My home DD-WRT configuration for privacy, security, and performance. Documenting mostly so I can remember my preferred settings whenever I update/reset the router.

All settings are kept as default unless otherwise noted below. Sensitive information is annotated with "{REDACTED}".

• Netgear R7800
• DD-WRT Netgear R7800 Wiki

• v3.0-r53562 (10/03/23)

• ProtonVPN
• NextDNS

• Ignore WAN DNS: ✓¹

• Forced DNS Redirection: ✓²
• Forced DNS Redirection DoT: ✓²

• Time Zone: {REDACTED}

1. Import Configuration from ProtonVPN
2. Configure
   • DNS Servers via Tunnel: {empty}
   • Kill Switch: ✓¹
   • Allow Clients WAN Access: {unchecked}¹
   • Source Routing (PBR): Route Selected sources via WAN¹
   • Source for PBR: 192.168.1.63¹
   • Watchdog: Enable¹
     • Server IP / Name: 1.1.1.1¹

• Service Set Identifier (SSID): {REDACTED}
• Network Mode: AC / N Mixed³
• Channel Width: VHT80⁴
• Channel: {least congested, maybe prefer 149-161, don't use Auto}⁴
• Extension Channel: {paired with Channel leads to least congested}⁴
• Advanced Settings: ✓
• Firmware Type: VANILLA⁵
• TX Power: 30⁴
• Protection Mode: RTS/CTS⁴
• RTS Threshold: Enable⁴
• Threshold: 980⁴
• Short Preamble: Enable⁴
• Single User Beamforming: Enable⁴
• Beacon Interval: 300⁴
• DTIM Interval: 1⁴
• Airtime Fairness: Disable⁵
• Sensitivity Range / ACK Timing: 3150³

• Service Set Identifier (SSID): {REDACTED}
• Advanced Settings: ✓
• Protection Mode: RTS/CTS⁴
• RTS Threshold: Enable⁴
• Threshold: 980⁴
• AP Isolation: Enable⁴
• DTIM Interval: 1⁴

• Service Set Identifier (SSID): {REDACTED}
• Network Mode: N / G Mixed⁴
• Channel: {least congested, don't use Auto}⁴
• TurboQAM (QAM256): Enable⁴
• Advanced Settings: ✓
• Firmware Type: VANILLA⁵
• TX Power: 30⁴ (consider lowering to 27 or 24 if clients are sticking to 2.4 GHz over 5 GHz too much)
• Protection Mode: RTS/CTS⁴
• RTS Threshold: Enable⁴
• Threshold: 980⁴
• Short Preamble: Enable⁴
• Beacon Interval: 400⁴
• DTIM Interval: 1⁴
• Airtime Fairness: Disable⁵
• Sensitivity Range / ACK Timing: 3150³

• Service Set Identifier (SSID): {REDACTED}
• Advanced Settings: ✓
• Protection Mode: RTS/CTS⁴
• RTS Threshold: Enable⁴
• Threshold: 980⁴
• AP Isolation: Enable⁴
• DTIM Interval: 1⁴

• WPA Shared Key: {REDACTED}

• Security Mode: WPA
• Network Authentication: WPA2 Personal
• WPA Shared Key: {REDACTED}

• WPA Shared Key: {REDACTED}

• Security Mode: WPA
• Network Authentication: WPA2 Personal
• WPA Shared Key: {REDACTED}
• Custom Config: vendor_vht=1⁴

• Static Leases:¹

  MAC Address	Hostname	IP Address	Lease Expiration
  {REDACTED}	tv	192.168.1.63

• Query DNS in Strict Order: Enable

• Maximum Cached Entries: 10000

• Additional Options:^{6 1 2}

  no-resolv
  
  # ask clients to cache locally served block responses
  local-ttl=3600
  
  # block abusive requests
  address=/.data.microsoft.com/0.0.0.0
  address=/scribe.logs.roku.com/0.0.0.0
  address=/.comcast.net/0.0.0.0
  
  # NextDNS
  server=45.90.30.0
  server=45.90.28.0
  add-cpe-id={REDACTED}
  
  # end
  

• Enable: ✓
• At a Set Time: ✓ 02 00 Monday