XDA-Developers listed five things your router is probably doing that you never asked for: UPnP opening ports on demand, WPS accepting an eight-digit PIN over Wi-Fi, remote admin exposed on WAN, telemetry to the vendor, and DNS pointed at the ISP. Every one is a default the vendor set for convenience; every one weakens the perimeter of the network. Fixing them is a small evening of work on the router’s admin page, or a bigger evening replacing the firmware with something you control.
We tested 7 desktop apps and firmwares that either replace stock router firmware, run a firewall in front of it, or audit the routers you have. The list covers the two long-standing open-source firmwares (OpenWrt, DD-WRT), a middle path for Asus owners who want a maintained fork of stock (AsusWRT-Merlin), the two BSD-based router operating systems that home labs run (pfSense, OPNsense), the router pentesting framework every security researcher uses (RouterSploit), and the network scanner that catches misconfigurations from any laptop (Nmap). Everything runs on Windows, macOS, or Linux; several also flash directly onto a supported router.
What to look for in router hardening
- Actively maintained firmware with a security update cadence, not a vendor blob abandoned two years after launch.
- Ability to disable UPnP, WPS, and WAN-side admin from a single page.
- Support for the router model you actually own. Compatibility varies wildly.
- Custom DNS (DoH, DoT, or DoH3), because default ISP DNS logs your traffic.
- Auditability, either via SSH into the router or via a full network scan from a client on the LAN.
Quick comparison
| App | Best for | Runs on | Type | Cost |
|---|---|---|---|---|
| OpenWrt | Full-featured firmware replacement | 1000+ supported routers | Firmware | Free (open source) |
| DD-WRT | Broadest hardware support | Very wide list | Firmware | Free (open source) |
| AsusWRT-Merlin | Asus owners who want to stay close to stock | Most Asus consumer routers | Firmware fork | Free (open source) |
| pfSense | x86 router or old PC as a firewall | Any x86 machine | Router OS | Free (open source, paid CE tier) |
| OPNsense | pfSense fork with faster release cadence | Any x86 machine | Router OS | Free (open source) |
| RouterSploit | Pen-testing your own router’s exposure | Windows, macOS, Linux | Framework | Free (open source) |
| Nmap | Scanning what ports the router actually exposes | Windows, macOS, Linux | Scanner | Free (open source) |
1. OpenWrt — best firmware replacement
OpenWrt is the reference open-source router firmware. It supports over a thousand devices, ships a modern Linux userland, and puts every setting the underlying hardware supports in front of you. UPnP is off by default. WPS isn’t compiled in. Remote admin is opt-in. SSH is on. Custom DNS providers, DoH, per-device VLANs, wireguard VPN server, and per-client bandwidth control are all one package install away.
Where it falls short: Requires a supported router; flashing incorrectly bricks the device. Not for people who dread a config file. Vendor-specific hardware features (Asus AiMesh, Netgear Nighthawk features) don’t survive the flash.
Pricing:
- Free (open source, GPLv2)
Platforms: Windows, macOS, Linux (flasher tools); firmware runs on the router
Download: openwrt.org/downloads
Bottom line: Best if your router is on the supported list and you want the most control.
2. DD-WRT — best broad hardware support
DD-WRT is the older firmware alternative and covers a wider list of hardware than OpenWrt, especially older Netgear, Linksys, and D-Link routers. Feature set is close to OpenWrt’s: kill UPnP, disable WPS, run a WireGuard or OpenVPN server, and point DNS wherever you like.
Where it falls short: Older codebase; some builds lag OpenWrt on security patches. Web UI feels dated. Documentation is scattered across old forum threads.
Pricing:
- Free (basic builds); premium activations for some hardware
Platforms: Windows, macOS, Linux (flasher); firmware runs on the router
Download: dd-wrt.com/support/router-database
Bottom line: Best when OpenWrt doesn’t have your model but DD-WRT does.
3. AsusWRT-Merlin — best for Asus owners
AsusWRT-Merlin is a maintained fork of Asus stock firmware, preserving AiMesh, Trend Micro AiProtection, and the Asus feature set while adding hardening options, custom scripts, better DNS handling, and community fixes. For Asus owners who want stock’s features without stock’s defaults, it’s the least disruptive path.
Where it falls short: Asus routers only. Doesn’t strip vendor telemetry as thoroughly as OpenWrt.
Pricing:
- Free (open source, GPL)
Platforms: Windows, macOS, Linux (flasher via router web UI); firmware runs on the router
Download: asuswrt.lostrealm.ca (mirror of asuswrt.lostrealm.ca)
Bottom line: Best for Asus owners who want the ecosystem features and better defaults.
4. pfSense — best x86 router platform
pfSense runs on any x86 hardware (an old PC, a small fanless box, a Protectli) and becomes a dedicated router and firewall. Feature set is enterprise-grade: stateful firewall, IDS/IPS via Suricata, VPN server, traffic shaping, VLANs, captive portals. Way more than a home network needs, and exactly what a home lab wants.
Where it falls short: Requires dedicated hardware. Learning curve is steep. Netgate (the vendor) moved features between free and paid editions over the years; the free Community Edition still covers most needs.
Pricing:
- Free (Community Edition)
- pfSense Plus: Free for home; commercial licences for business
Platforms: Runs on any x86 machine
Download: pfsense.org/download
Bottom line: Best if a spare PC can become the network’s front door.
5. OPNsense — best pfSense alternative
OPNsense forked from pfSense in 2015 over licensing and governance disagreements and has been shipping faster release cadences since. Feature parity is close (some pfSense-only features exist and vice versa); web UI is cleaner and more accessible.
Where it falls short: Slightly smaller community than pfSense. Some third-party guides still assume pfSense terminology.
Pricing:
- Free (open source, BSD)
Platforms: Runs on any x86 machine
Download: opnsense.org/download
Bottom line: Best if pfSense’s release cadence or governance history doesn’t suit you.
6. RouterSploit — best for auditing your own router
RouterSploit is the Metasploit-style framework for router vulnerabilities: a searchable database of exploits, credentials, and misconfigurations against consumer routers. Run it against your own router’s IP to see what a nearby attacker could exploit; the tool is the same one security researchers use to publish vendor advisories.
Where it falls short: Runs against devices, so only useful when you have permission (your own network only). Coverage is broad but not exhaustive; a “no matches” result doesn’t mean the router is safe, only that RouterSploit didn’t recognise anything.
Pricing:
- Free (open source, BSD)
Platforms: Windows, macOS, Linux (Python 3)
Download: github.com/threat9/routersploit
Bottom line: Best for a directed audit against a single router you own.
7. Nmap — best network scanner
Nmap doesn’t care about specific router bugs; it just reports what ports and services the router exposes. Run it from a laptop on the LAN against the router’s IP, then from outside the network against the WAN IP, and compare what’s actually open to what the admin page claims. That comparison usually catches a UPnP mapping the user never authorised or a remote-admin service that should be off.
Where it falls short: Requires interpretation; a Nmap report is a starting point, not a verdict. Full scans are slow on a large IP range.
Pricing:
- Free (open source, GPLv2)
Platforms: Windows, macOS, Linux
Download: nmap.org/download
Bottom line: Best sanity check on any router, before and after any hardening.
How to pick the right one
If your router is on the OpenWrt supported list: OpenWrt, and audit with Nmap before and after.
If OpenWrt doesn’t cover your device: DD-WRT first, then check vendor forums for a maintained fork.
If you’re on Asus: AsusWRT-Merlin is the least disruptive upgrade.
If you have a spare PC or small fanless box: pfSense or OPNsense in front of the ISP router, which becomes bridge mode.
If you want to see what an attacker sees: RouterSploit for known exploits, Nmap for the port surface.
If nothing on the list flashes your router (an ISP-provided modem-router combo, for instance): put a hardened box between it and the LAN, either pfSense/OPNsense on x86 or an OpenWrt-supported router in access-point mode.
FAQ
Is it safe to flash third-party firmware on my router?
Yes if you match the firmware to the exact router model and revision. Mismatches brick the device. Read the OpenWrt or DD-WRT device page for your model before starting; use the recovery-mode instructions if a flash fails.
Will flashing OpenWrt void the router’s warranty?
Usually yes, per most vendors’ terms. That matters most in the first year. Older routers past warranty are the usual targets.
What are the most important settings to change on stock firmware?
Disable UPnP, WPS, and remote admin on WAN. Change the default admin password. Turn on WPA3 if the router supports it (WPA2-only if not; never WEP or WPA). Point DNS at a custom provider (Quad9, Cloudflare 1.1.1.1, or a local Pi-hole).
Do I actually need pfSense at home?
Not if a decent Wi-Fi router does the job. pfSense wins when you have VLANs to segregate IoT devices, want intrusion detection, or have a home lab that needs to look enterprise.
Is DD-WRT still worth using?
Yes for hardware OpenWrt doesn’t cover. For anything on the OpenWrt list, OpenWrt has the more active security cadence.
Can I run OpenWrt as a Wi-Fi access point behind my ISP router?
Yes. Configure OpenWrt in access-point mode with routing disabled; the ISP router keeps handling the WAN and OpenWrt provides a hardened Wi-Fi layer.