Should you enable router firewalls, SPI, and DoS protection? I tested the SPI acceleration theory and changed the switch back to its original state

Last month,

helped a relative dig out an old TP router that was gathering dust. After cleaning up settings in the background, I was stunned when I saw the firewall page: the "SPI Firewall" and "DoS Protection" switches were present, one on and the other off. I remember years ago when searching "how to speed up routers," the first explanation on the screen was always "Turn off SPI Firewall," and many people said the internet speed would take off after turning it off. Whether this claim holds true or not, I took out two machines at home for a round of testing and also got a clear understanding of the details of these two switches.

first clarify what SPI does: the one at the entrance who checks the ledger

the term 'router firewall' is too vague; SPI is the core layer, standing for Stateful Packet Inspection. It sounds intimidating, but the work is not complicated.

ordinary package filtering is like a security guard in a residential complex who only looks at the notice—when you visit, they glance at the address and house number on the visitor slip, and if the format is correct, they let you through. SPI means the security guard has an extra ledger: your computer first sends a request, and it writes a note saying, "Send to row 3, row 2, seat 8, 10 a.m."; Later, someone claimed to be visiting from Row 5, Block 8. He checked the ledger and confirmed the transaction, so he let him through. If a previously unregistered foreign IP comes knocking on the door and the ledger shows no trace, stop them.

key lies in the second half. Your computer actively sends out connections, and the return packet is released; No one outside invited Bao who barged in, so he tacitly blocked him. Under home broadband, this layer of judgment is basically imperceptible because it only focuses on the "entry" direction; watching videos and downloading games is all "out-of-the-door" business.

have to add a fair note: the home router actually has an even thicker natural barrier—the NAT itself. You haven't done port forwarding, so foreign packets can't even find a way into your home. I've done the math in the on port forwarding and DMZ. SPI is the second line of insurance besides NAT, preventing abnormal backpackets and session hijacking that bypass the main door. It also serves as the foundation for a bunch of features—TP's IP address filtering and access control. The official documentation states that the firewall's main switch must be turned on before it works, and once SPI is turned off, all of these collapse.

Where are these two switches hidden: five brands explained one by one

clarify first: not every router has these two switches. I made a table of the routes I saved from home and for others to build PCs:

two details. First, in ASUS's official FAQ, the DoS protection section is labeled as "not required," leaving it off by default—the manufacturer's own attitude says it all. Second, TP's DoS protection level is deeply hidden, set separately in system tools → system parameters, not on the firewall page. The first time I looked for it, I had to take a detour twice. Xiaomi users can skip the second half of the story when they see this. Neither the 31.1 backend nor the Mi Home app leaves this door open; the firewall is always open, and there's nowhere to turn it off even if you want to.

By the way, ASUS's firewall page also has a sleeping suboption for "Respond to Ping Request," which is factory default to denial. Outside, they use scanners to check for live spots in bulk, relying on door-to-door pings—whoever replies has a machine at home. It's fine to default to not replying, don't change your hand to 'yes'.

can SPI speed up? I dug into the origin of this tutorial

"turning off SPI for speed-up" is not nonsense; it is real experience from over ten years ago. Back then, machines like the AC68U and early WDR series had CPUs running only a few hundred MHz per core, and SPI had to check packet by packet—CPUs really couldn't handle it. What's worse is that SPI and hardware acceleration clash: SPI is on, hard acceleration like CTF doesn't work, and gigabit ports can only run 600 to 700 km/h. Turn off SPI and force acceleration to let it go, and the speed immediately returns to over 900. This playstyle was truly practical back then.

problem is that Chinese home routers have already been replaced by two or three generations. I tested it with my ASUS RT-AX86U at home: with SPI on, the gigabit bandwidth measured 941 over wired speed; Turned off SPI and retested, 939; switched three rounds, the numbers fluctuated around 940, the difference completely buried in the speed measurement error. I also glanced at CPU usage; at full download speed, single-core performance is only a little over ten percent. Chips today don't even care about the cost of packet-by-packet inspection. When does the router CPU really become a bottleneck? I specifically calculated in CPU article: in home scenarios, SPI consumption is not among the top in gigabit broadband.

really want to squeeze the pace, the way to do it isn't even the way to touch the firewall. ASUS checked the LAN → switch control to see if NAT acceleration was set to Disable, so just switch back to Auto; Enabling features like QoS and traffic monitoring causes hard acceleration to automatically fail. I wrote about this conflict in QoS . Still holding an old machine from ten years ago, turning off SPI can indeed save it. But the machine itself is already old. When it comes to lifespan, I advise you to read this article first and then decide whether to save it.

DoS the default protection is understandable

DoS protection focuses on attack characteristics: ICMP floods, UDP floods, semi-connected floods, and a bunch of fake packets flooding in to kill lines or machines. Sounds like it should be opened, right? But there are two realities in the home scenario.

First, your chance of being targeted by DoS is so low that it's almost negligible. Nowadays, most broadband providers don't even have public IPs. Ahead of them is a layer of CGNAT from the carrier, so you can't find the address if you want to call outside. The method to determine is in the of the public IP check—you can confirm it in three steps. If there really are public IPs with port forwarding, the premise of being targeted is usually because they have made enemies with someone. Ordinary people don't deserve this treatment.

second, accidental injuries are commonplace. I just had DoS protection enabled for a week, but as soon as qBittorrent downloaded, it ran into trouble: traffic dropped halfway through crawling, and a string of interception records appeared in the log. The reason isn't complicated—BT essentially involves frantically sending and receiving packets with dozens or even hundreds of peers at once. Its traffic characteristics are almost identical to UDP floods, and the protection module can't distinguish between bad actors and diligence. Similarly, when PS5 online games occasionally have issues, NAT types mysteriously dropped from 2 to 3. Later, I thought it matched that era, and the way to troubleshoot online games was in the of the NAT genre.

ASUS official FAQ is very straightforward: after enabling DoS protection, if certain apps encounter connection issues, close them. In other words, this feature is designed for people who really get beaten up; ordinary families just add to their own frustration.

when do you really need to flip these two switches

won't apply a one-size-fits-all approach, just take it personally:

SPI my stance is very clear: don't turn off family use. It doesn't have an advantage in speed; the previous real-world data is clear; Losing a layer of safety insurance for free; He also took the opportunity to dismantle the foundation for IP filtering functions. This is the same idea as when I advised you to turn off WPS back then—the truly watchful switches in the backend. I reviewed them one by one in WPS and UPnP . SPI doesn't get blacklisted, and WMM shouldn't be tampered with. this article tested it.

Wrap up and give me an order

check the backend first to see if these two switches are there; if not, it's worry-free. Second, for switches, keep SPI on; if DoS protection is factory-off, just keep it off. Third, don't blame the firewall for data drops or speed drops. Think back to what you've done recently—just check DoS protection directly. Fourth, if you want to speed things up, check the NAT acceleration page—don't use the firewall as a tool. Fifth, keep the firmware updated, more reliable than any protective switch. How to choose automatic upgrade is article.

In the end,

summed up in one sentence: these two switches were a topic from ten years ago when CPUs were scarce. On today's machines, "all default" is the optimal solution. If you really want to optimize, you can move on to channels, placement, and mesh—those are the old skills that still count today.