How to secure your router and home network

Not all router security issues can be fixed by users, but there are many actions that can be taken to protect them from attacks

Many computer users don't realize it, but for most people their internet router is the most important electronic device in their home. It links most of their other devices together and to the world, so it has a highly privileged position that hackers can exploit.

Unfortunately many consumer and small-business routers come with insecure default configurations, have undocumented backdoor accounts, expose legacy services and have firmware that is riddled with basic flaws. Some of these problems can't be fixed by users, but there are many actions that can be taken to at least protect these devices from large-scale, automated attacks.

Don't let your router be a low-hanging fruit for hackers.

Basic actions

  • Avoid using routers supplied by ISPs. These routers are typically less secure than those sold by manufacturers to consumers. They often have hard-coded remote support credentials that users can't change and patches for their customized firmware versions lag behind patches for the same flaws released by router manufacturers.
  • Change the default admin password. Many routers come with default administrator passwords and attackers constantly try to break into devices using these publicly known credentials. After you connect to the router’s management interface for the first time through your browser — the address should be the router’s default IP address found on its bottom sticker or found in the set-up guide — make sure the first thing you do is change the password.
  • The router's web-based management interface should not be reachable from the internet. For most users, managing the router from outside the LAN (local area network) is not necessary. If remote management is needed, consider using a VPN (virtual private network) solution to establish a secure channel to the local network first and then access the router's interface.
  • Even inside the LAN, it's good to restrict which IP (Internet Protocol) addresses can manage the router. If this option is available, it's best to allow access from a single IP address that is not part of the pool of IP addresses assigned to computers via DHCP (Dynamic Host Configuration Protocol). For example, configure the router's DHCP server to assign IP addresses from 192.168.0.1 to 192.168.0.50 and then configure the web interface to only allow access from 192.168.0.53. The computer should be manually configured to use this address only when you need to connect to the router.
  • Turn on HTTPS access to the router interface, if available, and always log out when done. Use the browser in incognito or private mode when working with the router so that no session cookies are left behind and never allow the browser to save the router's username and password.
  • Change the router's LAN IP address if possible. Most of the time, routers will be assigned the first address in a predefined netblock, for example 192.168.0.1. If offered the option, change this to 192.168.0.99 or something else that's easy to remember and is not part of the DHCP pool. The entire netblock used by the router can also be changed to one of those reserved for private networks. Doing this will protect against cross-site request forgery (CSRF) attacks that try to access routers through users' browsers by using the default IP addresses commonly assigned to such devices.
  • Choose a complex Wi-Fi password and a strong security protocol. WPA2 (Wi-Fi Protected Access II) should be the option of choice, as the older WPA and WEP are susceptible to brute-force attacks. If the router offers the option, create a guest wireless network, also protected with WPA2 and a strong password. Let visitors or friends use this isolated guest network instead of your main one. They might not have malicious intentions, but their devices might be compromised or infected with malware.
  • Disable WPS (Wi-Fi Protected Setup). This is a rarely used feature designed to help users set up Wi-Fi networks easily by using a PIN printed on a sticker. However, a serious vulnerability was found in many vendor implementations of WPS a few years ago that allows hackers to break into networks. Because it's hard to determine which specific router models and firmware versions are vulnerable, it's best to simply turn off this feature on routers that allow it. Instead, you can connect to the router via a wired connection and access its web-based management interface and, for example, configure Wi-Fi with WPA2 and a custom password (no WPS needed).
  • The fewer services your router has exposed to the internet, the better. This is especially true if you haven't enabled those services yourself and don't know what they do. Services like Telnet, UPnP (Universal Plug and Play), SSH (Secure Shell), and HNAP (Home Network Administration Protocol) should not be reachable from the internet as they can pose serious security risks. They should also be turned off on the local network if they're not needed. Online services like Shields UP by Gibson Research Corporation (GRC), can scan your router's public IP address for open ports. Shields Up can also scan for UPnP separately.
  • Keep your router's firmware up to date. Some routers allow checking for firmware updates directly from the interface while others even have an automatic update feature. Sometimes these checks might be broken due to changes to the manufacturer's servers over the years. It's a good idea to regularly check the manufacturer's support website manually for firmware updates for your router model.

More complex stuff

  • Network segmentation can be used to isolate risky devices. Some consumer routers offer the option to create VLANs (virtual local area networks) inside a larger private network. These virtual networks can be used to isolate internet-of-things devices, which researchers have repeatedly shown are full of vulnerabilities. Many IoT devices can be controlled through smartphone apps via external cloud services, so as long as they have Internet access, these devices don't need to be able to communicate with smartphones directly over the local network after the initial set-up. IoT devices often expose unprotected administrative protocols to the local network so an attacker could easily break into such a device from a malware-infected computer, if both are on the same network.
  • MAC address filtering can keep rogue devices off your Wi-Fi network. Many routers allow for restricting which devices are allowed on the Wi-Fi network based on their MAC address -- a unique identifier of their physical network card. Enabling this feature can prevent attackers from connecting to a Wi-Fi network even if they stole its password. The downside is that manually whitelisting legitimate devices can quickly become an administrative burden on larger networks.
  • Port forwarding should be combined with IP filtering. Services running on a computer behind a router cannot be reached from the internet unless port forwarding rules are defined on the router. Many software programs will attempt to open ports in the router automatically via UPnP, which is not always safe. If UPnP is disabled, rules can be added manually and some routers offer the option to specify the source IP address or netblock that can connect on a specific port to reach a certain service inside the network. For example, if you want to access an FTP server on your home computer from work, you can create a port forwarding rule for port 21 (FTP) in your router, but only allow connections from your company's IP netblock.
  • Custom firmware can be more secure than factory firmware. There are several Linux-based, community-maintained firmware projects for a wide range of home routers. OpenWRT, DD-WRT and Asuswrt-Merlin (for Asus routers only) are just some of the most popular ones. These typically offer more advanced features and customizations than factory firmware and their maintainers are quicker to fix flaws when identified than router vendors. Because these firmware packages are aimed at enthusiasts, the number of devices that use them is much lower compared to those that run vendor-supplied firmware. This makes widespread attacks against custom firmware less likely. However, it's very important to keep in mind that loading custom firmware on a router requires a fair amount of technical knowledge, will likely void its warranty and, if done incorrectly, can render the device unusable. You have been warned!

Join the PC World newsletter!

Error: Please check your email address.

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Cool Tech

Crucial Ballistix Elite 32GB Kit (4 x 8GB) DDR4-3000 UDIMM

Learn more >

Gadgets & Things

Lexar® Professional 1000x microSDHC™/microSDXC™ UHS-II cards

Learn more >

Family Friendly

Lexar® JumpDrive® S57 USB 3.0 flash drive 

Learn more >

Stocking Stuffer

Plox Star Wars Death Star Levitating Bluetooth Speaker

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?