Keep your network secure
Everything you’ve set up in this course can quietly undo itself. A firmware update resets a setting, your provider swaps the router, a new gadget switches UPnP back on, a visitor’s phone ends up on the main network. In this last lesson you’ll check one more part of your setup, IPv6, learn the signs that something’s wrong, and build a ten-minute routine that keeps everything in place.
In this lesson
- Test your IPv6 setup, and what each result means
- Recognise the warning signs of a compromised network
- Run a ten-minute monthly check
You’ll need: a device on your home network with any VPN switched off, and your notes from the earlier lessons.
IPv6: the part people forget
Many home connections now use two kinds of address side by side: the older IPv4 and the newer IPv6. With IPv4, all your devices share the router’s one public address, which is what keeps them hidden, as you saw in Lesson 4. With IPv6 there are enough addresses for every device to have its own, so the router’s firewall is what keeps unwanted connections out. There’s also a privacy catch: some older devices build their IPv6 address from their network card’s permanent hardware ID, which then follows them from network to network.
Try it yourself · part 1
Test your IPv6 setup
- Open the IPv6 test and click Run the test.
- Read the verdict:
- Dual stack: your connection uses both. That’s normal and fine; make sure your router’s IPv6 firewall is on (it usually is by default), and check it in part 2.
- IPv4 only: your provider doesn’t offer IPv6, or it’s switched off in the router. Nothing to do for security.
- IPv6 only: unusual at home, more common on mobile networks. Your device is reached by its own address, so the network’s firewall matters.
- If you see Hardware ID exposed, your device’s IPv6 address contains its permanent hardware ID. Modern systems use private, changing addresses by default, so this usually points to an older device or operating system. Update it, or look in its network settings for IPv6 privacy or temporary addresses.
Try it yourself · part 2
Check the router’s IPv6 firewall
- In the router’s admin page, look under IPv6, Firewall or Security for the IPv6 firewall. Make sure it’s on and set to block incoming connections you haven’t allowed.
- If you got Dual stack in part 1, run the Port Scanner. If it shows a long address with colons, it’s scanning your device over IPv6, so the result tells you whether that firewall is doing its job.
Signs that something’s wrong
- Certificate warnings on sites you use every day, especially your bank or email. That’s the clearest outside sign that your traffic is being redirected. Don’t click through; run the checks from Lesson 5.
- Router settings you didn’t change: a new port forwarding rule, a different DNS server, remote management switched on, or an admin password that no longer works.
- Devices you can’t account for in the device list, after the checks in Lesson 1.
- An open port in the scan that wasn’t there last month.
If you find one: factory-reset the router, update its firmware, set a new admin password, and change your Wi-Fi password, so every device has to be reconnected by you. Then go through this course’s checks again.
Try it yourself · part 3
Your ten-minute monthly check
Put a reminder in your calendar for the same day each month, and run through this list:
| Check | Where | You want to see |
|---|---|---|
| Device list | Router admin page (Lesson 1) | Only devices you recognise; gadgets still on the guest network |
| Firmware | Router admin page (Lesson 2) | Up to date, with automatic updates on |
| Remote management, UPnP, DMZ | Router admin page (Lessons 2 and 4) | Still off, unless you turned one on deliberately |
| Open ports | Port Scanner (Lesson 4) | Nothing reachable |
| DNS | Router settings and the whoami lookup (Lesson 5) | Your provider or the service you chose |
| Gadget updates | Each device’s app (Lesson 6) | Everything updated; nothing that’s lost support |
Run the whole list again straight away after your provider replaces or resets your router, because a reset brings back the factory settings.
Key takeaways
- On IPv6 there’s no NAT: your router’s IPv6 firewall is what protects each device.
- “Hardware ID exposed” means an older device is using its permanent ID in its address. Update it.
- Certificate warnings on familiar sites and settings you didn’t change are the main warning signs.
- If something’s wrong: reset, update, new admin password, new Wi-Fi password.
- A ten-minute monthly check keeps everything from this course in place.
Check yourself
Three questions. Pick one answer each and you’ll see why.
1. The IPv6 test says “Dual stack”. What should you check?
2. Your bank’s site suddenly shows a certificate warning on your home Wi-Fi, but not on mobile data. What’s the safest move?
3. Your provider has just replaced your router. What should you do?
That’s the course. You can now list everything on your network and identify the strangers, lock down your router’s login, firmware and remote access, set up strong Wi-Fi and a proper guest network, see what’s open from the internet and close it, check your router’s DNS, keep smart devices contained, and run a monthly check that keeps it all in place. Go back to the course page and try the opening quiz again to see how far you’ve come.
More free courses are on the Learn page.
This lesson is part of the free course Secure Your Home Network, licensed under CC BY-NC-SA 4.0: you may share and adapt it for non-commercial use, with credit to ExamineIP and a link to the original.