Hardening the office router: twelve settings that matter

The router is the only device in your office that talks to the internet on everyone's behalf. If it is compromised, every laptop, phone and printer behind it is exposed. The good news: the settings that stop almost all real-world attacks fit on one page. Go through them in order.

1. Change the admin password — and the admin username if you can

Default credentials are printed on a sticker and published in every manual online. Set a long passphrase (four or five unrelated words) and store it in your password manager, not on the device.

2. Keep the admin page on the inside only

Look for Remote management, WAN access or Web access from internet and switch it off. On OpenWrt, make sure the LuCI interface listens on the LAN zone only and that the firewall rejects input from WAN.

3. Use key-based SSH, or turn SSH off

On routers with SSH (OpenWrt, MikroTik, Ubiquiti), disable password login and add your public key. If nobody uses SSH, disable the service entirely.

4. Update the firmware

The average router we audit runs firmware three years old. See Firmware updates without surprises for a safe procedure with a rollback path.

5. Wi-Fi: WPA2-AES at minimum, WPA3 where every device supports it

• Never use WEP or WPA-TKIP. If an old device only supports those, it is time to replace it.
• WPA3/WPA2 transition mode is a sensible default for mixed offices.
• Use a passphrase of at least 14 characters and change it when staff leave.

6. Turn off WPS

The push-button and PIN pairing feature has a long history of brute-force weaknesses. Nobody misses it.

7. Turn off UPnP

UPnP lets any device on the network open ports on the router without asking. Printers, cameras and smart TVs use it happily. Disable it and open the few ports you really need by hand, with a note of why.

8. Separate guests, staff and devices

Create a guest Wi-Fi with client isolation for visitors, and a separate segment for printers and other appliances. Details in Isolating network printers.

9. Use a filtering DNS resolver

Point the router at a resolver that blocks known malware domains, and enable DNS over TLS or HTTPS if the firmware supports it. Then block outbound port 53 from clients so devices cannot bypass it.

10. Default-deny inbound, review every forward

Open the port-forwarding table and justify each entry. Anything you cannot explain should go. Rules for a single external partner should be limited to their source IP.

11. Keep logs somewhere other than the router

Router logs live in RAM and vanish on reboot. Send them to a syslog server or a small cloud log service so you can look back after an incident.

12. Write it down

Record the model, firmware version, admin location and every non-default setting. The next technician — or you, in a year — will thank you. Our network baseline template is a good start.

Quick version

1. New admin password, admin page LAN-only, SSH key-only.
2. Current firmware.
3. WPA2-AES/WPA3, WPS off, UPnP off.
4. Guest and device networks separated.
5. Filtering DNS, no unexplained port forwards.
6. Logs shipped off-device, configuration documented.