Labs · Cyber Security

Lab: Harden Your Home Wi-Fi Router: WPA3 or WPA2-AES, a New Admin Password, WPS Off and Updated Firmware

By Ravindra Bagale Last updated: 8 October 2026

Beginner30 minYour own home Wi-Fi router (JioFiber, Airtel Xstream, TP-Link or similar) · Browser · Laptop and phone

Course: Cyber Security · Chapter 25: Wireless Security

Chapter 25 explains wireless security and attacks; this lab applies the defences to your own home router.

Chala mitrano! Your router is the front door of your whole home network: phones, TV, laptop, cameras. Many routers still use the default admin password printed on a sticker. Today we lock this door properly, in 30 minutes, and check that everything still works. Chala, gharachi suraksha!

Suppose we are…

Suppose our family uses a JioFiber connection at home, and we have just joined Airtel's network security team. Our first homework: secure our own router the way we would advise customers. The checklist is short: new admin password, strong Wi-Fi security (WPA3 or WPA2 with AES), WPS off (WPS is the push-button/PIN pairing feature that is easy to abuse), remote management off, latest firmware.

Goal of this lab

By the end you will have:

A router admin password that is not the default.
WPA3-Personal or WPA2-Personal (AES) with a long Wi-Fi password.
WPS and remote management turned off, firmware checked, and proof from your laptop.

What you need (all free)

Admin access to your own home router (if a parent or landlord owns it, do this together with them).
Your gateway IP from Lab 1 (often 192.168.29.1 on JioFiber, 192.168.1.1 on many others).
A laptop connected by Wi-Fi, and your password manager (Lab 22). 30 minutes.

Safety and ethics

Change settings only on a router you own or have permission to manage. Never try to log in to or test someone else's Wi-Fi or router. Changing the Wi-Fi password disconnects every device, so tell your family first.

Steps

Open a browser and go to your gateway, for example http://192.168.29.1. Log in with the admin details from the router sticker or your ISP app.

What you should see: the router's admin dashboard (menus such as Network, Wireless/WLAN, Security, Administration/Management).
Admin password: go to Administration (or Management → User) and change the admin password to a new one from your password manager. Save it there.
Wi-Fi security: go to Wireless/WLAN → Security for each band (2.4 GHz and 5 GHz). Set Security mode to WPA3-Personal or WPA2/WPA3-Personal (mixed). If WPA3 is not offered, choose WPA2-Personal with Encryption: AES (not TKIP, not WEP).
Set a Wi-Fi password of at least 12 characters, for example three random words and a number. Save. Your laptop will disconnect; reconnect with the new password.
WPS: find WPS (often under Wireless) and set it to Disabled. Save.
Remote management: find Remote Management, Remote Access or WAN access to web UI and make sure it is Off. Also turn off UPnP if you do not need it for gaming or video calls.
Firmware: go to Administration → Firmware/Software Upgrade (or check your ISP app). Note the current version and install any update offered. Do not switch off the router during the update.
Verify from your laptop. On Windows open Command Prompt and run:
```
netsh wlan show interfaces
```
What you should see: Authentication : WPA3-Personal (or WPA2-Personal) and Cipher : CCMP (CCMP means AES).

On a Mac hold Option and click the Wi-Fi icon: Security: WPA3 Personal or WPA2 Personal. On Android open the Wi-Fi network's details and look at Security.
Log out of the router and log in again with the new admin password to confirm it works and that the old one does not.
Write a small "router card" in your password manager: model, firmware version, date hardened, settings changed.

Ravindra Bagale's Tip

Some old devices (an old printer or smart plug) may not join WPA3. Use the "WPA2/WPA3 mixed" mode, or put those old devices on a guest network. And check firmware every three months; set a phone reminder. Chhota kaam, motha fayda!

Common mistakes

Mistake	What happens	Fix
Changing only the Wi-Fi password, not the admin password	Anyone on your Wi-Fi can open the router with the sticker password	Change both
Choosing WPA2 with TKIP or WEP	Old, weak encryption	WPA3, or WPA2 with AES
Securing 2.4 GHz but forgetting 5 GHz	One band stays weak	Repeat for every band
Leaving WPS on "because it is convenient"	A known weak pairing method stays open	Disable WPS
Losing the new admin password	You must factory-reset the router	Save it in your password manager first

Self-check checklist

The router admin password is new and saved in my password manager.
Every band uses WPA3, WPA2/WPA3 mixed, or WPA2-AES.
My Wi-Fi password is 12+ characters.
WPS and remote management are off.
Firmware is up to date and noted.
My laptop shows WPA2/WPA3 with CCMP.

0 of 6 done

Try-at-home challenge

Create a guest network on your router for visitors and smart devices. How do you check that a phone on the guest network cannot reach your laptop?

Check your answer

Enable the guest network with its own WPA2/WPA3 password and turn on "Allow guests to see each other and access my local network": Off (the name varies, for example AP/client isolation). Connect a phone to the guest Wi-Fi and use a network app (for example Fing) or try opening your laptop's shared folder: your laptop should not be visible or reachable.

Samjla ka? Lock the admin door, use strong Wi-Fi security, switch off what you don't use, keep firmware fresh. Aata pudhe jaauya: Chapter 26 checks who can become root on your server.