What a router does
A router moves traffic between networks. It takes packets from your LAN, performs Network Address Translation so many internal devices can share one public IP address, and forwards them to your ISP. It handles DHCP, basic DNS forwarding and Wi-Fi.
NAT does provide a useful side effect: unsolicited inbound connections have nowhere to go, so they are dropped. That is why a consumer router looks reasonably secure on a port scan — and why people mistake it for a firewall. But NAT inspects nothing. It has no opinion about the content of traffic your users request, and once a connection is initiated from inside, it passes freely.
What a firewall does
A firewall makes decisions about traffic based on policy. A modern business firewall — usually described as a UTM or next-generation firewall — inspects traffic in both directions and enforces rules by application, user, and content rather than just by port number.
Stateful and deep inspection. It tracks the state of every session and can inspect inside encrypted HTTPS traffic, where the overwhelming majority of modern threats now hide.
Intrusion prevention. Signature and behaviour-based detection blocks exploit attempts against your servers and, just as importantly, blocks infected internal devices calling out to command-and-control servers.
Gateway anti-malware and sandboxing. Files arriving over the web are scanned, and unknown executables can be detonated in a cloud sandbox before they reach a workstation.
Content and application control. Category-based web filtering and application awareness stop known-malicious and inappropriate destinations, and give you a defensible acceptable-use position.
Segmentation. VLANs with policy between them keep guest Wi-Fi, CCTV, card terminals and IoT devices away from your servers. This is what contains an incident rather than merely preventing one.
Secure remote access and logging. Proper site-to-site and client VPN with MFA, plus retained logs you can actually investigate after an event.
Zyxel versus a standard ISP router
Licensed, updating threat intelligence. A Zyxel USG FLEX runs subscription IPS, anti-malware, sandboxing and reputation feeds that update continuously. An ISP router's firmware may not be updated for years, and several consumer models have shipped with known unpatched vulnerabilities in the wild.
Visibility instead of a black box. Per-user and per-application reporting, alerting and log retention through Nebula cloud management. A consumer router typically offers a page of connected devices and nothing else, so you cannot answer 'what did that machine talk to?' after an incident.
Segmentation done properly. Multiple VLANs with inter-VLAN policy and separate guest networks as standard, rather than a single flat LAN where a compromised guest phone shares a broadcast domain with your accounts server.
Business-grade resilience. Dual-WAN failover to a 4G/5G or secondary line, device-level HA pairing, and hardware built for continuous throughput with inspection enabled — where a consumer box's throughput collapses the moment any inspection is switched on.
Central, remote management. Nebula lets us push consistent policy, firmware and configuration across every site from one console, with configuration backups. This is how we keep multi-site clients uniform and how we recover a failed unit quickly.
Integrated access layer. Zyxel switches and access points join the same managed fabric, so authentication, VLANs and Wi-Fi policy are one coherent design rather than three unrelated products.
How to tell what you have
A quick test: can you see which applications your users reached last week, block a whole category of website, put guest Wi-Fi on its own network, and receive an alert when an internal machine starts talking to a known-bad address? If the answer is no on all four, you have a router.
Our port scanner tool will show you whether your perimeter is dropping unsolicited traffic, which is a useful first check — but it only tests the inbound half of the problem. The outbound and inspection half is where the firewall earns its money.