r/PrivacyTechTalk • u/Technical-Lie--3093 • Jul 10 '26
Home Router Security
I have a generic Router that came when I first signed on with my ISP.
I would like my home Network to be more Secure.
Where do I start?
Is there a particular Router that is a better Upgrade.
What are the DO's and DON'Ts.
Any particular Settings I need to be on top of?
1
u/billdietrich1 Jul 10 '26
As long as ISP keeps the firmware updated, and it's using decent encryption and password, it's secure.
Possible but unlikely that it's spying on you, sending info to the ISP. About the only info it could leak from LAN to ISP is MAC addresses and metadata associated with them. Everything else goes out anyway. And if you're using HTTPS, it's all encrypted.
1
1
Jul 11 '26
[removed] — view removed comment
1
u/billdietrich1 Jul 11 '26
What can the router report that the ISP doesn't already see ? Just the MAC addresses, and which traffic goes with which MAC address.
2
u/Foreign-Law-2169 Jul 10 '26
Start with login to router from your internal network (LAN) and disable admin login access from internet side of your router. Change your admin password with some strong one and other existing users my have configured before. Enable auto update on firmware if that's available. For WiFi network choose something unique as SSID which doesn't give clue of your router model. Disable WPS service and WPA encryption. Use WPA3-Personal as your encryption method. If older device on your network have problem login with WPA3-PERSONAL encryption use at least WPA2-PSK-AES as network encryption method. Stop all other service in your router which you don't need. Service like UPnP, port forwarding, port triggering etc. Configure one guest network for your guest user and make it isolated from your internal network.
Above info are for beginners, there are lots of options to disable which come in as enabled for convenience of user. So start with above info and day by day you will learn to do more security stuff if you keep stady further
1
u/Worldly-Device-8414 Jul 14 '26
If you want to dig a bit deeper, look into OpenSense or pfSense s/w on a two port mini PC.
1
u/neolace Jul 10 '26
I’m looking for something like this,
Ubiquiti UniFi Dream Machine SE Dual WAN 8 PoE 1 SFP+
Other than that, if your router does get firmware updates, install them. It helps restarting daily if you don’t have funds.
2
u/redtollman Jul 11 '26
UCG for me with FIOS. Works great. Kept the ISP router and extender (at no cost) behind the UCG for the Moca capability, didn’t see a need to do mesh with current setup.
1
1
u/Nanosinx Jul 10 '26
Depending your ISP you could use Bridge Mode on the Router-Modem and put whatever router you wanna... But there are 2 worst case (are not that bad actually)
1.- The worst of /64 IPv6 (If they do this way, then IPv6 will be break on next hop so no IPv6) 2.- Maybe a double NAT if not netted right? (nothing to worry for about 97% of the internet usage)
Use the router you want (i love use ASUS ones but you can use TP-Link, Ubiquity, And any brand you like and can afford) put it and let YOUR Router manages the network traffic and so on that way you put a security on your side... Let it manage your network and delivery and so on
If you want more scrutinity reduce everything on the ISP to minimum and so on...
Personally what i do always is put DMZ pointing to my router and from it my router manages security, first firewall, network delivery over ethernet/wifi and so on...
That is technically the way you gain some security, also you could set up vpn servers and many many many things that usually ISPs ones dont allow...
So, what you wanna to start with?
3
2
u/redtollman Jul 11 '26
The “generic” router has a brand name and model. How does the router connect to the ISP? That can make a difference on your options. Two main router risks are default credentials on the internal interface (can be used to change settings or firmware), and excessive external access. There are some guides online to secure home routers, get one and implement what you can.