How to Audit Your Home Router and Cut What It Tracks

The router is the one box in your house that touches every other box. Nine settings decide how much of that leaves.

State of Surveillance

TL;DR: Your router is the only box in the house that touches every other box. It hands out the addresses, it forwards every DNS lookup your devices make, and it keeps a live list of who is connected. Most of that is a setting you can turn down tonight. The Canadian Centre for Cyber Security tells router owners to change all default passwords, to disable remote access management, to disable SNMP, to turn off WPS, to update the firmware, and to put the internet-of-things devices on the guest network.[1] UPnP is the setting that ships switched on. NETGEAR says "A worm or malware program can use UPnP to compromise the security of your LAN" and recommends setting port forwarding up by hand instead.[3] TP-Link's own support page tells you to disable UPnP if you do not need it, and to keep the firmware up to date while you are in there.[4] And one problem no admin panel can fix. Cloudflare's resolver documentation is blunt about the plain protocol: "Unencrypted DNS queries can be monitored, modified, or used for tracking by ISPs, network operators, or malicious actors."[6] That one needs a different resolver, not a different setting.

What Your Router Actually Knows

Start with the job description, because it explains the rest. A router assigns an address to every device on the network and forwards packets for them. The Canadian Centre for Cyber Security puts it this way: "To do so, the router assigns a unique local Internet Protocol (IP) address to each of the devices on the network."[1] That address book is written by the router, so the router is what knows which hardware is on your network at any given moment.

This is not a hypothetical panel. NETGEAR describes a table in its admin interface: "The UPnP Portmap Table displays the IP address of each UPnP device that is accessing the router and which ports (internal and external) that device opened."[3] The same page notes that UPnP "helps devices, such as Internet appliances and computers access the network and connect to other devices as needed."[3] The router is a switchboard, and the switchboard keeps a record of every call.

The second thing it sees is more revealing. Every time a device in your house opens a website, that device sends a DNS query to turn a domain name into an IP address. Cloudflare's resolver documentation explains the path: your device sends the query, and "Unencrypted DNS queries can be monitored, modified, or used for tracking by ISPs, network operators, or malicious actors."[6] Google's documentation for its own resolver says the same thing about the ordinary protocol: "Traditional DNS queries and replies are sent over UDP or TCP without encryption, making them subject to surveillance, spoofing, and DNS-based Internet filtering."[7] The router sits in the middle of that path.

The third thing is the identifier baked into the hardware. Apple explains why that identifier is a tracking problem, and the explanation is worth reading twice because it is not about hackers: "If the device always uses the same Wi-Fi MAC address across all networks, network operators and other network observers can more easily relate that address to the device's network activity and location over time. This allows a kind of user tracking or profiling, and it affects all devices on all Wi-Fi networks."[5] Your router is one of those network observers.

The Audit: Nine Settings, in the Order That Matters

Everything below is in the admin page you already avoid, and every step is one the Canadian Centre for Cyber Security or the router's own manufacturer recommends. Do them in this order. The password first, because everything after it assumes nobody else is in the room.

  1. Change the admin password. The guidance is short: "Change all default passwords for your Wi-Fi network and the router."[1] NETGEAR's own support article spells out what the default is on its hardware. The user name is admin and the default password is password.[3] If you have never changed it, assume it is still that.
  2. Turn off remote management. The Canadian Centre tells you to disable remote access management, if possible, so that unauthorized people cannot reach your router from the internet and tamper with it.[1] If your admin page cannot switch it off, that is a replacement decision, not a preference. It goes further in the section on replacing the router below.
  3. Turn off UPnP. This is the setting that ships switched on. NETGEAR's guide says of the toggle: "By default, this check box is selected."[3] Its warning is blunter: "A worm or malware program can use UPnP to compromise the security of your LAN. We recommend that you manually set up port forwarding instead of enabling UPnP."[3] On a NETGEAR router the path is http://www.routerlogin.net, then ADVANCED, then Advanced Setup, then UPnP, then clear the "Turn UPnP On" box.[3] On a TP-Link router the same toggle sits under Advanced, then Port Forwarding, then UPnP.[4] TP-Link's own wording: "UPnP can introduce security risks. Malicious applications can exploit it to open ports without your knowledge. If you do not need UPnP, consider disabling it and keeping your firmware up to date."[4]
  4. Turn off WPS. The Canadian Centre says to "Disable WPS (Wi-Fi Protected Setup)"[1] and gives the reason: "However, a threat actor within range can brute-force the PIN authentication method."[1] It exists to make joining a network easier, which is a convenience you can live without once every device is set up.
  5. Update the firmware, then check whether the router is already dead. "Keep the router’s firmware up to date. This ensures you have the latest security patch installed to address known vulnerabilities."[1] The same guidance tells you to confirm with your provider whether the router is end-of-life, is no longer receiving firmware updates, or has known vulnerabilities associated with it.[1] A router that stopped getting updates years ago cannot be fixed by changing a setting.
  6. Use WPA3 or WPA2 with a passphrase. "Turn on Wi-Fi Protected Access (WPA) to protect internet traffic from unauthorized access. WPA2 or the newer WPA3 provide strong encryption between the router and your devices."[1]
  7. Move the smart devices onto the guest network. "Set up a guest network to enable internet connection for your guests and for your IoT devices. This avoids sharing passwords and reduces the risk of threat actors accessing your primary network devices and sensitive information."[1] The televisions, cameras, plugs and thermostats stop sharing a password with your laptop.
  8. Turn off SNMP. "Disable Simple Network Management Protocol (SNMP) to reduce risk of threat actors collecting basic system configuration information about your network."[1] The UK's National Cyber Security Centre, writing to the network operators it was responding to, was blunter still: "Disable SNMP Read/Write if not strictly required (consider disabling SNMP entirely if not required)."[2]
  9. Turn on logging, then actually read it. "Enable event logging and regularly monitor activity. This will allow you to detect what types of attacks are being attempted against the router and implement proactive mitigation measures."[1] How to read the log for signs of trouble is the next section.

How to Tell If Something Already Touched Your Router

The NCSC published an advisory on a pattern of router compromise it was seeing at internet service providers and large networks. Hostile actors were reaching network devices with legitimate SNMP credentials, then downloading the configuration files out over the Trivial File Transfer Protocol.[2] In the cases the NCSC investigated, the attackers also built Generic Routing Encapsulation tunnels tied to access control lists they controlled, which is a way to pull the traffic passing through the router out to infrastructure the attacker owns.[2] The advisory notes that a configuration file can contain the administrative credentials, "which may then be used to compromise all traffic on the router, and enable the actor to target other devices on the network."[2]

Here is the part you can actually use. The NCSC tells administrators to "Check logs for any evidence of tampering with the device" and lists what to look for: "instances of configurations being copied to a TFTP destination, redirection of command output to a TFTP destination, or the configuration of GRE tunnels linked to Access Control Lists."[2] Open the router's system log and read it. You are looking for outbound traffic to a TFTP server you did not start, and for tunnel entries you did not create.

Two more checks sit in the same admin panel. The NCSC recommends that logs show failed authentication attempts and be sufficient to identify brute-force attempts, and that logging record configuration changes.[2] And if you did not turn UPnP off, look at the port table, because TP-Link tells you to "Monitor connected devices regularly and check for unexpected or unrecognized port openings in your router's UPnP table."[4] NETGEAR's port table shows the same thing from the other direction: the IP address of each UPnP device that is accessing the router, and which ports that device opened.[3]

The Part You Cannot Fix in the Settings Menu

Everything above is a toggle in the admin page. The DNS problem is not, because the router forwards your queries to whoever it was told to forward them to, and the person on the other end of that query sees every site your household looks up.

Google's documentation for the unencrypted protocol is blunt: "Traditional DNS queries and responses are sent over UDP or TCP without encryption."[8] The fix is to change the transport rather than the resolver. Google describes what it added: "DoH and DoT enhance privacy and security between clients and resolvers, complementing Google Public DNS validation of DNSSEC to provide end-to-end authenticated DNS for DNSSEC-signed domains."[7] Cloudflare's resolver documentation lists the same three options: "To protect your DNS traffic, 1.1.1.1 supports three encryption standards".[6] DNS over TLS runs on port 853, DNS over HTTPS on port 443, and Oblivious DNS over HTTPS adds a layer so that no single party sees both your identity and your query.[6]

The catch, and it is a real one: whichever resolver you pick sees every lookup from every device on the network. You are choosing who holds the list, not whether a list exists. Change the resolver in the router's LAN or DHCP settings and every device inherits it at once, which is why this belongs in a router audit rather than in a list of things to install on your phone. For the mechanics, our guide to encrypted DNS covers the options, and the guide to what HTTPS hides from your ISP covers what changes once the lookup is encrypted and what does not.

Rotate the Addresses on the Devices Too

The router can only track what the device tells it, so the other half of the fix happens on the phones and laptops. Apple ships a feature for exactly this, and its documentation is precise about what each setting does.[5] "Off: When set to Off, your device uses its hardware MAC address."[5] "Fixed: When set to Fixed, your device uses a private address, but the private address doesn’t rotate, regardless of the network's security or length of time since you last joined the network."[5] "Rotating: When set to Rotating, your device uses a private address that rotates to a different private address every 2 weeks."[5] Apple also notes the default depends on the network: "Your device chooses Rotating by default when joining a new network that uses weak security or no security."[5]

Rotating is the one that changes the picture. The honest side effect is that your router's device list stops being a reliable roster of who you own, because a rotating device shows up as a new entry. Apple notes the same effect from the other side: if you manage a router configured to notify you when a new device joins the network, you get that notification when a device first joins with a private address.[5] That is the trade. A list that changes every couple of weeks is a worse tracking record than one that never changes.

When to Replace It Instead of Auditing It

Some routers cannot be brought up to a reasonable standard, and no amount of menu work fixes them. If the firmware stopped coming years ago, the audit is over before it starts.[1] The NCSC's standard for the equipment it cares about is the right test to apply to a home router: "Security updates for these devices must be actively provided by the manufacturer."[2] If the manufacturer has stopped providing them, the box is a liability that happens to route traffic.

Two more signals that a replacement is due. The admin page has no way to turn off remote management or UPnP, so the only upgrade path runs through the vendor's cloud app or your internet service provider's app, which means the vendor's servers sit in the middle of your home network. Or the router is rented from your provider, in which case the admin page may be locked down to a handful of settings. Both are reasons to buy your own, and our privacy router comparison walks through what to look for in one, including the firmware question that decides whether it stays patched.

The Order That Actually Works

  1. Log in to the admin page. NETGEAR uses http://www.routerlogin.net,[3] TP-Link modem routers use tplinkmodem.net,[4] and ISP-supplied gear usually goes through the provider's app or a printed address on the box.
  2. Change the admin password before you touch anything else, so a session nobody is watching cannot follow you around the settings.
  3. Check for a firmware update and install it if one is waiting. Update the firmware before changing settings where you can, since a new image can reset options back to their defaults.[1]
  4. Turn off remote management, UPnP, WPS and SNMP in one pass, then confirm each one actually shows as disabled.[1][2][4]
  5. Move the internet-of-things devices to the guest network and give the main network a WPA3 or WPA2 passphrase.[1]
  6. Turn on event logging and read the existing log for TFTP transfers, tunnel entries and unknown port openings.[2][4]
  7. Change the resolver to an encrypted one at the router level so every device inherits it, and set the private or rotating Wi-Fi address on your phones and laptops.[5][6][7]

That is the whole job. None of it costs anything, and it leaves the one box that sees everything in your house a lot less interesting to whoever is watching.

Sources

  1. Canadian Centre for Cyber Security, Routers cyber security best practices, ITSAP.80.019 (October 2022)
  2. UK National Cyber Security Centre, UK Internet Edge Router Devices: Advisory (published 11 August 2017, reviewed 15 November 2018)
  3. NETGEAR Support, How do I enable or disable Universal Plug and Play on my NETGEAR router (article 24306, last updated 07/07/2025)
  4. TP-Link Support, UPnP on TP-Link Routers and Deco: What It Is and How to Manage It
  5. Apple Support, Use private Wi-Fi addresses on Apple devices (published December 05, 2025)
  6. Cloudflare 1.1.1.1 documentation, Encrypt DNS traffic (last updated May 5, 2026)
  7. Google Public DNS for Developers, Secure transports for DNS
  8. Google Public DNS for Developers, DNS-over-TLS

Published: November 1, 2026