Yep, hardware routers aren't application-aware so will allow any traffic through a port that you've permitted access... whereas a software firewall is able to determine whether traffic being pushed on port 80 is coming from your browser or not, as an example.
Pretty much what daniel and paul already said, really
