PCI Compliant Firewall Rules for Small Shops

What a PCI compliant firewall actually is

Requirement 1 of PCI DSS is titled “Install and maintain network security controls,” and the standard defines the term widely. In the Council's Quick Reference Guide: “Network security controls (NSCs), such as firewalls and other network security technologies, are network policy enforcement points that typically control network traffic between two or more logical or physical network segments (or subnets) based on pre-defined policies or rules.” The same page adds that the job “may be provided by virtual devices, cloud access controls, virtualization/container systems, and other software-defined networking technology.”

So the question is not which box to buy. It is whether something on your network enforces rules between your card systems and everything else, and whether those rules are written down and kept current. In a small shop that something may simply be the router the internet provider or the installer left behind. No device is PCI compliant on its own; the rules you set on it, and where it sits, are what the requirement checks.

The flat-network rule

The simplest setup is flat: one router, one network, and the terminal, the office PC, the cameras and the guest Wi-Fi all on it. The Council's scoping supplement is blunt about what that costs:

“In a flat network, all systems are in scope if any single system stores, processes, or transmits account data.”

Every PC, tablet and camera on that network then answers to the standard. Splitting the network is the way out. The same page says segmentation is “not a PCI DSS requirement” but is “strongly recommended” as a way to reduce the scope, the cost and the difficulty of compliance, and the risk itself.

The test of a real split is strict. The supplement's bar: “When properly implemented, a segmented (out-of-scope) system component could not impact the security of the CDE, even if an attacker obtained administrative access on that out-of-scope system.” A guest network that shares the terminal's network with a different Wi-Fi name does not pass. A separate network with a rule that blocks it from the terminal can.

The card terminal's own network

Segmentation is optional in the standard, but some SAQs write it into the form. The questionnaires for an IP-connected terminal, a virtual terminal and a small point-of-sale system each make isolation an eligibility condition, and each names network segmentation (C-VT also a firewall) as the way to get there:

The same guide adds detail that matters at the counter. Several IP terminals may share one network: on SAQ B-IP, other IP-connected PTS-approved terminals “can be in the same network zone but must be isolated from all other types of systems.” And the guide names the classic slip: connections that break B-IP eligibility include “connections to cash register systems,” and a terminal that needs a computer, phone or tablet to reach the processor does not fit SAQ B-IP at all.

SAQ B is the exception: its dial-out terminals “do not connect to the Internet” at all (p. 12), so a phone line, not a router, keeps them apart. If you are unsure which of these describes your terminal, the SAQ type finder asks the questions, and every SAQ in the Council's words sets them side by side.

Guest Wi-Fi and the terminal

Wireless gets a rule of its own, and it applies whether or not the Wi-Fi ever carries a card. 1.3.3: network security controls are installed “between all wireless networks and the CDE, regardless of whether the wireless network is a CDE,” so that “All wireless traffic from wireless networks into the CDE is denied by default” and “Only wireless traffic with an authorized business purpose is allowed into the CDE.” Your network diagram has to show those wireless networks too (1.2.3).

If the terminal itself runs on Wi-Fi, more lines arrive. 2.3.1: wireless vendor defaults are “changed at installation or are confirmed to be secure,” including “Default wireless encryption keys” and “Passwords on wireless access points.” 2.3.2: the encryption key is changed “Whenever personnel with knowledge of the key leave the company or the role for which the knowledge was necessary.” In a shop with seasonal staff, that second one is the line people miss.

Then there is the quarterly hunt for access points nobody approved. 11.2.1 has you test for them “at least once every three months,” and “The requirement applies even when a policy exists that prohibits the use of wireless technology.” Our PCI compliance checklist puts the 2.3.1 line on SAQ C and SAQ D and the 11.2.1 line on SAQ C and SAQ D; your SAQ form has the final list.

Source: PCI SSC, Prioritized Approach Tool for PCI DSS v4.0.1 (1.2.3, 1.3.3, 2.3.1, 2.3.2, 11.2.1), read on 2026-10-22

The router's rules, written down

Requirement 1 asks for rulesets that are defined, implemented and maintained (1.2.1), and for inbound traffic to the card systems limited to what is necessary, with “All other traffic … specifically denied” (1.3.1). Outbound gets the same treatment in 1.3.2. For a shop with one router and a terminal on its own network, the whole ruleset fits on one receipt:

Line 06 is the internet side. 1.4.2 lets in only traffic to systems “authorized to provide publicly accessible services” and “Stateful responses to communications initiated by system components in a trusted network,” and “All other traffic is denied.” If you run no public service from the shop, that means replies only. If your router reads rules in order, keep the deny-everything-else lines last.

Which SAQs carry Requirement 1

Not every small merchant answers Requirement 1. Your SAQ decides, and our PCI compliance checklist reads each SAQ's eligibility text to pick its lines. Here is where it puts the Requirement 1 lines; open your SAQ for the full list.

That is our checklist's reading, not the Council's form: the SAQ itself has the final list of questions, and your acquirer has the last word on which SAQ it accepts. Where an SAQ shows no Requirement 1 line, its eligibility conditions still decide how the terminal connects: SAQ B's terminals stay off the internet, for one. For terminals from a validated P2PE solution, what P2PE is covers what the encryption does and does not take off your hands.