[kevincox]

I don't think I agree with the author here. While if I was shipping a home router I would probably include a stateful firewall by default to match expectations from NAT I think the choice not to is pretty defensible.

1. The average consumer will take most of their devices to the coffee shop or other public WiFi with no thought. So their threat model already includes access from untrusted devices to some degree.

2. Network level security is pretty weak. Most people will give their WiFi password to their friends, do this a couple of times and it is likely that someone with an infected machine enters your network, such that it should no longer be trusted.

3. Users will benefit from direct connections for things like video calls and file transfers.

So you are basically picking between a weak security layer and functionality. I think either choice is reasonable.

That being said I am quite surprised that a stateful firewall isn't an option. But I guess this way their packet rewriting hardware only needs to support IPv4?