# Access router admin panel
# Login: admin / admin (default)

# Immediately change to strong password
# Use: 32-character random string
# Store in 1Password/Bitwarden

# Tools:
# 1Password: $4.99/month (includes password generator)
# Bitwarden: Free (open source)

# Router admin panel > System > Firmware Update
# Check for updates monthly

# Why: Patches WiFi vulnerabilities
# Critical: Some routers allow remote access without patching

# Common routers and update frequency:
# Ubiquiti: Monthly
# Netgear: Quarterly
# TP-Link: Quarterly
# Linksys: Bi-annual (slower)

# Router admin panel > Advanced > Remote Management
# DISABLE all of these:
# - Remote Management
# - UPnP (Universal Plug and Play)
# - Port Forwarding (unless specifically needed)

# Why: Prevents attackers from accessing router from internet

# Router admin panel > Wireless > Security

# Required encryption: WPA3 (if available)
# Fallback: WPA2 (WPA3 not yet universal)
# NEVER use: WEP or WPA (deprecated, crackable in minutes)

# WPA3 password requirements:
# - 20+ characters
# - Mixed case, numbers, symbols
# Example: T#x9mK$pL2@nQ7yW4bV8&Rs

# Store in password manager

# Router admin panel > Wireless > Security
# Disable: WPS
# Why: Vulnerable to brute-force attacks (8-digit PIN)
# Attacker can crack WPS in <4 hours with common tools

# Access: https://192.168.1.1 (admin panel)
# Username/Password: Set during setup

# Step 1: Create VLANs
# Unifi > Settings > Networks > Create New Network
# Name: "Work"
# VLAN ID: 1
# Subnet: 192.168.1.0/24
# Security: WPA3 Enterprise (optional)

# Step 2: Create WiFi Networks
# Unifi > Protect > WiFi Networks > Create
# Name: "Home-Work"
# Network: Work (VLAN 1)
# Security: WPA3
# Password: [32-char random]

# Repeat for IoT, Guest networks

# Step 3: Create Firewall Rules
# Unifi > Settings > Routing & Firewall > Firewall Rules
# Rule 1: IoT → Internet (allow)
# Rule 2: IoT → Work (deny)
# Rule 3: Work → IoT (deny)
# Result: Complete isolation

# Configuration on router
# Router admin > DNS > Primary: 1.1.1.2 (malware blocking)
# Secondary: 1.0.0.2 (fallback)

# Features:
# - Blocks malware domains (free)
# - Blocks adult content (optional)
# - DNSSEC validation
# - No logging (privacy)

# Cost: $0
# Setup: 2 minutes
# Coverage: ~92% of known malware domains

# Setup: https://nextdns.io
# Create account: $0-19.99/month depending on tier

# Configuration on router
# Router DNS > 45.90.28.0 (or custom IP)
# Or: Router > DoH (DNS over HTTPS) for encrypted queries

# Features:
# - Blocks malware, phishing, adult content
# - Per-device whitelisting/blacklisting
# - Usage analytics (see what was blocked)
# - Parental controls (block YouTube by time)
# - 9 domain blocklists to choose from

# Pricing:
# Free: 300k requests/month (fine for small home)
# $1.99/month: Unlimited, full features
# $3.99/month: Additional blocklists

# Coverage: ~98% of known malware domains

# Setup example:
# Step 1: https://nextdns.io > Sign up
# Step 2: Create profile "Home Network"
# Step 3: Enable: Malware Blocking, Security
# Step 4: Router admin > DNS > 45.90.28.0

# DNS: 9.9.9.9 and 149.112.112.112

# Features:
# - Blocks malware domains
# - DNSSEC validation
# - No user profiling (privacy)
# - No logging
# - Works with encrypted DNS

# Cost: $0
# Coverage: ~95% of known malware

# Your company likely mandates VPN for all remote work
# Common VPN clients:
# - Cisco AnyConnect
# - Palo Alto Networks GlobalProtect
# - Fortinet FortiClient
# - OpenVPN

# Setup: Download from company, install, login

# Benefit: All work traffic encrypted to company
# Cost: $0 (provided by employer)

# Using a personal VPN provides:
# - Encryption to VPN provider (not to company directly)
# - IP masking (hide home IP from websites)
# - Protection on public WiFi (if you work from coffee shops)

# Note: Check company policy before installing
# Most companies prohibit personal VPNs (policy enforcement)

# Router admin > Wireless > Guest Network
# Enable: Yes
# SSID: "Home-Guest"
# Security: WPA3
# Password: Different from main network
# Isolation: Enable (guest can't see main network)

# Unifi > Networks > Create New Network
# Type: Guest
# SSID: "Home-Guest"
# Firewall: Deny to LAN
# Result: Guests can access internet, nothing else

# Unifi > Settings > Routing & Firewall > Firewall Rules

# Rule 1: Block IoT from accessing Work
# Source: IoT VLAN (192.168.3.0/24)
# Destination: Work VLAN (192.168.1.0/24)
# Action: Drop
# Logging: Enabled (see blocked attempts)

# Rule 2: Block Work from IoT (return traffic allowed)
# Source: Work VLAN (192.168.1.0/24)
# Destination: IoT VLAN (192.168.3.0/24)
# Action: Drop

# Rule 3: Allow Work to Internet
# Source: Work VLAN
# Destination: 0.0.0.0/0 (any)
# Action: Accept
# (This is default, but make it explicit)

# Check for firmware updates
# Router admin > System > Firmware
# Review DNS filter logs (if using NextDNS)
# Check for new WiFi security advisories

# Review firewall rule logs
# Update WiFi password (if policy requires)
# Check for new malware domains in blocklist

# Full security audit
# Change all passwords (router admin, WiFi)
# Review VLAN configuration
# Update all firmware