Skip to content
LockdownGuide
Network security • Reviewed October 25, 2026

Home Network Privacy: Router Hardening, VLAN Segmentation, and DoH

Isolate vulnerable smart TVs, cameras, and IoT devices from trusted home computers using VLANs on pfSense, OPNsense, or UniFi routers.

Smart televisions, connected appliances, and cheap security cameras continuously broadcast telemetry and harbor unpatched firmware vulnerabilities. Allowing IoT devices to reside on the same flat local area network as your banking laptops exposes trusted systems to lateral network pivot attacks.

Home Router Security Baseline Checklist
Router Setting Target Configuration Reason / Threat Mitigated
Universal Plug and Play (UPnP)DISABLEDPrevents malware from automatically opening inbound WAN ports
Remote Web Management (WAN)DISABLEDBlocks public internet brute-force attacks on router admin portal
DNS ResolutionDNS-over-HTTPS (DoH) via NextDNS or Quad9Encrypts DNS queries to prevent ISP tracking and DNS hijacking
WPA ProtocolWPA3-Personal (or WPA2/WPA3 Mixed)Protects against KRACK attacks and offline dictionary brute-forcing

VLAN Network Architecture (The 3-Subnet Model)

Segment your local network into three distinct Virtual LANs: VLAN 10 (Trusted Devices: laptops, phones, NAS), VLAN 20 (IoT Untrusted: smart TVs, smart bulbs, cameras), and VLAN 30 (Guest Network: visitor devices).

Firewall Inter-VLAN Rules

Implement firewall rules that allow VLAN 10 to initiate connections into VLAN 20, but strictly drop any traffic initiated from VLAN 20 trying to reach VLAN 10. Untrusted smart devices can reach the internet, but cannot probe local laptops.

Frequently asked questions

Why is UPnP dangerous on home routers?
UPnP allows any device on your local network to request automated port forwarding without password authentication, enabling malware to expose internal services directly to the public web.

Sources and references

More in Hardening guides