41 — Securing a Home Network
Level: Beginner · Time: ~20 min · Prerequisites: Lesson 40 — Security Hygiene — The 20% That Stops 80%
Why this matters
The router in the hall cupboard is the security boundary of the entire house. Everything connected to it — laptops holding work documents, phones holding your mail, a storage box holding ten years of photographs — sits behind one device that most households have not logged into since the day it was installed. The factory administrator password is printed in the manual and repeated in a thousand forum posts, the firmware has never been updated, and the device is quietly forwarding ports to things nobody remembers configuring. None of that needs an advanced attacker to abuse, because the route in is a default password and a device the vendor stopped patching years ago. The whole list takes an afternoon, costs nothing, and removes the majority of realistic home attacks. This lesson is the procedure rather than the theory.
The mental model: one wall, and every room behind it is open
A home network has a hard outside and a soft inside. The router is the only device that speaks to the internet directly; everything behind it can reach everything else by default, because a home network was never designed with internal walls. That single fact explains most of the decisions in this lesson: if two devices cannot reach each other, compromising one of them stops at that device.
| Layer | What it protects | The practical consequence |
|---|---|---|
| The router | every device in the house at once | it is the highest-value device you own and the one you patch least |
| The wireless network | who may join at all | the security mode and the passphrase are the front door |
| Segmentation | freedom of movement between devices | a cheap internet-of-things device should not be able to reach your laptop |
| Name resolution | what the whole household may reach | one change filters every device, with no software installed anywhere |
| Accounts and second factors | what an attacker does with a stolen password | the mail account resets everything else, so it is protected first |
| Backups | the worst day | ransomware and a failed disk are answered by the same control |
[!IMPORTANT] Assume the router is the most valuable and least maintained device in the house. The procedure below is written for a device whose admin page you have never opened, and none of it requires a subscription or a purchase.
Router hardening, in the order that matters
Steps 1 to 4 remove the ways an attacker reaches the admin page at all; the rest remove the ways they get in afterwards.
- Reach the admin interface and change the administrator password first. The router's address is usually the default gateway your computer is using, and the label on the device gives the admin URL. Change the factory administrator password to a long unique one stored in your password manager before anything else — a router whose admin password is
adminis not hardened by any of the steps that follow. - Check whether the device is still supported. Look the model up on the manufacturer's support page and find the date of the most recent firmware release. If firmware stopped arriving years ago, the device is end-of-life: it will never receive a fix again, so every flaw found from this point forward is permanent. An unpatched router is a permanent open door. Replace it — a supported router costs little compared with what sits behind it.
- Update the firmware, then enable automatic updates if the router offers them. Many home routers only update by hand, so diarise it; where automatic updating exists, switch it on and register the device with the vendor so security notices reach you.
- Turn off administration from the internet. Find the setting called Remote Management, Web Access from WAN, Remote Administration, or Allow access from the internet and disable it. You do not need to manage your router from abroad, and an admin page reachable from the internet is found and attacked continuously.
- Turn off universal plug and play (UPnP) and push-button pairing (WPS), and understand why each is a risk. UPnP lets any program on any device ask the router to open an inbound port without asking you — games and some video calls use it, and so does malware, and UPnP implementations have repeatedly been shown to expose internal services to the entire internet. WPS exists so a visitor can join without typing the passphrase, and its short numeric PIN design has been brute-forced for years; even push-button mode is a timed window on your front door. If a game genuinely needs a port, forward it deliberately for that one device instead.
- Review the port-forwarding list and delete everything you cannot explain. This is where the past reaches into today: the camera set up in one afternoon years ago, the console rule nobody remembers, the entry UPnP created by an application. If you cannot name the device and the reason, remove the rule. If something stops working, you have found a rule you can re-add knowingly.
- Turn off services you do not use — USB or SMB file sharing on the router, the DLNA media server, an FTP server, the vendor's cloud-remote feature, printer sharing. Each one is code running on the boundary device with the least maintenance in the house.
- Put the admin interface somewhere nobody else can reach, and accept that changing its port is not security. Administration should answer only to your own network, never to the internet, and where the router supports it only to the wired segment or a dedicated management address. Moving it to a non-standard port changes nothing: a port scan finds it in seconds. That is obscurity, not a control.
- Write down what you changed — model, firmware version, admin address, date — so the next review starts from a page instead of from memory.
[!TIP] Do steps 1, 4, 5 and 6 today even if you never touch the rest. They close the four routes that are actively exploited against home routers, and they take about twenty minutes.
Wireless and segmentation: the settings that matter
Wireless
| Setting | What to choose | Why |
|---|---|---|
| Security mode | the current generation, WPA3; WPA3/WPA2 mixed mode if an older device cannot join | WPA3's handshake resists offline guessing, so capturing it buys an attacker little. WEP is broken, and any option offering only TKIP is a fallback into the past |
| Passphrase | a long random one — 20 or more characters, or a six-word passphrase — stored in a password manager | length beats cleverness: every extra character multiplies the work. Reusing the same passphrase across a home network and a work account is the real risk |
| WPS push-button pairing | off | see step 5 above; the PIN design is the weakness |
| Guest network | on, with its own passphrase and client isolation enabled | visitors and devices get the internet without a route into your own network |
| Hidden network name (SSID) | leave it visible | hiding the name does not stop a determined observer, and it makes your own devices broadcast their search for it. It is convenience theatre, not a security control |
| Admin page protection | a unique admin password, HTTPS where offered, and no cloud remote-access feature | the admin page is the actual prize, not the wireless key |
The practical fallback. If one older device refuses to join WPA3, set mixed WPA3/WPA2 mode. Do not drop to WEP, and avoid TKIP-only configurations — a device you cannot secure on a modern mode is a device to replace or to keep off the network entirely.
Segmentation: the single biggest improvement you can make at home
A cheap camera, a doorbell and a printer are built to a price, patched rarely if ever, and are the easiest devices in the house to compromise. On a flat home network that compromised camera can reach your laptop, your phone and your network storage box. Segmenting them is free on most routers sold in recent years, and it is the highest-value change in this lesson.
| Device class | Where it belongs | Why |
|---|---|---|
| Computers, phones, tablets | main network | these hold real data and log into real accounts |
| Televisions, games consoles, doorbells, cameras, plugs, printers | guest network or a dedicated internet-of-things network | built to a price, updated rarely, and they never need to reach your file shares |
| Visitors | guest network with client isolation | they are on the internet in your house, not in your house |
| Network storage and backup devices | main network, never forwarded from the internet | they hold everything, so nothing else should reach them casually |
Two settings make this work: client isolation (also called AP isolation, or the guest-network option allow guests to access the local network set to off) and, on routers that support it, a separate internet-of-things network with no route to the main one. If your router offers neither, that is a strong argument for the replacement in step 2 — and again, no subscription is required.
Names, updates, accounts, backups and remote access
Filtering name resolution
A resolver that filters known-malicious and advertising domains protects every device in the house at once, including the ones that cannot run security software — the television, the doorbell, the games console. It also gives you a query log, which is one of the most useful pieces of evidence a household can hold; Lesson 44 — Detecting Intrusion with Open-Source Tools uses exactly that data.
| Option | What it gives you | What to expect |
|---|---|---|
| A filtering resolver on a small always-on machine (Pi-hole, AdGuard Home, Blocky) | household-wide filtering, a per-device query log, local caching | free, and needs one machine that stays on |
| An encrypted upstream resolver (DNS over TLS or DNS over HTTPS) | the network between you and the resolver cannot read your queries | configure it on the router or the local resolver so every device benefits |
| A public resolver that filters against a malicious-domain blocklist (Quad9 is the best-known) | filtering with nothing to maintain | set it on the router; you lose the per-device query log |
Two honest caveats. This blocks opportunistic infrastructure — malware that uses a domain already on a blocklist — rather than a targeted attack, and a determined attacker can carry data inside the queries themselves, which Lesson 44 shows you how to spot. And things break: some devices have a hard-coded resolver address and will bypass your filter entirely, which is why filtering belongs on the router, and where a device ignores it, outbound name traffic should be redirected to your resolver. Expect a handful of applications and captive-portal logins to complain; record each exception rather than abandoning the filter.
Updates and inventory
Turn on automatic updates everywhere the option exists — computers, phones, the router, the television, the console, the doorbell. Then write the inventory down, because an asset list turns "the internet is frightening" into a task list.
| Device | Where it is | Owner | Updates automatic? | Network | Why it is here |
|---|---|---|---|---|---|
| Living room television | lounge | household | yes | guest | streaming only |
| Doorbell camera | front door | household | check monthly | internet-of-things | camera and chime |
| Work laptop | study | you | yes | main | work and banking |
A device nobody recognises is worth investigating rather than ignoring. It may be a neighbour on a weak passphrase, a gift someone set up and forgot, a device you bought and misplaced, or an intruder. Its address and its traffic will tell you which, and the quickest first comparison is your own order history and your password manager's list of devices.
Accounts
A unique password for everything, generated and stored in a password manager, and a second factor on the accounts that gate the rest. Start with email, because it is the reset route for everything else, then the mobile phone account (to make number porting harder), the bank, and any cloud storage. Second factors that are an app or a hardware key beat text messages, which can be intercepted by moving the number to another SIM.
Backups
Three copies of anything you cannot lose, on two kinds of media, with at least one copy off-site — the long-standing three-copy rule. Back up more than documents: photographs, the password database (in a form you can restore without it, or you will lock yourself out), phone data, and the router and resolver configurations that took an afternoon to get right. Then perform one restore test, because an untested backup is a hope rather than a control. And keep the storage box off the internet: a network-attached device with ten years of photographs is a ransomware target, so never forward its admin page, file-sharing or FTP ports, and use a virtual private network when you need to reach it from outside.
Remote access
Prefer a modern virtual private network or an overlay network over forwarding ports. A wireguard-based VPN on the router or a small always-on machine, or a mesh overlay product, gives you your own devices on your own network without exposing anything. Never forward remote desktop (the default remote desktop port), SMB file sharing, VNC or SSH directly to the internet — those ports are scanned constantly and brute-forced within hours of appearing. If you need to reach a desktop at home, reach it through the VPN, and put a second factor on the VPN itself.
The 30-minute home audit, and what to watch monthly
Work down the table once, then repeat it twice a year. The column on the right is what you are writing into your notes.
| Item | Why | Done |
|---|---|---|
| Router admin password changed from the factory default | the default is public knowledge | [ ] |
| Firmware version noted, and updating enabled | an unpatched router is a permanent open door | [ ] |
| Remote administration from the internet disabled | removes the continuously scanned admin page | [ ] |
| UPnP disabled | stops applications and malware opening ports for themselves | [ ] |
| WPS disabled | removes the brute-forceable pairing PIN | [ ] |
| Port-forwarding list reviewed, unexplained rules deleted | legacy rules are the most common exposed service | [ ] |
| Unused router services switched off | less code running on the boundary device | [ ] |
| Wireless security on the current mode | weak handshakes are attackable offline | [ ] |
| Wireless passphrase long, random, in the password manager | length, uniqueness, and no reuse | [ ] |
| Guest network on, with client isolation | visitors cannot reach the family network | [ ] |
| Internet-of-things devices moved off the main network | a compromised camera cannot reach a laptop | [ ] |
| Automatic updates on for every device that offers them | patching is the control that keeps working | [ ] |
| Inventory written, with an owner per device | you cannot protect what you cannot list | [ ] |
| Unknown devices investigated | an unexplained device is a finding, not an accident | [ ] |
| Password manager in use, unique passwords everywhere | one leaked password should open one thing | [ ] |
| Second factor on email, phone account, bank, cloud | email is the reset route for everything else | [ ] |
| Backups taken: three copies, one off-site, tested once | ransomware and hardware failure share one answer | [ ] |
| Storage box not exposed to the internet | it is the target that holds everything | [ ] |
| Remote access by VPN or overlay, not a forwarded port | forwarded management ports are attacked constantly | [ ] |
| Filtering resolver in place, with a query log | filters the whole house with no software on any device | [ ] |
| A monthly review date in the calendar | none of the above stays true on its own | [ ] |
What to actually watch each month — fifteen minutes, four checks. Look at the router's list of connected devices and confirm you recognise all of them. Read any firmware notice that arrived and decide whether to apply it this week. Open the port-forwarding table and confirm every rule is still needed and still yours. And skim the resolver's query log for a device making a great many requests to a domain you do not recognise — that is the shape of an infected device, and it is exactly the evidence Lesson 44 teaches you to interpret.
Attack it / Defend it
| The attack | How it works | The control that stops it |
|---|---|---|
| Default admin credentials | the attacker logs in with the factory username and password printed on the device | change the administrator password before anything else, and store it in a manager |
| Exploiting an unpatched router | a published flaw in an end-of-life device is exploited from the internet | check support status, update the firmware, enable automatic updates, replace end-of-life hardware |
| Exposed admin page | the admin interface is reachable from the internet and attacked continuously | disable remote administration, keep administration local-only |
| UPnP-created port forwards | malware asks the router to open an inbound port on its own | disable UPnP, forward ports deliberately, review the list twice a year |
| WPS brute force | a nearby attacker recovers the passphrase from the weak pairing PIN | disable WPS and type the passphrase |
| A compromised device on a flat network | a cheap camera is exploited and then used to reach every other device, because nothing separates them | a guest or internet-of-things network with client isolation, so the compromise stays where it started |
| Malware calling a known-bad domain | the payload fetches instructions from an address on a public blocklist | filtering resolver for the whole household |
| Exposed remote desktop or file sharing | a forwarded management port is brute-forced within hours | never forward those ports; use a VPN or an overlay network with a second factor |
| Password reuse | a password leaked from another site opens a home mail account | unique passwords with a manager, and a second factor on mail first |
| Ransomware against the storage box | the device holding the photographs is encrypted, along with its backups | three copies with one off-site and offline, and no exposure of the device to the internet |
Key takeaways
- The router is the security boundary of the whole house, and it is almost always the least maintained device in it. Admin password, remote administration, UPnP, WPS and the port-forwarding list are where the real risk sits.
- A device that no longer receives firmware is a permanent open door. Support status comes before any feature comparison.
- Segmentation is the highest-value change available at home, and on most modern routers it is free: put the internet-of-things devices and visitors on a network that cannot route to your computers.
- Filtering name resolution protects every device at once, including the ones that can never run security software, though it addresses opportunistic infrastructure rather than a targeted attacker.
- Never expose remote desktop, file sharing or a storage box to the internet. Modern VPN or overlay access is the safe pattern, and a forwarded management port is found within hours.
Check yourself
- A friend's router still works perfectly but its last firmware release was five years ago. Why is that a more urgent problem than a slow wireless connection?
- What does UPnP let happen without your knowledge, and what is the alternative when a device genuinely needs an inbound port?
- Why does hiding the wireless network name not count as a security control?
- You move a compromised doorbell camera's traffic to the guest network with client isolation. What have you actually prevented, and what have you not?
- Which account gets a second factor first, and why is that the one rather than the bank?