Port forwarding and firewall

I have a Synology NAS running on Static WAN IP cause I need to access its web server(not using quick connect).

Then as the forms on the web say that I have to do port forwarding in order to access home servers from WAN, so I basically just set up port 80 443 and 5001 as the port forwarding to my Synology NAS.

But then one day, I receive loads of warning emails from my server telling that there are bunch of SSH(mine port 44) login failure from some various IP address, and this is the time when I get confused about port forwarding, DOESN'T PORT NOT ON PORT FORWARDING RULE NOT SUPPOSED TO PASSTHROUGH THE ROUTER?

And my other questions are: Does the built-in firewall in a normal router strong enough to protect devices from Dos and other random attacks? What does a firewall machine(I mean a machine with two ethernet ports and it only functions as firewall protection) do more than the built-in one in Router, Windows, and Synology NAS?

ps. Yeah I know always leaving telnet and SSH on is not a good idea, but what if it's been hacked while I'm using SSH for maintenance? Also, if I need a router/firewall, please recommend me the brand(and model).

​

Sorry for my poor English and thanks for your help.