Setting up a small office network: the router, the wireless and the defaults

Why this matters

This is the job. A technician working with small businesses and home users sets up small networks constantly, and the exam reflects that by asking about the configuration steps directly rather than abstractly.

It is also the place where the difference between a working network and a safe one is decided, and where the difference costs nothing to get right at setup and a great deal to fix later. A router left on its default administrative password is on the internet within minutes of being connected, and the cost of changing it at setup is thirty seconds.

Everything in the previous three lessons comes together here: addressing from lesson 12, DHCP from lesson 11, wireless bands and security from lesson 10. This is where they are configured rather than described.

The lesson

The order of setup, and why the admin password changes before anything else

There is a correct order, and it is correct because each step depends on the one before and because some steps are dangerous to defer.

1. Connect to the router on an isolated link first — a cable to a laptop, or its own factory wireless — before connecting it to the internet service. A device configured while already exposed is a device that was exposed on defaults.
2. Change the administrative password. First, always. The default is published in the manual, which is online.
3. Update the firmware, because firmware fixes are the main defence a small router gets and the shipped version is usually a year behind.
4. Configure the internet connection, whatever the service requires.
5. Configure the internal network: addressing and DHCP.
6. Configure wireless: name, band, security, passphrase.
7. Configure anything extra: forwarding, guest network, quality of service.
8. Verify, from a client rather than from the router's own status page.
9. Record what you did, because the next person will be you in two years.

Deferring step 2 is the single most common real-world mistake in this list, and the reason it is second rather than last is that every subsequent step takes time during which the device is reachable.

Choosing an addressing scheme and a DHCP range that leaves room for static hosts

The defaults work and are worth changing for two reasons: to avoid collisions when a VPN connects two sites that both use 192.168.1.0/24, and to leave room for a deliberate structure.

A workable small-office scheme on a /24:

• .1 — the router.
• .2 to .20 — reserved for infrastructure set by hand: switches, access points, a network printer, a server.
• .21 to .199 — the DHCP pool.
• .200 to .254 — reserved for future static use.

The important property is that the pool excludes every static address. A static address inside the pool is an address conflict waiting for the day someone plugs in enough devices, and the resulting fault is intermittent and hard to attribute.

DHCP settings to get right at the same time: the lease time appropriate to the environment, the gateway (the router), and the DNS servers. Reservations for printers and servers are better than static configuration, for the reasons lesson 11 gave.

Wireless configuration: name, band, channel, security mode and passphrase

Six decisions, each with a defensible answer:

• Network name. Something identifying but not advertising: a business name is fine, the router model number is not, because it tells an attacker exactly which vulnerabilities to try. Hiding it is not a security control.
• Band. Modern routers present both bands under one name and steer clients between them. Splitting them into separate names is worth doing when a particular device needs to be pinned to one — usually an older device that chooses badly.
• Channel. Automatic is usually adequate; where it is not, 1, 6 or 11 at 2.4 GHz after surveying what neighbours are using. Lesson 10 explains why only those three.
• Channel width. 20 MHz at 2.4 GHz in any populated area. Wider at 5 GHz.
• Security mode. WPA3 where every client supports it, WPA2-AES otherwise, and a mixed mode only while old clients still exist. Never WEP, never WPA with TKIP, never open.
• Passphrase. Long, and different from the administrative password. A shared passphrase can only be revoked by changing it for everyone, which is the argument for the guest network below.

Port forwarding, universal plug and play, and why one of them is a decision

Network address translation means inbound connections have nowhere to go unless a mapping is created. Two mechanisms create them, and they differ in who decides.

Port forwarding is configured by a person: external port, internal address, internal port, protocol. It is explicit, auditable, and specific. Its risks are real — a forwarded remote desktop port is one of the most reliably exploited configurations in existence — but they are chosen.

Universal plug and play lets any device on the inside open a mapping for itself, with no authentication and no human involvement. It exists because games consoles and media applications want inbound connections. It also means that anything running on any device inside the network — including malware — can expose a service to the internet without anyone being told.

The examinable position: port forwarding is a decision, UPnP is a delegation of that decision to every device on the network. In a business context, turn it off and forward explicitly. Where a service genuinely needs inbound access, a VPN is usually the better answer, which is lesson 15.

DMZ host is the crudest form: forward everything to one internal address. It is occasionally seen in the field and it is almost never the right answer.

Guest networks, isolation, and the setting that separates devices from each other

A guest network gives visitors internet access without giving them the internal network. Done properly it provides three things:

• A separate name and passphrase, so the main credential is never shared.
• No route to the internal subnet, so a guest device cannot reach the server, the printer or anyone's laptop.
• Client isolation, so guest devices cannot reach each other either.

That last setting is the one people miss, and it matters because a compromised guest device on an isolated-from-internal network can still attack every other guest. In a café or waiting room that is the realistic threat.

Two related mechanisms are worth naming because the exam does:

• MAC filtering allows or blocks specific hardware addresses. It is trivially defeated, because addresses are visible in the clear and can be changed in software. It is a convenience feature, not a control, and it appears in exam questions as a distractor.
• Quality of service prioritises some traffic over others. Useful on a constrained link where voice or video must not be starved by a large download. It does not create bandwidth; it decides who waits.

The final step, and the one most often skipped: verify from a client. Connect a device to the guest network and try to reach an internal address. If it succeeds, the isolation is not configured, and the status page saying it is enabled is not evidence.