Firewall
FortiGate firewall
Hardware FortiGate firewalling at the network edge. Port and source policies, application-layer inspection and inter-segment transit rules are configured to your requirements.
- Positioned at the network edge
- Hardware
- Inspection layers
- L3–L7
- Inter-segment policy
- VLAN
- Intrusion prevention
- IPS
Why a host firewall isn't enough
A firewall running on the operating system — iptables, Windows Defender Firewall — only evaluates traffic after it has already reached the server. The malicious packet has entered your network, consumed server resources and arrived at the OS layer.
A hardware firewall makes that decision at the network edge. Disallowed traffic never reaches the server, narrowing the attack surface and sparing server resources. Even if a server is compromised, edge policies remain in force.
We chose FortiGate not just for packet filtering but because it combines application-layer inspection and intrusion prevention in the same appliance. Blocking traffic that matches known vulnerability signatures stops attacks that port-based rules alone would miss.
The rule set is written to your needs. Which source IP may reach which port, who can see management interfaces, and what traffic crosses between segments are decided together and updated through support requests.
- Disallowed traffic never reaches the server
- Application-layer inspection and IPS signatures
- Rule-based transit between VLAN segments
- Management interfaces restricted by source IP
- Rule changes handled through the support channel
Features
Protection layers configured
Stateful packet filtering
Connection-aware rules that permit response traffic while blocking unsolicited inbound connections.
Access policies
Permissions by source IP, destination port and protocol. Management ports are opened only to defined addresses.
Intrusion prevention (IPS)
Traffic matching known vulnerability signatures is stopped at the edge, providing cover until a patch is applied.
Segment isolation
Movement between web, application and database tiers is possible only through defined rules.
VPN access
An encrypted tunnel can be established for administrative access without exposing server ports to the internet.
Traffic visibility
What passes and what is blocked is logged, and those records are used during incident investigation.
FAQ
Frequently asked questions
Do I write the rules myself?
You set the policy and our technical team applies the configuration. We agree together which services must be publicly reachable and which addresses may reach management interfaces, and we take change requests through support.
What's the difference between FortiGate and pfSense?
FortiGate is a hardware appliance at the network edge, delivering IPS and application inspection at hardware speed. pfSense is used more for in-segment routing, VPN termination and flexible rule authoring. They are complementary layers rather than alternatives.
Does the firewall affect performance?
Because inspection happens on the appliance it consumes none of your server's resources. In fact, blocked traffic never reaching the server saves both CPU and bandwidth.
More
Related pages
- Network SecurityNetwork security with pfSenseIn-segment routing, encrypted VPN access, port forwarding and detailed rule sets with pfSense — a second protection layer behind the hardware firewall.
- DDoS ProtectionProtection against DDoS attacksAlways-on protection against volumetric, protocol and application-layer DDoS attacks. Edge scrubbing, anomaly detection and preservation of legitimate traffic.
- Network10 Gbps isolated VLAN networkingAn isolated VLAN per customer, 10 Gbps private server-to-server networking and rule-based segment transit. Private traffic does not consume internet quota.
Let's plan your infrastructure together
Tell us what you need and we prepare a configuration and pricing specific to you. We don't sell fixed packages; we build the deployment, licensing and backup plan with you.