The router features a packet-level firewall that inspects each packet and makes a determination as to whether it will be permitted to pass through. This allows the router to block unsolicited packets by keeping a log of the active connections.
It also has built-in denial of service and anti-IP spoofing protection and allows security alerts to be logged to a syslog server.

A default 'deny' policy (although port 1723 PPTP is allowed) ensures that when the router is powered up, it does not allow inbound connections although the wireless connection remains insecure until you manually either turn it off, or set up access lists, encryption, etc.

The IP filter/firewall is quite complex allowing a number of rulesets, etc. help is not far away at http://www.draytek.co.uk/support/filtering1.html.