Router, Switch & Firewall Configuration in Rwanda
The devices that move and gatekeep traffic, configured for your actual usage.
Router, switch and firewall configuration sets up the devices that move and gatekeep your network traffic, so they do what your organisation needs rather than what the factory defaults allow. Organisations with newly installed equipment, hardware inherited from a previous provider, or a firewall nobody has reviewed since it was installed need it. This page covers the routing and connectivity side: getting traffic where it needs to go, between VLANs, sites and the internet. Hardening the same firewall against threats is covered by security-focused firewall configuration under Cybersecurity.
What is this configuration work, and who needs it
It covers three device types working together. Switches connect devices and assign each port to the right VLAN. Routers move traffic between VLANs, between sites and to the internet. Firewalls apply rules that decide which traffic is allowed. Getting these to match the network design is what makes segmentation real rather than a diagram, and what keeps traffic flowing efficiently.
The problem it solves
Unreviewed or default configuration leaves a gap between what an organisation believes is happening and what the equipment actually does. Common findings: a firewall allowing almost all outbound traffic; VLANs drawn on a diagram but never configured on the switches; routing rules nobody can explain; internet failover that has never been tested; and management interfaces reachable from the guest Wi-Fi. Each is a risk, and many also cause slow or unreliable connectivity.
Configuration principles we work to
Deny by default, allow by need. Traffic between segments and to the internet is allowed because a system needs it, with each permission documented, rather than everything open and a few things blocked.
Management stays separate. Switch, router and firewall management is reachable only from a protected management network, with default accounts removed and administrator access individual and logged.
Consistent switch configuration. Every port is either assigned to a VLAN deliberately or disabled, and unused ports don’t silently join the staff network.
Failover that’s been proven. Where there are two internet links, failover is configured and then tested by disconnecting the main link.
Configurations are backed up. Every device’s configuration is saved after each change, so a failed unit can be replaced and restored in minutes.
Changing a live network safely
Most configuration work happens on networks people are using. Before any change, we save the current configuration of every device involved. Changes go in during an agreed window, in small steps, with a written rollback for each. Where a mistake could cut off remote access, we keep an out-of-band route in, so a bad change can be reversed without a drive to site.
What the work involves
- Audit. For existing networks, we export and review current configurations, documenting what is actually set and what no longer serves a purpose.
- Plan. We map the design onto each device: VLANs per switch port, routes, firewall zones and the rules between them.
- Configure. We apply changes in a scheduled window, in an order that keeps the network reachable throughout.
- Remote access. Where needed, we set up VPN access with individual accounts.
- Test. We confirm that intended traffic passes, unintended traffic is blocked, and failover works.
- Document. We hand over the rule register, diagrams and configuration backups.
What’s included and what’s not
Included: routing configuration, switch and VLAN configuration, firewall rules, VPN setup where remote access is needed, and rule documentation.
Not included unless specified: the physical installation and cabling (see LAN/WAN installation) and ongoing security monitoring for detecting intrusion attempts (see security monitoring under Cybersecurity).
Typical timelines and what drives cost
Configuring a single-site network typically takes one to three days, depending on how many rules and VLANs are needed and whether existing configuration must be audited first. Cost is driven by the number of devices, VLANs and sites, remote access requirements, and how much undocumented existing configuration has to be understood before it can be changed safely.
Equipment typically used
Configuration applies to whatever routing, switching and firewall hardware is in place or being installed. We work across established manufacturers, provided the hardware supports what the design requires, such as VLAN tagging, inter-VLAN routing, VPN and rule-based filtering, and still receives security updates from its manufacturer.
Common mistakes we see
Firewalls left on default “allow most things” rules. VLANs designed but never configured on the switches. VPN access through one shared account, so nobody knows who connected, and leavers keep access. Management interfaces exposed to the internet with default passwords. Rule lists that grow for years with no notes, so nobody dares remove anything. And configurations never backed up, so a single failed device means rebuilding from memory.
.ukGT6Tck_Z116PRC.webp)
IT Infrastructure & Networking
Related services
-
Network Architecture Design
A network design sized to your sites and growth plans before any cable gets pulled.
-
Structured Cabling
Cat6/6A cabling, containment and labelling installed and certified to a standard you can audit later.
-
Server Room Setup
Server rooms built around power, cooling and cable management, not just a rack in a spare room.
Insights
Related reading
-
.XvfLvyWu_2j9fr.webp)
, 4 min read
Router, Switch & Firewall Configuration: What to Check Before You Buy
A handful of specific questions to ask before choosing a router, switch and firewall configuration provider, beyond comparing quoted prices.
-
.axBI9cHA_Z1CMqlS.webp)
, 4 min read
How Much Does Router, Switch & Firewall Configuration Cost in Rwanda?
Router, switch and firewall configuration cost depends on device count, rule complexity, and whether existing equipment can be reused — here's the breakdown.
Frequently asked questions
Is it risky to have a firewall running on default settings?
Yes. Many firewall and router appliances ship with permissive defaults so a new installation works immediately, plus default administrator passwords and remote management settings that were never meant to stay. Left unreviewed, a firewall can allow far more traffic than intended while its owner assumes it's protecting them. Reviewing and replacing the defaults is the first job in any configuration.
Can you configure equipment we already own, or do we need to buy new hardware?
Often we can configure what you have, provided it can do what the design requires, such as VLANs, enough throughput and VPN, and the manufacturer still releases security updates for it. Equipment that no longer receives updates is a security risk however well it's configured. We assess each device and recommend replacement only where there's a concrete reason.
What's the difference between a router and a firewall — do we need both?
A router moves traffic between networks, such as between your VLANs or out to the internet. A firewall inspects that traffic and decides what's allowed, based on rules. Many business appliances do both in one box, which is fine. What matters is that filtering rules exist and are deliberate, because a router alone forwards traffic without judging whether it should.
How often should firewall rules be reviewed?
At least once a year, and whenever the network changes significantly: a new VLAN, a new site, or a new application that needs access. Rules accumulate and are rarely removed, so old exceptions for systems that no longer exist pile up. A review removes them, tightens over-broad rules, and confirms the documentation still matches what's actually configured.
Can remote staff connect securely through the firewall?
Yes, through a VPN configured with individual accounts for each person, ideally with multi-factor authentication, rather than one shared password. Individual accounts mean access can be removed when someone leaves, and the logs show who connected and when. Remote access is also limited to the systems each person needs, not the whole network.
Do you provide documentation of what rules are configured and why?
Yes. Every configuration comes with a rule register explaining what each rule allows, why it exists and who asked for it, alongside backups of every device's configuration. A future reviewer or a different administrator can then understand the intent behind the rules, instead of reverse-engineering it from a raw list and being afraid to remove anything.
Is your network holding the business back?
Tell us how many sites, users and drops you have, and where it slows down. We’ll survey it and quote what’s needed.