Plan the router before you plug it in

A small business router should be sized for the way your office actually works, not just the internet speed on the bill. Count how many wired devices need stable connections, such as desktop PCs, printers, VoIP phones, point-of-sale terminals, and network-attached storage. Then count wireless devices that will be active at the same time, including laptops, tablets, inventory scanners, cameras, and employee phones. This matters because most business-grade routers list a maximum throughput that drops once security features like firewall inspection, VPN, and content filtering are enabled. A router advertised for gigabit internet may only deliver a fraction of that speed when advanced protections are turned on.

Before setup, write down the details you will need from your internet provider: connection type, modem or ONT model, whether the connection uses DHCP, PPPoE, or static IP addressing, and any assigned DNS servers or public IP information. You should also decide the internal network ranges in advance. Many routers default to 192.168.1.0/24, but using a less common subnet such as 10.20.30.0/24 reduces conflicts when employees connect through VPN from home networks that already use the default range. Reserve space for separate networks too, such as one VLAN for office computers, one for guest Wi-Fi, and one for cameras or IoT devices.

Physical placement affects performance as much as software settings. Put the router in a central, ventilated location, off the floor, away from metal racks, microwave ovens, cordless phone bases, and electrical panels. If the router includes built-in Wi-Fi and your office is spread across several rooms, assume you may still need separate access points for full coverage. During planning, label each cable run and decide which switch ports will carry office traffic versus guest or voice traffic. Good labeling at the start makes later troubleshooting much faster because you can identify exactly which device or wall jack belongs to which network segment.

Step 2: Secure administrator access and update the firmware

1. Change the default admin username and password immediately. In the router menu, look under Administration, System, Device Management, or Users. Replace the default password with a long passphrase that is not reused anywhere else. If the router allows a custom admin username, change that too. Default credentials are the first thing attackers try, and many automated scans specifically target routers left on factory settings.
2. Set the correct time zone and enable NTP. This is usually in System, Clock, or Date and Time. Accurate time stamps make firewall logs, VPN troubleshooting, and outage reviews useful. Choose your local time zone and enable automatic internet time synchronization. Without this, logs may show events at the wrong time, making it much harder to track failed logins or internet drops.
3. Update the firmware before putting the router into daily use. Look for Firmware Update, Software Update, or Maintenance. Some routers can check online automatically; others require you to upload a downloaded file from the manufacturer’s site. Install the newest stable release rather than a beta version unless you need a specific fix. Firmware updates often patch security flaws, improve VPN stability, and fix bugs that cause random reboots or poor throughput.
4. Disable risky remote management options unless you truly need them. In Administration, Remote Access, or Management, turn off management from the WAN side of the internet. If remote administration is required, restrict it to VPN access or to specific trusted public IP addresses. Also disable insecure protocols such as plain HTTP or Telnet if the router still offers them, and use HTTPS or SSH instead. This closes off the most common path attackers use to reach a small business router from outside the office.

Step 4: Configure Wi-Fi, firewall protections, and verify the setup

1. Set business-grade Wi-Fi security and naming. In Wireless, Wi-Fi, or SSID Settings, create a primary SSID for staff and a separate SSID for guests if you are not using a single guest toggle. Use WPA3-Personal if all devices support it, or WPA2/WPA3 mixed mode if older hardware remains in service. Avoid WEP and WPA entirely. Give the staff network a clear name tied to the location or suite, not one that exposes the router brand or model. Turn off WPS in the same wireless security area because push-button pairing is a known weak point.
2. Enable the built-in firewall and basic threat protections. In Security, Firewall, or Threat Management, confirm that stateful packet inspection is on. If the router includes options such as DoS protection, port scan blocking, or malicious site filtering, enable them unless they interfere with a required application. Leave UPnP off unless a specific business device absolutely requires it, because UPnP can open ports automatically without clear oversight.
3. Only open ports when you can document the need. If a server or camera system needs inbound access, go to Port Forwarding, NAT, or Virtual Server and create the narrowest rule possible: one port, one internal IP, one protocol. Avoid exposing the router admin page, RDP, or file sharing directly to the internet. If remote users need office access, use the router’s VPN section instead of broad port forwards whenever possible.
4. Test from both inside and outside the network. Verify that staff devices receive the right DHCP addresses, guest devices cannot reach office systems, printers respond at their reserved IPs, and internet speed is acceptable over both Ethernet and Wi-Fi. In the Logs or System Log page, check for repeated WAN disconnects, DHCP errors, or blocked traffic that points to a misconfiguration. Save a backup of the final configuration from Administration or Backup/Restore so the router can be restored quickly after a hardware failure or accidental reset.

• Tip: Name reserved devices with a consistent pattern such as printer-front-office or ap-conference-room in the DHCP or device list. Clear names make firewall rules and troubleshooting much easier.
• Tip: If VoIP phones are in use, check whether the router supports QoS under Traffic Management or Quality of Service. Prioritizing voice traffic can reduce choppy calls during large uploads or cloud backups.
• Tip: Export the config file after every major change and store it with your ISP credentials and VLAN notes. A five-minute restore is far better than rebuilding the network from memory after an outage.

Need Hands-On Help?

MacSolutions Plus in East Amherst has been helping customers in Buffalo and Buffalo, Amherst, East Amherst with Mac and PC technology for 24+ years. Whether you need hands-on assistance or just have a quick question, we’re happy to help.

Call (716) 823-3085