@d0ugmac1 I don't want the router to originate connections to the internet on its own. Like reaching for updates, asking for the time or due to bugs. Call me "old school" but i want the firewall to be completely mute to the internet. If updates are gonna be installed, I prefer to give them to the router from the lan. Nowadays, even popular Linux firewall distros are generating various connection request to the internet per one single user connection request. It reveals there is a firewall there and it reveals the model of the firewall too.

AFAIK in some companies, they have their own internal time and update servers that provide updates and time from behind the walls. These servers are connecting the internet only occasionally, from only one public IP, reducing this way the attack surface.

  @d0ugmac1 I really don't want to mention other brands here. First i wrote a long rant, then deleted it. Considering the alternatives, I still think R605 is the best deal. Will use it and rant to myself :)