Quick Tip #006 - Recommended Router Settings

Setting up a new wifi router can be a relative quick and easy process.  Here's my personal checklist of items that I try to do.
​

Essential Quick To-Do's:

1. Update Firmware (And do this monthly, quarterly, yearly, but do it!)
2. Never use the same password for your wifi as administrating your network
3. Change your default SSID to something you create.
4. Check your wifi encryption method using the guide below.
5. Put IoT devices, or insecure devices, on a seperate IoT network or guest network.
6. Change DNS setting to a more secure DNS, I'd recommend 1.1.1.1 or 9.9.9.9
7. Add in a time server if possible, time.google.com, and update your geographic region.
8. Turn off WPS
9. Turn off UPnP
10. Turn off Ping reply
11. Turn off Remote Administration
12. Turn on logging if possible.
13. Now that everything is "secure", check that there are no open ports, https://www.grc.com/shieldsup

Encryption, Ranked from best to worst:

1. WPA3 (Secure, assuming long password. More recommendations may come later as technology becomes more prevalent.)
2. WPA2-AES (also known as WPA2-CCMP, Secure)
   1. Passphrases must be between eight and 63 ASCII characters
      1. Minimum is 8 characters long, maximum is 63 characters long.
      2. A password of 14 or 15 characters should be long enough to defeat most brute force guessing.
      3. The German government recommends 20 characters as a minimum.  Of course, it is better to include both upper and lower case letters along with numbers. WPA2 passwords can also contain a host of special characters.
      4. Do not trust auto generated random passwords from the manufacturer. 
   2. Note: On devices without a visible “TKIP” or “AES” option, WPA2 is generally synonymous with WPA2-AES.
3. WPA2 with TKIP (Insecure)
   1. Passphrases must be between eight and 63 ASCII characters
   2. To help secure, if you can change the multicast and unicast key rotations to 120 seconds, this can help prevent an attacker from making significant gains.
4. WPA (Highly insecure)
   1. Passphrases must be between eight and 63 ASCII characters
   2. Just don't use this....
   3. Note: Any device manufactured after 2006 with a “Wi-Fi” logo must support WPA2 encryption... It's time to upgrade your hardware. (Sorry)
      
5. 128-bit WEP (You might as well have an unsecured network).
   1. Passphrases must be exactly 13 ASCII characters

Optional Advanced Stuff:

1. MAC Filtering
   1. MAC spoofing isn't hard at all, so there are mixed reviews on this.
2. Hidden SSID
   1. If someone is trying to attack your WiFi network, you can bet that they see all, ALL, of the SSID's out there.
3. Set the wireless channel
   1. The non-overlapping channels for 802.11 a/b/g/n in the 2.4 GHz band are, 1, 6, and 11.  Go the channel that has the least interference including the channels that are around it.
   2. There are 23 non-overlapping channels for 5 GHz (802.11n and 802.11ac) @ 20MHz.  Go with the channel that has the least interference including the channels that are around it. 
4. 2.4GHz or 5GHz?
   1. 2.4 GHz: This band provides coverage at a longer range but transmits data at slower speeds.  This frequency also penetrates walls better, so if you want something in your backyard, this freq. will probably get you through your thick wall.  Also good for more IoT devices, doorbell, cameras, etc.
   2. 5 GHz: On the other hand, the 5 GHz band provides less coverage but transmits data at faster speeds. Most of this stops, or dramatically drops off, outside of your home. 
      1. 802.11n (Wi-Fi 4), released 2009, used in both 2.4 and 5 GHz, top speed of 600 Mbps. Real world expect speeds around 40-50 Mbps)
      2. 802.11ac (Wi-Fi 5), released in 2013, used in both 2.4 and 5 GHz, top speed varies based off of frequency and bandwidth, but can reach top speeds of just under 7 Gbps.  Real world is less, more like 70-100+ Mbps up to 250+ Mbps based off of: configuration, interference, distance, number of streams, number of devices connected.
      3. 802.11ax (Wi-Fi 6), released in 2020, backwards compatible with 2.4 and 5 GHz, but also capable of over 6 GHz band. Real-world speeds of over 2 Gbps.