Major American corporations, US Government Agencies, their contractors and others discovered that sophisticated crackers easily defeat packet filtering routers. Although routers provide useful functions and a modest level of security many companies augment routers with firewall systems that sit between the public unsecured and the private secure networks.
Advanced routers provide packet filtering capabilities.
Packet filters drop, reject or permit, packets based on destination IP address, source IP address, and application port numbers. Filters base decisions on the contents of the current packet with no general context maintained. When a site has more than a dozen non-contiguous Class C networks in internal use, routers are often configured with several hundred filters per port . Thus, you have to trust everyone on the system. If the trusted host is cracked, the cracker can get through your packet filter.