Home Network Security: Protect Your Wi-Fi, Devices, and Data

When did you last log into your router?

Seriously. If your answer is "never" or "I don't know the password," you're in the same spot as a lot of Indian households.

The average Indian home in 2026 has somewhere between 8 and 15 connected devices: phones, laptops, smart TVs, security cameras, speakers, robot vacuums, maybe a smart fridge. Every one of them is a way in. And most people have the whole lot sitting on one network, running on the default password the ISP technician typed in two years ago and nobody has touched since.

Audit a typical home network and you'll likely find a smart TV connecting to servers in several countries, a cheap security camera phoning home to overseas servers every few minutes, and an ISP router with UPnP on by default, punching holes in your firewall without asking. None of this is unusual; it's what most home networks look like.

No networking degree needed. One afternoon.

Fix your router first

The router sits between your home and the internet, so if it's compromised, everything behind it is too. Treat it like the front door of your house. That's what it is.

Change the default admin login

Obvious? Sure. Yet a shocking number of routers in India still run on admin/admin or admin/password, and attackers scan for these constantly. Log in (usually 192.168.1.1 or 192.168.0.1 in your browser) and change both the username and the password. Make it strong, at least 16 characters with mixed case, numbers and symbols, and save it in a password manager.

Update the firmware

Manufacturers patch vulnerabilities regularly, but most routers don't update themselves. Check your manufacturer's site for the latest version and update by hand:

1. Log into the admin panel
2. Find "Firmware Update" or "System Update" (usually under Administration or Maintenance)
3. Compare your current version with what's available
4. Download and apply
5. The router restarts, so give it a couple of minutes

Some ISP routers from Jio, Airtel and BSNL have locked firmware you can't update yourself. In that case, buy your own router and put the ISP device in bridge mode. The TP-Link Archer AX73, ASUS RT-AX86U and Netgear Nighthawk RAX50 are all solid under Rs 15,000 and support current security standards.

Switch to WPA3 encryption

WPA3 is the latest Wi-Fi security standard. Its biggest improvement over WPA2 is SAE (Simultaneous Authentication of Equals), which blocks offline dictionary attacks, the main way people crack WPA2 passwords.

1. Open your router admin panel
2. Go to Wireless Security settings
3. Change security mode to WPA3-Personal (or WPA2/WPA3 mixed if you have older devices that can't handle WPA3)
4. Set a strong passphrase, 12+ characters minimum

If your router doesn't support WPA3, it's time for a new one. WPA2 with a strong password is still okay. WPA3 is better.

Disable WPS and UPnP

WPS, that button for easy device connecting, has a known vulnerability: the PIN can be brute-forced in hours. Kill it. UPnP lets devices open ports on your router automatically. That's handy for gaming, but it also means malware on any device can punch holes in your firewall without you knowing, so turn it off too and set up port forwarding by hand for anything that really needs it.

Keep your junk devices away from your real ones

This is where I get skeptical of the "just plug everything in" approach. Your smart bulbs and cheap cameras have no reason to reach your laptop or NAS. If one of them gets compromised while sitting on the same network as everything else, the attacker can move sideways to your real data.

VLANs (Virtual Local Area Networks) let you carve separate, isolated networks out of your home network. Devices on one VLAN can't talk to devices on another unless you allow it.

You'll need a router that supports VLANs. Most consumer routers don't, but anything running OpenWrt, pfSense or OPNsense firmware does, and some prosumer models from ASUS, Ubiquiti and TP-Link support them natively.

The setup I'd recommend:

• VLAN 1 (Main) for laptops, desktops and phones, your trusted devices
• VLAN 2 (IoT) for smart home stuff, cameras and speakers, kept isolated
• VLAN 3 (Guest), where visitors get internet and nothing else

Internet
    |
  Router (with VLAN support)
    |
    +--- VLAN 1 (Trusted): Laptop, Phone, Desktop
    |         - Full internet access
    |         - Full local network access
    |
    +--- VLAN 2 (IoT): Smart TV, Camera, Alexa
    |         - Internet access (restricted)
    |         - No access to VLAN 1 or VLAN 3
    |
    +--- VLAN 3 (Guest): Visitor devices
              - Internet access only
              - No access to any other VLAN

If VLANs sound like too much right now, most modern routers have a guest network feature that does a simpler version of this. Put your IoT devices on the guest network. Less control. Still far better than one big flat network.

DNS filtering, which caught more than I expected

DNS is how your devices turn website names into IP addresses. By default your ISP handles your DNS queries, so it can see every site you visit. Worse, default DNS does no filtering at all, and malware domains, phishing sites and ad trackers all resolve just fine.

Pi-hole (self-hosted)

Pi-hole is a network-wide DNS filter that runs on a Raspberry Pi or any Linux machine. It catches DNS requests from every device on your network and blocks the ones headed for known ad servers, trackers and malicious domains.

1. Get a Raspberry Pi (any model works; a Pi Zero 2 W is under Rs 2,000 and perfect for this)
2. Install Raspberry Pi OS Lite
3. Run one command:

curl -sSL https://install.pi-hole.net | bash

4. Pick your upstream DNS provider during setup (Cloudflare 1.1.1.1 or Google 8.8.8.8)
5. Set your router's DHCP to hand out the Pi-hole's IP as the DNS server for everything

Pi-hole users commonly report a sizeable share of all DNS queries being blocked, and the first scroll through the query log is eye-opening: ads, trackers and telemetry that nobody in the house ever asked for. Browsing feels faster, you get more privacy, and malicious domains die before they load.

NextDNS (cloud-hosted)

If you don't want to maintain hardware, NextDNS is the cloud alternative. The free tier gives you 300,000 queries/month, enough for a small household, and the paid plan is about $20/year for unlimited. Its web dashboard lets you manage blocklists, whitelist domains, see analytics and set up different profiles per device. Point your router's DNS settings at NextDNS and every device gets filtered automatically.

VPNs are worth it, within limits

A VPN encrypts traffic between your device and the VPN server. Your ISP can't see what you're doing, and public Wi-Fi gets safer. It doesn't make you anonymous, though. Your VPN provider now sees the traffic your ISP used to see, so pick one you trust.

Running the VPN on the router is the most thorough option, since every device on your network is covered without installing apps one by one. Routers running OpenWrt or DD-WRT support WireGuard or OpenVPN. WireGuard is the newer protocol: noticeably faster, built on modern cryptography, and with a much smaller codebase, which means fewer places for holes to hide.

# WireGuard configuration example (client)
[Interface]
PrivateKey = YOUR_PRIVATE_KEY
Address = 10.0.0.2/32
DNS = 1.1.1.1

[Peer]
PublicKey = SERVER_PUBLIC_KEY
AllowedIPs = 0.0.0.0/0
Endpoint = vpn.example.com:51820
PersistentKeepalive = 25

VPN picks for India

Prices are in each provider's own currency, and Proton often discounts the first term, so check the checkout page before you pay.

Mine's Mullvad. You don't need an email address or any personal info to sign up: you pay, get an account number and connect. No logs, and no identity tied to the account.

Smart home devices, the weakest link

Smart home gear is notoriously insecure, with outdated firmware, unencrypted communications and constant phoning home to sketchy servers. You can still limit the damage.

Before buying, look up the manufacturer's security track record. Do they patch things? Have they been breached? Prefer devices that work locally without depending on the cloud, because cloud-reliant devices stop working if the company folds and are less private by nature. Check for Matter support too. It's the new standard backed by Apple, Google, Amazon and Samsung, with local communication and end-to-end encryption by default.

After setup, change every default password immediately and switch off features you don't use (a smart TV microphone you never talk to, for example). Put IoT on its own network, VLAN or guest. Block internet access for devices that don't need it; a smart bulb that works locally has no reason to call home. And check for firmware updates monthly.

Watching what your network is doing

You can't protect what you can't see, so spend a few minutes checking who's talking to whom.

• The Pi-hole dashboard shows every DNS query from every device, including what got blocked
• ntopng is a Linux-based traffic analyzer with real-time flows, per-device bandwidth and protocol-level visibility
• Wireshark handles deep packet inspection when you need to dig into something specific (it's not a daily tool)
• Your router's built-in tools usually include basic traffic monitoring in the admin panel

Watch for devices connecting to unexpected countries, unusually high data usage from devices that should be idle, DNS queries to known bad domains, and devices trying to reach other devices on your network.

Passwords and 2FA hold all of this together

Strictly speaking this isn't a network thing. But if an attacker gets one password you've reused across services, everything goes down with it. A password manager fixes that.

For most people I'd suggest Bitwarden. It's open source, independently audited and works everywhere, and the free tier really is enough. Paid adds emergency access, extra 2FA options and 1GB of encrypted file storage.

Turn on 2FA for everything that supports it. Go in this order: email accounts first (they're the master key for password resets), then banking and financial services, social media, cloud storage, and your password manager itself. Use an authenticator app instead of SMS. Aegis is a good open-source pick on Android. On iOS, avoid Raivo: it was sold in 2023, and a 2024 update from the new owner wiped many users' codes. SIM swapping makes SMS codes unreliable, and in India it's shockingly easy to pull off.

Your ISP sees more than you'd guess

Indian ISPs see every domain you resolve through DNS, every IP you connect to, the timing and volume of your activity, and connection metadata (though not content if you're on HTTPS). The IT Act provides some framework, but how ISPs in India handle that data is opaque at best.

What you can do: switch to encrypted DNS (DoH or DoT) with Cloudflare 1.1.1.1 or Google 8.8.8.8 and DNS-over-HTTPS turned on, and your ISP can no longer see your DNS queries. Use a VPN for full traffic encryption. And stick to HTTPS everywhere. Modern browsers default to it now, so the old HTTPS Everywhere extension isn't needed in 2026, but double-check anyway.

Guest network: two minutes and done

Everyone needs one. When friends or relatives visit and ask for the WiFi (which in India happens roughly every time anyone walks through your door), hand them the guest network password.

Give it a different SSID and password from your main network. Turn on client isolation so guest devices can't see each other, block access to local resources like the NAS and printers, and set bandwidth limits if your plan has caps. Change the password now and then. Most routers have all this built in, and it takes two minutes, after which you never have to wonder whether your cousin's malware-infested phone is about to hop onto your NAS and encrypt your photos.

Parental controls

If kids use devices on your network, DNS filtering (Pi-hole or NextDNS) is your best tool. NextDNS in particular has excellent parental controls: it blocks adult content, social media, gaming sites and specific apps at the DNS level, across all devices, without installing anything on each one.

Layer it: DNS filtering at the network level, device-level controls (Screen Time on iOS, Family Link on Android), app-level restrictions like YouTube restricted mode, and talking to your kids about online safety. No tech stack replaces that last one.

The checklist

• Change router admin username and password
• Update router firmware
• Enable WPA3 (or strong WPA2 passphrase)
• Disable WPS and UPnP
• Disable remote management
• Set up a guest network
• Set up DNS filtering (Pi-hole or NextDNS)
• Put IoT devices on separate VLAN or guest network
• Change default passwords on all smart devices
• Install a VPN (at least on mobile devices)
• Enable encrypted DNS (DoH or DoT)
• Set up a password manager with unique passwords for everything
• Enable 2FA on all critical accounts
• Review connected devices on your router monthly

Not all at once. Start with the router, since that gets you the biggest security improvement for the least work, then chip away at the rest over a few weekends. Each item makes your network harder to break into, and stacked together they give you a setup that's hard for anyone to compromise without physical access. The devices on your network hold your financial data, your private conversations, your family photos and your kids' browsing activity. An afternoon spent locking them down is time well spent.

For security habits beyond your home network, our cybersecurity tips guide covers the broader picture, and our privacy-focused app alternatives roundup can help you swap data-hungry software for more private options.