# Firewall and segmentation. An infected PC cannot reach your servers.

Source: https://vetosec.at/en/solutions/firewall/

In many businesses PCs, servers, printers and guest Wi-Fi share one network. We split them into separate zones and maintain the rules so an attack cannot spread.

- **Management zone** separate
- **Multiple** uplinks
- **Blocklists** against known attackers

## What changes for you

- **Attacks stay contained**: Office, servers, guests, printers and medical or production devices sit in separate networks. Ransomware does not spread freely.
- **A second firewall on standby**: Optionally two units that replace each other. If one fails, the internet keeps running.
- **Documented rules**: Every rule has a reason and is documented. Old exceptions are removed.
- **No licence subscription**: The firewall software needs no subscription. Security updates still arrive regularly.

## What runs behind it

- **Default is deny**: Between zones only what is explicitly allowed gets through.
- [**Remote access built in**](https://vetosec.at/en/solutions/fernzugriff-vpn/): Remote staff and sites connect encrypted, with per-person rights.
- [**Logs in monitoring**](https://vetosec.at/en/services/monitoring/): Suspicious connections land on our platform and are checked.
- **Yearly review**: Once a year we go through the rules with you.

[How we build in general](https://vetosec.at/en/how-we-build/)

## What it looks like

- Firewall overview: Separate zones for end devices, servers and management, intrusion blocking and remote access on one unit, all at a glance.

## What we set up

Thought through in detail.

- **Clean zones and a dedicated management zone**: Office, servers, guests and devices in separate networks. Admin interfaces of servers, switches and the firewall are only reachable from a dedicated management zone.
- **Multiple internet uplinks**: Two or more uplinks with load balancing and automatic failover. If one provider fails, the business keeps running over the other.
- **Known attackers stay out**: Shared blocklists block addresses that have already attacked elsewhere, before they try with you.
- **Own DNS with split DNS**: Internal names resolve in the office and via remote access, while the structure stays invisible from outside. Optionally, blocklists stop known malicious sites at name resolution.
- [**Remote access built in**](https://vetosec.at/en/solutions/fernzugriff-vpn/): WireGuard for sites and NetBird for per-person access run directly on the firewall, with the same zones and rules.
- **Two firewalls, one rule set**: Highly available if you want: both units sync rules and connections, a failure interrupts nothing.
- [**Logs in monitoring**](https://vetosec.at/en/services/monitoring/): Firewall logs land on our platform. An engineer sees suspicious patterns before they turn into an incident.
- **Configuration backed up and documented**: Every change is backed up and traceable. A replacement unit is back on the same state quickly.

## Service or project

**We run it for you, or your team takes over.**

As a managed service for a fixed monthly price, with updates, backup and monitoring. Or as a project with handover of network plan, runbook and all credentials.

## For IT leads

Technical details: OPNsense · CARP · WireGuard · CrowdSec

- **Platform**: OPNsense, open source, with regular security updates.
- **Zones**: VLANs for office, servers, guests and devices, plus a dedicated management zone. Default deny.
- **Uplinks**: Multiple uplinks with load balancing and automatic failover.
- **High availability**: Optionally two units with CARP and synchronised rules and connection state.
- **Remote access**: WireGuard for sites, NetBird for per-person access, using the same zones.
- **Blocklists and detection**: Community blocklists (CrowdSec), optional intrusion detection.
- **DNS**: Own resolver with split DNS, optional DNS blocklists.
- **Logging**: Firewall logs in the SIEM, configuration backed up and versioned.

## Further reading

More on the topic

- [**Firewall**](https://vetosec.at/en/it-security/firewall/): A firewall is a control point between your company network and the internet that permits or blocks every connection according to fixed rules.
- [**Network segmentation**](https://vetosec.at/en/it-security/netzwerksegmentierung/): Network segmentation divides a company network into separate zones, with only expressly permitted connections between them.
- [**Netzwerksegmentierung für KMU: Klein anfangen, Wirkung erzielen**](https://vetosec.at/en/articles/it-wissen/netzwerksegmentierung-kmu-praxis/): A practical approach to network segmentation for SMEs.

## Frequently asked questions

### Is the provider's router firewall enough?

It protects against open access from the internet but does not separate internal networks. That is exactly where attacks spread.

### Which technology do you use?

OPNsense, an open source firewall with regular security updates, VLANs, CARP high availability, WireGuard and optional intrusion detection.

### Do we have to change the cabling?

Usually not. Separation uses VLANs on existing switches, as long as they support it.

### Who do you offer this to?

For regulated companies, professions bound by confidentiality and anyone processing sensitive data, and for companies of about 30+ staff with critical systems.

## Related

- [Solutions](https://vetosec.at/en/solutions/): Nextcloud, SSO, backup, clusters
- [Managed services](https://vetosec.at/en/services/managed-services/): fixed price per service
- [How we build](https://vetosec.at/en/how-we-build/): security and backup standards

## OPNsense firewall and network segmentation in Austria

vetosec sets up OPNsense firewalls with segmentation, HA and VPN for businesses in Austria.

Updated: October 19, 2026

Provider: vetosec, Dipl.-Ing. Samuel Ziegler, BSc, Berndorf, Lower Austria, Austria. Contact: https://vetosec.at/en/contact/