At risk of sounding stupid, I need some pointers on how to set up a Wi-Fi router and make it as private and secure as possible.

To sound even more stupid, I don’t really know what PiHole is, or why some people route their traffic through a VPN. I suppose my main questions are these:

  • What Wi-Fi router should I get?
  • How do I configurate it as somebody who is somewhat privacy-conscious but not very tech-savvy?

I don’t really know how regular Wi-Fi routers work, what the common worries are, how/if data is at risk of being leaked, and so on. So, any pointers would be appreciated! Feel free to direct me to any privacy guides, as well. Cheers!

  • pezhore@lemmy.ml
    link
    fedilink
    arrow-up
    8
    ·
    edit-2
    11 months ago

    The brand/type of wifi router is more of a technical requirements discussion than privacy discussion.

    For instance, I live in a two story townhome rental with the modem in the basement - so I picked up an Orbi mesh system to bounce wifi up to the second floor. I also have a fairly complex network with IoT VLAN, DMZ (for remote VPN) and other network segments - again the orbi doing different VLANs per SSID was a deciding factor.

    I’ve also only used the Orbi as an access point, relying on a dedicated firewall/router for that stuff.

    If you’re looking at a flat network (e.g. everything on one segment - the typical home user setup), pretty much any WiFi router from Best Buy or equivalent will do the job. Check your current devices to see if you can take advantage of WiFi 7 technology - otherwise save a few bucks and go WiFi 6.

    For security purposes, change the default SSID (the wireless name) to something unique - and change the password to something from correcthorsebatterystaple.net. You don’t need the default jumble of letters and numbers to be secure.

    Lastly, getting to your privacy concerns, look at the DHCP settings - that’s what hands out IP addresses to your devices so they can reach the internet. Change the DNS servers to something other than your ISP. This looks like a good starting point.

    The big things are to make sure you don’t expose your router management to the Internet (the default shouldn’t do that) and to make sure you periodically check for firmware updates.

    If you want to up your game, you could look at spinning up a self-hosted DNS server like Pi-Hole - but that can be a bit more advanced to get setup and troubleshoot if something goes wrong.

      • pezhore@lemmy.ml
        link
        fedilink
        arrow-up
        1
        ·
        11 months ago

        Ideally, sure use a password generator - but I wouldn’t worry about the security of a password generator like the one I linked.

        1. There’s no linking of the password you generated to whichever account you are creating.
        2. There’s no guarantee from the web operator’s perspective that you are actually using the generated passwords for anything at all.

        Again, use bitwarden’s generator - or equivalent - for passphrases, but in the absence of that correcthorsebatterystaple.com is good enough for a non-shared password.

  • bloodfart@lemmy.ml
    link
    fedilink
    arrow-up
    2
    arrow-down
    2
    ·
    11 months ago

    Brand doesn’t matter. They’re all equally bad.

    There’s two passwords to change: your routers administrator password and your WiFi password.

    There’s mainly one setting to disable, but it’s often broken up into many across several parts of the device’s configuration page: wan administration or access to anything under any circumstances.

    The smart starting point with dns is: dns over https. It’s probably all you need so don’t worry about pihole or other stuff. You mentioned mullvad. Use theirs.

    These recommendations will provide a good baseline for security that doesn’t break the places you want to go on the internet. You could do more on the client side like use a vpn from your computer or configure your browser to use encrypted client hello and never store cookies or cache.

    • Wild Bill@midwest.socialOP
      link
      fedilink
      arrow-up
      1
      ·
      11 months ago

      I also had another question. I’ve tried to get my parents to use NextDNS, but they think it’s blocking too many sites (like "sponsored websites) so they don’t use it. I wonder if I should use a DNS on my router at all because I don’t want my visitors to get blocked from any sites, or is there a way to configurate NextDNS so it doesn’t block those sponsored sites?

      Furthermore, what are the consequences of using a VPN and DNS on a router AND your phone (different locations, etc)?

      • bloodfart@lemmy.ml
        link
        fedilink
        arrow-up
        1
        ·
        11 months ago

        Yeah only use doh on router, expect per device security otherwise.

        I don’t use nextdns so I don’t know. Some mullvad stuff (like their http proxy!) is only functional when you’re using their vpn, but the doh server works fine without it.

        DNS over https makes a connection with the dns server using the encrypted https protocol. That means that when I want to go to hanksbuttplugemoprium.com my isp doesn’t see the request because it’s encrypted. Normally those requests get passed up the chain in plaintext and that’s a Big Problem.

        Like I said, I don’t know about nextdns, but it seems like it’s built around using dns level blocking.

        The problem with blocking stuff through dns at the router level (like pihole and nextdns and if you’re not careful with what you choose, mullvads doh) is that you might end up stopping normal legitimate internet use. I stopped using pihole and later uhh the one with home in the name for that reason. Shit didn’t work and people wouldn’t tell me when it happened so I couldn’t whitelist stuff.

        If you’re worried about your isp seeing dns requests and cataloging them, selling them or just blocking them and reporting you to the authorities, set up dns over https at the router level.

        What are you trying to accomplish?