Securing Your Wi-Fi Hotspot: The Complete Guide to Network Security

To change this information:

• 🔧 Go to the router control panel through your browser by entering in the address bar 192.168.1.1 or 192.168.0.1 (the exact address is indicated on the device sticker).
• 🔐 In the section System or Administration find the item Password (or similar).
• 🆔 Create a complex password of at least 12 characters, including uppercase letters, numbers, and special characters. Example: K7#pL9@mQ2$vR1!.
• 📝 Save the new data in a password manager (for example, Bitwarden or 1Password) - their loss is equivalent to blocking access to network settings.

⚠️ Attention: Some router models (for example, Huawei HG8245) require a factory reset if the password is lost. This process erases all network settings, including the Wi-Fi name and connected devices.

2. Selecting a modern encryption protocol

The encryption protocol determines how difficult it is to hack your Wi-Fi. Outdated standards like WEP (hacked in 2-3 minutes) or WPA (vulnerable to dictionary attacks) have not provided protection for a long time. Today, the minimum acceptable level is WPA2-PSK (AES), but it's better to use WPA3, if your router supports it.

To check and change the protocol:

1. Go to the wireless network settings (section Wireless or Wi-Fi).
2. Find the parameter Security Mode (or Encryption).
3. Select WPA3-Personal (if available) or WPA2-PSK with encryption AES (Not TKIP!).
4. Set a Wi-Fi password of at least 15 characters. Example: Tr0ub4dour&3-Fox.

* Provided that there are no vulnerabilities in the implementation of the protocol on a specific router.

3. Disabling vulnerable router functions

Many routers include default features that make setup easier but create security holes. For example, WPS (Wi-Fi Protected Setup) Allows you to connect to the network without a password by pressing a button on the router or entering an 8-digit PIN. The problem is that this PIN is vulnerable to brute-force attacks: an attacker can try all combinations in 4-10 hours.

What features should be disabled:

• 🚫 WPS - Even if you don't use the connect button, the function remains active and vulnerable.
• 🚫 UPnP (Universal Plug and Play) - can allow devices on the network to automatically open ports that viruses use to spread.
• 🚫 Remote control - access to router settings from the Internet (function Remote Management).
• 🚫 Guest network with access to the local network — guest Wi-Fi must be isolated from the main network.

⚠️ Attention: Some providers (eg Rostelecom or Beeline) block access to router settings if UPnP is disabled. In this case, leave the feature enabled, but restrict its functionality in the menu. UPnP → Permit Rules.

4. Filtering devices by MAC addresses

MAC filtering — This method allows the router to only allow devices with authorized MAC addresses onto the network. Although MAC addresses can be spoofed, this method adds an additional layer of security, especially when combined with other measures. It's useful for restricting access on office networks or if you want to restrict connections to specific devices.

How to set up filtering:

1. Find the MAC addresses of your devices:
   • On Windows: run the command

     ipconfig /all

     and find the line Physical address.
   • On Android: go to Settings → About phone → General information → Wi-Fi MAC address.
   • On iOS: Settings → Wi-Fi → (i) next to the network → MAC address.

Disadvantage of the method: If you buy a new device (for example, smart speaker or fitness bracelet), its MAC address will have to be added to the list manually. Also, some devices (for example, Amazon Echo) may use random MAC addresses to protect privacy, making them difficult to add.

5. Updating the router firmware

A router's firmware is its operating system, and like any software, it can contain vulnerabilities. Manufacturers regularly release updates to patch critical flaws. For example, in 2023, a vulnerability was discovered CVE-2023-1389 in routers ASUS, allowing hackers to execute arbitrary code. Updating the firmware is the only way to protect against such attacks.

How to update firmware:

• 🔄 Check the current version in the menu Administration → Firmware.
• 🌐 Download the latest firmware from the manufacturer's official website (for example, support.tp-link.com For TP-Link).
• ⚠️ Do not interrupt the update process - this may brick the router (make it inoperable).
• 🔧 After the update, perform a factory reset (Reset) and configure the router again.

⚠️ Attention: Some providers (eg MTS or Megaphone) block manual firmware updates on branded routers. In this case, the update arrives automatically through the provider's server.

6. Hiding the network name (SSID) and other advanced settings

Hiding SSID (Network ID) does not make your Wi-Fi invisible to professional tools like Wireshark or Airodump-ng, but reduces the number of accidental connections. This method is useful when combined with other security measures.

How to hide SSID:

1. In your wireless network settings, find the option Hide SSID or Enable SSID Broadcast.
2. Turn off network name broadcasting (Disable).
3. Save the changes. Now you can only connect to the network manually by entering its name.

Other useful settings:

• 🕒 Wi-Fi operating hours: Turn off the network at night or when you are not at home (in the menu Wireless Schedule).
• 📡 Signal power limitation: Reduce the coverage radius if the network is not needed outside the apartment (parameter Transmit Power).
• 🛡️ Enabling the Firewall: Activate the built-in firewall of the router (section Security → Firewall).

7. Protection from DDoS and botnet attacks

Your router can become part of a botnet (a network of infected devices) and be used to attack other resources without you even realizing it. For example, in 2022, a botnet Mirai infected over 600,000 devices, including routers, and used them for DDoS attacks on banks and government websites. To prevent this:

• 🔒 Disable access to the router from the Internet (port 80 or 443).
• 🛡️ Turn on protection from DDoS (if there is one in the settings, for example, DDoS Protection V Keenetic).
• 🔄 Regularly check the list of connected devices in the menu DHCP Clients List — unknown gadgets may be a sign of hacking.
• 📊 Use cloud security services such as Cloudflare or OpenDNSto filter malicious traffic.

If your router supports VLAN (virtual networks), divide devices into groups. For example:

• 🖥️ VLAN 10 — computers and smartphones (full access).
• 💡 VLAN 20 - smart light bulbs and sockets (limited internet access).
• 🎮 VLAN 30 — guest devices (Internet only, no local network access).

8. Network monitoring and intrusion detection

Even after all the settings are in place, it's important to monitor for suspicious activity. Many modern routers (for example, ASUS RT-AX88U or Netgear Nighthawk) have built-in monitoring tools. If your device doesn't support them, use third-party programs:

• 📊 Wireshark - for deep traffic analysis (requires skills).
• 🔍 GlassWire — visualization of network activity in real time.
• 🛡️ Fing — scanning the network for unknown devices (mobile versions available).

Signs that your network has been hacked:

• ⚡ Unexpected decrease in internet speed.
• 🔌 Unknown devices in the list of connected clients.
• 🌐 Redirection to suspicious sites when trying to access familiar resources.
• 💾 Unauthorized changes to router settings.

If you detect an intrusion:

1. Disconnect the router from the Internet (remove the cable WAN).
2. Perform a factory reset (button Reset on the back panel).
3. Update your firmware and reconfigure your network using the instructions in this article.
4. Check all connected devices for viruses (for example, using Kaspersky Virus Removal Tool).

⚠️ Attention: Router interfaces and available features may vary depending on the model and firmware version. Always consult the manufacturer's official documentation.

FAQ: Frequently Asked Questions about Wi-Fi Security