And it's easy to make mistakes in setting up the routing table. Most people don't think in terms of IP addresses and port numbers. Some packet filters provide a graphical user interface to help with table administration, but the conceptual difficulties remain. Add an entry to allow access to your private network from some favored remote site on the Internet, and if you're not very careful you can end up inadvertently allowing wide-open access to your site. Therefore, setting up your own packet filtering is not recommended unless you're a very experienced system administrator.
Some system administrators dislike packet filters because of their inadequate logging facilities.
Packet filters only log the raw packet data going into and out of the router. For all these reasons, if you want real security you need more than just a router. Firewalls Another way to build a firewall is to put a computer system between the Internet and the private network. Many companies concerned about security use both a bastion host and a packet-filtering router. A proxy server is just a miniature version of an already existing network service that you want to allow to send data through your firewall.