Keeping your home router safe from DNS hijacking
DNS hijacking can redirect the web addresses your household types toward servers an attacker controls. It may occur through altered router settings, a compromised device or intercepted name lookups. A convincing fake page can collect passwords or divert a banking session. Learn more about How To Create A Personal Vpn Using A Raspberry Pi 5aa0.
A secure router needs several layers. Current firmware, unique administrator credentials, deliberate DNS choices, network separation and a way to spot unexpected changes reinforce one another. If a certificate warning appears, stop entering personal details. Learn more about How To Create A Blog.com.
Australian households usually begin with the modem-router supplied for an NBN service. Telstra, Optus, TPG and other retailers may provide it, while some attach a separate Wi-Fi router. Knowing which device controls DNS prevents changes being made in the wrong interface. Learn more about Ideas.
How DNS hijacking reaches the network
A router normally forwards DNS requests to the resolver supplied by the internet provider or configured by its owner. During a hijack, those requests are diverted, or a malicious device answers them. The web address can look normal while traffic goes elsewhere.
Weak defaults and exposed features make this possible. An unchanged administrator password, outdated firmware, open remote-management settings, malicious DHCP software or a compromised phone can alter the lookup path. A strong Wi-Fi password alone does not protect the router.
Many Australian homes combine fixed NBN, mobile broadband, smart TVs, baby monitors and IoT gadgets. In a shared Sydney or Melbourne flat, the router may sit in a communal hallway, so restrict its admin account and keep the ISP’s support details handy.
Secure the router before changing DNS
Access the administration interface from the local network, change every default administrator password, and give the Wi-Fi a separate random passphrase. Install current vendor firmware, enable automatic security updates if available, and back up the configuration before major changes.
Disable internet-facing remote administration unless a documented feature needs it. UPnP can open forwarding rules automatically, so turn it off when gaming or other applications do not need it; otherwise permit only narrow, provider-documented rules.
For a more hands-on privacy setup, WeWEAT’s [Raspberry Pi VPN guide] shows how a spare Raspberry Pi can create a personal VPN. It supports encrypted remote access, but it does not replace secure router accounts, firmware and DNS controls.
Choose DNS protection that fits your household
Choose who should answer lookups: the provider’s resolver, a reputable public resolver, or encrypted DNS configured on the router or devices. Test each option from your connection rather than assuming an overseas service will be reliable in Australia.
The practical choices differ in privacy, setup effort and protection.
| Option | Main benefit | Important limitation |
|---|---|---|
| ISP resolver | Easy and preconfigured | Provider can observe queries |
| Public DNS | Straightforward to specify | Resolver provider can see queries |
| DNS over HTTPS | Encrypts DNS lookups | Requires compatible configuration |
| DNS over TLS | Encrypts with efficient transport | Support varies by device |
| Filtering DNS | Blocks some malicious sites | Misses many scams and compromises |
Change DNS and Wi-Fi security separately, since simultaneous changes complicate troubleshooting. Record original values and test from several devices. Check that laptops and phones are not bypassing the router resolver with hard-coded DNS settings.
Shrink the routes an attacker can use
Put computers, phones and trusted consoles on the main network, while smart-home equipment and guest devices use a separate guest or IoT network if the router supports it. Use WPA2 or WPA3, disable WPS, and do not share the administrator password with household members who only need internet access.
Remote administration, unnecessary port forwarding and UPnP give devices ways to reach services that were never meant to be public. A dated record of your DNS settings, firmware version and connected devices is valuable after an incident; a [security blog setup guide] can provide a simple way to maintain that baseline without exposing the notes publicly.
Encrypted DNS protects only the lookup connection. It cannot repair a router already controlled by malware, and it does not stop a compromised device from sending traffic elsewhere. Keep operating systems and browsers updated, remove unused network apps, and investigate devices appearing under unfamiliar names in the router’s client list.
Recognise and contain a hijack
Common signs include searches landing on unrelated sites, new advertising on every page, a changed homepage, login pages that look slightly wrong, or fresh certificate errors. If only one phone behaves oddly, suspect that device; if every device follows the redirect, inspect the router, provider account and DNS configuration first.
From a trusted device, record the router settings, disconnect its internet cable if the problem continues, and restore a known-good configuration. If compromise is suspected, perform the vendor’s factory reset, update the firmware, change administrator and Wi-Fi credentials, and change the provider account password as well. Contact the ISP and any bank where credentials were entered.
For lightweight monitoring ideas, WeWEAT’s [practical project ideas] can help turn router status data into a useful local dashboard. If an Australian receives a suspicious message claiming to be from a bank or government service, ACMA’s Scamwatch advice says to use official contact details rather than those in the message; the Australian Signals Directorate’s cyber guidance also recommends isolating affected devices.
Turn router security into a routine
Set a recurring reminder to review firmware notices, administrator accounts, DNS values, connected devices and wireless networks. Many consumer routers show changes more clearly when you know the expected settings, so keep the baseline record offline and update it whenever your ISP replaces equipment.
After a new device joins, an ISP changes the modem, or a family member enables a remote-access app, revisit those controls. Outside the NBN footprint, fixed-wireless and satellite services use different routers, and a 5G backup introduces another connection whose DNS path deserves a separate check.
The thing to remember is that router protection is a maintained boundary. Unique administrator credentials, current firmware, deliberate DNS settings, restricted remote access and regular checks leave a DNS hijacker with far fewer opportunities to take hold.