Short answer: For most travelers, a compact model like the GL.iNet Beryl AX or Beryl 7 covers hotel Wi-Fi and VPN use; the Beryl 7 is the pick if VPN speed matters. Choose the Mudi 7 only if you need built-in 5G, and the ASUS RT-BE58 Go if you already run ASUS at home. Buy models already sold in the US: the FCC's March 2026 rule blocks new foreign-made router models from authorization unless they have Conditional Approval, and doesn't pull models already authorized.

For most people, a good starting point is a small, USB-C-powered model like the GL.iNet Beryl AX (GL-MT3000) or its Wi-Fi 7 successor, the Beryl 7 (GL-MT3600BE). Pick the Beryl 7 if you run a VPN, the Mudi 7 (GL-E5800) if you need built-in 5G, and the ASUS RT-BE58 Go if your home network is already ASUS. All five are sold in the US by their makers or major US retailers, though stock varies.

This is a research-based guide. We have not tested these routers. The picks come from manufacturer spec sheets, FCC records and setup documentation, matched to specific needs. We don’t list prices because they change often and stock was patchy when we checked.

What a travel router does

A travel router connects to the Wi-Fi (or Ethernet port) in a hotel, rental or dorm, then creates your own private Wi-Fi network from it. Your phone, laptop, tablet and streaming stick all join your network, which keeps the same name and password wherever you go.

That solves three common problems:

• Sign-in pages. You sign in to the hotel portal once, from one device, instead of on every gadget. GL.iNet notes that “the hotel Wi-Fi will only recognize the travel router as a single device,” which also helps where hotels cap devices per room.
• Devices without a browser. A streaming stick or game console can’t easily get past a portal page. On your own network, it doesn’t have to.
• One VPN for everything. Run the VPN on the router, and every device behind it uses it.

What it can’t do is make the hotel’s internet faster. The Wi-Fi ratings below are maximum link rates between your devices and the router, not internet speed. If the hotel connection is slow, everything behind your router is slow too.

Do you actually need one?

Not always. The FTC says that “because of the widespread use of encryption, connecting through a public Wi-Fi network is usually safe,” since most sites and apps encrypt traffic. It also warns that encryption won’t protect you from a scam website. So a travel router is mainly about convenience and privacy, not a fix for a security emergency.

It’s worth buying if you travel with three or more devices, want a TV streaming stick to work in hotel rooms, rely on a VPN, or work from rentals where an Ethernet port gives a better connection than the Wi-Fi.

What the FCC router rule means for buyers

On March 23, 2026, the FCC added “routers produced in a foreign country, except routers which have been granted a Conditional Approval” by the Department of War or Department of Homeland Security to its Covered List. Covered equipment can’t receive new FCC equipment authorizations.

What it doesn’t do is pull existing models. According to a summary by the law firm Steptoe, routers the FCC previously authorized “can continue to be imported and sold,” and devices consumers already bought are unaffected. The FCC’s engineering office also waived its rules so routers authorized before March 23 can keep receiving software and firmware updates. A May 8, 2026 notice extended that waiver until January 1, 2029, according to the law firm Pillsbury.

For the brands in this guide:

• GL.iNet says the products it already sells in the US are unaffected and that it will keep shipping firmware and security updates. It also says four newer products, the Slate 7 Pro, Flint 4, Velica 7 mesh system and Mango 2, are unavailable in the US “until further notice.” In that statement, last updated September 22, 2026, GL.iNet said it was preparing to apply for an exemption.
• ASUS said on September 14, 2026 that it had secured Conditional Approval “across its entire consumer router portfolio.”

The practical rule: buy a model that is already authorized and on sale in the US, and be wary of brand-new, imported versions of models that GL.iNet or another maker says aren’t available here.

Quick picks

The models, by need

GL.iNet Beryl AX (GL-MT3000): a simple, compact all-rounder

The Beryl AX is a Wi-Fi 6 router with a 2.5G WAN port and a 1G LAN port, a USB 3.0 port, and USB-C power at 5V/3A. GL.iNet lists it at 120 x 83 x 34 mm and 196 g, with power draw under 8 W. Its FCC authorization (FCC ID 2AFIW-MT3000) dates to January 19, 2023, so it predates the Covered List rule.

GL.iNet lists Wi-Fi link rates of 574 Mbps on 2.4 GHz and 2,402 Mbps on 5 GHz. Its own VPN figures are up to 300 Mbps with WireGuard and 150 Mbps with OpenVPN, measured in client mode on a local network. Its 5V/3A input also means it doesn’t need a high-wattage USB-C charger.

Best for: most travelers who want hotel Wi-Fi sharing and a VPN without paying for Wi-Fi 7.

GL.iNet Beryl 7 (GL-MT3600BE): fast VPN on every device

GL.iNet calls the Beryl 7 the Beryl AX’s successor. It became available to order on February 3, 2026, and its FCC authorization (2AFIW-MT3600BE) was granted December 24, 2025. GL.iNet’s statement on the FCC rule names the Beryl 7 among the US-launched models that remain eligible for updates.

It moves to dual-band Wi-Fi 7 (688 Mbps on 2.4 GHz, 2,882 Mbps on 5 GHz) and has two 2.5G Ethernet ports. The bigger change is VPN speed: GL.iNet’s datasheet lists up to 1,100 Mbps with WireGuard and 1,000 Mbps with OpenVPN (DCO). That’s more than three times the Beryl AX’s WireGuard figure, though GL.iNet states client-mode test conditions for the Beryl AX and not for the Beryl 7. It’s the same size as the Beryl AX and weighs 205 g. It accepts USB-C power at 5V/3A, 9V/3A or 12V/2.5A.

Best for: people who keep a VPN on all the time, or who plug into fast wired connections at rentals or offices.

GL.iNet Slate 7 (GL-BE3600): on-device status and controls

The Slate 7 has the same Wi-Fi 7 link rates as the Beryl 7, two 2.5G ports and a USB 3.0 port, plus a touchscreen that shows the connection mode and status, and foldable antennas. It measures 130 x 91 x 34 mm and weighs 295 g, more than the Beryl models.

On paper, it’s slower than the Beryl 7 for VPN use: GL.iNet lists up to 490 Mbps with WireGuard and 385 Mbps with OpenVPN (DCO), in client mode. The reason to choose it is the screen, which shows the connection status and, according to GL.iNet, lets you toggle the VPN without opening an app.

GL.iNet’s own US store listed the Slate 7 as sold out when we checked on October 18, 2026. If you find it elsewhere, buy the US version from an established retailer.

Best for: people who want to see what the router is doing at a glance.

GL.iNet Mudi 7 (GL-E5800): internet where there’s no Wi-Fi

The Mudi 7 is a different kind of device: a 5G mobile hotspot and travel router in one. The North American version has a Qualcomm X72 5G modem, two nano-SIM slots plus an eSIM, a 5,150 mAh battery, a 2.8-inch touchscreen and a 2.5G Ethernet port. It’s also the only tri-band Wi-Fi 7 model here, with a 6 GHz band GL.iNet rates at 5,764 Mbps. GL.iNet says the Mudi 7 is FCC-certified, and its FCC authorization (2AFIW-E5800) was granted February 13, 2026.

GL.iNet claims “up to 13.5hrs” of battery life but doesn’t say under what conditions, so treat that as a best case. GL.iNet’s US product page also doesn’t list carrier certifications. Before buying, check that your carrier will activate the device on your plan, and that the plan allows hotspot use.

Best for: RVs, road trips and remote work where hotel or rental Wi-Fi isn’t available or reliable. It’s overkill if you only stay in hotels.

ASUS RT-BE58 Go: a match for an ASUS home network

The RT-BE58 Go is ASUS’s Wi-Fi 7 travel router, announced August 5, 2025. It has the same 688 Mbps and 2,882 Mbps link rates as the GL.iNet Wi-Fi 7 models, a 2.5G WAN port and a 1G LAN port, a USB-A port for phone tethering, and USB-C power. ASUS lists it at 232 g.

Its advantage is the ASUS ecosystem: ASUS lists its ASUSWRT web interface and the ASUS Router app for management, and it supports WireGuard and OpenVPN as a client or server, and can act as an AiMesh node, so it can join an ASUS mesh network when you’re home. ASUS doesn’t publish VPN throughput figures for it, so we can’t compare its VPN speed with GL.iNet’s. ASUS says its whole consumer router portfolio has Conditional Approval, though its announcement doesn’t name individual models.

Best for: households already using ASUS routers.

Specs side by side

Wi-Fi figures are each maker’s listed maximum link rates per band, not real-world throughput. VPN figures are manufacturer claims, and test conditions vary by maker.

Wi-Fi 7 helps most when your laptop and phone also support it and the connection feeding the router is fast. If the hotel’s connection is slower than your Wi-Fi link, the hotel sets the limit, whichever Wi-Fi standard you use. Our Wi-Fi 6E vs. Wi-Fi 7 guide explains when the newer standard pays off.

Setting one up in a hotel

The basic steps are similar across brands: join the router’s own Wi-Fi, open its app or admin page, choose repeater (or WISP) mode, pick the hotel network, then sign in to the portal.

GL.iNet’s documentation, updated August 24, 2026, adds a few specifics for portals that don’t appear:

• On firmware 4.6 or later, turn on Auto-Enable Login Mode for Public Hotspots on the Join Network page.
• If the portal still won’t load, temporarily turn off the router’s VPN and AdGuard Home, and turn off DNS rebinding protection.
• If the hotel ties access to a device, clone the Wi-Fi address your phone used to sign in (Internet > Repeater > Modify > MAC Mode > Clone on firmware 4.6 or later).

GL.iNet warns that its login mode “may leak your network activity to the hotspot provider,” because it pauses some protections while you sign in. Turn your VPN back on afterward. Some hotels with strict verification may still block it; GL.iNet suggests asking staff to approve the router’s factory default address instead.

Our guide to the 2.4 GHz, 5 GHz and 6 GHz bands helps if a smart plug or older device won’t join your travel network.

Keep it updated

A travel router connects to networks you don’t control, so firmware updates matter. GL.iNet says it will keep providing updates for its US models, and the FCC’s waiver allows updates for routers authorized before March 23, 2026 until at least January 1, 2029. Check for updates before each trip; our guide on whether your router is still getting security updates shows how. Change the default Wi-Fi and admin passwords on day one, too.

Sources and verification

Bottom line

Start with the Beryl AX if you just want hotel Wi-Fi on all your devices, and step up to the Beryl 7 if you run a VPN. Buy the Mudi 7 only if you need cellular internet, and the RT-BE58 Go if you live in the ASUS ecosystem. Whatever you choose, buy a US version of a model that’s already on sale here, and update it before you leave.

Short answer: Your router keeps a list of every device on your network. Open it in the router's app or admin page, match each entry to a device you own, and block anything you can't identify. Unfamiliar entries are often your own phones and laptops using private Wi-Fi addresses, so check those first. If a stranger really is on your network, block them and change your Wi-Fi password.

Your router keeps a list of every device on your network. Open it in the router’s app or admin page, match each entry to something you own, and block anything you can’t identify. If a stranger really is connected, block them and change your Wi-Fi password.

This guide is based on eero, Google, Netgear, ASUS and Apple support documentation. It is not a hands-on test.

Step 1: Open your router’s device list

Google’s list includes devices that “used the network within the last 30 days, including ones not currently connected,” so an entry there doesn’t mean the device is online now. Netgear notes a device’s IP address can change when it rejoins, while its MAC address “does not change.” Eero says devices that haven’t connected in seven days drop off its list automatically.

Step 2: Identify unfamiliar devices

Most unknown entries turn out to be your own devices. Work through them:

• Smart home gear. Plugs, bulbs, TVs, speakers and printers often show a manufacturer name or a string of letters and numbers. ASUS’s client details include the manufacturer, which helps.
• Phones and laptops with private addresses. Apple says its devices identify themselves “to each network using a different Wi-Fi address” and may rotate it. On networks secured with WPA2 or stronger, Apple devices use a fixed private address by default; on weak or open networks, it rotates every two weeks. So the MAC address in your router’s list may not match the one printed on the device. On an iPhone, open Settings, Wi-Fi, then tap the More Info button next to your network to see the address it uses.
• Turn things off one at a time. If you still can’t place an entry, switch off or disconnect devices one by one and watch which entry goes offline.
• Rename what you’ve identified in the router’s app, so the next check is quicker.

Step 3: Block what you don’t recognize

• eero: find the device under Devices, open it, tap the more options icon in the top-right corner, then tap Block device. Eero says blocking “disconnects the device and prevents it from rejoining your network, even if the correct password is entered.” Blocking isn’t available when eero is in bridge mode.
• ASUS: in the web interface, click the device under Network Map, Clients, turn on Block Internet Access and click Apply. In the app, open the device and tap Block. ASUS says a blocked device “cannot connect to the Internet.”
• Netgear: the Attached Devices list shows whether each device is Allowed or Blocked. Look for access control settings on your model to block a device.
• Google Nest Wifi and Google Wifi: Google’s device-list help page doesn’t cover blocking. If you can’t block an unknown device, change your Wi-Fi password instead.

Step 4: Change your Wi-Fi password if someone got in

Blocking stops one device. If someone outside your household had the password, they can connect again from another device, so change it. Every device in your home will need the new password afterward.

While you’re in the settings:

• Use WPA3, or WPA2/WPA3 mixed mode, if your router offers it. See WPA2 vs. WPA3.
• Turn off WPS, which lets devices join without the password. See should you turn off WPS and UPnP.
• Give visitors a guest network instead of your main password. See guest networks for smart home devices.
• Change the router’s admin password too, and work through our router hardening checklist.

If your router no longer gets security updates, see is my router still getting security updates.

Fact-check notes

Bottom line

Check your router’s device list every so often and name what you recognize. Most unknown entries are your own gear, especially Apple devices using private addresses. If something truly isn’t yours, block it and change your Wi-Fi password.

Short answer: Look up your exact model and hardware version on the maker's end-of-life list, then check the router's app or admin page for a recent firmware update. If the model has reached end of life, it will not get security fixes again. The FBI and NSA both advise replacing routers in that state, because attackers target known, unpatched flaws.

Find your router’s exact model and hardware version on its label, then look it up on the manufacturer’s end-of-life list. If it is listed, it will not get security fixes again, and the FBI and NSA both advise replacing it. If it isn’t listed, open the router’s app or admin page, install any pending firmware update, and turn on automatic updates.

This is an explainer based on manufacturers’ published support policies and US government guidance. Policies differ by brand and region, so check your own model rather than relying on a general rule.

Why do security updates matter for a router?

Your router sits between every device in your home and the internet. When researchers or attackers find a flaw in its software, the fix arrives as a firmware update. A router that no longer gets updates keeps every flaw found after that date.

The FBI described this in a public service announcement on May 7, 2025. It said that when a router reaches end of life, the manufacturer is “not actively supporting the hardware,” so there are no more software updates or security patches. It warned that criminals were exploiting such routers with a malware family called TheMoon, which it said “allows cyber actors to install proxies on unsuspecting victim routers,” routing other people’s criminal traffic through them. The FBI advised replacing end-of-life routers and turning off remote administration.

The NSA’s home network guidance, published in February 2023, says routers “should be updated to the latest patches, preferably through automatic updates,” and “should also be replaced when they reach end-of-life (EOL) for support.”

How long do manufacturers support routers?

Two details make a difference:

• The clock usually starts when the model stops being sold, not when you bought it. Netgear’s three years runs from the last sale date, which can vary by country or region. A router bought near the end of its sales life may have little support left.
• Eero’s dates are published per model. Its table runs from March 11, 2030 for the eero Pro and eero Beacon to October 31, 2031 for most newer models, including the eero 6, eero 7 and eero Max 7 lines. Eero says that after updates end, “your eero device will still work and can still provide wifi,” but without guaranteed security fixes.

How do I check my router?

1. Find the model and hardware version. It’s on the label on the bottom or back. Netgear says that if no version is shown, the product is version 1. ASUS also points to the label and the box.
2. Search the maker’s list.
   • Netgear: search the End of Service Products page by model number. Netgear also offers end-of-service alerts if you register your product.
   • ASUS: check the End-of-life product list. ASUS notes that end-of-life status can vary by region.
   • TP-Link: check the TP-Link End of Life Products list, and note that dates vary by region.
   • eero: find your model’s date on the eero Software Security Updates page.
3. Check the firmware date. In the router’s app or admin page, look for the firmware version and an update option. Install anything pending.
4. Turn on automatic updates if your router offers them. Apple’s router guidance recommends setting routers to install firmware updates automatically. Eero installs updates automatically and lets you choose a preferred time under Settings, Software updates, Preferred update time.

For provider-supplied gateways, ask the provider. They typically manage firmware for their own equipment.

What if my router is no longer supported?

Plan to replace it. In the meantime, reduce the risk:

• Turn off remote administration. The FBI says to “disable remote management/remote administration, save the change, and reboot the router.”
• Change the admin password to a strong, unique one. The FBI recommends passwords of 16 to 64 characters.
• Turn off features you don’t use, such as WPS and UPnP. See should you turn off WPS and UPnP.
• Move smart home devices to a separate network if the router supports one. See guest networks for smart home devices.

When you buy a replacement, check how long the maker supports its routers before you choose. Our router hardening checklist covers the settings to change on day one, and our guides to Wi-Fi 6 vs. Wi-Fi 6E and router vs. mesh help with the choice. Under the FCC’s 2026 router rule, previously authorized models can still be bought; see our news report on TP-Link and the FCC for the current state of that rule.

Fact-check notes

Bottom line

Check your router’s model on its maker’s end-of-life list today, and turn on automatic updates. If it’s no longer supported, switch off remote administration and plan a replacement. When you buy the next one, add the maker’s update policy to the spec sheet you compare.

Short answer: Florida, Iowa, Montana and Nebraska sued TP-Link on October 6, 2026, joining a Texas suit from February. The states allege it misled consumers about router security and its ties to China; TP-Link denies the claims, and no court has ruled. Owning or using a TP-Link router remains legal. Check that yours still gets firmware updates.

Four more US states sued router maker TP-Link on October 6, 2026, bringing the number of state lawsuits to five. Florida, Iowa, Montana and Nebraska accuse the company of misleading consumers about how secure its routers are and about its ties to China, following a similar Texas suit filed in February. TP-Link denies the claims, and no court has ruled on them.

If you own a TP-Link router, nothing about the lawsuits requires you to stop using it. What matters for your network today is the same as for any router: whether it still receives security updates. This is a news report based on the attorneys general’s announcements, TP-Link’s response and FCC documents. We have not read the full court filings.

What happened?

Iowa’s suit is brought under the Iowa Consumer Fraud Act. The attorneys general announced the other suits as consumer-protection cases. We have not confirmed the court or statute for each one.

What do the states allege?

The announcements we read make overlapping claims. In summary, the states allege that TP-Link:

• Marketed its routers as secure while, according to Texas, its products were used by Chinese state-sponsored hackers in cyberattacks against the United States.
• Misled consumers about where its products are made. Iowa says that despite TP-Link’s statements that its routers are made in Vietnam, much of its research, development and manufacturing is in China and nearly all parts come from or through China.
• Hid its ties to China. Texas says those ties subject the company to Chinese laws that require support for intelligence services. Iowa’s announcement goes further and says TP-Link firmware gives the Chinese government access to users’ devices and data.

These are claims in lawsuits, not findings. Courts have not decided any of them, and TP-Link disputes them.

What does TP-Link say?

In a statement dated October 6, 2026, TP-Link’s corporate affairs officer Steve Kovsky called the lawsuits “built on false premises” and claims of foreign access “baseless.” The company describes itself as “an independent, U.S. company that is not owned or controlled by any foreign government,” says its devices sold in the US are made in Vietnam, and says it will not share customer network data with foreign governments. It says it looks forward to “refuting these baseless allegations in court.”

Is it still legal to own or buy a TP-Link router?

Yes to owning one. The lawsuits are actions against the company. They don’t create rules for people who own its products.

Buying is shaped by a separate federal rule. On March 23, 2026, the FCC added foreign-produced routers from every manufacturer to its Covered List. Under that rule, new models need a Conditional Approval to be authorized for sale. The FCC’s FAQ, updated May 12, 2026, says consumers using these routers “do not need to do anything,” and that consumers “will continue to be able to purchase previously authorized routers.”

The FCC’s list of routers with Conditional Approval, updated October 9, 2026, includes Netgear, ASUS and eero, among others. TP-Link is not on it.

On October 7, a Nebraska-led group of 21 state attorneys general wrote to the FCC about TP-Link’s pending request for that approval. Their announcement says their security concerns “must be addressed before a decision is made.” The same announcement claims TP-Link controls at least 60 percent of the US retail market for Wi-Fi systems and small office and home routers. That figure is the attorneys general’s claim; we have not verified it independently.

For more on how the rule affects which new routers reach US stores, see our Wi-Fi 8 availability report.

What should TP-Link owners do now?

The lawsuits don’t change your router’s security from one day to the next. These steps apply to any router, and they are the ones that make a practical difference:

1. Update the firmware. Check the TP-Link app or admin page for an update, and turn on automatic updates if your model offers them.
2. Check whether your model is still supported. A router that no longer receives security updates is a reason to replace it, whoever made it.
3. If your internet provider supplied it, ask the provider. TP-Link’s advisory on its Aginet equipment, the line it makes for internet providers to supply and manage, covers five flaws, CVE-2025-30237 to CVE-2025-30241. TP-Link says fixes reach those devices “via ISP-managed update mechanisms” and that firmware for provider versions may not be available for direct download. If no update appears, contact your provider.
4. Lock down the basics. Change the admin password, turn off remote management and WPS, and keep smart home devices on a separate network. See our router hardening checklist, WPS and UPnP guide and guest network guide.

If you decide to replace your router anyway, our guide to buying your own router vs. using your provider’s covers what to check first.

What happens next?

The cases will proceed in state courts, and TP-Link has said it will contest them. Separately, the FCC has not announced a decision on TP-Link’s request to sell new router models. We’ll update this article when either changes.

Fact-check notes

Bottom line

Five states now accuse TP-Link of misleading customers, and TP-Link says the cases have no merit. None of that changes whether you can use the router in your home. Make sure it’s updated and still supported, ask your provider about any provider-supplied TP-Link equipment, and follow the FCC’s decision on new models if you are shopping.

Short answer: Change your router's DNS if you want features your provider's DNS doesn't offer, mainly blocking known malicious sites or a published privacy policy you prefer. Don't expect faster downloads; DNS only affects the lookup before a connection starts. Set it once on the router and every device on the network uses it.

Change your router’s DNS if you want something your internet provider’s DNS doesn’t give you: blocking of known malicious websites, filtering for a family network, or a privacy policy you prefer. Don’t change it expecting faster downloads. DNS handles the lookup before a connection starts, not the connection itself.

This is a how-to based on the DNS providers’ and router makers’ own documentation. We have not measured DNS speeds for this guide.

What does DNS do?

DNS stands for Domain Name System. When you type a website name, your device asks a DNS server for the site’s numeric IP address, then connects to that address. It works like a phone book lookup before the call.

By default your router uses DNS servers assigned by your internet provider, and passes them on to every device that joins your network. Netgear’s support notes that “most ISPs supply DNS addresses automatically.” Changing the DNS setting on the router changes it for every device that gets its settings from the router, including smart TVs and other devices with no DNS option of their own.

Will changing DNS make my internet faster?

Not your download speed. Once the lookup finishes, the connection runs at the speed your plan and Wi-Fi allow, whichever DNS server answered.

Lookups can still add delay to page loading. Google’s Public DNS documentation says “DNS lookups significantly impact website loading speed,” especially on pages that pull content from many domains, and gives an example in which five lookups made up several seconds of an 11-second page load. That example is Google’s own illustration, not a measurement of any particular DNS provider. Whether a different server is quicker than your provider’s depends on where you are and which servers are closer, so if speed is your reason, test before and after rather than assuming.

For streaming, gaming and downloads, see how much internet speed you need and why Wi-Fi can be slow when your internet is fast.

Which public DNS should I choose?

Three widely used free services, with their own published details:

All three also publish IPv6 addresses. For Cloudflare’s standard service they are 2606:4700:4700::1111 and 2606:4700:4700::1001; for Google, 2001:4860:4860::8888 and 2001:4860:4860::8844.

How to choose:

• For protection from known malicious sites, use a filtering option: Quad9’s 9.9.9.9 or Cloudflare’s 1.1.1.2. Quad9 also offers 9.9.9.10 without malware blocking, which it labels “for experts only!”
• For a family network, Cloudflare’s 1.1.1.3 adds adult-content blocking.
• For no filtering at all, use Cloudflare’s 1.1.1.1 or Google’s 8.8.8.8.
• For privacy, read each provider’s policy in full. The summaries above are their own statements, and we have not audited them.

DNS filtering is one layer, not a security system. It only blocks domains already on the provider’s lists, and devices set to use their own DNS bypass the router’s setting. Pair it with the basics in our router hardening checklist.

How do I change DNS on my router?

Before you start, write down the DNS addresses your router uses now. Google recommends recording your current settings so you can switch back. Enter two addresses, a primary and a secondary from the same service, and don’t use the same address in both fields.

eero

1. Open the eero app and tap Settings.
2. Tap Advanced networking, then DNS.
3. Turn on Custom DNS and enter the IPv4 and, if you want, IPv6 addresses.
4. Tap Save. Eero says the network reboots to push the change to devices.

If DNS settings are grayed out, eero says to turn off eero Plus filters, Advanced Security and Ad Blocking first, under Home, Security & privacy, Network Controls.

Netgear

1. Browse to routerlogin.net and sign in.
2. Go to BASIC, then Internet.
3. Under Domain Name Server (DNS) Address, select Use These DNS Servers.
4. Enter the Primary DNS and Secondary DNS, then click Apply.

Other routers and provider gateways

Google notes that “every router uses a different user interface for configuring DNS server settings.” Look in the router’s app or admin page for DNS under Internet, WAN or advanced network settings.

Some provider gateways won’t let you change DNS. Google warns that “some ISPs hard-code their DNS servers into the equipment they provide.” If that’s your situation, set DNS on your own router placed behind the gateway, or on individual devices. Our guide to buying your own router vs. using your provider’s covers that setup.

How do I check it worked?

After the change, restart a device or reconnect it to Wi-Fi so it picks up the new settings, then:

• Visit a few sites to confirm they load. If nothing loads, recheck the addresses for typos.
• Check the device’s network details for the DNS servers it received. Some routers hand out their own address and forward lookups to your chosen servers; eero does this with some features turned on, so you may see the router’s address instead.
• If you chose a filtering service, the provider may offer a way to confirm you’re using it. Quad9, for example, links to a tool for searching blocked domains.

If something breaks, enter the addresses you wrote down, or switch the router back to getting DNS automatically.

Fact-check notes

Bottom line

Changing your router’s DNS is quick, reversible and covers every device on the network. Do it for malware or content filtering, or for a privacy policy you prefer, and pick the service by those features. Don’t do it to fix slow speeds; check your plan and Wi-Fi for that. Write down your current settings before you start.

Short answer: Turn off WPS: its PIN method has a design flaw that lets someone in Wi-Fi range recover your password, and you can join devices by typing the password instead. Turn off UPnP unless something you use needs it, which the NSA recommends. Game consoles are the common exception, and port forwarding is the narrower alternative.

Turn off WPS. Turn off UPnP too, unless something you use stops working without it. Both features exist to save you a setup step, and both have documented security weaknesses. For most homes the only real cost of switching them off is a few minutes of extra setup, and for game consoles, a port-forwarding rule.

This is an explainer based on US government security guidance and published vulnerability notes. We have not tested routers for it.

What is WPS, and what is wrong with it?

WPS stands for Wi-Fi Protected Setup. The Wi-Fi Alliance, the industry group that certifies Wi-Fi products, says it was “designed to ease the setup of security-protected Wi-Fi networks in home and small office environments.” In practice it lets a device join your Wi-Fi without anyone typing the password, usually by pressing a button on the router or entering an 8-digit PIN.

The PIN is the problem. On December 27, 2011, the CERT Coordination Center at Carnegie Mellon University published a vulnerability note on a flaw reported by researcher Stefan Viehböck. The router checks the 8-digit PIN in two halves and tells the other side when the first half is right. The last digit is a checksum, a digit calculated from the others. Together those reduce the number of guesses needed from 100 million to 11,000.

CERT’s note says an attacker within wireless range can “brute force the WPS PIN and retrieve the password for the wireless network, change the configuration of the access point, or cause a denial of service.” A long Wi-Fi password does not help, because the attack goes around it.

CERT’s recommended solution was to disable the feature. The Cybersecurity and Infrastructure Security Agency (CISA) says the same in its home Wi-Fi guidance: WPS “increases the likelihood that a threat actor could gain unauthorized access to your Wi-Fi network.”

Is the button safer than the PIN?

The published flaw concerns the PIN. The button method opens a short window after someone physically presses it, so an attacker would need to be in range at that moment.

Whether you can keep the button and lose the PIN depends on your router. Some have separate settings, and many have a single WPS switch that controls both. The CERT note is from 2011 and router firmware has changed since, but you can’t easily verify how your own router handles repeated PIN attempts. If you can’t confirm the PIN method is off, turn WPS off altogether.

What do I use instead?

Type the password, or scan it. Many phones can share a Wi-Fi password by QR code, and printers and smart devices can be joined through their own apps or control panels. The Wi-Fi Alliance also has a newer setup method, Wi-Fi Easy Connect, which works by “scanning a product quick response (QR) code.” Whether you can use it depends on both the router and the device supporting it.

What is UPnP, and what is wrong with it?

UPnP stands for Universal Plug and Play. On a home router, it lets a device on your network ask the router to open a port, which is a numbered doorway for incoming connections from the internet. A game console might open ports so other players can connect to it. The device asks, the router agrees, and you never see a prompt.

That convenience is also the weakness. The router does not check whether the request is a good idea. Any device or program on your network can ask, including one that is infected or badly made.

Three official sources address it:

• The National Security Agency (NSA), in home network guidance published in February 2023: “Disable Universal Plug-n-Play (UPnP). These measures help close holes that may enable an attacker to compromise your network.”
• CISA: “Threat actors can use UPnP to spread malware to devices in your network and control them remotely.”
• CERT, in a note published January 29, 2013, on flaws found by security firm Rapid7 in a widely used UPnP software library: “A remote, unauthenticated attacker may be able to execute arbitrary code on the device or cause a denial of service.” One of its suggested workarounds was to disable UPnP.

That 2013 flaw was in one software library, and CERT’s note lists a fixed version of it. It is here as an example of the kind of problem UPnP has had, not as a current threat to your specific router. The NSA and CISA advice is the reason to act.

What breaks if I turn them off?

Turning off WPS breaks nothing that is already connected. Devices that joined by WPS should stay joined, because they store the password once connected.

Turning off UPnP is the one that can bite. Web browsing, streaming and video calls generally start from your device and reach outward, so they don’t need incoming ports. Multiplayer gaming and voice chat on consoles are different, because other players’ consoles need to connect in.

Xbox support explains the symptom: you can sign in, but “can’t hear your friends online within a game or a party” or can’t host or join a multiplayer game. It says “You need your NAT type to be Open to resolve this issue.” NAT (Network Address Translation) is how your router shares one internet address among all your devices, and the NAT type is the console’s measure of how easily others can reach it. The first fix Xbox lists is “Turn on UPnP.” The next ones it lists are opening ports with port forwarding, then a “perimeter network (also known as DMZ).”

Which should I choose for gaming: UPnP or port forwarding?

Port forwarding is the better fit for a household that wants UPnP off. You give the console a fixed address on your network, then forward the ports the console maker lists to that address. The exact ports are on each console maker’s support site.

If you decide to keep UPnP on for a console, reduce the exposure in other ways. Keep the router’s firmware current, and put smart home devices on a separate network so they can’t use UPnP on your main one. Our guide to guest networks for smart home devices covers how.

One note for gamers: an Open NAT type helps you connect to other players. It does not reduce lag. For that, see our bufferbloat guide.

How do I turn them off?

Menu names vary by brand, so look for the closest match in your router’s app or admin page.

1. Open the router’s settings in its app or by browsing to its admin address.
2. Find WPS. It is usually under wireless or Wi-Fi settings, sometimes under advanced settings. Turn it off, and if there is a separate PIN option, turn that off too.
3. Find UPnP. It is usually under advanced, network or NAT settings. Turn it off.
4. Save, then test. Check that devices still connect, and run the network test on any game console. On Xbox this is under Settings, General, Network settings.
5. Add port forwarding only for a device that now has a problem.
6. While you are there, turn off remote management. The NSA guidance says to “disable the ability to perform remote administration on the routing device.”

Your router or mesh system may not have a WPS setting at all. If you can’t find one, check the maker’s support pages before assuming WPS is on.

For the rest of the settings worth changing, see our router hardening checklist. For the security mode itself, see WPA2 vs. WPA3.

Fact-check notes

Bottom line

WPS saves you typing a password once and leaves a known weakness in place, so turn it off. UPnP is off in the NSA’s recommended setup, so turn that off too and see whether anything complains. If a game console does, forward its ports instead of switching UPnP back on. Neither change takes more than a few minutes, and both are easy to reverse.

Short answer: Yes for devices that only need the internet, such as cameras that work through a cloud app, smart plugs and TVs. A guest network keeps them from reaching your laptops and phones, which is what the NSA and FBI recommend. Devices you control directly from your phone, cast to, or print to may stop working there, so move one device first and test it.

For most smart home devices, yes. Cameras, plugs, TVs and speakers that only need an internet connection are better off on a guest network, where they can’t reach your laptops and phones. The trade-off is that the same separation can break features that need your phone and the device on one network. Move one device, test it, then move the rest.

Smart home devices are often called IoT devices, short for Internet of Things. They vary widely in how well they are secured and how long they are updated, and they usually sit on the same network as the computers that hold your email, banking and files. Separating the two groups is called network segmentation.

What do security agencies recommend?

Two US agencies give the same advice.

The National Security Agency (NSA), in home network guidance published in February 2023, says: “your wireless network should be segmented between your primary Wi-Fi, guest Wi-Fi, and IoT network. This segmentation keeps less secure devices from directly communicating with your more secure devices.”

The FBI’s Portland field office, in a public notice dated December 3, 2019, said: “Your fridge and your laptop should not be on the same network. Keep your most private, sensitive data on a separate system from your other IoT devices.”

Neither agency says smart devices are unsafe to own. The point is containment. If a device is compromised, it should not have a direct route to the machines that matter most.

How does a guest network separate devices?

A guest network is a second Wi-Fi network from the same router, with its own name and password. Devices on it get internet access but are walled off from your main network. How strict the wall is depends on the brand.

Settings and wording differ on other brands, and some routers have an option that lets guest devices see the main network. If yours has one, leave it off. That option removes the protection you are setting the network up for.

What can break when smart devices are on a guest network?

The wall works in both directions. Your phone on the main network may not be able to find a device on the guest network. Whether that matters depends on how the device is controlled.

The examples are typical patterns, not guarantees for any model. We have not tested devices for this guide, so check with one device before moving everything.

Google’s approach reduces the problem. Its guest network lets you select shared devices, described as “a Google streaming device, smart TV, wireless speaker, or printer,” that guests can still use.

Setup is the other snag. Many devices are set up by a phone app that expects the phone and device on the same Wi-Fi. If setup fails, join your phone to the guest network for the setup, then switch the phone back.

Which devices should go where?

This table is our application of the NSA and FBI principle to common devices. It is a starting point, not a rule from either agency.

Should visitors and smart devices share one guest network?

Ideally not. The NSA guidance names three networks: primary, guest and IoT. A visitor’s laptop and your cameras have no more reason to share a network than your own laptop does.

Many home routers offer only two: main and guest. In that case, putting smart devices on the guest network and giving visitors that password is still a clear improvement over a single network. On a system that isolates guest devices from each other, as eero does, the two groups can’t reach one another anyway.

If your router has a separate IoT network or supports VLANs (virtual networks that divide one router into several isolated ones), use that for smart devices and keep the guest network for people.

How do I set it up?

1. Turn on the guest network in your router’s app or admin page. On eero it is under Settings, then “Guest wifi network.” On Deco it is under More, then Guest Network. On Google’s systems it is in the Google Home app’s Wi-Fi settings.
2. Give it a different password from your main network. Eero and Google both say to do this. Use a long one; the NSA guidance recommends at least 20 characters for Wi-Fi passphrases.
3. Check the security mode. Use WPA3 or a WPA2/WPA3 mixed mode where the guest network offers it. Our WPA2 vs. WPA3 guide explains the options. Avoid an open guest network with no password.
4. Make sure 2.4 GHz is available on it. Many smart devices connect only on 2.4 GHz. Deco lets you choose which bands the guest network uses. See our guide to the Wi-Fi bands.
5. Move one device and test it. Remove it from the main network in its app, set it up again on the guest network, then check every feature you use, from both home and away.
6. Move the rest, leaving on the main network anything that failed the test and matters to you.
7. Leave any “access local network” option off.

Is a guest network enough on its own?

No. It limits where a compromised device can reach. It does not stop the device from being compromised, and it does not protect what the device itself sees or records.

The FBI notice lists the other steps: change default passwords, use a strong and unique password for each device, review what the companion app collects, and turn on automatic updates. Its advice on default passwords is blunt: if you can’t find out how to change one, consider a different product.

For the router’s own settings, work through our router hardening checklist. For how smart home devices connect in the first place, see Matter and Thread, explained.

Fact-check notes

Bottom line

Put smart home devices that only need the internet on a guest or IoT network, and keep computers, phones and storage on the main one. That is the separation the NSA and FBI describe. Expect a few features, mainly casting and local control, to need a workaround, and test with one device before you move the rest. Then finish the job with unique passwords and automatic updates.

Short answer: Use WPA3 Personal if every device you own can connect with it. If some can't, use the WPA2/WPA3 transitional (mixed) mode. Use WPA2 Personal with AES only when your router offers nothing newer. Avoid WEP, the original WPA and anything labeled TKIP. Whichever mode you use, a long passphrase and current firmware matter as much as the setting.

Use WPA3 Personal if every device in your home can connect with it. If some can’t, use your router’s WPA2/WPA3 transitional mode, which some brands call mixed mode. Use WPA2 Personal with AES only when the router offers nothing newer. Avoid WEP, the original WPA, and any option with TKIP in its name.

WPA stands for Wi-Fi Protected Access. It is the security that scrambles traffic between your devices and your router and decides who is allowed to join. This guide covers the “Personal” versions, the ones that use a shared Wi-Fi password at home. “Enterprise” versions use individual logins and are meant for workplaces.

What is the difference between WPA2 and WPA3?

The main difference is how each one handles your Wi-Fi password when a device joins.

With WPA2 Personal, a device and the router prove they know the password through a four-step exchange. Someone within radio range can record that exchange and then try password guesses against the recording on their own computer, as fast as their hardware allows. Security researchers describe this as a dictionary attack. A short or common password can fall to it.

WPA3 Personal replaces that exchange with one called Simultaneous Authentication of Equals (SAE). The Wi-Fi Alliance, the industry group that certifies Wi-Fi products, introduced WPA3 on June 25, 2018. It says SAE provides “stronger protections for users against password guessing attempts by third parties” and gives more resilient protection “even when users choose passwords that fall short of typical complexity recommendations.”

Protected Management Frames (PMF) guard the control messages that keep a device connected, which the Wi-Fi Alliance describes as protection from eavesdropping and forging.

The Wi-Fi Alliance now states that WPA3 is mandatory for Wi-Fi CERTIFIED devices, so current routers, phones and laptops that carry that certification support it.

Which setting should I choose on my router?

Router menus use different labels, so look for the closest match.

That order follows Apple’s router guidance, dated July 14, 2026, which also says: “Don’t create or join networks that use older, deprecated security protocols.”

The National Security Agency’s home network guidance, published in February 2023, gives the same advice from a different direction. It says to make sure your router “is capable of Wi-Fi Protected Access 3 (WPA3),” and that if you have devices that don’t support WPA3, “you can select WPA2/3 instead.”

Is transitional mode as secure as WPA3 only?

No. It is a compromise, and a reasonable one for most homes.

In transitional mode, the router accepts both WPA2 and WPA3 connections under one network name and one password. Any device that joins with WPA2 gets WPA2’s protection, not WPA3’s. And because the password is shared, a weak password remains exposed to the offline guessing described above through those WPA2 connections.

There is also a known attack on the mode itself. In April 2019, researchers Mathy Vanhoef and Eyal Ronen published a set of WPA3 weaknesses they named Dragonblood. One of them was a downgrade attack: an attacker sets up a fake WPA2-only copy of a network and pushes WPA3-capable devices to try connecting to it, which captures enough to start guessing the password offline. The researchers worked with the Wi-Fi Alliance on fixes, and patches were published. Newer versions of WPA3 include a feature called Transition Disable, which Cisco describes as protection against exactly this kind of downgrade. Whether your router and devices have it depends on their firmware.

What this means in practice:

• If every device you own supports WPA3, choose WPA3 only.
• If you need transitional mode, use a long passphrase. It closes most of the gap.
• Another option is to keep your main network on WPA3 and put older devices on a guest or smart-home network that uses WPA2 with AES. The NSA guidance recommends separating your primary, guest and smart-home networks anyway.

Is WPA2 still safe?

WPA2 Personal with AES is still acceptable when you have no better option. Apple keeps it on its recommended list for that case. Two conditions apply.

Your password has to carry more weight. Because WPA2 allows offline guessing, a short or reused password is the weak point. The NSA guidance says to use “a strong passphrase with a minimum length of twenty characters.” Several unrelated words strung together are easy to type and hard to guess.

Your devices need their updates. In 2017, security researcher Mathy Vanhoef disclosed KRACK, a weakness in WPA2’s four-way handshake. He wrote that the flaw was “in the Wi-Fi standard itself,” so “any correct implementation of WPA2 is likely affected.” It was fixed through software updates to devices and routers. His guidance at the time still stands: changing your Wi-Fi password does not fix it; installing updates does. A phone, laptop or router that stopped receiving updates before 2018 may still be exposed.

WPA3 is not flawless either, as Dragonblood showed. But the researchers who found those flaws wrote that, with vendors mitigating the attacks, WPA3 “will still be an improvement over WPA2.”

Do I need WPA3 for 6 GHz, Wi-Fi 6E and Wi-Fi 7?

Yes, for the 6 GHz band. Cisco’s WPA3 deployment guide, updated October 6, 2025, states that “WPA3 is mandatory for all Wi-Fi 6E devices operating in 6 GHz band” and that “WPA2 is not permitted in 6 GHz operation.” Protected Management Frames are mandatory there too. That guide is written for business networks, but the requirement comes from the Wi-Fi Alliance and applies to home routers as well.

Two practical effects:

• If you own a Wi-Fi 6E or Wi-Fi 7 router and the 6 GHz network doesn’t show up, check that security is set to WPA3 or WPA2/WPA3 transitional. The 6 GHz band can’t run on WPA2 alone.
• Wi-Fi 7’s Multi-Link Operation, which lets a device use more than one band at once, has stricter security requirements still. According to the same Cisco guide, a device that doesn’t meet them can’t connect as MLO-capable.

For what those bands and features do, see our guides to the 2.4, 5 and 6 GHz bands and Wi-Fi 6E versus Wi-Fi 7.

How do I check what I’m using now?

On a Windows 11 PC: open Settings, go to Network & internet, then Wi-Fi, and open your network’s properties. That is where Microsoft points users for connection details; look for the security type in the list. The exact wording can differ between Windows versions.

On the router: open the router’s app or admin page and look under wireless or Wi-Fi settings for “Security,” “Authentication” or “Encryption.” This is also where you change it. Menu names vary by brand.

How do I switch to WPA3 without breaking things?

1. Update the router’s firmware first. WPA3 support and its fixes arrive through firmware.
2. Choose WPA2/WPA3 transitional mode and save. Most devices reconnect on their own.
3. Check your older devices. Printers, smart plugs, older TVs and game consoles are the usual holdouts. If something can’t reconnect, “forget” the network on that device and join again.
4. Set a long passphrase while you are in the menu, if yours is short. You will have to re-enter it on every device, so do this once.
5. Move to WPA3 only later, once everything has connected reliably for a few weeks and you have confirmed each device supports it. If a device drops off, go back to transitional mode.

If a device can’t connect in transitional mode either, it likely needs an old protocol such as WPA with TKIP. Don’t lower the whole network’s security for it. Put it on a separate guest network, or replace it.

Security mode is one setting among several. Our router hardening checklist covers the admin password, automatic updates, WPS and remote management.

Fact-check notes

Bottom line

WPA3 Personal is the right setting when all your devices support it, and WPA2/WPA3 transitional mode is the right setting when they don’t. Plain WPA2 with AES is a fallback, and it leans hard on a long password and updated devices. If you use the 6 GHz band, WPA3 is not optional. Pick the strongest mode your devices can all join, set a passphrase of 20 characters or more, and keep the router’s firmware current.

Short answer: Most router attacks succeed because of weak admin passwords, old firmware, or services you never use. Change the admin password, turn on automatic updates, use WPA3 or WPA2 with AES, and put smart-home gear on a guest network. A VPN protects traffic on your device but does not secure your router.

Your router is the front door to your home network. These ten changes take about 15 minutes, and they are in order of importance. Settings names vary by brand, so look for the closest match in your router’s app or admin page.

The checklist

1. Change the router admin password. This is separate from your WiFi password. Use a long, unique password and store it in a password manager.
2. Install updates and turn on automatic updates. Firmware updates fix security problems. If your router no longer receives updates, replace it. See how to check whether your router still gets updates.
3. Use WPA3, or WPA2 with AES. Avoid the older WEP and WPA settings, and avoid “TKIP.” If a device can’t connect on WPA3, a mixed WPA2/WPA3 mode is a reasonable compromise. Our WPA2 vs. WPA3 guide explains the difference.
4. Set a long WiFi password. A passphrase of several random words is easy to type and hard to guess.
5. Turn off WPS. The push-button and PIN setup feature is convenient and a known weak spot. See whether to turn off WPS and UPnP.
6. Turn off remote management. Unless you deliberately use it, you don’t need to reach your router’s admin page from the internet.
7. Use a guest network for visitors and smart-home gear. This keeps cameras, plugs, and TVs away from the laptops and phones that hold your private data. See whether smart home devices belong on a guest network.
8. Review connected devices. Remove anything you don’t recognize and change your WiFi password if something looks wrong. See how to see who’s connected to your Wi-Fi.
9. Check for risky services you don’t use. UPnP, port forwarding, and remote file sharing should be off unless you need them.
10. Consider DNS filtering. Many routers let you choose a DNS service that blocks known malicious sites. See how to change your router’s DNS.

What does a VPN do?

A VPN encrypts your connection from your device to the VPN provider, which is useful on public WiFi. It doesn’t secure your router, and it won’t protect you from a weak admin password. Treat it as an extra, not a replacement for the checklist.

What about smart-home devices?

Put them on a guest network and keep their apps updated. Our guide to Matter and Thread explains how smart-home devices connect to your network.

When is it time to replace the router?

Replace your router when the maker stops releasing security updates, or if it can’t use WPA3 and you have devices that do. If you’re shopping, our guide to picking a router for a large house has current picks and notes on FCC rules.