Інструкція користувача

Set a complex admin password for the router that is at least 8 characters long; Generate random passwords; Include numbers and other characters in the password; Avoid using the same password for different sites or purposes; Check the password strength here; Use a password manager to create complex passwords;

Use a strong password to connect to your Wi-Fi network. The default router has a strong password that's hard to guess and take a long time to find by a brute force attack;

Register all your devices in the router, and set a 'No Internet' access profile (to deny access to all unregistered devices) or speed limit for unregistered devices;

Use one of the pre-installed Internet filters (SafeDNS, AdGuard DNS, Cloudflare DNS, NextDNS) for secure Internet access, to protect all home devices from dangerous sites, online services, and other threats;

To protect DNS traffic, you can use protocols DNS over TLS and DNS over HTTPS, which allow you to encrypt DNS requests. Support for these protocols is available from KeeneticOS version 3.0. Their main purpose is to encrypt DNS traffic to prevent interception and provide additional privacy and security. You can find more information in the 'DNS-over-TLS and DNS-over-HTTPS protocols to encrypt DNS queries' instructions;

You can use the Wi-Fi Access Control feature by creating a 'White List'. In this case, the router will block the connection for all clients that are not on this list;

If you need to provide temporary Internet access to third parties, use the Wi-Fi Guest Network for this purpose. This is a separate network with Internet access only. At the same time, devices connected to the Guest Network will be isolated from the resources of your home network to protect and secure it from viruses and malware, for example, contained on the devices of your friends;

You can disable the WPS Quick Setup feature to improve the security level of your Wi-Fi network;

To improve local network security, you can use our Keenetic mobile app to send notifications of a new unregistered device connecting to the network to your e-mail address, via push notifications (notifications from the Keenetic app on your mobile device) or as a Telegram messenger alert. For more information, please refer to the 'Setting up notifications to turn on / turn off a certain home network device' guide;

To connect to the router via a third-party application, we recommend creating a dedicated user account, only allowing access to the desired server (e.g. SMB USB storage only, WebDAV server or VPN server). For security reasons, do not use a router administrator account, apply a user account with restricted rights.

The Hide SSID function enables the wireless network's hidden SSID mode. If you use it, the name of your Wi-Fi network won't be displayed in the list of available wireless networks on users' devices (no SSID will be visible), but users who know the network exists and know its name will be able to connect to the network.

Do not allow remote access from the Internet to the Keenetic web interface over HTTP and even more so over TELNET unless necessary;

We recommend changing the standard control ports of the router. For example, change the control port via HTTP from 80 to 8080, and the control port via TELNET from 23 to 2023; Enable the use of a remote connection to the router web interface only via the HTTPS protocol (this feature is implemented from KeeneticOS version 3.1);

Starting from KeeneticOS version 2.12, the SSH (Secure Shell) server was added, allowing us to connect to the router command line securely. We recommend using an SSH connection instead of TELNET when connecting to the device from the Internet. Change the standard SSH control port from 22 to another, e.g., 2022;

For remote access to the local network, including network devices (e.g., IP camera, network media player, or USB drive), we recommend using a VPN server on Keenetic (e.g., L2TP/IPsec, WireGuard, SSTP or PPTP) rather than opening access using port forwarding rules. In this case, create a separate user account to connect to the VPN and use a complex user password. In the 'VPN types in Keenetic routers' manual, you will find a brief description of all types of VPNs that are implemented in our routers;

If you're not using the UPnP service, disable it. In this case, you will be sure that NAT rules and firewall will not be automatically created. For example, the UPnP service may use malware from the localhost;

In some cases, you may need to open certain ports manually (set up port forwarding). In port forwarding, we recommend you open only certain ports and protocols that are required for the server or network device to operate, rather than forwarding all ports and protocols to a LAN host;

When using forwarding rules and the firewall, it is possible to restrict access, for example, by allowing access from only one IP address or a specific subnet while prohibiting all others;

If necessary, you can use firewall rules to block access to the router's web interface for certain LAN hosts, block Telnet connections, allow only certain LAN computers to access the Internet and block access for all others, etc. For more information, see the Firewall rule examples tutorial;

Do not allow ping requests on the firewall for all users on the external network (from the Internet).