If your ADSL router is a real IP router (almost certainly not the case, but it is a good starting point), it relays packets based on IP addresses, using the internal and external addresses and a routing table. Assuming your internal network is a typical class C network (200.1.1.0/255.255.255.0)
PC 200.1.1.10 ------ 200.1.1.1 Router ISP supplied IP address -------{internet}
Packets from your PC get sent via the default gateway (200.1.1.1) which then knows the way to the internet via your ISP. As packets traverse gateways, they update their routing tables, so returning packets find the return path. Systems like this are somewhat exposed - any packet sent to a 200.1.1.x address will get to the router and on to the network. This gives an attacker the opportunity to probe systems within your network looking an exposed system to attack, and every system in the network would need firewall protection, and intrusion detection would be valuable.
However, your home network will not have a real valid class C network address - it will have a private address, probably class C (192.168.x.x). These addresses are non-routable on the wider internet - internet routers just drop these packets, since there are millions of home networks using the same addresses. To get round this, all home ADSL routers use Network Address Translation as a matter of course. NAT filters and rewrites network packets, so all requests from your home network originate with your ISP assigned network address. The router maintains a table that relates internal_address:_port information with external_address:_port information. So when you connect to straightdope.com:80 (http) from your PC, straightdope.com:80 sees a request from ISP_address:1001, and sends the response there. The router sees the response and translates it back to your PC. By managing the internal NAT table, the router can handle multiple internal private addresses. NAT systems are pretty safe by default, as an external system cannot route a connection to an internal system that has not already been established through the NAT table. The only known address (as far as the outside is concerned) is the ISP_assigned one on the outside of the router, and internal details of the network should not leak, and you are effectively firewalled anyhow. Some applications (like Skype) use NAT traversal techniques to allow peer-to-peer connections via NATted systems - Your PC establishes a NAT connection to a Skype server, as does your friend. Once both NAT connections are set up to the Skype server, the connection details are exchanged, and you can then connect directly to your friends NATted Skype connection without going via the Skype server, and they can connect back to you. This is a useful technique, but relies on a central internet server. My son uses Leaf VPN (which uses NAT traversal) to set up game networks with his friends, without me opening holes in my firewall - a big win.
All the Enable Firewall option does on a NAT router is enable additional rules editing, so that you can allow certain packets from outside to be directed to an internal address, or to block certain packets from going outside your network. So if you want your PC to host an internet playable game that uses port 9000, you create a rule that forwards incoming packets from port 9000 on the router to port 9000 on your PC. As far as anyone on the outside is concerned, the ISP_supplied address is listening on port 9000, and no further details of the internal addresses are required. This is less safe than NAT only, but if you are careful about what you expose, the risk is low. Of course, this is a manual process and can be hard for people to understand. Microsoft introduced a system called UPnP, which lets a Windows application automatically modify the router firewall with no security or confirmation - I hope you can see how bad this could be if a virus does infect your PC (it can completely open your firewall, and you would not know) - I would always disable the UPnP option on a router. You can also set the firewall to forward all or most of the traffic to an internal host (a so-called DMZ option). I use this to forward traffic from my router to my Linux server gateway, running a similar firewall as well as other external services - I only maintain a single powerful firewall on the Linux box.
The Intrusion Detection option monitors local traffic looking for suspicious traffic patterns - useful, but not generally necessary. You need to monitor the router to spot the alerts.
Your softwall firewall is different - it monitors your PC for active connections, and compares them with a database. This allows it to spot malware seeking to connect to control servers, or to ask your approval for new applications. It should also maintain information on applications, so if apps get changed, the firewall should alert you. Many firewalls maintain application proxies, so that web downloads and email can be scanned before execution/opening. A software firewall is as important as a hardware firewall, but for different reasons.
Si
