Winston has a firewall in it, but it does not provide firewall protections in all circumstances, as the default configuration for Winston is pass-through of all ports if you only have one Router or device connected to Winston's LAN.

Pass-through of all ports is disabled if Winston detects more than one router or device connected to LAN.  In this case, when port-forwarding was needed for a modem or router firewall without Winston, the same port forwarding would need to be set on Winston.

Winston drops ping and many other types of generic probe requests, obscures IP addresses, adds an additional subnet around your original router to prevent direct access and encrypts DNS to stop rebinding attacks.

We recommend use of a separate firewall for complete protection, such as what may be included in your modem or router. See your owners manual for more information.