To put the router software or hardware. I think there is 1 system unit for this. Personally, I other solutions can not see. The local firewall is already above advised. But personally I'm not comfortable to configure something at each place (when you have to make changes — you'll understand why), I find it easier to tie everything on 1 node (router) and it is already running.