As my interest in networking and cybersecurity has grown, upgrading my basic router from my Internet Service Provider (ISP) has been on my to-do list. I called last week to ask about the replacement process, and they came out yesterday to swap the router for a modem. I chose a modem from my ISP rather than one of their routers so that I could later upgrade to a pfSense router, in line with my long-term plans. My immediate goal was to set up a guest network and an IoT network, both separated from my main network.
I already had some experience configuring a DD-WRT router from an old Linksys device I found at Goodwill. I liked the customization options it offered, even though it was outdated. After reviewing several recommended routers on the DD-WRT forum, I decided to go with the Netgear R7800 because of its speed, positive reviews, and affordability (I got a used one for $40 on eBay).
Before flashing the router, I reviewed the flashing instructions carefully and saved the necessary firmware on my laptop. I also documented the static IP settings for devices like Home Assistant, Unraid, Pi-hole, and my IoT devices to help plan the setup.
When the router arrived, I first explored the default Netgear firmware to see if it would meet my needs. Setting up my network and the guest network was simple, requiring just a few clicks. However, I decided to flash DD-WRT because I wanted the flexibility to create more Virtual Access Points (VAPs) and address specific challenges with my IoT network. The IoT devices needed to be mostly isolated but still required communication with my Home Assistant virtual machine running on my Unraid tower.
Following a guide from a forum post, I successfully installed DD-WRT on the Netgear R7800. The process was smoother than with the older Linksys router, which had more complex reset procedures and a higher risk of bricking the device. Initially, I installed the latest stable build (53562), but I ran into stability issues with the 5GHz band. I reverted to an older version (44715) listed in the DD-WRT Router Database, which worked much better.
Once I had the older version installed, I adjusted the router’s IP address, DHCP server settings, and static IP addresses for my devices. This allowed me to set up the local and static DNS settings early, which helped me make the most of Pi-hole. I always seem to forget this step, so it was great to get it done early. After confirming everything was working, I started creating backups after each new configuration to avoid losing progress, something I learned the hard way after resetting the router a few times.
I configured two access points for my main network and created virtual access points for guests and IoT devices. Initially, setting up the guest network in unbridged mode caused issues with the DHCP server, but I solved it by creating a second bridge (br1) and implementing firewall rules for traffic management, based on a guide I found. I also had ChatGPT help me understand what these rules meant, as I was unfamiliar with them. It took me a few days to isolate the IoT devices, but I eventually pieced together the necessary firewall rules. If anyone needs help with a similar setup, feel free to reach out, and I can share more details.
Firewall Rules I Used:
- Flush Existing Rules and Chains: Clears any previous firewall rules to start fresh.
- Allow Established Connections and Loopback: Allows ongoing connections and local device traffic.
- Allow DNS Traffic on All Bridges: Enables DNS requests on all network bridges so devices can resolve domain names.
- Allow Forwarding to WAN Interface: Lets traffic from all bridges reach the WAN (Internet) interface for internet access.
- Allow Specific Communication Between Home Assistant and IoT Devices: Allows IoT devices to communicate with the Home Assistant server.
- Block Communication Between Specific Bridges: Prevents devices on one bridge from communicating with devices on other bridges, isolating traffic.
I think I can refine these rules further, especially by narrowing traffic to the observer port on Home Assistant. I want to make sure I understand the implications of that before proceeding. There may also be some redundant or unnecessary rules that need to be addressed. While working on the firewall, I realized there’s a lot I don’t know, so I’ll hold off on any more changes for now. My family is definitely getting tired of me constantly working on this and kicking them off the internet!
One persistent issue I've been dealing with is my iPhone’s inaccurate location since setting up the new network. It sometimes places me across the creek in a nearby neighborhood, which causes issues with my home automation setup, triggering alarms and actions unexpectedly. To work around this, I’ve added short delays to automations and used a ping integration in Home Assistant to check my phone’s connection to the home network before taking any actions. While effective, I’d like to find a more permanent solution.
Upgrading my home network has involved hardware upgrades, firmware flashing, and network setup, all of which tested my skills and patience. Transitioning from my ISP’s router to a modem and then configuring the Netgear R7800 with DD-WRT has boosted performance and taught me a lot about how networking actually works. Setting up separate guest and IoT networks was a significant milestone, but it came with troubleshooting and plenty of lessons in planning and flexibility.
This hands-on experience has helped me improve my network configuration skills and taught me how to tackle real-time issues. Moving forward, I plan to enhance IoT device security, resolve automation problems, and explore more advanced networking concepts. This project was a good one, and it confirmed my interest in IT and my commitment to continuous learning.