Does My Router Have a Firewall? What It Blocks, What It Misses and How to Check

Yes, almost certainly. Practically every home router and provider gateway sold in the last two decades blocks unsolicited connections from the internet, and most also have a setting explicitly called a firewall. What matters more is knowing what that firewall does, how to check it is on, and which of your own settings punch holes in it.

The Short Answer

A home router protects your network in two layers. Network address translation (NAT) hides your devices behind one public address, so nobody on the internet can start a connection to them directly. On top of that, an SPI firewall (stateful packet inspection) checks that incoming traffic belongs to a connection one of your devices started, and drops everything else. Both are on by default on current routers. The firewall cannot, however, stop malware you download, phishing, or attacks that come through devices and ports you opened yourself.

Layer 1: NAT

All your devices use private addresses such as 192.168.1.x, which cannot be reached from the internet. The router replaces them with its single public address on the way out and remembers which device asked for what. When an unexpected packet arrives from the internet with no matching request, the router has no device to send it to, so it goes nowhere. NETGEAR describes this as NAT securing your network by blocking direct access to your local IP addresses.

NAT was designed to share addresses, not as a security feature, but in practice it makes every home network unreachable from outside unless you open something on purpose.

Layer 2: The SPI Firewall

A stateful firewall goes further. It tracks every connection your devices open and only lets in replies that match one of them, checking that they follow the rules of the protocol. TP-Link’s user guides describe its SPI firewall as protecting the router from cyber attacks and validating traffic passing through it based on the protocol, and note that it is enabled by default.

Many routers add related protections under names such as DoS protection, “Respond to ping on WAN port” (usually off) or blocking of port scans.

IPv6. With IPv6, every device can have its own public address and NAT is not used. Protection then depends entirely on the firewall. The IETF’s recommendations for home routers (RFC 6092) describe this filtering of unsolicited incoming IPv6 traffic, but also require an option to switch it off — a “transparent mode” — and even allow that mode as the default. So if your connection uses IPv6, check the router’s IPv6 firewall settings: unsolicited incoming connections should be blocked unless you need them. See IPv6 vs IPv4.

How to Check Your Router’s Firewall

Sign in to the router — see what is my router IP — and look under Security, Firewall or Advanced → Security. On TP-Link routers, for example, the SPI firewall is under Advanced → Security → Firewall. On many routers it is simply a checkbox labelled “SPI Firewall” or “Enable Firewall”. If it is off, turn it on. Some routers, especially app-managed ones, show no firewall switch at all; the manual or support pages then explain how their protection works.

Then check from the outside. Our port checker tests whether common ports on your public IP address answer. On a typical home network without port forwarding, all of them should be closed.

What Opens Holes in It

The firewall blocks what you did not ask for — but several common settings deliberately let traffic in. Review them:

Port forwarding sends traffic on chosen ports straight to one device. Keep only the rules you actually use; see how to port forward.

UPnP lets devices open ports by themselves. It is convenient for game consoles, but malware can use it too; see how to secure your home network for the trade-off.

DMZ exposes one device completely. Avoid it except as a short test.

Remote management makes the router’s own admin page reachable from the internet. Leave it off unless you need it.

What a Router Firewall Doesn’t Do

It does not inspect what you download. A malicious file or a phishing page arrives through a connection you started, so the firewall lets it through.

It does not protect devices from each other. Once a device on your network is compromised, the router’s firewall does not stand between it and your other devices. A guest network for smart gadgets limits this.

It does not protect you on other networks. On public Wi-Fi or mobile data, your laptop relies on its own firewall. Keep the firewall built into Windows or macOS turned on.

It does not fix old firmware. Vulnerabilities in the router itself are closed by updates, not by the firewall; see how to update router firmware.

Some routers include extra security services — network antivirus, malicious site blocking — sometimes as a paid subscription. They work on top of the firewall and can help, but they are not a replacement for updates and good passwords.

Do You Need a Separate Firewall?

For a typical home, no. The router’s NAT and SPI firewall, together with the firewall on each computer and current updates everywhere, cover what a home network needs. A dedicated firewall appliance or firewall software on a mini PC makes sense for people who run servers at home, need detailed traffic rules and VLANs, or want to monitor everything that leaves the network — and who are prepared to maintain it.