On October 16, 2026, researcher Quentin Kaiser presented a flaw in Broadcom’s Wi-Fi Protected Setup code at the Hexacon conference, and The Hacker News reported that it lets an attacker in radio range run code as root on affected routers, with no CVE assigned and no fix deployed to the devices he tested. He calls it WPSplinter. Most home-router checklists predate that finding, and almost none of them tell you what to do when the vendor never ships a patch.
This tutorial takes a different route. You will work through 13 steps in about 50 minutes and change the router security settings that decide whether a stranger on your street, a hijacked IoT camera or a bot on the internet gets anywhere. The primary goal is simple: update the firmware, shut the doors you never use, encrypt the Wi-Fi properly, split the network into zones and prove the result with a scan.
The steps work on stock firmware from the big consumer brands, on OpenWrt 25.12.6 and on MikroTik RouterOS 7.23.8. If you are shopping for hardware first, our walkthrough of a Wi-Fi 8 gaming router setup shows what current flagship firmware menus look like. By the end you will also have a small Python audit script that checks your own gateway in under ten seconds.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
Why Router Security Settings Matter in October 2026
The router is the one device that sees every packet your household sends. It also runs a full operating system, exposes a web server and often an SSH daemon, and tends to get updated less often than a phone. Three stories from the last two weeks show how that plays out.
First, WPSplinter. According to The Hacker News, Kaiser showed the attack against gateways supplied by Belgian internet providers, in one case reading the Wi-Fi password off the device and in another opening a remote shell over the air. The Register adds that the bugs trace back to at least 2010 and that Kaiser first reported them to Broadcom in July. He reports no attacks in the wild. The catch for owners is that Kaiser reportedly knows of no setting that blocks the attack over the air, so turning WPS off is good hygiene but is not a cure. Hardware that never gets a patch has to be replaced.
Second, OpenWrt 25.12.6 shipped on October 18, 2026. The release announcement says it fixes several remotely triggerable vulnerabilities in core network services that are enabled by default. One of them, CVE-2026-102338, is a high-severity memory-exhaustion denial of service in the uhttpd web server caused by an unlimited number of HTTP request headers. Another, in the optional ser2net package, scores a critical 9.9 on the CVSS scale because a newline in a configuration option could add a connection that runs commands as root.
Third, MikroTik. RouterOS 7.23.8 landed on October 8, 2026 with fixes for CVE-2026-84411 and CVE-2026-103903, and independent researchers at MikroTik Dojo documented an SSH authentication bypass, CVE-2026-67276, that they confirmed against RouterOS 7.23.3. Same lesson, different vendor.
None of this requires panic. It requires a checklist that you actually finish. The sections below give you one, with commands you can paste and outputs you can compare against.
What this guide covers and what it skips
Everything here targets the router or gateway at the edge of a home or small office network. It does not cover endpoint antivirus, VPN selection or enterprise gear with RADIUS. Where a step differs between stock firmware, OpenWrt and RouterOS, you get all three. Where a menu name differs between brands, you get the usual labels and a note on where they hide.
Prerequisites and Versions
You need less than you might think. Set up the following before step 1 so you do not stop halfway with the admin page half configured.
- A router or gateway you are allowed to configure. ISP-managed gateways often hide or lock several settings. Step 1 shows you how to tell.
- A wired Ethernet connection from a laptop to the router. Do not change Wi-Fi security over Wi-Fi, because you will drop your own session mid-change.
- Python 3.9 or newer for the audit script. Any recent Python 3 release works because the script uses only the standard library.
- A current nmap release from nmap.org for the manual port checks in step 13.
- A phone with a cellular connection that is not on your home Wi-Fi. You will use it to test whether your router answers from the outside.
- A password manager. Your router will get a new admin passphrase and a new Wi-Fi passphrase, and neither should live on a sticky note.
- 50 free minutes and about ten minutes of tolerance for your household losing internet briefly.
Version reference as of October 22, 2026:
| Platform | Current stable build | Release date | Status note |
|---|---|---|---|
| OpenWrt 25.12 series | 25.12.6 | October 18, 2026 | Sixth service release of the series, includes security fixes |
| OpenWrt 24.10 series | 24.10.8 | July 26, 2026 | OpenWrt said security updates for this series stop after September 2026 |
| MikroTik RouterOS | 7.23.8 | October 8, 2026 | Long-term release, fixes CVE-2026-84411 and CVE-2026-103903 |
| MikroTik RouterOS 7.26 | beta builds only | October 2026 | Beta, do not run it on a production router |
| Stock firmware | Whatever your vendor lists as latest | Varies | Check the support page for your exact model and hardware revision |
If you run OpenWrt 24.10, plan the move to 25.12 this week. The project has stopped providing security updates for the 24.10 series as of the end of September 2026, which makes an unmodified 24.10 install a poor fit for a security-focused setup.
Time budget
| Step | Task | Minutes |
|---|---|---|
| 1 | Inventory the router and its firmware | 4 |
| 2 | Back up the current configuration | 2 |
| 3 | Update the firmware | 8 |
| 4 | Replace the admin credentials | 3 |
| 5 | Turn off remote administration | 2 |
| 6 | Limit local admin access and kill legacy services | 3 |
| 7 | Set Wi-Fi encryption to WPA3 or transition mode | 5 |
| 8 | Disable WPS | 2 |
| 9 | Turn off UPnP and audit port forwards | 3 |
| 10 | Build guest and IoT networks | 6 |
| 11 | Lock down DNS | 5 |
| 12 | Shrink the remaining attack surface | 3 |
| 13 | Verify from inside and outside | 4 |
| Total | 50 |
Steps 1 to 3: Inventory, Back Up and Update the Firmware
Firmware is where this checklist earns most of its value. Every other setting below limits damage, but a patched router closes the hole itself.
Step 1: Inventory the router (4 minutes)
Find out what you actually have. You need the make, model, hardware revision, current firmware version and whether your ISP manages the device. Start by finding the gateway address from a wired laptop.
# Linux
ip route show default
# macOS
route -n get default | grep gateway
# Windows (PowerShell)
Get-NetRoute -DestinationPrefix 0.0.0.0/0 | Select-Object NextHopOn Linux the output looks like this:
default via 192.168.1.1 dev eth0 proto dhcp metric 100Open that address in a browser, log in and look for a page called Status, System Information or About. Write down the firmware version and the hardware revision from the label on the underside of the router. The revision matters because a vendor may ship different firmware for revision A and revision B of the same model.
Then decide which of three categories you are in:
- You own the router. You control firmware and every setting. This is the easy case.
- The ISP supplied a combined modem and router. The ISP usually pushes firmware through a remote management channel, and some settings will be greyed out. Plan to put your own router behind it, or ask the ISP to switch the gateway to bridge mode.
- You run OpenWrt or RouterOS. You have the most control and the most responsibility. You also get fast patches.
Pull the version on OpenWrt with one command over SSH:
ubus call system board{
"kernel": "6.12.112",
"hostname": "OpenWrt",
"model": "Example Router v1",
"release": {
"distribution": "OpenWrt",
"version": "25.12.6"
}
}On RouterOS, run /system resource print and read the version line. The 7.26 documentation branch on MikroTik’s site is a beta line, so do not follow a beta tutorial on a router you rely on.
Step 2: Back up the current configuration (2 minutes)
Every change below is reversible if you have a backup, and painful if you do not. Export the configuration now and store it on the laptop, not on the router.
- Stock firmware: look for Administration, Backup or Save Settings, then download the file.
- OpenWrt: in LuCI go to System, Backup / Flash Firmware, then Generate archive. Or run
sysupgrade -b /tmp/backup.tar.gzand copy it off with scp. - RouterOS: run
/export file=pre-hardeningfor a readable text export, plus/system backup save name=pre-hardeningfor a binary backup, and download both from Files.
Treat the backup as a secret. Router backups often contain the Wi-Fi passphrase, PPPoE credentials and VPN keys in a form that is easy to read.
Step 3: Update the firmware (8 minutes)
Check the vendor’s support page for your exact model and hardware revision, download the newest firmware and compare the published checksum if the vendor lists one. Then flash it from a wired connection and do not unplug anything during the process. A flash that gets interrupted is the most common way people brick a router.
Many mainstream mesh systems and routers have a firmware or system update screen in their admin page or vendor app. Open it and enable automatic updates with an overnight window if it is offered. Automatic updates take away the human delay that turns a patch into a months-long exposure.
On OpenWrt, download the 25.12.6 image for your device from the official firmware selector and flash it. Verify the checksum first:
sha256sum openwrt-25.12.6-your-device-sysupgrade.bin
scp openwrt-25.12.6-your-device-sysupgrade.bin [email protected]:/tmp/
ssh [email protected] "sysupgrade -v /tmp/openwrt-25.12.6-your-device-sysupgrade.bin"Keep settings is the default for sysupgrade, so your configuration survives. If you jump across a major series, for example from 24.10 to 25.12, read the release notes first. The upgrade path can differ per device, and a clean install plus your saved settings is sometimes safer than a keep-settings flash.
On RouterOS, run:
/system package update check-for-updates
/system package update installStay on the stable or long-term channel. MikroTik’s product pages also state that the included devices receive free software updates for the life of the product or at least five years from purchase, so check your purchase date against that window.
If your vendor stopped shipping firmware for the model, note that down. You will use it in the section on when to replace the router. Hardening settings lessen risk, but they cannot fix a bug in a network daemon you cannot patch.
Expected result: after the reboot, the status page shows the new version number. Log in again, because several vendors reset the session or the admin password policy after a major update.
Steps 4 to 6: Lock Down Admin Access
The admin interface is the most valuable target on the router. These three steps decide who can reach it, from where and with what credentials.
Step 4: Replace the admin credentials (3 minutes)
Change the admin password to a long random passphrase from your password manager. Aim for at least 16 characters and do not reuse any other password. If the router lets you rename the admin account from admin to something else, do that too, because it removes the first username every credential-stuffing bot tries.
If the vendor offers a cloud account for remote management, treat that account like your email. Turn on multi-factor authentication, and prefer a hardware key if it supports one. Our guide to FIDO2 hardware security key setup covers the registration flow in detail. If you do not use the vendor’s cloud features, delete the account link entirely, because an unused cloud login is an unwatched door.
On OpenWrt, set the root password with passwd and switch SSH to key-based login:
passwd
# paste your public key into /etc/dropbear/authorized_keys, then:
uci set dropbear.@dropbear[0].PasswordAuth='off'
uci set dropbear.@dropbear[0].RootPasswordAuth='off'
uci commit dropbear
service dropbear restartTest a second SSH session with your key before you close the first one. If the key does not work and you already disabled passwords, you will need failsafe mode to get back in.
On RouterOS, add a new full-rights user, log in as that user and then disable the default admin account:
/user add name=netadmin group=full password="use-a-long-random-passphrase"
/user disable adminStep 5: Turn off remote administration (2 minutes)
Remote administration, sometimes labeled Remote Management, Web Access from WAN, Access from Internet or Remote Access, lets anyone on the internet reach your login page. Turn it off. If you need to manage the router while you are away, put a VPN in front of it and reach the admin page through the tunnel.
Exposed management is the same class of mistake that fills the news about exposed Windows RDP: a powerful login page reachable by everyone, protected by a single password. The router version is worse, because routers rarely have account lockout or alerting.
On stock firmware, the toggle usually sits under Administration, Management or Advanced. Save, then test from your phone on cellular data. Browse to your public IP address. If you see a login page or even a certificate warning, remote administration is still on or the ISP is forwarding it. You will do a more rigorous check in step 13.
On OpenWrt, confirm that no firewall rule forwards or accepts WAN traffic on the admin ports. The default firewall drops it. List any custom rules:
uci show firewall | grep -E "src='wan'|dest_port"On RouterOS, the equivalent is a short input chain rule that drops everything arriving from the WAN interface list that you did not explicitly allow:
/ip firewall filter add chain=input connection-state=established,related action=accept
/ip firewall filter add chain=input in-interface-list=LAN action=accept
/ip firewall filter add chain=input in-interface-list=WAN action=drop comment="drop all other WAN input"Place those rules above any permissive rules and check the order with /ip firewall filter print. Put the LAN accept rule in place before you add the drop rule, or you will cut yourself off.
Step 6: Limit local admin access and kill legacy services (3 minutes)
Even from the LAN, the router does not need to speak every protocol it was built with. Turn off Telnet, FTP and any plain HTTP admin page. Keep HTTPS for the web interface and SSH with keys if you use the command line.
On stock firmware, look for Administration, Services or Management and set HTTPS only. Disable Telnet if it is listed. Some vendors hide an FTP or Samba server inside a USB sharing feature. If nothing is plugged into the USB port, switch the feature off.
On OpenWrt, bind the services to the LAN interface so they never listen on the WAN side, and redirect plain HTTP to HTTPS:
uci set dropbear.@dropbear[0].Interface='lan'
uci set uhttpd.main.redirect_https='1'
uci commit dropbear
uci commit uhttpd
service dropbear restart
service uhttpd restartThe uhttpd flaw fixed in 25.12.6 matters here. It is a good reason to keep the web interface reachable from the LAN only and to run the current release.
On RouterOS, disable the services you do not use and restrict the rest to your LAN subnet:
/ip service disable telnet,ftp,www,api,api-ssl
/ip service set ssh address=192.168.88.0/24
/ip service set winbox address=192.168.88.0/24
/tool mac-server set allowed-interface-list=LAN
/ip neighbor discovery-settings set discover-interface-list=LANMikroTik’s documentation changed shape in October (the current docs now describe 7.26 and the 7.25 edition was frozen), so confirm that each command matches the manual page for the version you run. The syntax above is long-standing, but menu paths do move.
Steps 7 and 8: Wi-Fi Encryption and WPS
Wi-Fi is the radio doorway to your network. Anyone parked within range can try it, which is why the settings here carry extra weight.
Step 7: Set WPA3 or a WPA2/WPA3 transition mode (5 minutes)
The Wi-Fi Alliance positions WPA3 as the current security baseline for new certified equipment, and WPA2 has not disappeared. For a home router, the practical rule is short: use WPA3-Personal if every important device supports it, otherwise use WPA2/WPA3 transition mode. Do not weaken the passphrase to make an old device connect, and do not leave WPS on.
Pick the mode from this table.
| Mode (OpenWrt name) | What it does | Use it when |
|---|---|---|
WPA3-Personal (sae) | WPA3 only, no WPA2 fallback | Every device you care about supports WPA3 |
WPA2/WPA3 mixed (sae-mixed) | WPA3 clients use WPA3, older clients use WPA2 | You have a mix of new and old devices |
WPA3-Personal Compatibility Mode (sae-compat) | Shown in LuCI as WPA2-PSK/WPA3-SAE Compatibility Mode, WPA2-only clients see WPA2 and capable clients can use WPA3 | Some clients fail on ordinary transition mode |
| WPA2-PSK | Legacy only | Last resort for an isolated IoT network |
| Open or WEP | No meaningful protection | Never |
OpenWrt recommends sae for a modern WPA3-capable network and sae-mixed when older clients must stay connected. The 25.12.6 release also changed the WPA3 defaults. According to the release announcement, it stopped offering GCMP-256 and SAE-EXT-KEY by default in the sae and sae-mixed modes, and it added a transition_disable option that tells clients not to fall back to older security modes on a WPA3 network. It also enables Beacon Protection when protected management frames are on. If a WPA3 client could not join after an earlier update, 25.12.6 is the release that targets those interoperability problems.
Set it from SSH on OpenWrt like this:
uci set wireless.default_radio0.encryption='sae-mixed'
uci set wireless.default_radio0.ieee80211w='1'
uci set wireless.default_radio1.encryption='sae-mixed'
uci set wireless.default_radio1.ieee80211w='1'
uci commit wireless
wifi reloadThe ieee80211w option controls protected management frames. A value of 1 means optional and 2 means required. Start with 1 on a mixed network so older clients still connect, and move to 2 once you have confirmed that every device handles it.
On stock firmware, open Wireless, Security or Wi-Fi settings and choose WPA3-Personal or WPA2/WPA3. Many brands bury protected management frames under Advanced or label it PMF or 802.11w. Turn it on whenever compatibility allows.
Choose a passphrase of at least 16 random characters or a four-word passphrase with a separator. Do not reuse the router admin password. Also change the default network name to something impersonal. Names like the vendor’s model or your surname hand an attacker free reconnaissance.
If you are buying a new router anyway, a current Wi-Fi 7 model such as the one in our devolo BE9300 Wi-Fi 7 router coverage ships with WPA3 as part of the Wi-Fi 7 certification. According to the Wi-Fi Alliance, Wi-Fi CERTIFIED 7 products support the required security capabilities including WPA3, so you can stop treating WPA3 as an optional extra on new hardware.
Step 8: Disable WPS (2 minutes)
Wi-Fi Protected Setup lets a device join without typing the passphrase, through a push button or a short PIN. TP-Link’s guidance says the push-button window lasts roughly two minutes and then expires, which is fine in theory. In practice, the PIN method has long been a brute-force target, and now WPSplinter shows that the WPS code path itself can be a memory-corruption bug on Broadcom-based routers.
NETGEAR states that many modern routers ship with WPS disabled by default and recommends turning it off right after temporary use. France’s government-backed Cybermalveillance.gouv.fr recommends the same in its guidance on securing a Wi-Fi network.
Look for WPS under Wireless, Advanced or Wi-Fi Protected Setup, and switch off both the push button and the PIN. On OpenWrt, confirm that you have not installed a wpad build with WPS support and enabled it by hand.
Now the honest part. According to Kaiser’s reporting, turning WPS off in the menu may not remove the vulnerable code from a Broadcom-based router, and changing the Wi-Fi password does not fix it either. Treat the toggle as one layer. If your router is a Broadcom-based ISP gateway and your ISP has not confirmed a fix, the safer long-term move is to replace the gateway or put your own router behind it in bridge mode and switch the ISP radios off. The section on when to replace the router covers how to decide.
Steps 9 and 10: UPnP, Port Forwards and Network Segmentation
Steps 9 and 10 stop a compromised device from reaching everything else. A smart plug with a bad firmware update should not be able to talk to your laptop or open holes in your firewall.
Step 9: Turn off UPnP and audit your port forwards (3 minutes)
Universal Plug and Play lets any device on your LAN ask the router to open an inbound port automatically. That is convenient for consoles and torrent clients, and it is also exactly what malware wants. Current router-security guidance continues to recommend disabling UPnP unless a specific application needs it.
The risk is not only theoretical. According to the UPnP Forum, the vulnerabilities concerned third-party libupnp and MiniUPnP implementations rather than the UPnP standard itself, and it urged vendors to use maintained, current stacks. Many routers embed those open-source libraries, so on old firmware UPnP is a liability.
Disable it in the router menu under Advanced, NAT or UPnP. On OpenWrt, if you installed miniupnpd, stop and disable it:
service miniupnpd stop
service miniupnpd disableOn RouterOS:
/ip upnp set enabled=no
/ip firewall nat print where comment~"upnp"Then audit what is already forwarded. Open Port Forwarding, Virtual Servers or NAT in the admin page and read every rule. Delete anything you do not recognize or no longer use. Ports opened for a game server you stopped hosting two years ago still point at a machine on your LAN.
If a console complains afterward about a strict NAT type, do not turn UPnP back on as a reflex. Create one explicit forward for the one device, or follow our guide to fix a strict NAT type with a static address reservation and a narrow rule. A single documented port is much easier to defend than an open-ended automatic mechanism.
Step 10: Build guest and IoT networks (6 minutes)
Segmentation means putting devices with different trust levels on different networks. At minimum, create two extra Wi-Fi networks:
- Guest. For visitors. Internet access only, with client isolation on.
- IoT. For smart plugs, cameras, TVs and anything that you do not fully control. Internet access only, no route to your main devices.
Most current routers ship a Guest Network switch. Turn it on, give it its own passphrase and enable the option called AP Isolation, Client Isolation or Allow guests to see each other (set to off). Some budget routers label the guest option as simple Wi-Fi sharing without true isolation, so test it. Connect a phone to the guest network and try to open the main router’s admin page and a file share on your laptop. Both should fail.
For IoT, repeat the process with a second guest-style network if your router allows more than one. If it does not, a cheap approach is to put IoT on the guest network and give visitors your phone’s hotspot. It is not elegant but it works.
On OpenWrt, create a new interface and zone with its own subnet and firewall rules. This sketch uses iot as the interface name and a separate private subnet of your choice:
uci set network.iot=interface
uci set network.iot.proto='static'
uci set network.iot.ipaddr='192.168.30.1'
uci set network.iot.netmask='255.255.255.0'
uci set dhcp.iot=dhcp
uci set dhcp.iot.interface='iot'
uci set dhcp.iot.start='100'
uci set dhcp.iot.limit='100'
uci set dhcp.iot.leasetime='12h'
uci add firewall zone
uci set firewall.@zone[-1].name='iot'
uci set firewall.@zone[-1].network='iot'
uci set firewall.@zone[-1].input='REJECT'
uci set firewall.@zone[-1].output='ACCEPT'
uci set firewall.@zone[-1].forward='REJECT'
uci add firewall forwarding
uci set firewall.@forwarding[-1].src='iot'
uci set firewall.@forwarding[-1].dest='wan'
uci add firewall rule
uci set firewall.@rule[-1].name='IoT-DHCP-DNS'
uci set firewall.@rule[-1].src='iot'
uci set firewall.@rule[-1].proto='udp'
uci set firewall.@rule[-1].dest_port='53 67'
uci set firewall.@rule[-1].target='ACCEPT'
uci commit
service network restart
service firewall restartNext, add a Wi-Fi SSID attached to the iot network, with ieee80211w set to 1 and encryption sae-mixed or psk2 depending on the devices. The zone setup above lets IoT devices reach the internet and the router’s DHCP and DNS, and nothing else.
On RouterOS, the cleaner path is a VLAN or a separate bridge with its own address pool and a firewall rule that drops traffic from the IoT list to the LAN list. Write the drop rule first and the accept rules after, then test.
Some devices, such as casting dongles and printers, expect to be on the same subnet as the phone that talks to them. If something stops working after the split, resist the urge to merge the networks. Add a narrow rule for that one device pair. Troubleshooting item 4 below covers it.
Steps 11 and 12: DNS and the Rest of the Attack Surface
DNS is the phone book of the internet, and whoever controls it can send you to a fake bank. Attackers still abuse DNS, and router DNS settings are a classic hijack target because a changed resolver quietly affects every device.
Step 11: Lock down DNS (5 minutes)
Do three things: choose a trusted upstream resolver, encrypt the link to it if the router supports that, and stop devices from sidestepping the router’s DNS.
First, set the upstream resolver in the WAN or Internet settings. Cloudflare’s public resolver at 1.1.1.1 and 1.0.0.1 is a reasonable default. According to Cloudflare’s documentation, a separate 1.1.1.1 for Families variant adds malware filtering, and the standard 1.1.1.1 service does not sell user data to advertisers. If you run a filtering resolver on your own LAN, point the router’s DHCP DNS option at that machine instead. Either way, check that the router no longer hands out the ISP’s resolver to clients unless you chose that on purpose.
Second, encrypt DNS where the firmware allows it. Many current routers support DNS over TLS or DNS over HTTPS in the Internet or DNS settings. OpenWrt offers packages for both. RouterOS documents DoH support, and MikroTik rewrote its DNS documentation on September 24, 2026, so use that page for the exact options. One caveat from a community thread: a user reported that remote DNS requests stopped working after upgrading to RouterOS 7.23.5, and the cause was still under discussion in mid-October, so test DNS from a client right after any RouterOS upgrade.
Third, stop DNS bypass. Many TVs, browsers and apps hardcode a resolver such as 8.8.8.8 or use their own DoH, which sidesteps whatever filtering the router does. You can redirect plain DNS from the LAN back to the router on OpenWrt:
uci add firewall redirect
uci set firewall.@redirect[-1].name='Force-DNS'
uci set firewall.@redirect[-1].src='lan'
uci set firewall.@redirect[-1].src_dport='53'
uci set firewall.@redirect[-1].src_dip='!192.168.1.1'
uci set firewall.@redirect[-1].dest_ip='192.168.1.1'
uci set firewall.@redirect[-1].dest_port='53'
uci set firewall.@redirect[-1].proto='tcp udp'
uci set firewall.@redirect[-1].target='DNAT'
uci commit firewall
service firewall restartThis catches plain port 53 only. Apps that use DoH over port 443 blend in with normal web traffic, so you cannot stop them with a port rule. The workaround is blocking known DoH endpoints at the firewall or accepting that some apps will bypass the router. For most households, the redirect rule covers the lazy hardcoded cases.
On RouterOS, also stop the router from answering DNS queries that arrive from the internet:
/ip firewall filter add chain=input in-interface-list=WAN protocol=udp dst-port=53 action=drop comment="no WAN DNS"
/ip firewall filter add chain=input in-interface-list=WAN protocol=tcp dst-port=53 action=drop comment="no WAN DNS tcp"An open resolver on the WAN side gets abused in amplification attacks. MikroTik Dojo’s October 18 report from its own gateway described dropping 464,107 DNS amplification queries in one hour of real WAN traffic, which gives you a feel for how constant that background noise is.
Step 12: Shrink the remaining attack surface (3 minutes)
Spend three minutes on the leftovers. Each one is small, and together they remove a lot of exposure.
- Respond to ping from WAN. Turn it off. Scanners use ping replies to find live hosts.
- Dynamic DNS. If you set up DDNS for remote access years ago and no longer use it, delete the entry. It publishes a stable name that points at your home.
- USB sharing and media servers. Disable them if no drive is attached.
- ISP remote management (TR-069). On an ISP-supplied gateway you usually cannot turn it off, because the ISP uses it for updates. On your own router, disable any TR-069 or CWMP client.
- Wi-Fi extenders and powerline adapters. Each has its own admin page and firmware. Our WiFi extender setup guide covers the placement side, and the security side is to give each unit a unique admin password and update it with the same discipline as the main router.
- Router apps and cloud features. Remove anything you do not use, including remote-access relays, parental-control cloud accounts and vendor analytics.
- Logging. Turn on local logging. If your router can ship logs to a syslog server or a NAS, do it. A log you never read still helps after an incident.
Keep a written list of every change you made and why. When something breaks in six months, that list saves an hour of guessing.
Step 13: Verify from the Inside and the Outside
A setting is only real once you have tested it. Step 13 gives you three checks: a LAN-side port scan, an external probe and the audit script in the next section.
LAN-side port scan
From a wired laptop, scan the router’s TCP ports and its two most interesting UDP ports. Replace the address with your gateway.
nmap -sT -Pn -p 21,22,23,53,80,443,7547,8080,8291,8443,8728,8729 192.168.1.1
sudo nmap -sU -Pn -p 53,1900 192.168.1.1A hardened stock router might return:
PORT STATE SERVICE
21/tcp closed ftp
22/tcp closed ssh
23/tcp closed telnet
53/tcp open domain
80/tcp open http
443/tcp open https
7547/tcp closed unknown
8080/tcp closed http-proxy
8291/tcp closed unknown
8443/tcp closed https-alt
8728/tcp closed unknown
8729/tcp closed unknown
PORT STATE SERVICE
53/udp open domain
1900/udp open|filtered upnpPort 53 stays open because the router is your LAN resolver. Port 80 should only redirect to HTTPS. If 23 or 21 show open, go back to step 6. If UDP 1900 answers an SSDP request, UPnP is still on.
External probe
Switch your phone to cellular data, turn Wi-Fi off and find your home’s public IP address using any what-is-my-IP page. From a second machine that is not on your home network, or from a laptop tethered to your phone, run the same scan against that public address:
nmap -sT -Pn -p 22,23,80,443,7547,8080,8291,8443,8728,8729 YOUR.PUBLIC.IP.ADDRESSEvery port should come back filtered or closed. A response on a web or router-management port means remote administration or an ISP-side forward is still active. Only scan addresses you own. Scanning someone else’s network without permission is illegal in many places.
Watch the traffic
If you want ongoing visibility, mirror the router’s traffic to a small box that runs a passive monitor. Our guide to setting up the Zeek network security monitor walks through the install and gives you connection, DNS and HTTP logs that make odd behavior from an IoT device easy to spot.
The Working Project: A Router Audit Script
This script automates the LAN-side checks from step 13 and a few more. It finds your default gateway, tests the risky ports, sends an SSDP probe to see whether UPnP answers, checks whether plain HTTP redirects to HTTPS and tests how the router handles DNS. It uses only the Python standard library, so it runs on Linux, macOS and Windows without installing anything.
Save it as router_audit.py:
#!/usr/bin/env python3
"""Quick LAN-side audit of a home router. Standard library only."""
import argparse
import http.client
import json
import platform
import re
import socket
import struct
import subprocess
import sys
RISKY_PORTS = {
21: ("FTP", "FAIL"),
22: ("SSH", "WARN"),
23: ("Telnet", "FAIL"),
80: ("HTTP admin", "WARN"),
443: ("HTTPS admin", "INFO"),
7547: ("TR-069 ISP management", "WARN"),
8080: ("Alternate HTTP admin", "WARN"),
8291: ("WinBox", "WARN"),
8443: ("Alternate HTTPS admin", "INFO"),
8728: ("RouterOS API", "WARN"),
8729: ("RouterOS API-SSL", "WARN"),
}
def default_gateway():
system = platform.system()
try:
if system == "Linux":
out = subprocess.check_output(["ip", "route", "show", "default"], text=True)
match = re.search(r"default via (\d+\.\d+\.\d+\.\d+)", out)
elif system == "Darwin":
out = subprocess.check_output(["route", "-n", "get", "default"], text=True)
match = re.search(r"gateway:\s+(\d+\.\d+\.\d+\.\d+)", out)
elif system == "Windows":
out = subprocess.check_output(["ipconfig"], text=True)
match = re.search(r"Default Gateway[ .]*:\s*(\d+\.\d+\.\d+\.\d+)", out)
else:
return None
except (OSError, subprocess.CalledProcessError):
return None
return match.group(1) if match else None
def tcp_open(host, port, timeout=0.7):
with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:
sock.settimeout(timeout)
return sock.connect_ex((host, port)) == 0
def ssdp_response(host, timeout=2.0):
message = (
"M-SEARCH * HTTP/1.1\r\n"
"HOST: 239.255.255.250:1900\r\n"
'MAN: "ssdp:discover"\r\n'
"MX: 1\r\n"
"ST: upnp:rootdevice\r\n\r\n"
).encode()
with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as sock:
sock.settimeout(timeout)
try:
sock.sendto(message, (host, 1900))
data, _ = sock.recvfrom(2048)
except (socket.timeout, OSError):
return None
return data.decode(errors="replace")
def http_redirects_to_https(host):
try:
conn = http.client.HTTPConnection(host, 80, timeout=2)
conn.request("HEAD", "/")
resp = conn.getresponse()
location = resp.getheader("Location", "")
return resp.status in (301, 302, 307, 308) and location.startswith("https://")
except OSError:
return False
def dns_answers(server, name="example.com", timeout=2.0):
tid = 0x1A2B
header = struct.pack(">HHHHHH", tid, 0x0100, 1, 0, 0, 0)
qname = b"".join(bytes([len(p)]) + p.encode() for p in name.split(".")) + b"\x00"
packet = header + qname + struct.pack(">HH", 1, 1)
with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as sock:
sock.settimeout(timeout)
try:
sock.sendto(packet, (server, 53))
data, _ = sock.recvfrom(512)
except (socket.timeout, OSError):
return False
return len(data) > 12 and struct.unpack(">H", data[:2])[0] == tid and (data[3] & 0x0F) == 0
def run_audit(gateway):
results = []
def add(status, check, detail):
results.append({"status": status, "check": check, "detail": detail})
for port, (label, level) in RISKY_PORTS.items():
if tcp_open(gateway, port):
add(level, f"tcp/{port} {label}", "open on the LAN side")
else:
add("PASS", f"tcp/{port} {label}", "closed")
if tcp_open(gateway, 80):
if http_redirects_to_https(gateway):
add("PASS", "HTTP to HTTPS redirect", "port 80 redirects to HTTPS")
else:
add("WARN", "HTTP to HTTPS redirect", "port 80 serves the admin page without redirecting")
reply = ssdp_response(gateway)
if reply:
add("WARN", "UPnP / SSDP", "router answers SSDP discovery, UPnP looks enabled")
else:
add("PASS", "UPnP / SSDP", "no SSDP answer")
if dns_answers(gateway):
add("PASS", "Router DNS", "router resolves names for the LAN")
else:
add("WARN", "Router DNS", "router did not answer a DNS query")
if dns_answers("192.0.2.53", timeout=1.5):
add("INFO", "DNS interception", "a query to an unused address got an answer, so DNS is being redirected")
else:
add("INFO", "DNS interception", "no redirect detected, devices can use any resolver they like")
return results
def main():
parser = argparse.ArgumentParser(description="Audit a home router from the LAN side.")
parser.add_argument("--gateway", help="router IP (default: detect the default gateway)")
parser.add_argument("--json", action="store_true", help="print JSON instead of a table")
args = parser.parse_args()
gateway = args.gateway or default_gateway()
if not gateway:
sys.exit("Could not detect the default gateway. Pass --gateway 192.168.1.1")
results = run_audit(gateway)
if args.json:
print(json.dumps({"gateway": gateway, "results": results}, indent=2))
else:
print(f"Router audit for {gateway}")
print("-" * 64)
for r in results:
print(f"{r['status']:<5} {r['check']:<28} {r['detail']}")
counts = {s: sum(1 for r in results if r["status"] == s) for s in ("FAIL", "WARN", "PASS", "INFO")}
print("-" * 64)
print("FAIL {FAIL} WARN {WARN} PASS {PASS} INFO {INFO}".format(**counts))
sys.exit(1 if any(r["status"] == "FAIL" for r in results) else 0)
if __name__ == "__main__":
main()Run it from a wired laptop:
python3 router_audit.pyOn a router that has been through steps 1 to 12, the output looks like this:
Router audit for 192.168.1.1
----------------------------------------------------------------
PASS tcp/21 FTP closed
PASS tcp/22 SSH closed
PASS tcp/23 Telnet closed
WARN tcp/80 HTTP admin open on the LAN side
INFO tcp/443 HTTPS admin open on the LAN side
PASS tcp/7547 TR-069 ISP management closed
PASS tcp/8080 Alternate HTTP admin closed
PASS tcp/8291 WinBox closed
PASS tcp/8443 Alternate HTTPS admin closed
PASS tcp/8728 RouterOS API closed
PASS tcp/8729 RouterOS API-SSL closed
PASS HTTP to HTTPS redirect port 80 redirects to HTTPS
PASS UPnP / SSDP no SSDP answer
PASS Router DNS router resolves names for the LAN
INFO DNS interception a query to an unused address got an answer, so DNS is being redirected
----------------------------------------------------------------
FAIL 0 WARN 1 PASS 12 INFO 2The one WARN is expected because port 80 is open to serve the redirect. The exit code is 1 only when a FAIL appears, so you can run the script from a cron job or a scheduled task and alert yourself if Telnet or FTP ever reappears after a firmware update. A reset to factory defaults is a common way for old settings to sneak back.
Extend it as you like. Common additions are a check for a self-signed certificate on 443, a comparison of the reported server header against a known-bad list and a JSON export that feeds into your monitoring. Keep the script read-only, though. It should observe the router, never change it.
Common Pitfalls When Changing Router Security Settings
Most failures here are self-inflicted. These six account for the bulk of the support threads.
Pitfall 1: Changing Wi-Fi security over Wi-Fi. The moment you save a new encryption mode, your laptop drops off the network and the admin page stops responding. Sometimes the router applies half the change and the browser never sees the confirmation. Always use a cable for steps 5 to 12.
Pitfall 2: Restricting admin access before confirming you can still get in. Limiting SSH to a subnet, disabling the default admin account or switching to key-only login are all good moves. Do them one at a time and keep a second session open until the first test succeeds. On RouterOS, safe mode (Ctrl+X in the terminal) rolls back changes if you lose the connection.
Pitfall 3: Going WPA3-only on a house full of old gadgets. An older smart plug or printer may not speak WPA3 at all. If you set sae and half the house disappears, switch to sae-mixed or move the old devices to an isolated IoT network on WPA2. Do not respond by turning security off.
Pitfall 4: Treating the WPS toggle as a fix for WPSplinter. Based on the researcher’s reporting, switching WPS off in the menu may not remove the vulnerable code from a Broadcom-based router. It is still worth doing, but do not stop there. Check the vendor and ISP for firmware, and plan a replacement if none exists.
Pitfall 5: Forgetting that guest networks need actual isolation. Some routers offer a second SSID that still bridges onto the main LAN. After you create the guest or IoT network, join it with a phone and try to reach the main admin page and a shared folder. If either works, the isolation is cosmetic.
Pitfall 6: Updating an ISP gateway and assuming the job is finished. The ISP controls firmware on its own schedule, and it may reset settings during a push. Recheck remote management, WPS and UPnP after any ISP maintenance window. Better still, put your own router behind the gateway so that you own the settings that matter.
Troubleshooting: 10 Problems and Fixes
- I cannot open the admin page after restricting access to the LAN. You probably bound the service to the wrong interface or subnet. Connect by cable, set a static IP in the router’s subnet and try again. On OpenWrt, boot into failsafe mode by pressing a button when the LED flashes during boot, then fix
/etc/config/uhttpdor/etc/config/dropbear. On RouterOS, use MAC-server access in WinBox from the same Layer 2 segment, then loosen the address list. - A device will not join the Wi-Fi after I enabled WPA3. Switch the SSID to
sae-mixedor WPA2/WPA3 mixed. If a specific client still fails, trysae-compaton OpenWrt, which the 25.12.6 release added for clients that cope badly with ordinary transition behavior. Also set protected management frames to optional rather than required. - A console shows a strict NAT type or friends cannot join my game server after UPnP went off. Reserve a DHCP address for the console or server, then add one explicit port forward for the ports the game documents. If you host a server for friends, follow our game server security setup so the forward points at a hardened host instead of a general-purpose PC.
- Chromecasts, printers or smart speakers vanish after I split the network. Discovery protocols such as mDNS do not cross subnets by default. Either put the controlling phone and the device on the same network, or enable an mDNS reflector (an Avahi reflector on OpenWrt, the mDNS repeater on RouterOS) between exactly those two zones. Do not remove the firewall boundary to fix discovery.
- DNS stopped working after a change or an upgrade. Query the router directly with
nslookup example.com 192.168.1.1. If the router answers but clients do not, check the DHCP DNS option. If you use RouterOS, note that a community thread reported remote DNS requests failing after the 7.23.5 upgrade and that the cause was not confirmed as a formal regression, so compare your forwarder and allow-remote-requests settings and review the thread before blaming your own config. If DoH to an upstream resolver is the suspect, fall back to plain upstream DNS temporarily to isolate the problem. - The router will not boot after a firmware flash. Do not keep power cycling it. On stock firmware, use the vendor’s recovery mode, usually a button held during power-on, then upload the image through the recovery page. On OpenWrt, use failsafe mode and run
firstbootfollowed by a reboot to reset to defaults, then restore your backup archive. - Settings are greyed out or revert on an ISP gateway. The ISP is locking or overwriting them. Ask support for bridge mode (sometimes called IP passthrough), then connect your own router and apply the whole checklist there.
- Internet speed dropped after I turned features on. Some consumer routers disable hardware NAT acceleration when you enable certain firewall or QoS features. Test with a wired speed test, then turn features off one at a time to find the culprit. The most common offenders are deep packet inspection add-ons and heavy logging.
- A smart TV or older laptop cannot connect when PMF is required. Set protected management frames to optional (ieee80211w value 1) for that SSID, or move the device to the IoT network where you can run WPA2 and still keep it away from your main devices.
- The audit script reports that it cannot detect the gateway, or it shows UPnP as enabled when I turned it off. Pass the address by hand with
--gateway 192.168.1.1. For the SSDP result, remember that some routers answer discovery for the router’s own device description even when port mapping is disabled. Confirm in the admin page that the UPnP port-mapping service is off, and check the list of active mappings.
Advanced Tips for Router Hardening
Once the basics pass the audit, a few upgrades move the needle further.
Use a VPN for remote access instead of a port forward. If you want to reach your home network while traveling, run a WireGuard or similar VPN endpoint on the router or on a small always-on box, and open a single UDP port for it. That swaps a login page exposed to everyone for a cryptographic handshake that ignores strangers.
Pair a managed switch with VLANs. If your router and access points support VLAN tagging, carry the IoT and guest SSIDs on separate VLANs end to end. That is cleaner than relying on isolation features inside a single consumer access point, and it scales if you add cameras or a home lab.
Reserve addresses and name your devices. A DHCP reservation for every device you own makes strange new clients stand out in the lease table. Review the lease list monthly. An unfamiliar device that stays connected is worth a closer look.
Ship logs somewhere durable. Send syslog from the router to a NAS or a small server. Pair that with the connection logs from a passive monitor and you can answer questions after an incident, such as which device first talked to an odd domain. The wider cybersecurity coverage on this site goes deeper on tooling for that.
Schedule the audit. Run router_audit.py weekly from a machine that is always on, and alert yourself on exit code 1. Firmware updates and factory resets are the two events most likely to restore something you disabled.
Rotate secrets on a schedule. Change the Wi-Fi passphrase when someone you shared it with leaves your life, and rotate the admin passphrase yearly. A guest network with its own passphrase makes the first rotation painless, because you only touch the main SSID for devices you own.
Test your recovery path. Restore your backup on a spare router or at least confirm the file opens. A backup you have never restored is a hope, not a plan.
When to Replace the Router Instead of Hardening It
Settings cannot patch code. If the vendor has stopped shipping firmware for your model, you are running a device whose known flaws will stay known. Use these checks:
- The support page shows a last firmware date from several years ago and the product is listed as end of life.
- Your ISP gateway uses a chip family that the researcher lists as unfixable. According to The Hacker News, Kaiser identified the older eCos-based Broadcom chips BCM3380, BCM3383 and BCM33834 as ones where he found no usable fix, and for gear that will never be fixed he says replacement is the practical option.
- Your router runs an OpenWrt series that has dropped security support, such as 24.10, and the hardware has a supported image for 25.12.
- The vendor will not tell you whether your model is affected by a disclosed flaw such as WPSplinter.
Replacement does not have to mean an expensive flagship. A router with a long update commitment and a reputation for patching quickly matters more than raw Wi-Fi speed. MikroTik, for example, states on its product pages that included devices get free software updates for the product’s life or at least five years from purchase. OpenWrt supports a long list of hardware and publishes service releases like 25.12.6 on a public schedule. If you want to see where flagship hardware is heading, our report on the ASUS Wi-Fi 8 router launch covers what is arriving, though you do not need Wi-Fi 8 to be secure.
The takeaway: firmware currency beats feature lists. A modest router that gets patched within weeks of a disclosure protects you better than a premium model that stops updating after a short window.
FAQ: Router Security Settings
What are the most important router security settings to change first?
Update the firmware, change the default admin credentials, turn off remote administration and set Wi-Fi to WPA3 or WPA2/WPA3 mixed mode with a long passphrase. Those four changes remove the most common ways into a home network. Then disable WPS and UPnP, and set up a guest network for visitors and IoT devices.
Is WPA3 worth enabling on a home router?
Yes, if your router supports it. The Wi-Fi Alliance positions WPA3 as the current security baseline for new certified equipment. Use WPA3-Personal when all your important devices support it, and WPA2/WPA3 mixed mode when some do not. Avoid weakening your passphrase or leaving WPS on to accommodate an old device.
Does turning off WPS protect me from WPSplinter?
Not reliably. Turning off WPS is still good practice, and agencies such as France’s Cybermalveillance.gouv.fr recommend it when WPS is unused. But the researcher behind WPSplinter reportedly knows of no setting that blocks the attack, so the real fix is firmware from the vendor. If none arrives for your Broadcom-based gateway, replace it or put your own router behind it.
Should I disable UPnP on my router?
In most homes, yes. UPnP lets any LAN device open inbound ports without asking you, and that is exactly the behavior malware abuses. If a game or app breaks, create one explicit port forward for the one device instead of re-enabling UPnP for the whole network.
How often should I update router firmware?
Check at least monthly, and turn on automatic updates if your router offers them. After a disclosed vulnerability in your router’s family, check the same day. OpenWrt and MikroTik both published security-relevant releases in October 2026, so the cadence is real.
Can I make an ISP-supplied gateway secure?
Partly. You can usually change the Wi-Fi password, disable WPS and sometimes turn off UPnP, but the ISP controls firmware and may lock other settings. The better approach is to ask for bridge mode and run your own router behind the gateway, then apply the full checklist to the router you control.
How do I know my router changes actually worked?
Test them. Scan the router from the LAN with nmap, probe your public address from a connection outside your home and run the audit script in this guide. A setting that you never verified is an assumption. The script returns a nonzero exit code if Telnet or FTP is reachable, which makes it easy to catch regressions after updates.
