Security, your side
Keeping your network safe from hackers
ISN protects the platform. This guide shows what you do on your own side: the computer that runs the ISN Connector, your routers, your controller, your access points and your accounts, in plain words and in order of importance.
1
Who protects what
Keeping a WiFi network safe is a shared job. ISN protects the platform: our servers, the sign-in pages, and the way we talk to your routers and your ISN Connector. You protect what stands in your own building: the computer that runs the connector, your routers, your controller, your access points and your accounts. Most real break-ins happen on the second list, usually through an old firmware version, an admin page left open to the internet, or a password that was never changed. This guide tells you exactly what to do, in order of importance, in plain words.
How to read it. Sections 2 to 8 are things to do. Section 9 is what to do if something goes wrong. Section 10 is a checklist you can print and tick once a month. You do not need to do everything today: the five habits in section 2 stop most attacks.
A few words you will see: firmware is the built-in software of a router or access point, and it needs updating just like a phone. An admin page is the settings screen of a device. Two-step sign-in (also called 2FA or MFA) asks for a code from an app on your phone as well as your password. A VLAN is a way to keep groups of devices, such as guests and staff, on separate virtual networks.
2
The five habits that stop most attacks
| Habit | Why it matters |
|---|---|
| 1. Keep firmware and software up to date. Routers, access points, the UniFi controller, the connector computer. | Attackers scan the internet all day for devices that run old versions with known flaws. In 2026 there were serious flaws reported in MikroTik, UniFi and Teltonika products. Updating closes them. |
| 2. Never open an admin page to the internet. No port forwarding to a router, controller or camera screen. | If the settings page can be reached from anywhere, anyone can try to break into it. If you need remote access, use a VPN such as WireGuard instead of opening a port. |
| 3. A different strong password on every device, and two-step sign-in wherever it exists. | Factory passwords are public knowledge. Reusing one password means one leak opens everything. |
| 4. Keep guests, staff and equipment on separate networks. | Then a guest who misbehaves cannot reach your office computers, till or cameras, or the settings of your routers. |
| 5. Lock the connector computer down and keep it for that job only. | It holds a key that lets it work with your controller. Treat it like the key cupboard. |
3
The computer that runs the ISN Connector
The connector only ever connects out to ISN, so you never open a port for it. It also keeps your UniFi login on your own computer. That is a good design, and these steps keep that computer from becoming the weak spot.
| Do this | How |
|---|---|
| Use a computer (or virtual machine) that does only this job. | No email, no web browsing, no games, no pirated software. A small mini-PC or a Raspberry Pi is fine. Fewer programs means fewer ways in. |
| Install every operating system update. | Windows: turn on automatic updates and restart when asked. Linux: turn on unattended security updates. An old, unpatched PC on your network is exactly what attackers look for. Use a version of the operating system that its maker still supports. |
| Run the connector as a limited account, not as the most powerful one. | On Linux our installer already creates a dedicated no-login account. On Windows, if you are able to, run the scheduled task under a normal service account instead of the highest-privilege one, and keep the connector folder readable only by that account and by administrators. |
| Use a current Node.js version. | The connector runs on Node.js. Use a version that still gets security fixes (a current long-term-support release from nodejs.org). Older versions stop receiving fixes. |
| Encrypt the disk. | Windows Pro: turn on BitLocker. Linux: choose disk encryption when installing. If the computer is stolen, nobody can read your connector key or your UniFi login from the disk. |
| Keep the firewall on and block everything coming in. | The connector needs no inbound connections. Leave Windows Defender Firewall on, or on Linux allow only what you truly use. Do not turn on Remote Desktop or SSH to the internet. If you need remote access, use a VPN. |
| Keep antivirus on. | On Windows leave Microsoft Defender running, including real-time protection and, if available, Tamper Protection. |
| Protect it physically. | Keep it in a locked room or cabinet. Set a firmware (BIOS) password, switch off booting from USB, and plug it into a UPS (a small battery) so a power cut does not corrupt it. |
| Use a strong password and a separate sign-in for each person. | No shared "admin" login on the computer. Remove accounts of people who have left. |
| Know where the keys are. | The connector key and the UniFi password sit in the connector's settings file. Only the connector's own account and administrators should be able to open that file. If a staff member who knew them leaves, change the UniFi account password and create a new connector in ISN (this replaces the old key). When you stop using a connector, remove it from the computer. Setting up a new connector in your dashboard creates a new key that replaces the old one. |
| Check it is alive. | Open the UniFi settings in your ISN dashboard once a week and confirm the connector shows as connected. A connector that is suddenly offline, or that you did not install, deserves a look. |
4
Your UniFi controller and access points
The controller (a Cloud Key, a Dream Machine, or the UniFi Network program on a computer) is the brain of your WiFi. Whoever controls it controls the whole network.
| Do this | Why and how |
|---|---|
| Update UniFi OS, the UniFi Network application and every access point. | Ubiquiti has released serious security fixes in 2026, so update to the latest versions and read Ubiquiti's security advisories for your model. Turn on automatic updates where offered. |
| Never expose the controller to the internet. | Do not forward ports 443, 8443, 8080 or SSH to it. If you must manage it from away, use a VPN or Ubiquiti's own remote access with two-step sign-in turned on. |
| Turn on two-step sign-in for the owner account. | In the UniFi account settings, add an authenticator app. Do not share the owner login. |
| Give the connector its own account. | Create a separate local account just for ISN, with the lowest role that works (see the connector guide), limited to the site your guest WiFi uses. Do not use the owner account for it. If the account is ever misused you can disable it without locking yourself out. |
| Switch on guest isolation. | On the guest WiFi, turn on client isolation ("Isolate network" or "Client device isolation") and use the guest network type, so guests cannot see each other, your staff network or the controller. |
| Change device SSH passwords. | Under Settings, System, set a strong device authentication password, and switch SSH off if you do not use it. |
| Keep backups. | Turn on automatic backups of the controller and copy them to a safe place that is not the same device. |
Using TP-Link Omada, Meraki or Ruckus instead? The same rules apply: current firmware, no controller on the internet, two-step sign-in, a separate limited account for integrations, and guest isolation.
5
MikroTik routers
MikroTik routers are powerful and popular, and attackers know it: botnets such as Meris took over tens of thousands of them. A router bought with the factory settings is not safe until you do the following. Do these steps on your local network with a cable, never from the internet. In WinBox or the terminal, turn on Safe Mode (the Safe button, or Ctrl+X in the terminal) first, so a mistake rolls back by itself instead of locking you out.
| Do this | How |
|---|---|
| Update RouterOS and the router firmware. | System, Packages, Check for updates, then install and reboot. Use the "stable" channel. Serious flaws affecting the SSH service were reported in September 2026, so being up to date matters. Read MikroTik's own notices to see which versions fix them. |
| Replace the default "admin" user. | System, Users: create a new user with a strong, long password, sign in with it, then disable or delete "admin". |
| Switch off the services you do not use. | Terminal: /ip service disable telnet,ftp,www,www-ssl,api,api-ssl. Then limit what is left to your own network, for example /ip service set winbox address=192.168.88.0/24 and the same for ssh (use your own LAN range). Make sure that range includes the computer you manage the router from, or you lock yourself out. Switching off "api" also stops any tool or script that uses the RouterOS API. |
| Turn off the extras. | /tool mac-server set allowed-interface-list=none, /tool mac-server mac-winbox set allowed-interface-list=none, /ip neighbor discovery-settings set discover-interface-list=none, /tool bandwidth-server set enabled=no, /ip proxy set enabled=no, /ip socks set enabled=no, /ip upnp set enabled=no, /ip cloud set ddns-enabled=no. Note: with neighbour discovery and the MAC server off, you can no longer reach the router by its hardware address if you lock yourself out, so the only way back is a cable and a reset. Do these last, and only when you are comfortable. |
| Stronger SSH. | /ip ssh set strong-crypto=yes. |
| Protect the router itself with the firewall. | In the input chain, accept established and related connections, drop invalid ones, accept traffic from your own staff network, and drop everything else. Keep the guest WiFi interface out of the list of networks that may reach the router. |
| Do not let the internet use your router as a DNS server. | If guests use the router for DNS, keep that allowed only for your own networks and add a rule that drops DNS (port 53, TCP and UDP) arriving from the internet side. |
| Back up and note the version. | Files, Backup, and save a copy off the router. If you ever suspect a break-in, do not restore a full backup from the affected router: reset it to factory settings and rebuild it from a clean configuration. |
MikroTik explains these steps on its help page "Securing your router" (help.mikrotik.com). Menu names can differ slightly between RouterOS versions, so read the screen as you go.
6
OpenWrt and Teltonika routers (such as the RUT360)
| Do this | How |
|---|---|
| Change the default password at once. | Teltonika routers ship with a printed default. Set a long, unique one on first sign-in (System, Administration). |
| Update the firmware. | Teltonika publishes security advisories for its routers. Check the version, update from the router's own update page, and turn on the check for new firmware. Updating is how known flaws get fixed. |
| Close remote access you do not use. | In the access control settings, turn off web, SSH, Telnet and command-line access from the WAN (internet side), and use HTTPS only. If you do not use Teltonika's RMS cloud service or SMS commands, switch them off. |
| Make SSH key-only, or switch it off. | On OpenWrt: uci set dropbear.@dropbear[0].PasswordAuth='off', uci set dropbear.@dropbear[0].RootPasswordAuth='off', then uci commit dropbear and restart it. Allow it only on the staff network. Install your SSH key first and test that it works in a second window before you switch passwords off, or you will lock yourself out. |
| Keep guests out of the router. | Put guests on their own network zone that may reach the internet but not the router's admin pages or your staff devices. On supported routers ISN's setup can turn on guest isolation. Check it still holds after any change you make. |
| Switch off what you do not use. | UPnP, unused services, WPS, and guest-facing file sharing. |
The names of the menus differ between firmware versions. If you cannot find a setting, ask your supplier or ISN support before guessing.
7
The WiFi itself and the rest of the network
| Do this | Why and how |
|---|---|
| Separate guest, staff and equipment. | Use one WiFi name for guests and a different, password-protected one for staff. Put point-of-sale machines, cameras and door systems on their own network, not on the guest one. |
| Use strong encryption on the staff WiFi. | WPA3 if all your devices support it, otherwise WPA2 with a long passphrase. Turn off WPS. Change the staff passphrase when someone leaves. |
| Be honest with guests about the open network. | An open guest network is not private. Anyone nearby can try to read unencrypted traffic, and a criminal can set up a fake network with your WiFi's name (an "evil twin"). A line on your login page telling guests to use HTTPS sites and not to enter banking details helps. |
| Walk your premises now and then. | Look for access points or devices you did not install. ISN scans for fake copies of your WiFi name about every half hour and tells you, but a quick look in person helps too. |
| Put your internet provider's router into bridge mode if you can. | Two routers stacked on each other cause confusing gaps in your firewall. Ask your provider how. |
| Check for port forwards. | Open your router's port-forwarding list. Remove anything you did not set up and understand. |
| Plan for abuse. | Free WiFi can be misused. Use ISN's content filter and speed limits, and keep a contact for abuse complaints. ISN can look up which router had a given public IP address at a given time, which helps when a complaint arrives. |
8
Your ISN account and your team
| Do this | How |
|---|---|
| Turn on two-step sign-in. | In your dashboard, switch on the authenticator-app code. It protects your account even if your password leaks. |
| Use a password you use nowhere else. | A password manager makes this easy. |
| Give each person only the access they need. | Add team members with a role that fits (for example IT or Ads manager) instead of sharing the owner login, and remove people when they leave. |
| Watch out for fake messages. | ISN will never ask for your password, your two-step code or your connector key by email, SMS or phone. If a message pushes you to hurry, stop and contact us on the address in the footer of this site. Check that the web address is exactly isnfreewifi.co.za. |
| Keep your own email safe. | Whoever controls your email address can reset your passwords. Use two-step sign-in on it too. |
| Use the pause options if something looks wrong. | You can change the guest WiFi password, restart or reset a router from the dashboard, and replace the connector key. ISN also keeps an emergency switch that can pause every change sent to routers and connectors if we ever suspect a break-in on our side. |
9
If you think you have been hacked
Signs: routers rebooting by themselves, settings you did not change, new admin users, the guest WiFi slowing to a crawl for no reason, unknown devices in your controller, or a message from ISN or your internet provider about unusual traffic. Do this in order:
- Stay calm and write down what you see (times, screenshots). Do not delete logs.
- Contact ISN straight away on the support address on this site. We can pause commands to your routers, and help you check.
- Cut off the affected device. Unplug its internet cable, or disconnect the connector computer from the network.
- Change passwords from a clean device: the ISN dashboard, the controller, router admin accounts, WiFi passphrases and your email. Turn on two-step sign-in.
- Replace the ISN Connector key by creating a new connector in your dashboard, and remove the old one.
- Update the firmware on the affected devices. For a router that was taken over, reset it to factory settings and rebuild it from a clean setup. Some infections survive a normal reboot.
- Check what was exposed. If guests' personal details may have been seen, the law in your country may require you to tell the people affected and the regulator. In South Africa that is the Information Regulator under POPIA. Ask an attorney, and ask ISN for the facts you need.
10
Your monthly and yearly checklist
| When | Tick off |
|---|---|
| Every week | The ISN Connector shows as connected. No unknown devices in the controller. No router shows as outdated or tampered with in the dashboard. |
| Every month | Router, access point and controller firmware are current. The connector computer has installed its updates. Old staff accounts are removed. Backups of the controller and the router exist. |
| Every three months | Change the staff WiFi passphrase if anyone left. Check the port-forwarding list. Test that you can restore a backup. Walk the building for devices that should not be there. |
| Every year | Replace passwords on admin accounts that never change, review who has access to what, and check that your equipment still gets security updates from its maker. Replace what no longer does. |
11
What ISN does for you
We tell you plainly what we do, so you know what to expect and what is left for you.
- The ISN Connector only connects outwards, so your firewall stays closed. When you use the connector, your UniFi login stays on your own computer. ISN keeps only a one-way fingerprint of the connector key, and the download link for the connector is used once and expires after 15 minutes.
- Dangerous router actions (a factory reset, a restore, or running a command) ask for your password again first.
- On routers where you switched the firewall protection on, the platform checks it about every five minutes and puts it back if it was removed (this stops while ISN has paused changes). It also watches for fake copies of your WiFi name.
- Stored controller passwords and keys are encrypted and are never sent back to your browser.
- ISN has an emergency switch that can pause every change to routers and connectors at once, while guests stay online.
- Your sign-in supports two-step codes, sessions can be ended from the dashboard, and a router that is running older software than the rest of your routers is flagged in the dashboard.
Security keeps changing, and so do we. Related guides: Run the ISN Connector as a service, Routers and Network and How ISN protects your data. Questions about anything here? Contact ISN support from the footer of this site.