Why SuperSupport Does Not Change Firewall Rules

A firewall rule by chat is set quickly. And just as quickly it is a hole.

“Can you please open the port for remote support?” “Open up the guest Wi-Fi.” “Set the VPN so it is always connected.” Requests like these land in support. An AI agent with access to the firewall could grant them straight away. SuperSupport deliberately does not, just as with password resets and user management.

Where the agent works, and where it does not

The SuperSupport agent runs on the workstation, Windows or Mac. There it checks what is going on with the device.

Firewalls, routers, switches, Wi-Fi controllers and the VPN gateway are infrastructure. They apply to all devices in the company. Changes to them are administration, not first level.

Reason 1: A rule applies to everyone

A mistake on a workstation affects one employee. A mistake on the firewall affects the whole company, up to a total outage of internet, VPN or telephony. Whoever changes a rule has to know the consequences for all devices and services.

Reason 2: Port forwards are entry points

Openly reachable services are among the most common ways in for attackers, above all Remote Desktop. See Remote Desktop will not connect and Ransomware: recognizing it and first steps. A port forward “just for the technician” often stays open for years, in our experience.

Reason 3: No credentials to the infrastructure in the support tool

A tool that can change firewall rules needs the firewall's admin credentials. Whoever compromises the tool then holds the key to the network. SuperSupport does not need these credentials for first level, so it does not get them.

Reason 4: Changes to the infrastructure should be documented

What was changed, when and why? For firewall and network changes, that is the basis for troubleshooting, audits and insurance. See IT documentation for small businesses and Cyber insurance.

What SuperSupport does instead

Network problems almost always begin with a sentence like “The internet is not working”. That is exactly where the agent helps, from the affected device:

• Adapter, IP address, gateway – Is the device on the right network at all?
• DNS – Is the name resolved?
• Reachability – Does the server, the printer, the NAS respond? Is the port open?
• Wi-Fi – Signal, frequency band, dropouts
• VPN – Is the client running, is it connected?
• Proxy, time, certificates – Is something on the device preventing the connection?

Beta

IT support that fixes itself.

supersupport.ai handles your 1st-level support fully automatically. Secure your spot on the waitlist now.

Join the Waitlist

• If it is the device, it solves it: flush the DNS cache, restart an adapter, reconnect a Wi-Fi profile, remove saved old credentials. See Internet connection unstable and Network drive disconnected.
• If it is the network, it hands IT a case with measurements: “Gateway reachable, DNS not responding, affects three devices on the second floor” instead of “The internet is not working”.
• Sensitive changes on the device (fixed IP, turning off adapters) it submits for approval.

That turns a vague cry for help into a precise report, and the change to the infrastructure is made by whoever can take responsibility for it.

Who is this the right choice for?

• Small and midsize businesses that have an MSP look after their firewall and do not want additional access points there.
• MSPs that manage customer networks centrally: the agent helps with narrowing things down, and the change stays with the technician. See MSPs.
• Companies with security requirements that have to keep changes to the infrastructure traceable.

What does SuperSupport offer?

SuperSupport takes over first-level IT support via chat, directly on the Windows or Mac device: the agent handles harmless things itself, submits sensitive ones to IT for approval, every step is logged, and every chat is also the case record. How this looks for internal IT teams and MSPs is described on the respective pages.

Frequently asked questions

Can SuperSupport change firewall rules or router settings?

No, deliberately not. The SuperSupport agent runs on Windows and Mac workstations, not on firewalls, routers, switches or Wi-Fi controllers. Changes to the network infrastructure stay with IT or the MSP.

Why should an AI not create firewall rules?

Because a firewall rule applies to all devices, can open security holes and is often not reversed. Opening a port on request, for example for Remote Desktop, is one of the most common ways attackers get into company networks.

What does SuperSupport do about network problems?

The agent diagnoses from the affected device: connection, IP address, gateway, DNS, VPN, Wi-Fi signal, whether servers and ports are reachable. If the problem is on the device, it solves it; if it is on the network, it hands IT a case with measurements instead of “The internet is not working”.

Does the agent change network settings on the PC?

Only on the device itself and only if it is harmless or has been approved, such as flushing the DNS cache, restarting an adapter or reconnecting a Wi-Fi profile. Turning off network adapters or changing fixed IP addresses it submits to IT for approval.

Who changes the firewall and router then?

IT or the MSP, with access to the management interface, documentation of the change and ideally a four-eyes principle for security-relevant rules.

Beta

IT support that fixes itself.

supersupport.ai handles your 1st-level support fully automatically. Secure your spot on the waitlist now.

Join the Waitlist