Your ISP-supplied router is fine for the family. The retired one in a drawer is a firewall. Give it a fresh firmware, put every smart plug, doorbell, and TV behind it, and outbound calls become something you allow, not something that quietly ships your data to whoever paid for it. These seven desktop and firmware apps make the setup real, from a full pfSense rebuild to a Raspberry Pi acting as the enforcement layer.
What to look for in a home IoT firewall
Answer these before you start:
- Does the router support open firmware (OpenWrt or DD-WRT)?
- Do you want firewall rules, DNS filtering, or both?
- Is a full x86 firewall box a option, or does it have to be the old router?
- How comfortable are you with VLANs and separate SSIDs?
- Do you want per-device outbound logs, or just aggregate blocking?
Quick comparison
| App | Best for | Free plan | Paid | Platforms | Standout |
|---|---|---|---|---|---|
| OpenWrt | Reflashing a compatible router | Yes | Free | Router hardware, x86, VMs | The de facto open firmware standard |
| DD-WRT | Broader hardware support | Yes | Optional donations | Router hardware | Runs on some routers OpenWrt does not support |
| pfSense | x86 firewall built from a mini PC | Yes | Plus paid | x86, Netgate hardware | Enterprise-grade rules and logging |
| OPNsense | pfSense fork with a friendlier UI | Yes | Business support | x86, VMs | HardenedBSD base, updated more often |
| AdGuard Home | Network-wide DNS filtering | Yes | Free | Windows, macOS, Linux, Docker | Blocks ad and tracker traffic at DNS |
| Pi-hole | Raspberry Pi DNS block | Yes | Free | Linux, Docker | The classic home DNS filter |
| IoTGuard | Community IoT rules for OpenWrt | Yes | Free | OpenWrt add-on | Preconfigured smart-device block lists |
The apps
1. OpenWrt — best for reflashing a compatible router
OpenWrt replaces stock router firmware with a Linux userland, an actual firewall, and per-interface rules. Once installed, one SSID becomes a guest network, another becomes the IoT VLAN, and firewall rules block cross-VLAN chatter by default. The wiki catalog covers a decade of routers.
Where it falls short: Flashing is irreversible on a wrong device. Some newer routers with locked bootloaders refuse OpenWrt. Wi-Fi 7 hardware support lags stock firmware by months.
Pricing: Free, open source.
Platforms: Router hardware, x86, VMs.
Download: OpenWrt
Bottom line: The standard first move for any spare router.
2. DD-WRT — best when OpenWrt does not support your hardware
DD-WRT ships builds for a wider set of routers than OpenWrt, including some old Broadcom-based hardware OpenWrt gave up on. VPN clients, QoS, and a mature web UI make it a friendly first-time flash.
Where it falls short: Release cadence is uneven. Some builds are effectively unmaintained. UI mixes deep options with beginner-friendly toggles awkwardly.
Pricing: Free. Donations for builds accepted.
Platforms: Router hardware.
Download: DD-WRT
Bottom line: The fallback when OpenWrt’s router database comes back empty.
3. pfSense — best x86 firewall on a mini PC
pfSense turns any small x86 box (an old laptop, a fanless mini PC) into a full enterprise firewall. Multi-WAN, deep packet inspection through Suricata, VLAN routing, and a captive portal for the guest network all sit in one polished UI.
Where it falls short: Not a router firmware. You still need a switch or a router in AP-only mode behind it. Installation on non-Intel NICs can be painful.
Pricing: pfSense CE: free. pfSense Plus: paid, bundled with Netgate hardware.
Platforms: x86, VMs.
Download: pfSense
Bottom line: The correct pick when the goal is a serious home firewall.
4. OPNsense — best actively developed pfSense alternative
OPNsense is a pfSense fork with a modern UI, a HardenedBSD base, and a faster release cadence. The plugin catalog covers Suricata, WireGuard, ZeroTier, and Nginx reverse proxy for internal services.
Where it falls short: Smaller community than pfSense. Some third-party tutorials still target pfSense specifically.
Pricing: Free. Business Edition available.
Platforms: x86, VMs.
Download: OPNsense
Bottom line: The pick when you want pfSense’s power and a friendlier UI.
5. AdGuard Home — best for DNS-level ad and tracker blocking
AdGuard Home runs as a network-wide DNS server that filters requests against curated block lists. Point every device on the IoT VLAN at it and half the smart-device telemetry stops before it leaves the router.
Where it falls short: DNS blocking cannot stop hardcoded IP calls, and some IoT vendors do exactly that. Pair with a real firewall for full coverage.
Pricing: Free, open source.
Platforms: Windows, macOS, Linux, Docker, most home NAS units.
Download: AdGuard Home
Bottom line: The easiest 30-minute win on the network side.
6. Pi-hole — best classic home DNS filter
Pi-hole is the original Raspberry Pi DNS block. Installer script, browser dashboard, real-time query logs. Point the DHCP server (router or dnsmasq) at Pi-hole and every device on the network filters through it.
Where it falls short: No native native VLAN awareness. Uses regex and text lists, which are less flexible than AdGuard Home’s rule engine.
Pricing: Free, open source.
Platforms: Linux, Docker.
Download: Pi-hole
Bottom line: The community classic. A Raspberry Pi Zero W runs it for a decade.
7. IoTGuard — best preconfigured IoT block lists for OpenWrt
IoTGuard is a small OpenWrt add-on that ships curated block lists specifically for smart-device telemetry (Roku, Samsung TV, Ring, LG WebOS, and dozens more). Enable the list for the IoT VLAN, and the vendor traffic drops to almost nothing without breaking core functionality.
Where it falls short: OpenWrt-specific. Community-maintained, so occasional overreach breaks a device until a rule tweak lands.
Pricing: Free, open source.
Platforms: OpenWrt.
Download: IoTGuard on GitHub
Bottom line: The right add-on once OpenWrt is installed and the VLAN split is done.
How to pick the right one
- If the router is a supported model: OpenWrt, first.
- If OpenWrt refuses: DD-WRT next.
- If you have a spare mini PC: pfSense or OPNsense as the real firewall, with the router demoted to an AP.
- If you want tracker blocking without any flashing: AdGuard Home or Pi-hole.
- If you have OpenWrt already: layer IoTGuard for smart-device block lists.
FAQ
Do I actually need to segment smart devices? Yes if the goal is real privacy. Smart TVs and cameras phone home constantly, and one compromised device on the main LAN can pivot to a laptop.
Can I just block internet for IoT devices? Some devices refuse to work without a cloud call. Segmenting into a separate VLAN with narrow outbound rules is more sustainable than a full block.
Is OpenWrt safe on my Wi-Fi 6 router? Check the OpenWrt hardware database. Wi-Fi 6 support is uneven across chipsets. Wi-Fi 7 support is still catching up in mid-2026.
Do I need to buy new hardware? No. That is the whole point. The retired router in a drawer is the hardware.
Is a raw firewall enough or do I need DNS filtering too? Both. Firewall rules cover the connection layer; DNS filtering catches the ad and tracker layer that goes over allowed connections.
Are these tools safe to run permanently? OpenWrt, DD-WRT, pfSense, and OPNsense receive security updates regularly. Pi-hole and AdGuard Home push updates weekly. Keep them current the same way you would any router firmware.
