DEV Community: Glen Winemiller

My Wi-Fi range extender

Glen Winemiller — Fri, 21 Aug 2026 20:18:41 +0000

I have a finished basement and my router's signal is weak there, so I installed a Wi-Fi range extender in the basement to provide a stronger signal. The extender is part of my HomeNet_Guest network; its network name is HomeNet_Guest_EXT.

Settings

Band steering: Enabled
The same network name (HomeNet_Guest_EXT [SSID]) is used for both the 2.4 GHz and 5 GHz Wi-Fi frequency bands.
Hide SSID: Disabled
Password access: Enabled
Authentication method: WPA2/WPA3-Personal
Automatic time change (+/- 1 hour) when Daylight Saving Time changes in March and November
Automatic firmware check and upgrade: Once a day
Automatic reboot: Once a week

My Wi-Fi networks

Glen Winemiller — Thu, 20 Aug 2026 22:58:27 +0000

I have configured my Wi-Fi router to provide four wireless networks:

HomeNet_Main
HomeNet_Guest
HomeNet_SmartDevices
HomeNet_HVAC

HomeNet_Main
This is the primary wireless network for our home. It is the network used by all our personal devices (PC, laptops, tablets, mobile phones) to connect to and interact with the internet securely.

Settings

Band steering: Enabled
The same network name (HomeNet_Main [SSID]) is used for both the 2.4 GHz and 5 GHz Wi-Fi frequency bands. Some wireless devices can use either band. Band steering allows these devices to automatically choose the appropriate band for best performance.
Hide SSID: Disabled
Password access: Enabled
The password is a strong password (mix of upper/lower case letters, numbers, and special characters), and is unique to this network.
Authentication method: WPA2/WPA3-Personal
WPA encryption: AES
MAC filtering: Disabled

HomeNet_Guest
This is a wireless network that can be used by guests to connect to the internet. It is totally separate from all the other networks (especially HomeNet_Main), so anything guests do cannot interfere with or harm any other network (especially our main wireless network).

Settings

Band steering: Enabled
The same network name (HomeNet_Guest [SSID]) is used for both the 2.4 GHz and 5 GHz Wi-Fi frequency bands.
Hide SSID: Disabled
This allows "HomeNet_Guest" to be visible to wireless devices.
Password access: Enabled
The password is a strong password (mix of upper/lower case letters, numbers, and special characters), and is unique to this network.
Authentication method: WPA2/WPA3-Personal
WPA encryption: AES
MAC filtering: Disabled

HomeNet_SmartDevices
This is a wireless network used by our Internet of Things (IoT) devices that allows them to connect to the internet, and also allows us to use mobile phone apps to interact with those devices. This network is totally separate from all the other networks (especially HomeNet_Main), so anything a smart device does cannot interfere with or harm any other network (especially our main wireless network). This is particularly important if a smart device is hacked, since any malware-induced bad behavior will be constrained to the HomeNet_SmartDevices network.

Settings

Band steering: Disabled
This network uses just the 2.4 GHz Wi-Fi band because some of our older smart devices (e.g., Roku) only support 2.4 GHz.
Hide SSID: Enabled
This is a "privacy" precaution so "HomeNet_SmartDevices" is not visible to wireless devices as an available network.
Password access: Enabled
The password is a strong password (mix of upper/lower case letters, numbers, and special characters), and is unique to this network.
Authentication method: WPA2/WPA3-Personal
WPA encryption: AES
MAC filtering: Enabled
This is a "cybersecurity" precaution. Enabling this feature allows me to create a list with the MAC addresses of the devices allowed to access HomeNet_SmartDevices. This prevents devices with other MAC addresses from joining the network even if they discover "HomeNet_SmartDevices."

HomeNet_HVAC
This is a wireless network used to connect to the internet two smart thermostats (the vendor calls them "system controls") installed for our two HVAC systems. Each system control is used to set temperatures, humidity levels, fan speeds, heat/cool schedules, etc., for each HVAC system. This network is totally separate from all the other networks (especially HomeNet_Main), so anything a system control does cannot interfere with or harm any other network (especially our main wireless network). This is particularly important if a system control is hacked, since any malware-induced bad behavior will be constrained to the HomeNet_HVAC network.

Note: The two smart thermostats do not need to be connected to the internet. Setting them can be done using their built-in screens. However, by connecting them to the internet, I can use the vendor's system control app on my mobile phone to set, monitor, and manage each control using just my phone, from anywhere, as long as my phone is connected to a Wi-Fi network (especially handy when we are on vacation away from home).

A more important benefit of internet-connected controls is that they automatically check for firmware upgrades. When an upgrade is available, the controls display a message on their screens. Tapping the message downloads the upgraded firmware and installs it on a control.

Settings

Band steering: Disabled
This network uses just the 2.4 GHz Wi-Fi band because the two HVAC system controls (smart thermostats) only support 2.4 GHz.
Hide SSID: Enabled
This is a "privacy" precaution so "HomeNet_HVAC" is not visible to wireless devices as an available network.
Password access: Enabled
The password is a strong password (mix of upper/lower case letters, numbers, and special characters), and is unique to this network.
Authentication method: WPA2/WPA3-Personal
WPA encryption: AES
MAC filtering: Enabled
This is a "cybersecurity" precaution. Enabling this feature allows me to create a list with the MAC addresses of the two system controls that are permitted to access HomeNet_HVAC. This prevents devices with other MAC addresses from joining the network even if they discover "HomeNet_HVAC."

Next: My Wi-Fi range extender

My Wi-Fi router

Glen Winemiller — Wed, 19 Aug 2026 22:45:16 +0000

Strong login credentials
As soon as I powered on my router the first time, I changed the management console's login credentials from the default values. The username is now a strong username (a mix of upper/lower case letters, numbers, and special characters), and the password is a long, strong password (also a mix of upper/lower case letters, numbers, and special characters).

Access restrictions
My router has been configured to allow only three devices to login to its management console (Web UI): my PC, laptop, and mobile phone. The router uses the devices' IP addresses as the access filter (essentially, a "white list" of permitted devices/IPs).

This means those devices' IPs must not change when they join the network (the router's DHCP server may do that automatically). If a device's IP changes, that device will not be allowed to login to the management console because its new IP will be different from the one stored in the access list. Therefore, I configured the router to make those device IP addresses static IPs, which means the three devices will always have the same whitelisted IPs when they join the network.

Firewall settings

IPv4 firewall: Enabled
IPv6 firewall: Enabled
DoS (Denial-of-Service) protection: Enabled
Respond to ICMP Echo (ping) Requests from WAN: Disabled

Wireless settings
My router is a Wi-Fi 7 dual-band router (2.4 GHz and 5 GHz bands). Here are the settings for each band:

2.4 GHz - channel bandwidth: 20 MHz, control channel: 11.
5 GHz - channel bandwidth: 40 MHz (160 MHz is enabled), control channel: Auto.
WPS (Wi-Fi Protected Setup): Disabled

Miscellaneous settings

Management console remote access from WAN (internet): Disabled
SSH (Secure Shell): Disabled
Telnet: Disabled
UPnP (Universal Plug and Play): Disabled
NAT (Network Address Translation): Enabled
DHCP (Dynamic Host Configuration Protocol) server: Enabled
DNS (Domain Name System) server: Cloudflare (1.1.1.2, 1.0.0.2) instead of my ISP's DNS server
DNS Rebind protection: Enabled
DNSSEC (DNS Security Extensions) support: Enabled
Validate unsigned DNSSEC replies: Enabled
Prevent client auto DoH (DNS-over-HTTPS): Auto
DNS privacy protocol: DoT (DNS-over-TLS)
DoT profile: Strict
DoT server: 1.0.0.2 (security.cloudflare-dns.com)

Administrative settings

Automatic time change (+/- 1 hour) when Daylight Saving Time changes in March and November
Automatic firmware check and upgrade: Once a day
Automatic reboot: Once a week
Automatic management console logout: 30 minutes

Next: My Wi-Fi networks

My home computers

Glen Winemiller — Tue, 18 Aug 2026 14:05:11 +0000

Like our house, I feel (cyber) safety and security begins at the front door - the devices I and my family use every day to access the internet via our home network. Our technological front doors consist of computers, tablets, and mobile phones. They need to be secure so our "doors" and our house (network) are not easily compromised by actors with malicious intent.

I secure our home computers (PC and laptop, both Windows 11) using different types of passwords, as follows:

BIOS Admin Password - Used to access and change BIOS firmware settings. The BIOS Admin Password prevents unauthorized access to the computer's BIOS utility, so BIOS settings cannot be viewed or changed unless the BIOS Admin Password is used. The BIOS has been configured to enable a Password on Boot feature.
BIOS User Password - Used to access (login to) the computer once it has booted ("Password on Boot"). The BIOS User Password cannot be used to access the BIOS, but instead secures the physical computer against unauthorized use.
Windows User Password - Used to login to a Windows local user account once the computer itself can be accessed (by using the BIOS User Password).
Windows Hello PIN - Used to unlock the computer after a manual lock (Win + L) or a screensaver lock.
VeraCrypt password - Used to access and change sensitive files on my PC. I installed and used VeraCrypt to create an encrypted volume (Windows file) that contains sensitive files with financial information, estate plan information, tax returns, etc. When VeraCrypt is not being used, the volume is just a Windows file (encrypted, AES, 256-bit key) stored in my User directory. Double-clicking the file does not open it. Launching VeraCrypt and entering the password mounts and decrypts the file and presents it as a Windows virtual disk containing folders and files, which I can then access and change as needed. When done, I use VeraCrypt to unmount the disk, which then re-encrypts all folders and files including those that were added or changed.

I know that Microsoft's BitLocker Drive Encryption provides full disk encryption, but I use Windows 11 Home and BitLocker is not available for this version of Windows 11. I do know that a separate feature called Device Encryption is available for Windows 11 Home, which is a limited version of BitLocker.

I routinely back up all my user files to an external USB drive. Currently, my backups include non-encrypted files (these do not contain sensitive information) and the VeraCrypt-encrypted file. The VeraCrypt-encrypted file on my backup drive is protected just like it is on my PC: double-clicking the file will not open it, so it is secure.

I have not enabled Device Encryption on my PC. I'm concerned (but do not know for certain) that if I encrypt my PC's drive using Device Encryption (and do not use VeraCrypt to separately encrypt my sensitive files), when I back up my files to the external drive all the files on the drive will be unencrypted, including those containing sensitive information. Therefore, I am not using Device Encryption but instead using VeraCrypt for my sensitive files.

Finally, both computers run antivirus software and are updated every Patch Tuesday. Our other devices (Android phone, iPad, and iPhone) are updated whenever updates are available.

Next: My Wi-Fi router

Introduction

Glen Winemiller — Mon, 17 Aug 2026 15:02:39 +0000

I've spent some time the last couple of months updating my home network configuration. The goal was to make it as cyber-safe as reasonably possible. I've configured my devices and network (primarily my Wi-Fi 7 router) using tips and recommendations from various online resources. I thought I would share my configuration details so others can pick up some ideas about how they may want to configure their home networks, plus get feedback about changes I should consider.

I plan to post my home network details in chunks so the posts don't get too long. Here are the components of my home network I will discuss in upcoming posts:

My home computers
My Wi-Fi router
My Wi-Fi networks
My Wi-Fi range extender