At risk of sounding stupid, I need some pointers on how to set up a Wi-Fi router and make it as private and secure as possible.
To sound even more stupid, I don’t really know what PiHole is, or why some people route their traffic through a VPN. I suppose my main questions are these:
- What Wi-Fi router should I get?
- How do I configurate it as somebody who is somewhat privacy-conscious but not very tech-savvy?
I don’t really know how regular Wi-Fi routers work, what the common worries are, how/if data is at risk of being leaked, and so on. So, any pointers would be appreciated! Feel free to direct me to any privacy guides, as well. Cheers!
Since you are coming at this from a privacy standpoint, I’d suggest a router that runs some type of open source firmware such as OpenWRT. GL.iNet makes some good routers with their own fork of OpenWRT which has a very easy to use and intuitive UI as opposed to flashing OpenWRT to a supported router (setup then is very complicated).
Many routers out there will spy on you, make it difficult or impossible to set up privacy features, and have limited software updates for security patches.
The GL.iNet Flint 2 is a modern, fast router and makes it easy to setup a VPN, supports AdGuard home, and setting custom DNS providers. I’ve had it since launch and its had numerous updates too.
A VPN and private DNS hide your internet traffic from your ISP who will undoubtedly sell your data. However, a VPN is a transfer of trust so you want to use one that is open source, audited, and has a good track record of not logging any data. IVPN, Mullvad, and Proton are good VPNs. Quad9 and NextDNS are great private DNS providers. AdGuard and PiHole will block ads through various means.
Watch videos from Naomi Brockwell to learn more about all this stuff.
GL.iNet is a little overpriced if you ask me
What VPN speeds can go.inet flint 2 handle?
It is stated on the linked webpage. I don’t appear to loose any speed stated from my ISP either.
The brand/type of wifi router is more of a technical requirements discussion than privacy discussion.
For instance, I live in a two story townhome rental with the modem in the basement - so I picked up an Orbi mesh system to bounce wifi up to the second floor. I also have a fairly complex network with IoT VLAN, DMZ (for remote VPN) and other network segments - again the orbi doing different VLANs per SSID was a deciding factor.
I’ve also only used the Orbi as an access point, relying on a dedicated firewall/router for that stuff.
If you’re looking at a flat network (e.g. everything on one segment - the typical home user setup), pretty much any WiFi router from Best Buy or equivalent will do the job. Check your current devices to see if you can take advantage of WiFi 7 technology - otherwise save a few bucks and go WiFi 6.
For security purposes, change the default SSID (the wireless name) to something unique - and change the password to something from correcthorsebatterystaple.net. You don’t need the default jumble of letters and numbers to be secure.
Lastly, getting to your privacy concerns, look at the DHCP settings - that’s what hands out IP addresses to your devices so they can reach the internet. Change the DNS servers to something other than your ISP. This looks like a good starting point.
The big things are to make sure you don’t expose your router management to the Internet (the default shouldn’t do that) and to make sure you periodically check for firmware updates.
If you want to up your game, you could look at spinning up a self-hosted DNS server like Pi-Hole - but that can be a bit more advanced to get setup and troubleshoot if something goes wrong.
and change the password to something from correcthorsebatterystaple.net.
i wonder how secure or private it is to use a password generated online. You should use a password manger instead. They have built-in password generators
Ideally, sure use a password generator - but I wouldn’t worry about the security of a password generator like the one I linked.
- There’s no linking of the password you generated to whichever account you are creating.
- There’s no guarantee from the web operator’s perspective that you are actually using the generated passwords for anything at all.
Again, use bitwarden’s generator - or equivalent - for passphrases, but in the absence of that correcthorsebatterystaple.com is good enough for a non-shared password.
Any router from a mainstream brand is likely fine, just don’t enable any of their “cloud” BS and don’t use their smartphone app. I’ve had good luck with Asus, they have an app but you don’t have to use it at all.
For security, try to enable WPA3 on your Wi-Fi networks, otherwise WPA2 is probably fine unless you’re being targeted by a government-sponsored hacking operation. Choose a long password for your network.
Once you get it up and running, then worry about DNS and PiHole and VPNs and all that. Don’t get in over your head.
Solid advice. I already know what brand is good in my area (Bahnhof), and I’ve enjoyed using Mullvad and NextDNS, so I already know what VPN and DNS I’m comfortable with.
I’ve always been a bit confused about the exact purpose of PiHole, what it is and such, but I’ll have to read up on it and see if it fits my needs.
I’ve been running PiHole for awhile, in short it’s your own DNS server that’s configured to block DNS requests to known advertising domains. So when you load a website and it sends a DNS request to PopularAdvertisingCompany.com to load an ad, PiHole blocks the request so the ad can’t be loaded. It’s useful for devices that you can’t put an ad blocker on, like iPhones and smart TVs and such, but can’t block stuff like YouTube ads cause they come from the same domain as the videos themselves.
It also has bonus features like DNS caching which can speed up web browsing.
The other thing to keep in mind with PiHole - some things are just going to break with it’s default blocking, namely the Google suggested results.
i know, I know - just don’t use google, but android phones/parents have a hard time not just braindead going to Google for results.
It’s not the end of the world - I’ve trained myself to just keep scrolling to actual results.
Another feature for PiHole is local DNS - if you want, you can set up custom dnsmasq entries for self hosted/internal services.
Is it necessary to use PiHole if I already use NextDNS? Do I need PiHole to configurate NextDNS if I want all the ads gone on each device connected to the Wi-Fi?
No, they effectively do the same thing so you can just set your router to use NextDNS and you’re good.
Well, I can’t help you much with what router to get, but one thing I do is use ControlD.com free DNS. They have several levels of blocking you can do for free. You can do no blocking at all, you can block known malware, you can block known malware, and advertising, or you can block known malware, advertising, and big social media. Since this is on the router DNS setting, it will apply to every device as long as it is on your network. And then you can also set it up on your Android or iPhone so that when you are on mobile data, it also keeps the same level of blocking.
https://www.privacyguides.org/en/basics/hardware/?h=networking#secure-your-network
Really you need to first define your threat model, the EFF has a good guide on that.
Maximum paranoia would be Wi-Fi only connects to a restricted VLAN that can only talk to a VPN server. You must use a VPN to access your network over wireless. That’s probably too much work for most people. But it would be the most compartmentalized, not trusting Wi-Fi encryption, which really isn’t that strong
Super basic data hygiene means you only use WPA2 and above security for your Wi-Fi network.
Depending on your actual threat model, what you choose to do will probably be between those two points.
Turn off broadcast of the SSID (meaning that your network isn’t seen when someone looks at available networks).
PiHole is probably more advanced than you’re ready to explore given your present level of knowledge, but I’d encourage you to dive in if you consider the concept interesting. You might develop a new hobby. If you have a tech-interested friend, you might ask them to set one up on your behalf.
Turn off broadcast of the SSID
Don’t do this. It provides zero security, and just reduces usability. Now you should call your SSID something non-identifiable. So instead of “$YourName Wifi” call it “pleasure chest” or something. Additionally do not set a ridiculous 64 character + special characters password, because again you are providing next to zero additional security, while hugely reducing usability.
Use a simple password scheme of 3-5 unrelated common words like from here: https://www.correcthorsebatterystaple.net/index.html for your wifi password.
Turning off broadcast doesn’t do that much IMO, any of the Wifi scanning tools will show those networks anyways.
That is a complex problem. When you say router I assume you mean the all in one units? The common off the shelf devices are a router, switch, firewall, dhcp server and WiFi access point. Depending on the hardware they are normally pretty solid for one or a few people. The key thing you should be concerned about is the software on the device. There are plenty of open firmwares for network devices but they normally expect you to have a decent understanding of networking. Software like OpenWRT does have some decent defaults but you need to know things like how to keep it updated and how to create a secure WiFi network in the GUI.
Oh, one other thing you may consider doing. Put your network on five gigahertz only and disable 2.4 gigahertz entirely because 2.4 gigahertz goes farther so somebody could try to hack your network from a physical longer distance away. Whereas on five gigahertz they would have to be physically closer to do so.
Some routers will let you change the power of each frequency so you don’t have to disable it.
Some do, but I’m not aware of many of them, especially not on the home side. Some of the more business-style routers I know do, and some home routers do. But to my knowledge, most home routers do not.
I know OpenWRT routers have the feature fyi
Okay, I appreciate knowing that information.
Do a Site Survey and make a Wi-Fi heat map of your current setup so you can figure out if you need any APs in specific areas.
To me, this is the most important and most overlooked thing you can do to prepare a wireless network.
I’ve personally had good luck with NetSpot but pretty sure you have to pay for the enterprise version to do a heatmap/site survey.
Brand doesn’t matter. They’re all equally bad.
There’s two passwords to change: your routers administrator password and your WiFi password.
There’s mainly one setting to disable, but it’s often broken up into many across several parts of the device’s configuration page: wan administration or access to anything under any circumstances.
The smart starting point with dns is: dns over https. It’s probably all you need so don’t worry about pihole or other stuff. You mentioned mullvad. Use theirs.
These recommendations will provide a good baseline for security that doesn’t break the places you want to go on the internet. You could do more on the client side like use a vpn from your computer or configure your browser to use encrypted client hello and never store cookies or cache.
I also had another question. I’ve tried to get my parents to use NextDNS, but they think it’s blocking too many sites (like "sponsored websites) so they don’t use it. I wonder if I should use a DNS on my router at all because I don’t want my visitors to get blocked from any sites, or is there a way to configurate NextDNS so it doesn’t block those sponsored sites?
Furthermore, what are the consequences of using a VPN and DNS on a router AND your phone (different locations, etc)?
Yeah only use doh on router, expect per device security otherwise.
I don’t use nextdns so I don’t know. Some mullvad stuff (like their http proxy!) is only functional when you’re using their vpn, but the doh server works fine without it.
DNS over https makes a connection with the dns server using the encrypted https protocol. That means that when I want to go to hanksbuttplugemoprium.com my isp doesn’t see the request because it’s encrypted. Normally those requests get passed up the chain in plaintext and that’s a Big Problem.
Like I said, I don’t know about nextdns, but it seems like it’s built around using dns level blocking.
The problem with blocking stuff through dns at the router level (like pihole and nextdns and if you’re not careful with what you choose, mullvads doh) is that you might end up stopping normal legitimate internet use. I stopped using pihole and later uhh the one with home in the name for that reason. Shit didn’t work and people wouldn’t tell me when it happened so I couldn’t whitelist stuff.
If you’re worried about your isp seeing dns requests and cataloging them, selling them or just blocking them and reporting you to the authorities, set up dns over https at the router level.
What are you trying to accomplish?
