Router Hardening
Replaces: Default ISP router config
Secure your router by changing the admin password, disabling WPS and UPnP, and enabling automatic firmware updates.
Sources
trackingmalwarebig-tech-surveillance
Phase
Home Network — router access, 30-90 min
General
The firewall (NAT + SPI) is already ON by default in almost every consumer router — you do NOT need to buy a new router. The real work is closing other security holes:
1. Change admin password (default passwords are publicly known)
2. Disable WPS (PIN-based, crackable in minutes with Reaver)
3. Disable UPnP (lets malware auto-open ports; manually forward if needed)
4. Disable remote admin (router admin page should not be reachable from internet)
5. Set Wi-Fi encryption to WPA3-Personal, or WPA2-AES (never WEP/WPA/WPA2-TKIP)
6. Enable firmware auto-update if available, else check monthly
7. Audit and remove unknown port forwards
8. Rename SSID to something neutral (no name, router model, or ISP)
9. Enable guest network for visitors (client isolation on)
10. Enable IPv6 firewall if your ISP provides IPv6
1. Change admin password (default passwords are publicly known)
2. Disable WPS (PIN-based, crackable in minutes with Reaver)
3. Disable UPnP (lets malware auto-open ports; manually forward if needed)
4. Disable remote admin (router admin page should not be reachable from internet)
5. Set Wi-Fi encryption to WPA3-Personal, or WPA2-AES (never WEP/WPA/WPA2-TKIP)
6. Enable firmware auto-update if available, else check monthly
7. Audit and remove unknown port forwards
8. Rename SSID to something neutral (no name, router model, or ISP)
9. Enable guest network for visitors (client isolation on)
10. Enable IPv6 firewall if your ISP provides IPv6
Related Cards
Research Findings
SPI firewall is enabled by default on TP-Link, Netgear, ASUS, Linksys. NAT hides all internal devices behind one public IP. SPI only allows responses to connections you initiated. The firewall is not the problem — the problem is WPS, UPnP, default admin passwords, and unpatched firmware. No new router needed.