systems
• Alerts for impossible travel, new countries or unusual login times

FortiGate SSL VPN users should pay close attention to firmware and vendor advisories. VPN vulnerabilities are frequently exploited at the edge because they are internet-facing and valuable. If your firewall is end-of-life or cannot receive security updates, replacing it is cheaper than recovering from ransomware.

Tailscale can be a strong SMB option when the goal is private remote access without opening inbound VPN ports. It is built on WireGuard and can reduce exposure by creating identity-based access between approved devices. For many SMBs, Tailscale is a practical replacement for ad hoc RDP exposure or broad legacy VPN access. Costs can range from free or low-cost tiers for small teams through paid business plans depending on users and controls.

Cloudflare Tunnel is useful when you need to publish an internal web app without exposing the origin server directly to the internet. Instead of opening inbound firewall ports, the internal connector establishes an outbound tunnel to Cloudflare. Pair it with Cloudflare Access, identity provider login, MFA and device rules. This can be a major improvement over exposing admin panels, intranet tools or small line-of-business web apps directly.

However, zero-trust tools are not a substitute for governance. Misconfigured Cloudflare Access policies, overly broad Tailscale ACLs or unmanaged personal devices can recreate the same risk in a newer wrapper.

4. Build a Simple DMZ or Zero-Trust Alternative

A DMZ is a separated network zone for systems that need controlled exposure, such as web servers, reverse proxies, mail gateways or vendor portals. The principle is simple: if an exposed service is compromised, it should not give the attacker direct access to payroll, file shares, accounting systems or domain controllers.

For an SMB, a practical DMZ does not need to be complex. It can be:

• A separate firewall interface
• A dedicated VLAN
• A cloud-hosted reverse proxy
• A Cloudflare Tunnel-protected access path
• A segmented hosting environment separate from the office LAN

The key rules are:

• Internet can reach only the required DMZ service ports.
• DMZ systems cannot initiate broad access into the LAN.
• LAN management access into the DMZ is restricted to admin devices.
• Logs from DMZ systems are retained and reviewed.
• Backups are not writable from the DMZ.
• Secrets, database credentials and API keys are limited.

For example, if your business hosts a small internal web portal, avoid forwarding TCP 443 directly to a Windows server sitting on the same network as staff laptops. A better pattern is Cloudflare Tunnel or a reverse proxy in a DMZ VLAN, protected by identity-aware access and MFA. If that portal needs database access, allow only the specific database port to the specific database host, not broad LAN access.

This aligns with the ASD Essential Eight principle of limiting the blast radius. While the Essential Eight is broader than perimeter defence, several maturity model themes apply directly: patch applications, patch operating systems, restrict administrative privileges, enforce MFA and maintain backups. A clean perimeter makes those controls easier to enforce.

5. Budget, Priorities and the Quick-Win Checklist

Most Australian SMBs can make meaningful improvements in the AUD $500-$5,000 range, depending on existing hardware, licensing and support needs.

Typical cost ranges:

• pfSense or small firewall appliance: AUD $500-$1,500
• FortiGate small office appliance with security services: AUD $900-$2,500
• Managed firewall deployment and rule cleanup: AUD $1,500-$5,000
• Tailscale for small teams: low-cost per-user SaaS depending on plan
• Cloudflare Tunnel and Access: free to paid tiers depending on business requirements
• External perimeter review by a consultant or MSP: AUD $1,000-$5,000 depending on scope

If budget is tight, prioritise configuration over shiny hardware. A well-maintained modest firewall with MFA, clean rules and good segmentation is usually safer than an expensive NGFW running stale firmware with years of messy rules.

Quick-win firewall audit checklist:

• Export and back up firewall configuration.
• Confirm firewall firmware is supported and patched.
• List all inbound NAT, port forwards and exposed services.
• Remove or disable unused inbound rules.
• Replace “any source” with trusted source IPs where possible.
• Block direct internet access to RDP, SMB, databases, NAS and cameras.
• Confirm firewall admin is not exposed to the internet.
• Enable MFA for firewall administration.
• Turn on logging for critical allow rules and default denies.
• Document owner, purpose and review date for each inbound rule.

Quick-win VPN posture checklist:

• Enforce MFA for every VPN user.
• Remove former staff, stale vendor accounts and shared accounts.
• Patch VPN/firewall firmware.
• Restrict VPN users to required systems only.
• Separate admin VPN access from standard staff access.
• Review failed login attempts and unusual countries.
• Disable legacy VPN protocols and weak cryptography.
• Consider Tailscale or Cloudflare Tunnel for specific use cases.
• Test whether one compromised VPN account can reach sensitive systems.
• Schedule a monthly VPN user and rule review.

FAQ

Conclusion

Perimeter defence for Australian SMBs is not about building a perfect enterprise architecture overnight. It is about removing obvious exposure, enforcing MFA, patching edge devices, cleaning up firewall rules, and separating public-facing systems from the rest of the business.

This week, start with the basics: map your internet-facing services, remove risky port forwards, harden VPN access, patch your firewall, and decide whether a DMZ, Cloudflare Tunnel or Tailscale model better fits your operations. Visit consult.lil.business for a free cybersecurity assessment.

References

1. Australian Cyber Security Centre — Essential Eight
2. NIST SP 800-41 Revision 1 — Guidelines on Firewalls and Firewall Policy
3. Fortinet PSIRT Advisories
4. Cloudflare Tunnel Documentation
5. Tailscale Security Documentation

Verifier warning: verifier could not run (PluginLlmTrustError).