Topic

Router Setup & Wi‑Fi
Configure home routers for reliable, secure Wi‑Fi. This covers SSIDs, encryption, channel planning, band management, WAN and DNS, QoS tuning, and routine maintenance so your network remains stable under real‑world loads.

Basics
1
- Change the default router admin password and rename SSIDs to avoid advertising the model or defaults.
- Set WPA2 or WPA3 encryption and avoid legacy WEP. Use strong passphrases to deter brute force attacks.
- Disable WPS to eliminate a common attack vector and reduce misconfiguration risks.
- Create a separate guest network with limited bandwidth and no access to internal devices.

Channels and Bands
2
- Use non‑overlapping 2.4 GHz channels (1, 6, 11) to reduce collisions with neighbors.
- Prefer 5 GHz for high‑throughput and low‑latency devices; reserve 2.4 GHz for range and IoT.
- Disable Smart Connect if band steering causes misassociation. Separate SSIDs allow manual control.
- Place the router centrally, elevate it, and avoid obstructions to create even coverage.

WAN and DNS
3
- Verify ISP WAN settings (PPPoE or DHCP) and ensure authentication credentials are correct to avoid intermittent drops.
- Set DNS to reliable resolvers (1.1.1.1 or 8.8.8.8) and consider DoT/DoH where compatible and stable.
- Check NAT type and avoid double‑NAT by enabling bridge mode on upstream devices where possible.
- Configure port forwarding explicitly for self‑hosted services and test reachability from the internet.

QoS and Performance
4
- Prioritize work devices during calls and conferences to maintain audio/video quality under load.
- Limit bandwidth hogs with per‑device caps or schedules for bulk downloads and streaming.
- Enable MU‑MIMO and beamforming if supported to improve multi‑client performance and coverage.
- Use traffic shaping to prevent bufferbloat and ensure consistent latency during heavy uploads.

Maintenance
5
- Update firmware regularly to patch security issues and improve stability.
- Backup router configuration after major changes for quick recovery.
- Monitor logs for WAN drops or authentication retries that indicate line issues.
- If stability improves after reboots, schedule periodic maintenance reboots during off‑hours.

Guest and IoT Segmentation
6
- Place guest devices on an isolated SSID with bandwidth limits and no LAN access.
- Segment IoT devices to reduce lateral movement risks and contain misbehavior.

Firewall and Parental Controls
7
- Enable basic firewall features and block known malicious domains via DNS filtering.
- Use parental controls to schedule access and restrict inappropriate categories.

Monitoring
8
- Track device associations, RSSI, and throughput to detect weak links and optimize placement.
- Export logs periodically for deeper analysis of intermittent issues.
Checklist
Work through these steps in order.
- Secure admin and SSIDs.
- Tune channels and bands.
- Set DNS; check NAT.
- Enable QoS; update firmware.