A network router is a device whose role is to forward packets entering the device out onto an appropriate physical interface, based primarily, or solely, on the destination IP address of the packets. Typically the source address of each packet is not considered in the forwarding decision.

A firewall on the other hand is a device whose primary role is to filter traffic based on specified criteria. Since most network communication between two end-points is bi-directional, any such filtering must correctly handle the packets flowing in both directions that constitute a specific end-to-end 'flow' (for connection-less protocols, such as UDP) or 'connection' (for connection-orientated protocols, such as TCP).

In practice, a firewall appliance will have to make routing decisions too.