DNS filtering vs perimeter firewall where each one actually stops the attack
A FortiGate in your office cannot see a staff laptop on home Wi-Fi or hotel networks. DNS filtering travels with the device.
The coverage map
Most SG SMEs we audit already have a hardware firewall in the office. The question is not whether the firewall works. It is what the firewall can see.
- Staff in office on work Wi-Fi. Firewall sees this. DNS filter also sees this.
- Staff in a café on personal hotspot. Firewall blind. DNS filter sees this.
- Staff phone tethering. Firewall blind. DNS filter sees this.
- Staff at home on personal Wi-Fi. Firewall blind. DNS filter sees this.
In any team where staff work outside the office sometimes, perimeter firewall coverage is roughly 30 to 60 percent of the actual threat surface. The phishing link clicked on a Sunday afternoon at home never touches your FortiGate.
Where each control covers your team
| Feature | StrongKeep DNS filter | Firewall only (FortiGate / Sophos UTM) | Cisco Umbrella | Cloudflare Gateway | No filtering |
|---|---|---|---|---|---|
| Office network coverage | Yes | Yes | Yes | Yes | No |
| Home Wi-Fi coverage | Yes (agent) | No | Yes (roaming client) | Yes (WARP) | No |
| Mobile / phone tethering coverage | Yes | No | Yes | Yes | No |
| Known-phishing block list (auto-updated) | Yes | Manual rule sets | Yes | Yes | No |
| Time to deploy (5-person team) | First device in minutes · whole team in under 2 hours | Multi-day install | ~half a day | ~half a day | 0 |
| Price (per user / month) | Included in Protection, from US$39 (S$49)/month | Hardware capex + annual maintenance | SG SMB pricing on application | SG SMB pricing on application | $0 |
What if I already have Cisco Umbrella?
Cisco Umbrella is a legitimate DNS firewall. We position differently on bundling and SME-friendliness. Umbrella DNS Essentials is typically quoted in the low single-digit-dollar range per user per month for that one capability, on a quote-based annual contract. StrongKeep DNS filtering ships inside the Protection plan, at US$39 (S$49) a month billed annually, alongside EDR, password manager, and bite-sized cyber training in the same line item.
If your team is happy with Umbrella, keep it. The DNS-filter piece of Protection can be turned off and you can still use the rest.
What StrongKeep does that a hardware firewall cannot
- Cloud-managed. No rules to update on a box that lives in a wiring cupboard.
- Home Wi-Fi and mobile coverage through a lightweight agent.
- Blocks known phishing and malware domains at the DNS lookup, before the browser ever connects.
- No per-device install required for office traffic. Configure once at the network level.
- Logs and reports flow into the same console as your EDR alerts.
Close the home Wi-Fi gap in an afternoon
DNS filtering ships inside the Protection plan. No extra licence to buy. Start with a free cyberscan to see what your current setup misses.
Why a hardware firewall is not enoughNo credit card required to run the free cyberscan.