Matthew Donnelly’s Home-Lab Security Checklist: 12 Steps to Harden Your Home Network

Server racks in a data centre (photo: Derrick Coetzee, CC0)

I'm Matthew Donnelly, a New Yorker who's spent years tinkering with IT and cybersecurity as a hobby, and one thing I've noticed is that most home networks are set up once and never touched again. Meanwhile, the number of devices on them keeps growing: laptops, phones, smart TVs, cameras, a NAS, maybe a Raspberry Pi.

If you run a home lab or just want your apartment Wi-Fi to be less vulnerable, here is the checklist I would give a friend. You don't need enterprise-grade hardware, and the first few steps give the biggest wins.

1. Change your router's admin password

Your Wi-Fi password is not your router's admin password. Most routers ship with a default admin password, often printed on a sticker. Change it to a unique password and save it in a password manager. If the router or the vendor's app offers multi-factor authentication, turn it on.

2. Update the firmware, then automate it

Router firmware updates patch vulnerabilities that attackers are actively exploiting. Log in to the router's web interface, check for updates, apply any that are available and turn on auto-update if the option exists. If the router is end-of-life, it won't get updates anymore, so replace it.

3. Use up-to-date Wi-Fi encryption

If all your devices support WPA3-Personal, use it; otherwise choose WPA2/WPA3 mixed mode. Never use WEP, and don't use WPA2 with TKIP. Use a long passphrase as well (five or six random words works well).

4. Disable Wi-Fi Protected Setup (WPS)

WPS lets devices join the network with a button press or a PIN, and it has a long history of vulnerabilities, especially the PIN method. If you don't need it, turn it off.

5. Disable remote administration and UPnP

Remote administration makes the router's admin page reachable from the internet. Most people have no reason to leave it on, so disable it. Universal Plug and Play (UPnP) lets devices on your network open ports on your router automatically. That can be handy for game consoles, but it's a real risk when a cheap camera with an insecure web server can do the same. Turn it off and open ports manually only when you understand why.

6. Segment your network

This is the step that separates a basic home network from a well-run home lab. Group your devices by how much you trust them:

• Trusted: Your own laptops and phones.
• IoT: Smart plugs, TVs, cameras, speakers.
• Guest: Visitors' devices.
• Lab: Servers and experimental equipment.

Even a basic consumer router usually offers a separate guest network. Put your IoT devices there so a hacked smart bulb can't reach your laptop. If your router or firewall supports VLANs (OPNsense, pfSense, OpenWrt, UniFi and many others do), create separate VLANs with firewall rules that block the IoT and guest segments from reaching your trusted segment.

7. Default-deny between segments

When you write firewall rules between segments, start by denying everything and then allow only what's needed. Your phone may need access to the TV for casting purposes, but the TV doesn't have to initiate any connections to your phone.

8. Never expose services to the internet directly

Port-forwarding your NAS or a self-hosted app is easy and tempting, but every open port is exposed to the entire internet. Instead, connect to your home network through a VPN first. WireGuard is fast and easy to self-host, and mesh VPNs such as Tailscale make it even simpler. If you really must expose a service, put it behind a reverse proxy with authentication and keep it patched.

9. Filter DNS

A filtering DNS resolver blocks known malicious and tracking domains for every device on the network, including devices you can't install software on. You can run your own with Pi-hole or AdGuard Home, or use a public service like Quad9. It's an easy extra layer of protection.

10. Maintain an inventory

You can't protect what you don't know about. List every connected device using your router's client list or a network scanner like Nmap. Name each device, note which segment it belongs to, and investigate anything you don't recognize. Repeat this every few months.

11. Patch your devices too

The router is only one device. Turn on automatic updates for operating systems, browsers and apps, and schedule regular patching for lab servers. Retire any device that no longer gets updates, especially IP cameras and old NAS boxes.

12. Back up, and test your restores

Without backups, ransomware and a dead drive end the same way: your data is gone. Follow the 3-2-1 rule: three copies of your data, on two types of storage, with one copy offsite (a cloud backup counts). Keep at least one copy where malware can't overwrite it, such as an offline drive or versioned cloud storage. Finally, test restoring a file. Until you do, you're just hoping.

A quick quarterly routine

Once the big changes are done, maintenance takes about 30 minutes a quarter:

1. Update router and firewall firmware.
2. Review the list of connected devices.
3. Make sure that UPnP, WPS, and remote administration are turned off (they may get turned back on by updates).
4. Recheck port forwarding and remove anything unnecessary.
5. Do a test restore from your backups to make sure they work.

Home security isn't about being impenetrable; it's about being hard to attack and limiting the damage if something does get in. If you only do three things from this list, change the router admin password, update the firmware and move your IoT devices onto their own network.

About the author

Matthew Donnelly is a New Yorker into IT and cybersecurity, and a photographer at heart. He writes practical guides on security and technology drawn from hands-on experience, and shares his photography of the city.