Advanced Home Router Setup: The Settings That Make a Difference

The home router is the centre of the whole network: it hands out addresses, routes traffic, protects against the outside and often acts as the Wi-Fi access point too. Many people leave it on factory settings for years. With a few deliberate choices you can get a network that is more stable, faster under load and easier to manage. Here we focus on network configuration; securing the Wi-Fi deserves a separate discussion.

Modem, router and the provider's box

The same box usually combines different functions:

• modem or line termination: converts the fibre, copper or radio signal to Ethernet (on FTTH fibre this is done by the ONT);
• router: routes between the local network and the Internet, applying NAT and firewall;
• switch: the Ethernet ports on the back;
• access point: the Wi-Fi.

If you want to use your own router, more capable than the one supplied by your provider, you have two options:

1. connect it directly to the ONT or modem and configure the connection parameters on it (for example PPPoE with the credentials and any VLAN specified by the provider);
2. keep the provider's box and connect your router behind it.

Double NAT and how to avoid it

In the second case, if both devices act as routers, you get double NAT: traffic is translated twice. Browsing works, but port forwarding, some game consoles, inbound VPNs and telephony may run into trouble.

The solutions, from cleanest down:

1. put the provider's box into bridge mode, if it allows it: it becomes a simple bridge and your router receives the public address directly;
2. use the provider box's DMZ feature pointed at your router's WAN address, so it receives all inbound traffic;
3. as a last resort, configure port forwarding on both.

If the line also carries the provider's voice service through its box, check first that bridge mode does not disable it.

DHCP and addressing

• Pick an uncommon subnet and a DHCP range that leaves room for fixed addresses: for example .100 to .199 for DHCP, reservations from .10 to .99.
• Use DHCP reservations for printers, NAS units, cameras and servers: the device always gets the same address without manual configuration.
• Set a sensible lease time, for example 24 hours; very short leases generate pointless traffic, leases of several weeks hold on to addresses of devices long gone.

DNS: who answers the network's questions

The router usually acts as the resolver for internal devices and forwards queries to the provider's servers. You can choose different servers, including encrypted DNS, if the firmware supports it. Bear in mind that some devices and browsers use their own encrypted DNS, ignoring the router's.

If you run a local DNS server with filtering or internal names, configure DHCP to hand it out as the primary DNS and do not list a public resolver as secondary: clients would use it at random, making the filters ineffective.

UPnP: convenient, but think about it

UPnP lets internal programs and devices open ports on the router by themselves. It makes gaming and some applications easier, but it means any software on the network, including malicious software, can expose services to the outside without asking you.

A cautious choice is to disable it and open the few necessary ports by hand. If you keep it enabled, periodically check the list of mappings it has created on the router's dedicated page.

QoS and bufferbloat

Have you ever noticed a video call becoming unusable while someone at home downloads a big file? Often the cause is not insufficient bandwidth but bufferbloat: devices queue up too many packets and latency climbs by hundreds of milliseconds.

Many advanced routers offer SQM (Smart Queue Management), with algorithms such as fq_codel or CAKE, which manage queues intelligently. To make it work:

1. measure the line's real download and upload speed;
2. set slightly lower values in SQM, typically around 90% of what you measured;
3. repeat a latency-under-load test: the gap between idle latency and loaded latency should shrink dramatically.

Firmware and admin access

• Update the firmware, or turn on automatic updates if available.
• Disable remote administration from the Internet; if you need to manage the router from outside, come in through a VPN.
• Change the management interface password to a strong one and keep it in a password manager.
• Export a configuration backup after every significant change.

In short

• Tell apart the modem, router, switch and access point functions in the same box.
• Avoid double NAT with bridge mode or, alternatively, a DMZ pointing at your router.
• Organise DHCP with a clear range and reservations for fixed devices.
• Think carefully about UPnP and use SQM to keep bufferbloat in check.
• Update the firmware, close remote management and back up the configuration.