A neighbor asked us this exact question last month, holding a box store receipt for a $200 “firewall device” a salesman had talked him into. We walked to his house, opened his router’s admin page, and showed him the firewall he’d already owned for six years — enabled, working, quietly dropping junk traffic the whole time.
So let’s answer it properly. Yes, your router almost certainly has a firewall. Here’s how to confirm it in about two minutes, what that firewall genuinely protects you from, the surprisingly long list of things it doesn’t, and the honest cases where dedicated hardware earns its keep.
The short answer
Every consumer router sold in roughly the last twenty years ships with two overlapping protections:
- NAT (Network Address Translation). Your home has one public internet address shared by all devices. From the outside, individual devices simply aren’t addressable — a side effect that blocks most unsolicited incoming traffic before any “firewall” logic even runs.
- A stateful firewall (SPI). The router tracks which connections you initiated and only lets responses to those back in. An unsolicited knock from a stranger on the internet gets dropped silently.
Together these mean random attackers scanning the internet can’t simply reach into your laptop. That protection is on by default. The two-minute check is really about confirming nobody (or no glitchy firmware update) turned it off. (If you want the deeper background on how these protections work, CISA’s plain-English guide to firewalls for home and small office use covers the same ground.)
How to check, brand by brand
You’ll need either the router’s app or its admin panel. For the panel, the address and password are usually printed on a sticker on the router itself — and it’s the admin password, not your WiFi password.
eero
There is no firewall toggle in the eero app — the stateful firewall is always on and can’t be disabled, which is very on-brand for eero. To verify your overall posture instead: open the app, tap Settings → Network Settings, and confirm UPnP is off unless you specifically need it (our guide to risky router settings explains why). If you subscribe to eero Plus, Settings → Security shows the additional threat-blocking layer. Owners of the eero Pro 6E: same steps, same answer.
TP-Link Deco
- Open the Deco app → More → Advanced.
- Look for Firewall (on some models it’s SPI Firewall under the web panel at
tplinkdeco.netinstead). - Confirm it’s toggled on. While you’re in Advanced, glance at Port Forwarding — an empty list is what most homes should see.
Netgear (Nighthawk / Orbi)
- Browse to
routerlogin.netand sign in. - Go to Advanced → Setup → WAN Setup.
- Confirm “Disable SPI Firewall” is UNCHECKED. (Netgear phrases it backwards — unchecked means the firewall is on.)
- On the same page, confirm “Default DMZ Server” is unchecked. DMZ places one device fully outside the firewall and almost no home needs it.
Asus
- Browse to
router.asus.comand sign in. - In the sidebar, click Firewall.
- Confirm Enable Firewall: Yes. Asus also exposes DoS Protection here; turning it on is reasonable and costs nothing noticeable.
Any other brand
Log into the admin panel and look for a section literally called Firewall, Security, or SPI — usually under Advanced settings. If the toggle exists, it should be on. If you find it off and nobody in your house did that, treat it as a warning sign and read our guide on checking whether your router’s been tampered with.
What your router’s firewall does NOT catch
This is the part the box-store pitch gets right, even when the product is wrong. The stock firewall is a doorman checking that nobody walks in uninvited. It does nothing about:
| Threat | Why the firewall misses it | What actually covers it |
|---|---|---|
| Phishing links and scam sites | You clicked, so the connection is “invited” | Browser sense + DNS filtering + antivirus |
| Malware in downloads and attachments | Same — outbound request, legitimate-looking response | Antivirus on each device |
| A compromised smart device calling home | Outbound traffic is allowed by default, all of it | Outbound monitoring (see below) or network segmentation via guest WiFi |
| Anything on public WiFi | Your router isn’t with you at the coffee shop | A VPN like Proton VPN or NordVPN |
| Holes you punched yourself | UPnP and port forwarding are firewall exceptions by design | Auditing those settings — start here |
| Threats between your own devices | LAN traffic never touches the firewall | Segmentation, again |
Notice the pattern: the stock firewall watches the front door, in one direction. Modern trouble mostly arrives as something you invited, or starts on a device already inside.
When a dedicated hardware firewall makes sense
For most families: it doesn’t, yet. Router firewall on, UPnP off, guest network for smart devices, antivirus on computers — that stack covers the realistic threats to a normal household, and we’d rather you spend the money on a password manager first.
The calculus changes when any of these are true:
- You run a small business from home — client data, invoices, a point-of-sale system. Outbound monitoring and intrusion detection stop being paranoia and start being diligence.
- Your smart-device count has gotten away from you. Twenty-plus IoT gadgets is twenty-plus vendors’ firmware discipline you’re trusting blind. A monitoring firewall shows you what each device is actually saying to the internet — which is regularly eye-opening.
- You want real segmentation with rules, not just the one guest-network checkbox.
- Kids’ internet management beyond app-store parental controls — per-device pauses, category filtering, usage visibility.
The good news is this category grew up. It’s no longer rack-mounted business gear with a certification exam attached; devices like the Firewalla Purple SE plug in behind your existing router, take about fifteen minutes to set up from a phone app, and give you the outbound visibility and per-device control the stock firewall can’t. For bigger homes and home offices, the Firewalla Gold SE adds the horsepower for gigabit lines, and the Ubiquiti Dream Router 7 rolls router, WiFi 7, and serious firewall into one box. Our full comparison lives in the firewalls section.
Two minutes of extra credit
While you’re in the admin panel anyway:
- Change the admin password if it’s still the sticker default.
- Check for a firmware update — most panels have a button; newer routers do it automatically.
- Turn off remote management / WPS / UPnP unless you knowingly use them — the full walkthrough is here.
Those three items, honestly, do more for a typical home than any hardware purchase.
The bottom line
Yes — your router has a firewall, it’s almost certainly on, and now you’ve verified it instead of wondering. Just be clear-eyed about its job description: it blocks uninvited inbound traffic and nothing else. The threats that actually reach families in 2026 walk in through clicked links, weak passwords, and chatty smart devices. Cover those with device-level protection and sane settings first; then, if your home has crossed into small-business territory or serious smart-home sprawl, the Firewalla Purple SE is the rare security gadget we tested and then simply never unplugged.