Specific situation of schools
Schools operate networks that typical businesses do not. Within a single building, there is a network for students, one for teachers, the school's administrative system containing personal data, and often guest Wi-Fi for parents or visitors. Yet, this network is usually managed by a teacher in addition to their teaching duties, rather than by a dedicated IT administrator. The budget is limited, but the responsibility, protecting students' personal data, financial administration, and running the electronic student record book, is just as real as in a company.
This does not only concern large schools with their own IT budget. Smaller primary or secondary schools have the same network structure, just with fewer people looking after it. In recent years, the number of pupils and teachers has also been reflected in the number of devices connecting to the school network, teachers' own laptops, tablets in classrooms, devices for the electronic class register. The more devices and user groups a network serves, the more sense it makes to keep them separated from each other.
Content filtering
The web filter can block entire categories of websites based on content type, not just individual addresses manually added to a list, simply select which categories should be inaccessible for the student network, and the filter will enforce them automatically, without manual intervention for each new page. For the student network, stricter settings make sense than for the teacher or administration networks, and the firewall can maintain separate rules for each network simultaneously, without requiring teachers to manage computer supervision rules.
Networks Department: apprentices, teachers, administrative matters
The computer classroom, staff room and administrative or personnel departments should not share a single flat network. A firewall can logically divide the network into separate segments, so that a problem in one part, for example, an infected student laptop, does not automatically spread to areas handling sensitive data, such as pupil personal details or school employee payroll. Guest Wi-Fi for parents or visitors can be completely separated from the school's internal network, ensuring visitors have no access to anything other than internet connectivity.
This section operates on the same principle as in article on the difference between a router and a firewall We describe this for companies, in schools it applies to other user groups. Once a department is set up, it runs automatically, with no need to manually reconfigure anything at the start of each new school year.
Management without a dedicated IT department
Centralised management allows rules to be set once in a single location and then monitored continuously, without the need for manual intervention on each computer or access point individually. Security updates run automatically in the background, with no requirement for anyone to launch them manually. This is particularly important where the network is managed by someone for whom it is not their primary job responsibility.
When a school lacks the capacity to manage its network internally, administration can be outsourced. We handle the technical side, while the school receives only a clear, regular overview of network activity without needing to understand technical details. The headteacher or designated teacher thus retains full oversight while avoiding daily hands-on management of technical operations.
Which functions are most useful for schools
Apart from content filtering and network segmentation, schools also benefit from intrusion prevention and antivirus directly on the firewall: both are described in our article about UTM functions in practiceA VPN is useful where access to school systems (such as the electronic student record or accounting software) is required from outside the building: typically by the headteacher, finance manager or accountant who handle part of their duties from home.
The specific configuration always depends on the size of the school and what the network serves. This is best determined by a brief initial audit of the current state, not by a general recommendation that applies equally to everyone.
Where schools typically begin
In practice, three issues are most commonly addressed simultaneously: separating the student and teacher networks from administrative functions, implementing content filtering for students, and providing secure remote access for school management. The goal is not to do everything at once; it is sufficient to start where the gap is most significant and gradually add the rest as the school's budget and equipment evolve. An audit of the current state, showing how the network currently looks and what is missing, is always the first step, regardless of how much will ultimately be addressed at once.