The FRITZ!Box offers you a completely closed firewall to protect against unwanted data from the internet. In the factory settings, all of the computers, smartphones, and other devices connected to the FRITZ!Box are already fully protected against attacks from the internet.

The FRITZ!Box's firewall provides the following security functions:

• The FRITZ!Box checks all incoming and outgoing data packets and automatically rejects unwanted data from the internet (Stateful Packet Inspection). This way only data packets that are direct replies to previous requests reach the home network.
• None of the devices in the home network are visible on the internet, which means that it is not possible to access the devices directly over the internet. This is ensured by IP Masquerading or Network Address Translation (NAT) on the TCP/IP level.
• By default, all TCP and UDP ports are closed for incoming connections from the internet to the home network. Therefore, so-called "port scans" cannot find any open TCP or UDP ports that could represent weak points for potential attacks from "hackers".
• The FRITZ!Box uses packet filters to prevent data packets (for example NetBIOS) containing information about devices in the home network from reaching the internet.

You can specifically set up port sharing for web servers or VPN servers, online games, and other applications that should be accessible from the internet.

If you want to make it more difficult to identify the FRITZ!Box with port scans, you can enable the option "Firewall in stealth mode" under "Internet > Filter > Lists > Global Filter Settings" in the FRITZ!Box user interface. Then the FRITZ!Box discards all queries from the internet to ports that have not been opened for sharing.

You can find an overview of opened ports and active packet filters under "Diagnostics > Security" in the FRITZ!Box user interface.