How to Enable Your Router Firewall
The SPI (Stateful Packet Inspection) firewall in your router filters out unsolicited incoming traffic before it reaches any device on your network. It is usually enabled by default, but worth confirming.
What the Router Firewall Does
Your router's SPI firewall inspects incoming network packets and blocks any that were not requested by a device on your local network. When your laptop requests a webpage, the router allows the web server's response through because it knows what was requested. But if an outside connection tries to initiate contact with a device on your network without any prior request, the firewall blocks it.
The SPI firewall is your first line of defense against port scanning, unsolicited connection attempts, and some types of network-based attacks. It operates at the network level and protects every device on your network simultaneously, including smart home devices that cannot run their own security software.
How to Enable the SPI Firewall
Go to http://192.168.1.1 or your router gateway IP. Enter admin credentials.
Look under Security, Advanced Security, or Firewall. The option is usually labeled SPI Firewall, Stateful Packet Inspection, or simply Firewall Protection.
Toggle or check the SPI Firewall option to Enabled. Some routers also offer protection against DoS (Denial of Service) attacks and port scan responses - enable these too if available.
Click Save or Apply. The firewall is active immediately - no router restart is required on most models.
The SPI firewall is separate from port forwarding rules. Enabling the firewall does not break any port forwards you have already set up. Forwarded ports are explicitly allowed exceptions in the firewall.
Where to Find Firewall Settings by Brand
| Brand | Path to Firewall Settings |
|---|---|
| Netgear | Advanced > Security > Firewall |
| TP-Link | Advanced > Security > Firewall |
| Linksys | Security > Firewall |
| Asus | Firewall > General (enabled by default) |
| D-Link | Advanced > Firewall Settings |
| Arris/Comcast | Gateway > Firewall |
Good News: It's Almost Certainly Already On
Unlike most settings this site covers, the firewall is one you rarely need to touch. Every consumer router made in the last fifteen years ships with the SPI firewall enabled, and NAT itself adds a layer of accidental protection because unsolicited traffic has nowhere to be forwarded to. The realistic scenarios where it's actually off: someone disabled it while troubleshooting a game and never turned it back on, a used router arrived with previous-owner settings, or a firmware restore loaded an old config. That's the checklist above, five minutes, mostly reassurance.
What the router firewall does not do is filter what your devices themselves request. Malware that phones home, phishing pages, a smart TV shipping analytics, all of that is outbound traffic the SPI firewall happily allows because a device inside asked for it. Content filtering, DNS-level blocking (Quad9, AdGuard DNS) and device hygiene handle that side; the firewall's job is keeping the outside from initiating contact, and it does that one job well.
What Those Firewall Menu Options Actually Mean
Router firewall pages love unexplained toggles, so here's a translation of the usual suspects. "Disable WAN ping response" (or "block ICMP"): whether your router answers pings from the internet. Ignoring pings makes you slightly less visible to lazy scans; it doesn't meaningfully change security either way. "DoS protection": rate-limits flood-style traffic; fine to leave on, though on weak CPUs it can shave a little throughput. "ALG" entries (SIP ALG especially): protocol helpers that rewrite traffic for old VoIP and FTP setups, and SIP ALG is notorious for breaking modern VoIP more often than helping, if calls drop or one-way audio plagues you, turning SIP ALG off is the first classic fix. "DMZ": exposes one chosen device to everything from the internet, which is a firewall bypass, not a firewall feature. It has legitimate short-term diagnostic uses and almost no legitimate permanent ones.
If you changed something while troubleshooting and things got worse, the safe baseline on virtually every router is: firewall on, DoS protection on, SIP ALG off, DMZ empty, and specific port forwards instead of broad exceptions.