Remediation playbook

When netglance flags issues on your network, this playbook provides step-by-step fixes grouped by category. Each section addresses a specific problem type with actionable remediation steps.

DNS Issues¶

Changing DNS Resolvers¶

At the router level (affects all devices):
Open your router's admin panel (usually 192.168.1.1 or 192.168.0.1)
Log in with your admin credentials
Navigate to Settings > DNS or Internet > DNS
Replace ISP-provided DNS with preferred resolvers:
- Cloudflare: 1.1.1.1 and 1.0.0.1
- Quad9: 9.9.9.9 and 149.112.112.112
- Google: 8.8.8.8 and 8.8.4.4
Save and reboot the router
Run netglance dns check to confirm resolution works

Per-device on macOS:

networksetup -setdnsservers Wi-Fi 1.1.1.1 1.0.0.1
networksetup -getdnsservers Wi-Fi  # verify

Per-device on Linux:
Edit /etc/resolv.conf or use systemd-resolved
Add nameserver 1.1.1.1 and nameserver 1.0.0.1

Enabling DNS-over-HTTPS (DoH)¶

On macOS:
System Preferences > Network > Wi-Fi > Advanced > DNS
Click the + button under DNS Servers
Add: 1.1.1.1 and 1.0.0.1
Enabled DoH by default for Cloudflare (macOS 14+)
On Linux:

Edit /etc/systemd/resolved.conf:

DNS=1.1.1.1 1.0.0.1
DNSSECMode=yes
DNSOverTLS=yes

Restart: sudo systemctl restart systemd-resolved
Via browser (Firefox, Chrome):
Settings > Privacy & Security > DNS over HTTPS
Select your resolver or custom endpoint

Fixing DNS Leaks When Using a VPN¶

Verify the leak:
```
netglance dns check
```
If it reports queries leaking outside your VPN tunnel, proceed.
Force DNS through VPN:
Open your VPN app settings
Find DNS Settings or Custom DNS
Enable "Force DNS through VPN tunnel"
Set DNS to your VPN provider's servers or Quad9 (9.9.9.9)
Reconnect to VPN
Disable IPv6 if needed:
If leak persists, your VPN may not fully support IPv6
On macOS: System Preferences > Network > Wi-Fi > Advanced > TCP/IP > Configure IPv6 > Off
On Linux: echo "net.ipv6.conf.all.disable_ipv6 = 1" | sudo tee -a /etc/sysctl.conf && sudo sysctl -p
Verify the fix:
```
netglance dns check
```

Enabling DNSSEC Validation¶

At the router level:
Admin panel > Settings > DNSSEC
Enable DNSSEC validation
Save and reboot
On Linux:
Edit /etc/systemd/resolved.conf:
```
DNSSEC=yes
```
Restart: sudo systemctl restart systemd-resolved
Verify:
```
netglance dns check
```
Look for "DNSSEC: enabled" in output.

WiFi Issues¶

Upgrading to WPA3 (or WPA2/WPA3 Transitional)¶

Check router capabilities:
Log in to admin panel
Navigate to Wireless > Security or WiFi > Authentication
If WPA3 is available, select it; otherwise use WPA2/WPA3 (Mixed)
Set a strong passphrase (25+ characters, mixed case, numbers, symbols):
Router admin panel > WiFi settings
Update the pre-shared key (PSK)
Save and reconnect all devices
Verify:
```
netglance wifi scan
```
Look for "WPA3" or "WPA2-PSK/WPA3-PSK" in the security column.

Optimizing WiFi Channel¶

Scan for interference:
```
netglance wifi scan
```
Note neighboring SSIDs and their channels.
Select least-congested channel:
2.4GHz band: Use channel 1, 6, or 11 (non-overlapping)
5GHz band: Try DFS channels (120–144) if available and uncontested
Avoid channels close to neighbors' networks
Change channel:
Router admin panel > Wireless > Channel
Apply change and reboot
Reconnect devices
Verify:
```
netglance wifi scan
```

Disabling WPS (WiFi Protected Setup)¶

Log in to router admin panel
Navigate to Wireless > Security or WiFi > Advanced
Find WPS and set to Disabled
Save and reboot
Verify in netglance output (no WPS vulnerabilities reported)

Setting Up a Guest Network for IoT Devices¶

Create guest network:
Router admin panel > Wireless > Guest Network
Enable guest network
Give it a descriptive name (e.g., Home-IoT)
Set a strong passphrase
Isolate guest traffic:
Look for Guest Network Isolation or AP Isolation
Enable isolation so guest devices can't access main network
Connect IoT devices to the guest network (not your primary WiFi)
Verify isolation:
```
netglance discover
```
Devices on guest network should appear separately or with restricted connectivity to primary network.

Port and Service Issues¶

Identifying and Disabling Unused Services¶

Scan for open ports:
```
netglance scan <target-ip>
```
Note which ports/services are exposed.
For each unwanted service, identify and disable:
SSH (port 22): Disable remote login or restrict to specific IPs
SMB (ports 139, 445): Disable file sharing or restrict to LAN only
HTTP (port 80): Disable web server if not needed
On macOS (disable SSH):
```
sudo systemsetup -setremotelogin off
```

On Linux (disable SSH):

sudo systemctl disable ssh
sudo systemctl stop ssh

Configuring Host Firewalls¶

On macOS (pf firewall):
System Preferences > Security & Privacy > Firewall
Click Firewall Options
Check "Block all incoming connections" (or configure rules via pfctl)

On Linux (iptables/firewalld):

sudo systemctl enable firewalld
sudo systemctl start firewalld
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --reload

Verify:
```
netglance scan <your-ip>
```

Closing Router Ports¶

Disable UPnP (prevents apps from auto-opening ports):
Router admin panel > Advanced > UPnP
Set to Disabled
Save and reboot
Remove port forwarding rules:
Router admin panel > Port Forwarding or Virtual Server
Delete any rules you don't recognize
Save
Disable remote management:
Router admin panel > Administration or Advanced > Remote Management
Set to Disabled
Verify:
```
netglance scan <router-ip>
```

VPN Issues¶

Fixing DNS Leaks with VPN¶

See DNS Issues > Fixing DNS Leaks When Using a VPN above.

Enabling IPv6 Leak Protection¶

Check if your VPN supports IPv6:
Consult your VPN provider's documentation
If not supported, disable IPv6 system-wide:
macOS: System Preferences > Network > Wi-Fi > Advanced > TCP/IP > Configure IPv6 > Off

Linux: Add to /etc/sysctl.conf:

net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1

Then run: sudo sysctl -p

Verify VPN app settings:
Look for IPv6 Leak Protection toggle and enable it

Verifying VPN Kill Switch¶

Test kill switch functionality:
Enable VPN kill switch in your VPN app settings
Disconnect from VPN
Confirm your ISP DNS is NOT leaking: netglance dns check
If kill switch isn't working:
Update your VPN app to the latest version
Reinstall and reconfigure from scratch
Contact VPN provider support

Device Management¶

Identifying and Removing Unknown Devices¶

List connected devices:
```
netglance discover
```
For each unknown device:
Check the MAC address against a vendor lookup (usually shown in netglance output)
Ask household members if they recognize it
Check your router's admin panel for the device name
Remove unauthorized devices:
Option 1: Change your WiFi passphrase (forces reconnect, unknown devices drop)
Option 2: Router admin panel > Wireless > MAC Filter > Block the MAC address
Option 3: Router admin panel > Connected Devices > Disconnect/blacklist

Network Segmentation with VLANs¶

Create a separate IoT VLAN:
Router admin panel > Wireless > Guest Network or Advanced > VLAN
Create a new network (e.g., Home-IoT)
Enable VLAN isolation
Set up firewall rules (advanced):
Prevent IoT devices from accessing your primary LAN
Allow IoT devices outbound to internet
Example (Linux): sudo firewall-cmd --permanent --new-zone=iot && sudo firewall-cmd --reload
Move IoT devices to the isolated network
Verify isolation:
```
netglance discover
```

Updating Firmware¶

Check for router firmware updates:
Router admin panel > Administration > Firmware Update or System > Updates
Click "Check for Updates"
If available, download and install
Router will reboot automatically
Update access points and mesh nodes:
Use the manufacturer's app or web interface
Check for updates regularly (monthly)
Update IoT devices:
Check each device's app or web interface for firmware updates

Setting Up Static DHCP Leases¶

Identify devices to pin:
Router admin panel > Connected Devices or DHCP Client List
Note the MAC address and current IP
Create static lease:
Router admin panel > DHCP > Static Leases or Advanced > DHCP Reservation
Add: MAC address → desired IP (e.g., 192.168.1.100)
Save and reboot
Verify:
```
netglance discover
```

Certificate Issues¶

Understanding Self-Signed Certificate Warnings¶

Determine if the certificate is yours:
Check the certificate subject (CN field)
If it's your home server's hostname, it's safe to ignore
Temporarily trust the certificate (macOS):
Open the certificate file in Keychain Access
Right-click > Get Info
Expand "Trust" section
Set "When using this certificate" to Always Trust
Or, create a local CA and sign certificates:
Use mkcert (easiest): mkcert -install && mkcert localhost 192.168.1.100
Add the generated .crt to your system's trusted root CAs

Renewing Expiring Certificates¶

Identify expiring certificates:
```
netglance tls check <server-ip>:<port>
```
Renew via Let's Encrypt (if public domain):
```
certbot renew --force-renewal
```

Renew self-signed certificates:

openssl req -x509 -newkey rsa:4096 -out cert.pem -outform PEM -keyout key.pem -days 365 -nodes

Update the server to use the new certificate files
Verify:
```
netglance tls check <server-ip>:<port>
```

Getting Help¶

If a remediation doesn't work or you're unsure about a step:

Run netglance --help to see all available commands
Run netglance <module> --help for module-specific options
Check the Documentation for detailed command syntax