OK, I see what you're asking. Apologies for not answering your question earlier.

First, let's make sure you're got what you think you've got.

A true router makes a decision as to whether to pass a packet from one interface to another by examining network "level-3" addresses and protocol types -- in this case, IP addresses and IP protocol types.

A bridge or switch examines "level 2" network addresses -- these would be your MAC addresses and your Ethernet protocol type.

First, let's get a read on what your router is -- a level 2 or level 3 device. Then I can tell you how to nail it down so that it is very, very difficult to get at your workgroup from the outside. I can't assure you it will be impossible, because of something called "tunneling", which I can explain later how it can be (and is) used to attack through a firewall.

So what is the make/mode/software-rev of your router?