The perimeter is the boundary between the internal corporate network (Intranet) and the external Internet (or ISP). A router alone forwards packets — it doesn't decide who is allowed through. Anything beyond minimal trust requires packet filters, firewalls, or ALGs.

The two-zone mental model:

   Internet (untrusted)
        │
   ━━━━━━━━━━━  ← perimeter (the line of defense)
        │
   Intranet (trusted, your network)

Why a router isn't enough:

Functionality	Router	Firewall
Forwards packets between networks
Stops packets based on policy	(in default config)
Tracks connection state		(stateful FWs)
Inspects application content		(NGFW/WAF)
Logs decisions	Minimal

A router with no ACLs forwards everything it can route. The perimeter exists because routing ≠ security — connecting two networks doesn't decide what should be allowed between them.

Why "perimeter" is partially obsolete:

The classic perimeter model assumed: "inside = trusted, outside = hostile." Today with cloud services, remote workers, BYOD, and SaaS, that boundary is dissolving — hence Zero-Trust Architecture (where nothing is trusted by default, regardless of network position). The perimeter still exists as a defense layer; it's just no longer the only one.

Tip: Even Zero-Trust networks deploy firewalls — they just don't rely on them as the sole defense. Defense-in-depth is the lesson: layer perimeter FW + host FW + identity-based access + encryption.

Go deeper:

• Zero trust architecture (Wikipedia) — the perimeterless model dissolving the classic inside-trusted/outside-hostile boundary.
• NIST SP 800-207 — Zero Trust Architecture — the authoritative primary source for the "never trust, regardless of network position" model that supersedes pure perimeter defense.
• Access-control list (Wikipedia) — the router ACL mechanism that turns routing into security policy.

A firewall is a system of hardware and/or software components, deployed between two or more networks, that enforces three core properties: all traffic must be authorized, unknown protocols are dropped, and the firewall itself must resist attack.

The three required properties:

The Wikipedia callout for context:

"A security system that protects a computer network or a single computer from unwanted network access."

Why "hardware and software":

A firewall isn't just "a box" or "a piece of software" — it's the combination:

• Software defines the rules and inspects packets.
• Hardware provides the network interfaces and processing power.
• The OS underneath is hardened (often a stripped-down Linux/BSD).

Common physical forms:

Tip: When someone says "we have a firewall" — ask what kind. Many "firewalls" in SOHO routers are little more than NAT + a basic ACL. Real perimeter firewalls cost from CHF 1k for entry-level appliances up to 6 figures for enterprise stateful clusters.

Go deeper:

• Firewall (computing) — Wikipedia — covers the generations (packet filter → stateful → application layer) with their historical dates in one place.
• NIST SP 800-41 Rev. 1 — Guidelines on Firewalls and Firewall Policy — the primary-source reference defining firewall technologies and policy; the canonical citation for any firewall topic.