Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
When a critical patch is not yet tested or cannot be deployed immediately, reduce the vulnerable system’s attack surface first. Remove nonessential internet access, place the system in a tightly controlled segment, allow only documented flows, and harden any VPN path that must remain. Keep the change temporary, logged, tested and reversible; then remove it after the patch is installed and verified.
The controls below follow 2025 guidance from the Cybersecurity and Infrastructure Security Agency (CISA), including its Internet Exposure Reduction Guidance and Primary Mitigations to Reduce Cyber Threats to Operational Technology. Exact menu names and syntax vary by firewall, VPN vendor, network design and protocol, so treat this as a change plan rather than a copy-and-paste configuration.
What to change first
Start with exposure, not with a long list of product settings. During an emergency, every reachable service is a possible entry point and every unrestricted route can turn a compromise into lateral movement.
Inventory every reachable asset
List public IP addresses, DNS names, cloud security groups, load balancers, VPN gateways, remote-management interfaces, industrial or building-control devices, and any service forwarded through a perimeter firewall. Record the owner, business function, listening ports, protocol, dependencies, normal source networks and an emergency contact. Include devices that are reachable only through a partner, site-to-site tunnel or management network; attackers can use those paths even when a device is not directly visible on the public internet.
#1 Best Overall
- 【NEWER MODEL AVAILABLE - Protectli Vault V1210】THE VAULT (FW2B): Secure your network with a compact, fanless & silent firewall. Comes with US-based Support & 30-day money back guarantee!
- CPU: Intel Celeron J3060 Dual Core at 1.6 GHz (Turbo 2.48 GHz), AES-NI hardware support
- PORTS: 2x Intel Gigabit Ethernet NIC ports, 4x USB 2.0, 2x USB 3.0, 1x RJ-45 COM, 2x HDMI
- COMPONENTS: Needs RAM & Storage to work! This is a Barebones unit for maximum customizability (no RAM or mSATA). Not all memory is compatible with the Vault! Please research "Vault Hardware Compatibility" before purchasing. coreboot BIOS optional, must be installed by user.
- COMPATIBILITY: No OS pre-installed. All hardware tested with pfSense, untangle, OPNsense and other popular open-source software solutions.
Remove access that is not operationally necessary
Delete unused port-forwarding and destination-NAT rules, withdraw public DNS records that no longer serve a purpose, disable dormant remote-access accounts and close temporary vendor exceptions. If a service can operate from a private network, move it there rather than leaving a public rule in place. CISA’s exposure-reduction guidance emphasizes recurring reviews because forgotten exceptions often outlive the incident that created them.
Choose isolation proportional to risk
For a known or suspected vulnerable asset, isolation is the default until mitigation and verification are complete. The strongest option is physical disconnection, but a quarantine VLAN, a dedicated firewall zone or network-layer blocking can provide controlled availability when the device must continue a limited function. Document which option was chosen and why, including any safety or availability consequence.
Firewall settings for temporary containment
Use a default-deny policy for the affected path
Create an explicit deny rule above broad allow rules for traffic to and from the vulnerable host or segment. Add narrow exceptions only for flows that have a named business owner and a defined source, destination, port and direction. A rule such as “allow the subnet” is usually too broad during an emergency; prefer one host or service where the platform permits it.
Keep denied-traffic logging enabled for the quarantine rule. Log the timestamp, source and destination addresses, protocol, port, interface and action. Rate-limit or sample noisy logs so that a denial storm does not exhaust the firewall, but retain enough data to identify scanning, repeated exploit attempts and unexpected dependencies.
Separate public services from internal and backend networks
Place an internet-facing service in a DMZ or equivalent security zone. Permit the smallest set of connections from the DMZ to application, identity and database tiers, and block direct inbound access from the internet to those internal tiers. A DMZ is not a substitute for host patching; it limits the paths available if the exposed service is compromised.
Rank #2
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
For operational technology, building systems or other safety-sensitive environments, use a quarantine or “jail” VLAN with explicitly approved connections to required controllers, historians or engineering workstations. Coordinate changes with operations personnel before blocking traffic that could affect a physical process.
Restrict administration to trusted management paths
Do not administer an exposed device directly from the internet. Permit management protocols only from dedicated administrative workstations, a trusted management zone or a monitored jump host. Use separate administrator accounts, least-privilege roles and phishing-resistant multifactor authentication where supported. Block management ports from user VLANs and from the production service’s own public interface.
Monitor for unauthorized changes to access-control lists, routes, NAT rules and security-group membership. An attacker who obtains a firewall or cloud-console account may undo isolation without touching the protected host.
Control egress as well as ingress
Emergency containment should restrict outbound connections from the vulnerable system to the destinations it genuinely needs, such as a specific update repository, DNS resolver, time source or monitoring collector. Block arbitrary outbound internet access, peer-to-peer protocols and unsolicited connections to internal segments. Egress logs can reveal command-and-control traffic or attempted lateral movement that an inbound rule would not show.
VPN settings that reduce exposure
Expose only the selected protocol’s required ports
Limit the VPN gateway to the minimum external exposure required by the protocol you actually operate. For an IPsec deployment, CISA examples include UDP 500 for Internet Key Exchange, UDP 4500 for NAT traversal and the ESP protocol. Do not open every common VPN port “just in case,” and do not expose a second protocol unless it has a documented user or site requirement. Confirm the gateway’s current protocol, NAT behavior and failover design before changing rules; a port list copied from another product may be wrong for yours.
Rank #3
- Package Include: 200 Pcs Round Rubber Grommets, 7 Different Size, Fits Drill Hole: 9/32", 3/8", 1/2", 5/8", 3/4", 7/8", 1"
- Size and Quantity: M7.14 x 80pcs, M9.53 x 40pcs, M12.07 x 30pcs, M15.88 x 20pcs, M19.05 x 10pcs, M22.23 x 10pcs, M25.4 x 10pcs, Material: Black Rubber
- Product Names: Sheet Metal Hole Plug, Auto Body Hole Plug, Firewall Grommet, Firewall Hole Plug, Plug for Drill Hole, Cable Wire Hole Plug, Electrical Appliance Hole Plug, Plumbing Hole Plug, Round Rubber Grommet, Round Rubber Hole Plug, Closed Rubber Grommet, Rubber Hole Plug, Closed Hole Plug, Drill Hole Plug, Rubber Cable Hole Plug, Firewall Solid Closed Hole Plug, Electrical Wire Gasket, Electrical Firewall Gasket, Wire Electrical Appliance Plumbing Hole Plug, Automotive Hole Plug
- Application: Used for Sheet Metal, Auto Body, Firewall, Drill hole, Plumbing, Electric Appliance, Automotive and Boat, Metal Panels, Electrical Cabinet, Box Outlet Protection Seal, Wall Hole, Spray, Cylinder, Valve, Garages, General Plumbers, Workshop, Door, Window, Bearing, Pump, Drain Plugs, Chemical Pipe, Water Pipe, etc.
- Other Names: Closed Grommet, Drill Hole Grommet, Rubber Cable Grommet, Cable Wire Grommet, Firewall Solid Closed Grommet, Electrical Wire Grommet, Electrical FirewallGrommet, Sheet Metal Grommet, Auto Body Hole Grommet, Wire Electrical Appliance Plumbing Grommet, Electrical Appliance Grommet, Automotive Grommet
Disable unused features and weak algorithms
Turn off legacy tunnels, unused client types, split-tunnel profiles that are not required, administrative interfaces on the public side and automatic features that broaden access. Require current, vendor-supported cryptography for key exchange, authentication and encryption. Remove obsolete algorithms and short keys according to the gateway vendor’s current hardening guidance. Keep the gateway software and firmware at the newest version that your change process has approved; the joint CISA, FBI, NSA and partner advisory from the 2021 Log4j response specifically warned that VPNs can themselves have vulnerabilities and should be updated.
Constrain who can connect and what they can reach
Require strong, unique passwords and phishing-resistant MFA for every remote-access account, including administrators and contractors. Map each group to only the networks and applications it needs. A user who needs a ticketing system should not receive a route to server-management VLANs. Expire emergency accounts and vendor access at a fixed time, and review active sessions after the firewall change.
Do not treat VPN membership as endpoint trust
A VPN encrypts a path; it does not make an untrusted laptop safe. Require supported operating-system versions, current endpoint protection, disk encryption and a device-health check where your platform supports it. Place remote clients in a restricted access zone and require a jump host for sensitive administration. Private connectivity is preferable to public exposure when it is practical, but private does not mean unrestricted.
A documented emergency-change runbook
Use an incident or emergency change record even when the decision must be made quickly. The record should identify the vulnerable asset, business owner, approver, start time, expiry time, expected user impact and rollback method.
- Confirm the scope. Validate the advisory, affected product and installed version. Identify every instance, replica, standby node and cloud copy before changing rules.
- Capture the current state. Export firewall, VPN, router and cloud security-group configurations. Save them in a central, access-controlled repository with a timestamp and checksum, and record active sessions and important routes.
- Map essential flows. Ask the service owner and operations team which inbound, outbound and administrative connections are required for safe operation. Include monitoring, authentication, DNS, time and backup dependencies.
- Stage the containment rule. Build a specific deny or quarantine policy with logging, placing it ahead of permissive rules. Predefine narrow allows for essential flows and set an automatic review or expiration time if the platform supports it.
- Test outside production. Exercise the rule in a representative lab, standby environment or maintenance window. Confirm that the firewall logs both an allowed test flow and a denied test flow, and verify that the rollback configuration loads cleanly.
- Apply with a second person watching. Keep an out-of-band management path available. One operator makes the change while another watches device health, VPN sessions, application checks and safety indicators.
- Verify from several viewpoints. Test from an external network, an ordinary user segment, the trusted management zone and the protected host. Confirm that only the intended ports and destinations work, that direct management from the internet fails, and that required service functions remain available.
- Monitor continuously. Alert on repeated denied connections, new source countries or autonomous systems, unusual egress, authentication failures, configuration changes and route changes. Increase review frequency while the patch is pending.
- Patch and validate. Test the emergency update in a representative environment, deploy it according to the approved change, restart affected services if required and verify the installed version. Run an authenticated vulnerability check or vendor validation rather than assuming that a successful reboot completed the fix.
- Remove temporary controls deliberately. Restore only the access that remains justified, in stages. Compare the resulting rules with the pre-incident baseline, close emergency accounts and retain the change record and logs.
Choosing a containment option
The following choices address the same exposure problem with different availability and operational costs.
Recommended Free Tools
Rank #4
- Quad Core J3710 Processor: F3 firewall hardware with Pentium J3710 Processor, 4 Cores 4 Threads, 2M Cache, up to 2.64 GHz, TDP 6.5 W. Compatible with pfsense, OPNsense, Linux, ESXi, Proxmox
- 4 x i225V 2.5GbE LAN: J3710 mini pc with 4 x i225V 2500Mbps LAN, can monitor network data, improve network security, powerful and widely used
- DDR3 RAM mSATA Slot: J3710 firewall pc with 1 x DDR3L SO-DIMM memory, 1 x mSATA SSD slot, 1 x SATA 3.0 slot(SATA Cable included), 1 x Mini-PCIe Slot
- HD DP Dual Display: Micro firewall appliance J3710 integrated HD Graphics, HD + DP dual display interfaces improve work efficiency
- Fanless Mini Size: Firewall appliance J3710 with aluminium alloy body, fanless quiet running without noise. Size only 11 x 10 x 3.5 cm
| Option | Internet exposure | Rule granularity and segmentation | Visibility | Availability and rollback |
|---|---|---|---|---|
| Physical disconnection | Removed completely | No network path; requires physical access or process shutdown | Host is unreachable, so network telemetry stops | Highest service and safety impact; reconnect only under an approved plan |
| Quarantine or jail VLAN | Removed or reduced to a controlled gateway | Strong separation with explicit ACLs for required peers | Firewall and switch flow logs remain available | Usually reversible without rewiring; test operational dependencies carefully |
| DMZ with strict ACLs | Retained for a necessary public service | Separates the public service from internal and backend tiers | Perimeter, inter-zone and host telemetry can be correlated | Preserves service while limiting lateral movement; rollback is rule-based |
| Host or service ACL block | Specific ports or sources removed | Fine-grained when the firewall supports host-level rules | Denied-flow logs show attempted access | Fast to apply and undo, but broad rules can cause hidden outages |
| Hardened VPN through a jump host | Gateway remains exposed on minimum required ports | Users reach only the jump host and approved management targets | VPN, jump-host and destination logs provide an audit trail | Maintains remote administration with more operational complexity |
Monitoring while the patch is pending
Watch the controls, not just the host
Centralize firewall, VPN, router, cloud-control-plane and endpoint events. Create alerts for a sudden rise in denied traffic, successful logins from new locations, repeated MFA failures, new VPN profiles, unexpected outbound destinations, disabled logging and edits to ACLs or routes. Compare observed flows with the inventory; an unrecognized connection is a reason to investigate, not automatically a reason to allow it.
Scan the exposed edge
From an approved external vantage point, periodically scan the organization’s own internet-facing addresses to confirm that closed ports remain closed and that no forgotten NAT or cloud rule exposes the vulnerable service. Coordinate scan timing with operations and avoid aggressive tests against fragile equipment.
Keep a tested rollback
Store configurations centrally and maintain a written reversal sequence. Define who can authorize rollback, which symptoms justify it and how to preserve evidence if a block is suspected of causing an outage. A rollback should restore the smallest necessary service, not automatically return the entire pre-incident exposure.
Common mistakes and their fixes
Blocking only the advertised exploit port
An advisory may identify one service, while the host has other exposed management or file-sharing interfaces. Reconcile the complete exposure inventory and deny unrelated services rather than relying on a single-port block.
Leaving a broad allow rule above the quarantine rule
Firewall policies are evaluated in vendor-specific order. Review the effective policy, not just the rule you edited, and test from an external network. Shadowed rules and inherited cloud security-group permissions are common causes of ineffective containment.
Best Value
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
Assuming the VPN makes any endpoint acceptable
Require device health, MFA and least privilege, then segment the client. If those controls are unavailable, use a managed jump host or suspend remote access instead of granting a direct route to the vulnerable network.
Making an emergency change without an expiry
Every temporary rule needs an owner, review date and removal condition. Put the expiry in the change record and, where possible, in the firewall or identity platform itself. Review exceptions during the next exposure assessment.
Forgetting safety and dependency checks
A block can interrupt monitoring, authentication, backups or a physical process. Have operations and safety personnel approve the flow list, and keep an out-of-band administrative path so a mistake does not strand responders.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Failing to log denied traffic
Without denial logs, you cannot distinguish successful isolation from a service that is silently failing or an attacker probing the boundary. Enable useful fields, forward them centrally and watch storage and processing capacity.
Restoring normal access after patching
Do not remove the controls merely because the vendor update installed. Verify the patched version on every affected instance, confirm that dependent services operate normally, and perform a vulnerability scan or equivalent vendor check. Review the temporary rule’s logs for attempted exploitation and investigate unexplained connections before reopening access.
Restore connectivity in stages: first essential service flows, then approved administration, and finally any optional access that still has a business owner. Re-scan the public edge, compare the final configuration with the approved baseline, remove emergency VPN accounts and document lessons for the next patch cycle. CISA’s guidance treats exposure review as recurring work, so schedule a follow-up rather than letting the emergency state become permanent.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
