Topic 3 · Deep Dive

3.5 Home and Office Network Safety Basics

The gateway is the one asset that matters most

A consumer router runs a web admin console, a DNS resolver, DHCP, port forwarding, and often a Telnet or httpd service, all as root on a device that is patched rarely. Start with the control plane. Confirm the console is reachable only on the LAN, because "allow configuration from WAN" exposes the same login form to the whole Internet, typically on 8443 or 8080. Replace vendor credentials, since tens of thousands of models ship with a fixed password derived from the model number. Change WPA2/WPA3 from the factory passphrase printed on the label to a long unique one, then disable WPS entirely: its eight-digit PIN is brute-forced offline in seconds through the Pixie Dust attack. Update firmware once at setup and again whenever the vendor ships a release, because the update channel is usually authenticated over HTTPS while the exploit channels are not.

Turn off the features you did not ask for

UPnP Internet Gateway Device lets any LAN application open a port by itself: it finds the gateway with an SSDP multicast to 239.255.255.250:1900, then posts a SOAP AddPortMapping request, and the router obediently forwards, say, external 51413 to an internal host. Malware and game exploits abuse this to punch inbound holes and to reach the admin interface, so disable UPnP and the newer NAT-PMP or PCP on 5351. Also disable WPS, Telnet, unused guest features, and remote diagnostics, and turn off UPnP-driven DMZ settings. If remote access is genuinely needed, use a vendor-free WireGuard tunnel that terminates on a device you patch, rather than an exposed port.

Segment so a breach stops at one box

One flat 192.168.1.0/24 means a compromised bulb can port-scan the NAS and the workstation. Split the network into VLANs: 10 for staff machines and file servers, 20 for guests, 30 for cameras and IoT. Then write inter-VLAN rules deliberately. Guests should get Internet only, so block 192.168.20.0/24 to 192.168.10.0/24 and block the guest subnet from reaching 192.168.1.1 admin, while leaving DNS on 53 and DHCP on 67/68 allowed. IoT usually needs outbound HTTPS only, so permit 443 egress, drop all inbound, and drop LAN-internal destinations. Enable client isolation on the guest SSID so guests cannot see each other, keep static leases for servers so rules stay meaningful, and use a filtering resolver to sinkhole known malware domains.

Verify, then watch

Proof beats intention. Run nmap -p- <wan-ip> from outside to confirm only expected ports answer, check the router's attached-device list monthly for unknown MACs, and look at forwarded-port tables for mappings you never created. Treat a device you cannot identify as a guest until you can.

Architecture Diagram

Each segment gets its own rules at the gateway, so a compromised IoT or guest device cannot walk sideways.

Key Takeaways

Lock the gateway: LAN-only admin console, no default credentials, current firmware.
Disable UPnP/IGD, NAT-PMP, WPS, and remote management to close self-inflicted holes.
VLAN 10/20/30 plus explicit inter-VLAN rules stop lateral movement.
Guests get Internet only; IoT gets outbound 443 with no inbound and no LAN access.
Verify from outside with an external port scan and review attached devices and port maps.

« Back to Topic 3 — « 3.4