# AX1800 hardening

**URL:** <https://forum.gl-inet.com/t/ax1800-hardening/31532>\
**Category:** Router\
**Created:** [July 18, 2023, 2:05pm UTC](https://forum.gl-inet.com/t/ax1800-hardening/31532 "2023-07-18T14:05:19Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![bring.fringe18](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/bring.fringe18/32/11777_2.png) [@bring.fringe18](https://forum.gl-inet.com/u/bring.fringe18)\
**Post date:** [July 18, 2023, 5:27pm UTC](https://forum.gl-inet.com/t/ax1800-hardening/31532/2 "2023-07-18T17:27:23Z")

</div>

There’s all kinds of things you can depending on how deep down the rabbit hole you want to go but by default the firewall rules are already configured to reject any unauthorized/unknown incoming WAN traffic to the device.

Most hardening would be related to the LAN side of things which may/may not be important depending on your threat model.

> [@StinkySteve](#):
>
> to ensure maximum privacy and security possible?

One aspect I would highly advise regardless is to enable Encrypted DNS via DOH through either Cloudflare or Quad9. Note Cloudflare is generally faster but US based & holds logs for 25 hours per their privacy policy.

GL GUI → Network → DNS → DNS Server Settings →

- Mode → Encrypted DNS
- Encryption Type → DNS over HTTPS
- Servers → + Server → [search for Cloudflare/Quad9]

Confirm your results via [ipleak.net](http://ipleak.net).

There’s other details that can harden Encrypted DNS at the cost of a slight performance hit but that requires digging into configuration files (`.conf`) within the underlying OpenWrt Linux OS. If you’re comfortable with the premise of learning SSH, basic command line usage, basic text editing it can be done easily enough.

Of course I’m still neglecting a [discussion of VPN providers](https://forum.gl-inet.com/t/noob-establishing-a-vpn-first-time/31184).

> [@StinkySteve](#):
>
> It was surprising to see the Flint worth nearly £100 doesn’t have a VPN leak kill switch […]

It does but it’s a change in terminology as firmware v. 4.x is more flexible than the Mango’s v. 3.x: GL GUI → VPN → VPN Dashboard → VPN Client → Global Option.

Also, 4.23-release5 is the latest stable firmware for the Flint: GL GUI → System → Upgrade or [GL.iNet download center](https://dl.gl-inet.com/?model=ax1800)

* * *

> **[DNS over HTTPS](https://en.wikipedia.org/wiki/DNS_over_HTTPS)**
>
> DNS over HTTPS (DoH) is a protocol for performing remote Domain Name System (DNS) resolution via the HTTPS protocol. A goal of the method is to increase user privacy and security by preventing eavesdropping and manipulation of DNS data by man-in-the-middle attacks by using the HTTPS protocol to encrypt the data between the DoH client and the DoH-based DNS resolver. By March 2018, Google and the Mozilla Foundation had started testing versions of DNS over HTTPS. In February 2020, Firefox An alter...

> **[Quad9 | A public and free DNS service for a better security and privacy](https://www.quad9.net/)**
>
> A public and free DNS service for a better security and privacy

---

_[View the full topic](https://forum.gl-inet.com/t/ax1800-hardening/31532)._