Most homes should turn automatic updates on to close the flaws that botnet scans hunt for. Power users and home businesses may prefer manual or scheduled updates, chosen in the admin panel.
Your router, system tools, monitoring software and DNS-level monitoring each show part of the picture. Take readings before and after one change and treat IP location as approximate.
Open your router's device list, run arp -a, or try a scanner such as Fing, then match each IP and MAC address to something you own and decide what to do about the rest.
Record your IP, DNS resolver and existing rules, then test each new rule with a port scan, a log entry or an unapproved app. Expect your public IP to stay the same.
A passkey only works on the real domain, so a fake login page has nothing to relay. Switch your primary email first, register a second passkey as backup and review the recovery settings.
Scan your public IP with an external port checker, check each open port against your router's forwarding table, and tell a refused connection (closed) from no reply (filtered).
Record port forwards, DNS and VPN settings before you update, retest after, and watch for DNS reverted to ISP defaults or cloud features turned on. An ASUS advisory is the worked example.
Enter your provider's server and sign-in details under Settings > Network & internet > VPN, pick IKEv2 over Automatic, then confirm the new IP and check DNS and IPv6 for leaks.
Gather the server address, remote ID and credentials, add an IKEv2 connection in System Settings, turn on Send all traffic over VPN, then test your IP, DNS and WebRTC to confirm it works.
Back up your settings and connect by cable first, then update from the admin page, a downloaded file or the mobile app, and restore the backup if the update resets anything.
Where the setting hides on Netgear, TP-Link, Asus, Linksys and D-Link routers, how to confirm it is off from outside your network, and why an ISP router may keep its own TR-069 access.
Which office VPN and firewall jobs SSE can take over, why on-site servers may still need a local firewall, how to test its web filtering and app access, and why antivirus stays.