Secure Your Globe Fiber Network

Harden your Globe router with strong encryption, DNS filtering, and MAC filtering.

Introduction

30 Second Summary

Your home WiFi router came with a default password that anyone can search online. Right now, neighbors or strangers could be connected to your network without you knowing.

In this project, you will secure your Globe At Home Fiber router and Xiaomi WiFi extender from the ground up. You'll change default credentials, upgrade encryption, block unauthorized devices, and add DNS-level malware protection that covers every device on your network.

What You'll Build

Imagine checking your network's connected devices list and seeing only your own phones, laptops, and tablets. Then trying the old default admin password and getting locked out. Then walking upstairs and getting full-speed WiFi through a properly secured extender.

By the end of this project, you'll have:

A locked-down Globe router where the old default password gets rejected, only WPA2-AES encrypted connections are allowed, and a MAC address whitelist blocks any device you haven't personally approved.
Automatic DNS-level malware protection via Quad9 that blocks phishing and malware sites for every device on your network, verified by a live leak test.
A secured Xiaomi WiFi extender delivering strong signal on your second floor with matching encryption and optimized placement.
Secret Mission: Set up an isolated guest network so visitors get internet access without being able to see or reach your personal devices.

Are there any prerequisites?

You need an active Globe At Home Fiber internet connection, a Windows PC or laptop connected to the Globe WiFi network, and a phone with the Mi Home app installed. No additional software or paid tools are required.

Before We Start

Before We Start...

Before we dive in, let's lock in what you're about to secure and why it matters to your everyday internet safety.

Log In and Audit Your Globe Router

Before you can fix security gaps, you need to see what's currently exposed.

Most Globe routers ship with weak default settings that anyone can look up online. In this step, you'll log into your router's admin panel and take stock of your current security posture: who's connected, what encryption is active, and whether your passwords are still set to factory defaults.

In this step, get ready to:

Access your Globe router admin panel and log in with the default credentials.
Review the list of devices currently connected to your network.
Note your current WiFi security mode, encryption type, and SSID for both frequency bands.

Access the Globe router admin panel

Every Globe At Home Fiber router has a built-in settings page you can reach through your web browser. You access it using a local IP address that only works when you're connected to the Globe network.

In your browser's address bar (where you'd normally type a website), type 192.168.254.254 and press Enter.

You should see the Globe router login page appear. It will have fields for a username and password.

What is a router admin panel?

Your router has a hidden settings page that controls everything about your home network: who can connect, what security is active, and how traffic flows.

The address 192.168.254.254 is the local gateway for all Globe Fiber routers. It only works from a device connected to that router's network.

Page not loading?

Make sure your PC is connected to your Globe WiFi, not mobile data or a different network.

Try typing the full URL including http:// at the start: http://192.168.254.254. Some browsers treat bare IPs as search queries.

help me access my Globe router admin panel

Log in and review connected devices

The login credentials are printed on a sticker on the back or bottom of your physical router. Globe routers have two access levels: a limited "user" account and a full "admin" account.

Find the sticker on the back or bottom of your Globe router. It lists the default username and password.
Enter the username and password from the sticker into the login fields.

Common Globe default credentials

If your sticker is unreadable, here are common defaults. For Huawei models: username user with password @l03e1t3. For FiberHome models: username user with password tattoo@home.

For full admin access (needed in later steps), try username admin with the admin password printed on your sticker.

Once logged in, you'll see the router's dashboard.

Before you look at the device list, take a guess: how many devices do you think are connected to your network right now?

Find the section that shows connected devices. It may be labelled Device List, DHCP, LAN Status, or similar depending on your model.
Count the total number of devices shown.
Write down any device names or MAC addresses you do not recognize. These could be neighbors using your WiFi.

You may see more devices than you expected. Phones, smart TVs, game consoles, and even smart light bulbs all count as connected devices.

Spotting unfamiliar devices

Some devices show cryptic names like "android-abc123" or just a MAC address. Count all the phones, laptops, tablets, TVs, and smart devices in your household. If the connected list shows more devices than you can account for, someone else may be on your network.

Can't find the device list?

On Huawei models, try looking under Status or LAN in the top navigation. On FiberHome models, look under Status then User Device Information.

help me find the connected devices list on my Globe router

Check your current wireless security settings

Now you know who's on your network. Next, you need to check how your network is protected. The security mode tells you how strong your WiFi encryption is.

Navigate to the wireless or WLAN settings section. Look for a tab or menu item labelled WLAN, Wireless, or WiFi Settings.
Find the security mode setting. It will say something like WPA-PSK, WPA2-PSK, WPA/WPA2 Mixed, or Open.
Write down the current security mode and whether it uses AES or TKIP encryption.
Note your current WiFi password (the WPA Pre-Shared Key or Passphrase field).
Note your current SSID (network name) for this band.
Check if your router has separate settings for the 2.4GHz and 5GHz bands. If it does, repeat the steps above for the second band.

What do these security modes mean?

WPA2-PSK with AES is the minimum acceptable security for a home network today. WPA (without the "2") and TKIP encryption are outdated and crackable.

If your router shows "Open" or "WEP", your network has no real protection at all. If it shows "WPA/WPA2 Mixed" with TKIP, that's better but still has weaknesses you'll fix in the next step.

Why does my router have two bands?

The 2.4GHz band has longer range but slower speeds. The 5GHz band is faster but covers less distance. Both need to be secured individually because each has its own password and encryption settings.

You should now have your current security mode, encryption type, WiFi password, and SSID written down for both bands. Keep this information handy. You'll use it as a reference when you upgrade these settings in the next step.

Settings look different from what's described?

Globe uses multiple router brands (Huawei and FiberHome are the most common). The menu labels and layout differ between models, but every Globe router has wireless security settings somewhere in the WLAN or Wireless section.

help me find WiFi security settings on my Globe router model

Your audit is complete. You now have a clear picture of your network's current state: who's connected, how strong (or weak) the encryption is, and what the default passwords are. In the next step, you'll use this information to lock everything down with strong passwords and upgraded encryption.

Harden Passwords and Upgrade Encryption

You've audited your router and now know exactly what's connected. It's time to lock the door.

Default Globe router passwords are publicly known. Anyone can search them online and gain full access to your network, your files, and your internet connection.

In this step, get ready to:

Change your WiFi password and upgrade encryption on both 2.4GHz and 5GHz bands.
Change the router admin password to a unique strong password.
Reconnect your PC and verify internet access with the new credentials.

Secure the 2.4GHz WiFi band

The 2.4GHz band is what most of your devices connect to by default. Securing it first protects the majority of your network traffic.

In the admin panel, navigate to the WLAN or WiFi Settings section.
Find the 2.4GHz band settings (some routers show this as a separate tab or dropdown).
Change the SSID (network name) to something that does not reveal your router brand or personal name.
Change the WiFi password (labeled WPA Pre-Shared Key or Passphrase) to a strong password of at least 16 characters mixing uppercase, lowercase, numbers, and symbols.
For the security mode, select WPA2-PSK with AES encryption.
If your router offers a WPA2/WPA3 mixed mode option, select that instead.
Click Apply or Save.

You should see a confirmation message or the page will refresh. Your 2.4GHz band is now secured.

What is WPA2-PSK AES?

WPA2-PSK is a WiFi security protocol that encrypts all traffic between your devices and your router using a shared password. AES is the encryption algorithm it uses.

Avoid selecting TKIP, which is an older algorithm with known vulnerabilities. AES is the current standard and provides much stronger protection.

Choosing a good SSID

Avoid names like "Globe_Huawei_5G" or "Juan's WiFi" that reveal your router model or identity. Pick something generic or creative that gives nothing away to a potential attacker.

Secure the 5GHz WiFi band

Your router broadcasts on two separate frequency bands. The 5GHz band needs the same security treatment as the 2.4GHz band you just configured.

Still in the WLAN settings, switch to the 5GHz band tab or section.
Change the SSID to a custom name (it can be different from your 2.4GHz name to help you identify which band you're on).
Change the WiFi password to the same strong password you used for 2.4GHz (or a different one for extra security).
Ensure the security mode is set to WPA2-PSK AES (or WPA2/WPA3 mixed if available).

Before you click Apply, think about what will happen. Your PC and every other device are still connected using the old WiFi password. What do you think happens when the router accepts a new password?

Click Apply or Save.

All previously connected devices, including your PC, disconnect from the network. This is expected. The old credentials no longer work, which means any freeloaders just got kicked off too.

Can't find your new network?

If you don't see your new SSID in the WiFi list after a few seconds, give it 30 seconds for the router to reboot the wireless radio. Click the WiFi icon in your Windows taskbar and hit Refresh or toggle WiFi off and back on.

If it still doesn't appear after 2 minutes, the router may have fully rebooted. Wait for the WiFi indicator light on the router to turn solid green, then scan again.

help me find my new WiFi network after changing the SSID

Reconnect and change the admin password

Your WiFi passwords are upgraded, but there's one more critical password to change. The admin login password controls who can modify your router settings.

Click the WiFi icon in your Windows taskbar.
Find your new SSID (the custom name you chose for 2.4GHz or 5GHz) in the list of available networks.
Click Connect and enter your new strong WiFi password when prompted.
Wait for the connection status to show Connected.
Open Chrome or Edge and type 192.168.254.254 in the address bar to return to the admin panel.
Log in with your current admin credentials (the ones from the sticker, since you haven't changed the admin password yet).
Navigate to the Administration or System settings section.
Change the admin/login password to a new strong password of at least 12 characters. This password must be different from your WiFi password.
Click Save or Apply.

Why a separate admin password?

Anyone who connects to your WiFi knows the WiFi password. If your admin password is the same, every guest or family member could change your router settings, disable security features, or lock you out.

A separate admin password means WiFi access and router control are two different keys. Sharing one does not compromise the other.

Now confirm everything is working. Open a new browser tab and load any website. Do you think it will load successfully?

The page should load normally. This confirms your new WiFi password works, your internet connection is intact, and your router is now secured with upgraded credentials.

Locked out of the admin panel?

If you saved the admin password but can't remember it, the only recovery option is a factory reset. Press and hold the physical reset button on the back of your Globe router for 10 seconds. This restores all factory defaults, and you'll need to redo all security settings from Step 1.

Write your new admin password down and store it somewhere safe (not on a sticky note attached to the router).

help me recover access to my Globe router admin panel

Your network now has strong, unique passwords and modern encryption. Next up, you'll add a second layer of defense with MAC address filtering and switch to a DNS that blocks malware automatically.

Block Unauthorized Access and Switch DNS

Your new passwords and encryption keep casual intruders out. But passwords alone have limits. Someone determined enough could guess a weak one, or a visitor who once had access still knows your credentials.

In this step, you'll add two more layers of protection. MAC address filtering creates an approved-devices-only list so even a correct password isn't enough to join. Switching your DNS to Quad9 blocks malware and phishing sites automatically for every device on your network.

In this step, get ready to:

Enable MAC address filtering in whitelist mode so only your approved devices can connect.
Switch your DNS to Quad9 for network-wide malware blocking.
Disable WPS and Remote Management to close two known vulnerabilities.

Enable MAC address filtering in whitelist mode

A whitelist means "deny everyone by default, allow only the devices I list." Even if someone knows your WiFi password, their device gets rejected unless its MAC address is on your approved list.

In the Globe admin panel at 192.168.254.254, navigate to the Security or Advanced Configuration section in the left sidebar.
Look for MAC Address Filtering (for wired connections) or WLAN MAC Filter (for wireless connections).
Enable the filter and set the filter mode to Whitelist.

Where do I find my devices' MAC addresses?

Your router's connected devices list (the one you checked in Step 1) shows each device's MAC address next to its name or IP. You can also find a device's MAC address in its own network settings.

On Windows, open Command Prompt and run ipconfig /all. Look for the "Physical Address" under your WiFi adapter. On phones, check WiFi settings for "MAC address" or "Hardware address."

Add each of your trusted devices' MAC addresses to the whitelist one by one.
Include your Windows PC, your phone, and any other device you want on the network (smart TV, tablet, etc.).
Click Apply or Save after adding all your devices.

After saving, confirm your PC is still connected to the internet by loading any website. If you can browse normally, your PC's MAC address is correctly whitelisted.

Lost internet after enabling MAC filtering?

This means your PC's MAC address wasn't added to the whitelist correctly. Use the physical reset button on the router (hold for 10 seconds) to restore defaults, then redo the security settings from Step 2. This time, double-check the MAC address character by character before saving.

help me fix MAC address filtering that locked me out of my own router

Is MAC filtering foolproof?

MAC addresses can be spoofed by a technically skilled attacker. Think of MAC filtering as a second lock on your door, not a replacement for the first. Combined with your strong WPA2 password, it stops the vast majority of unauthorized users (like neighbors guessing your old password).

Switch DNS to Quad9

Your router currently uses Globe's default DNS servers. These just translate website names to IP addresses without any filtering. Quad9 does the same translation but also blocks connections to known malware and phishing domains automatically.

In the admin panel, navigate to the WAN or Internet settings section.
Look for DNS settings. On some models this appears under DHCP or LAN settings instead.
Change the Primary DNS to 9.9.9.9.
Change the Secondary DNS to 149.112.112.112.
Click Save or Apply.

Why Quad9 instead of Cloudflare or Google DNS?

Quad9 is run by a Swiss non-profit and blocks known malicious domains by default with no extra configuration. Cloudflare (1.1.1.1) is faster but does not block malware unless you use their separate 1.1.1.2 address. For a home network focused on security, Quad9 is the better fit.

Confirm the DNS values saved correctly by navigating back to the DNS settings page. You should see 9.9.9.9 as Primary and 149.112.112.112 as Secondary.

Disable WPS and Remote Management

WPS (Wi-Fi Protected Setup) has a known vulnerability. Its PIN-based mode has been exploitable since 2011 and lets attackers brute-force their way onto your network. Remote Management lets someone access your router settings from outside your home network. Both should be off.

Navigate to the Wireless or WLAN settings section.
Look for a WPS toggle or section. Set it to Disabled.
Navigate to Administration or System settings.
Look for Remote Management or Remote Access. Make sure it is set to Disabled.
Click Save or Apply to confirm all changes.

Can't find WPS or Remote Management?

The exact menu names vary between Huawei and FiberHome Globe router models. Try checking under Advanced, Security, or Network Application sections. If your model doesn't show a WPS option at all, it may already be disabled by default.

help me find WPS and Remote Management settings on my Globe router

Now it's time to verify that your DNS change is actually working. Before you test, what do you think you'll see when you check which DNS servers your network is using?

Open a new browser tab and go to dnsleaktest.com.
Click Standard test.
Wait for the test to complete. It sends 6 DNS queries and displays which servers answered them.

The results should show Quad9 servers in the list. If you see Globe or your ISP's servers instead, the DNS change hasn't taken effect yet.

DNS leak test still shows Globe/ISP servers?

Your browser may be caching the old DNS. Close all browser tabs, reopen the browser, and try the test again. If it still shows ISP servers, go back to the router DNS settings and confirm the values saved as 9.9.9.9 and 149.112.112.112. Some Globe routers require a reboot for DNS changes to take effect. Try power-cycling the router (unplug for 10 seconds, then plug back in).

help me troubleshoot why my DNS leak test isn't showing Quad9 after I changed the settings

Your network now has multiple layers of defense. Unauthorized devices are blocked at the door by MAC filtering, and every device that IS allowed in gets automatic malware protection through Quad9. Next up, you'll reconfigure your Xiaomi extender to work with these new secure settings and optimize it for second-floor coverage.

Reconfigure and Secure Your Xiaomi Extender

Your Globe router is now locked down with MAC filtering and Quad9 DNS protection.

But there's a casualty. Your Xiaomi WiFi Range Extender is still trying to connect with the old WiFi password, so it's offline right now. This is the perfect time to reset it fresh, reconnect with your new secure credentials, and find the best spot for second-floor coverage.

In this step, get ready to:

Factory reset the Xiaomi extender to clear old credentials.
Pair the extender to your Globe router using the Mi Home app with your new WiFi password.
Test and optimize the extender's placement for maximum second-floor signal.

Factory reset the Xiaomi extender

Since you changed your Globe WiFi password in Step 2, the extender lost its connection. A factory reset wipes the old stored credentials and puts the extender back into pairing mode so you can start fresh.

Locate the reset button on your Xiaomi extender. It's a small pinhole on the side or bottom of the device.
Use a pin or paperclip to press and hold the reset button for at least 5 seconds.
Watch the indicator light. It will turn solid yellow, confirming the reset is happening.
Release the button and wait for the indicator light to start flashing yellow. This means the extender is in pairing mode and ready to connect.

What do the indicator lights mean?

Solid yellow means the extender has been reset to factory defaults. Flashing yellow means it's broadcasting and waiting for a new connection.

Later, solid blue means the extender is successfully connected to your router and working normally.

Indicator light didn't change?

Make sure you held the reset button for a full 5 seconds. A quick press won't trigger the factory reset.

If the extender seems completely dead (no lights at all), check that it's plugged into a working power outlet. Try a different outlet to rule out a power issue.

Why isn't my Xiaomi extender responding to the reset button?

Pair the extender to your Globe router using Mi Home

With the extender in pairing mode (flashing yellow), you'll use the Mi Home app on your phone to connect it to your Globe router with your new secure WiFi credentials.

Open the Mi Home app on your phone.
Tap the + button to add a new device. The app may also auto-detect the extender and show a setup prompt.
Follow the in-app pairing instructions. When prompted, select your Globe WiFi network (the new SSID you set in Step 2).
Enter your new WiFi password when prompted.
Wait for pairing to complete. The extender's indicator light will turn solid blue when the connection is successful.

Why does the extender inherit your router's security?

The Xiaomi extender supports WPA-PSK/WPA2-PSK encryption. It automatically inherits the security mode from the router it connects to.

Since your Globe router now uses WPA2-PSK AES, the extender also operates with that same encryption. You get strong security on both the router and the extender without extra configuration.

Confirm the indicator light on your extender is now solid blue. In the Mi Home app, the extender's status should show Online.

Extender not connecting?

Double check that you entered the new WiFi password exactly as you set it in Step 2. Passwords are case-sensitive.

If the Mi Home app can't find the extender, make sure your phone is connected to the same Globe WiFi network. Also confirm the extender's light is still flashing yellow (pairing mode). If the light went off, try the factory reset again.

If you enabled MAC filtering in whitelist mode in Step 3, you may need to add the extender's MAC address to your whitelist. Check the connected devices list in your Globe admin panel to find it.

Help me troubleshoot my Xiaomi extender pairing issue.

Optimize extender placement for second-floor coverage

A connected extender is only useful if it's in the right spot. Placement determines whether your second floor gets strong signal or barely any at all.

In the Mi Home app, find the signal strength test feature for your extender.
Run the signal test from the extender's current location. Check whether it shows at least 2-3 bars of signal from the Globe router.

Where should the extender go?

The ideal spot is between the Globe router and the dead zone on the second floor. A stairway landing or hallway midpoint usually works best.

The extender needs to receive a strong signal from the router to rebroadcast it. Placing it too far from the router (right in the dead zone) means it has a weak source signal and can only rebroadcast that weak signal.

If the signal test shows fewer than 2-3 bars, unplug the extender and move it closer to the Globe router or to a midpoint like the stairway landing.
Plug it back in, wait for the solid blue indicator, then run the signal test again in the Mi Home app.
Repeat until you get a solid signal reading of at least 2-3 bars from the router.

Before you do the final check, think about this: if you walk to the second floor right now, do you expect strong WiFi signal or a weak one?

Take your phone to the second floor.
Check your WiFi signal bars. You should see strong signal (3+ bars) from your Globe network or the extender's rebroadcast.
Open a browser on your phone and load any website to confirm internet is working on the second floor.

You should have strong WiFi on the second floor. The extender is rebroadcasting your Globe router's secured signal with the same WPA2-PSK AES encryption.

Still getting weak signal on the second floor?

Try moving the extender to a higher position or one outlet closer toward the second floor. Walls and floors absorb signal, so elevation and line-of-sight matter.

Avoid placing the extender behind large metal objects, fish tanks, or thick concrete walls. These block WiFi signal significantly.

How can I improve my WiFi extender's coverage on the second floor?

Your Xiaomi extender is now reset, secured, and optimally placed. Your second floor has strong WiFi coverage with the same encryption as your hardened Globe router. Next up, you'll run a full security audit to confirm every change actually works.

Verify Your Secured Network

Your Xiaomi extender is back online and your Globe router is locked down with strong passwords, encryption, and Quad9 DNS. But how do you know all of this actually works?

Security changes only matter if they hold up under testing. In this step, you will systematically verify every layer of protection you configured: rejected default passwords, active malware-blocking DNS, a clean device list, and strong second-floor coverage.

In this step, get ready to:

Confirm the old default admin password no longer grants access to your router.
Run a DNS leak test proving Quad9 is active network-wide.
Verify only your approved devices are connected and second-floor WiFi is strong.

Test the old admin password and audit connected devices

The most important check comes first: can someone still get into your router settings using the factory default password printed on the sticker?

On your PC, open Chrome or Edge.
In the address bar, type 192.168.254.254 and press Enter.
When the login page appears, enter the OLD default password from your router sticker (for example @l03e1t3 for Huawei or tattoo@home for FiberHome).

Before you hit the login button, ask yourself: do you expect this old password to work, or be rejected?

Click Login.

The login fails. You see an error indicating incorrect credentials. This proves your admin access is secured.

Why does this matter?

Anyone can search "Globe router default password" online and find the factory credentials. If the old password still worked, a neighbour or anyone on your network could access your router settings and undo everything you just configured.

Now log in using your new admin password.
Navigate to the dashboard or connected devices list.
Count the devices shown and confirm you recognize every single one (your PC, your phone, the Xiaomi extender, and any other devices you added to the MAC address filtering whitelist).

See a device you don't recognize?

Check the MAC address against your whitelist. If a device appears that you did not add, it may have connected before your MAC filter took effect. Remove it from the connected list or block it, then reboot the router to force all devices to re-authenticate.

Need help identifying unknown devices? How can I figure out what an unknown device on my network is?

Run a DNS leak test

Your router is set to use Quad9 (9.9.9.9) for DNS. A DNS leak test confirms that your browser actually routes lookups through Quad9 instead of Globe's default servers.

Open a new browser tab.
Type dnsleaktest.com in the address bar and press Enter.
You will see a greeting showing your IP address and approximate location.

Before clicking the test button, think: which DNS servers do you expect to appear in the results? Globe's ISP servers, or Quad9?

Click Standard test.
Wait a few seconds for the test to complete.

The results page displays a list of DNS servers that answered your queries. You should see Quad9 servers (9.9.9.9 or related Quad9 IPs) listed. You should NOT see Globe or your ISP's name.

What does this prove?

Every device on your network now has its DNS lookups filtered through Quad9. Quad9 automatically blocks connections to known malware and phishing domains before they load. This protection is active for every device, from your PC to your phone, without installing any software on each one.

Still seeing Globe or your ISP in the results?

Your browser might be using its own DNS-over-HTTPS setting instead of your router's DNS. Open your browser settings, search for "DNS" or "Secure DNS", and disable the browser's custom DNS option. Then run the test again.

If you still see ISP servers, double-check that your router's Primary DNS is set to 9.9.9.9 and Secondary DNS is 149.112.112.112 in the WAN/Internet settings.

Still not working? Help me troubleshoot why my DNS leak test doesn't show Quad9.

Confirm second-floor coverage and complete the security checklist

The final check is physical. Your Xiaomi extender should be delivering strong WiFi to the second floor through the secured connection.

Pick up your phone and walk to the second floor.
Check your WiFi signal strength indicator. You should see at least 2-3 bars.
Open a browser on your phone and load any website to confirm internet access works.
Open the Mi Home app and check the extender status. It should show Online with good signal strength to the router.

Weak signal on the second floor?

Your extender may be placed too far from the router or too close to the dead zone. Move it to a midpoint (like a stairway landing) where it still gets a strong signal from the Globe router. Use the Mi Home app's signal strength test to find the best spot.

Having placement trouble? Help me find the best placement for my Xiaomi WiFi extender.

Return to your PC and go back to 192.168.254.254 in the browser.
Navigate to the wireless settings and confirm WPS is still set to Disabled.
Navigate to the administration or remote access settings and confirm Remote Management is set to Disabled.

Run through the full security checklist to confirm every layer is active.

Old default admin password is rejected at 192.168.254.254.
DNS leak test shows Quad9 (9.9.9.9), not Globe/ISP.
Connected devices list contains only your known devices.
Second floor WiFi is strong through the extender.
WPS is confirmed disabled.
Remote management is confirmed disabled.

What does a fully verified network mean?

Every item on this checklist confirms a different attack vector is closed. Default passwords block casual break-ins. Quad9 blocks malware domains. MAC filtering blocks unapproved hardware. Disabling WPS closes a brute-force vulnerability that has existed since 2011.

Together, these layers mean your home network is no longer running on factory defaults that anyone can look up online.

Secret mission

Set Up a Guest Network with Client Isolation

Friends or family visit and ask for your WiFi password. You hand it over, but now their devices can see your computers, access shared folders, and even reach your router's admin panel. A guest network with client isolation gives visitors internet access while keeping your personal devices completely invisible to them.

Clean Up Your Resources

This project modified settings on your existing home network equipment. There are no ongoing costs since all changes were made to hardware you already own.

Resources you changed:

Globe router settings (admin password, WiFi passwords, WPA2-AES encryption, MAC address filtering whitelist, DNS changed to Quad9, WPS disabled, remote management disabled).
Xiaomi WiFi extender (factory reset, re-paired with new credentials, placement optimized for second-floor coverage).
Guest network on Globe router (separate SSID and password, client isolation enabled).

Keep everything running

No action needed. This is the intended permanent state for your home network.

Your secured settings (strong passwords, WPA2-AES, MAC filtering, Quad9 DNS) should stay active indefinitely.
If you need to add a new device later, log into 192.168.254.254 with your new admin password, navigate to MAC filtering, and add the new device's MAC address to the whitelist.
Keep your new admin password and WiFi password stored somewhere safe (a password manager is ideal).
The Xiaomi extender will continue working with no maintenance as long as your Globe router stays on.

Pause - I'll come back to this later

If you need to temporarily relax security to troubleshoot connectivity or let a new device connect quickly, follow these steps.

Log into 192.168.254.254 with your new admin password.
To temporarily allow any device to connect, disable MAC address filtering in the Security or WLAN MAC Filter section. Remember to re-enable it once your new device is connected and added to the whitelist.
Do not revert your admin password or WiFi passwords to defaults. Those changes should remain permanent.
Do not re-enable WPS, even temporarily. The vulnerability is always exploitable while WPS is active.

Delete - I don't want to use this again

To restore your Globe router and Xiaomi extender to their original factory state, follow these steps. You will lose all security settings and need to redo everything from scratch.

Globe router factory reset: locate the small reset button on the back of your Globe router. Use a pin or paperclip to press and hold it for 10 seconds. The router will restart with all original factory defaults (default passwords, no MAC filtering, default DNS, WPS re-enabled).
Xiaomi extender factory reset: press and hold the reset button on the extender for at least 5 seconds until the indicator turns solid yellow. The extender will return to its unpaired factory state.
Guest network removal: the guest network is part of the Globe router settings and will be removed automatically by the factory reset above.
After a factory reset, your network will be wide open with default credentials. Anyone who searches for Globe default passwords online can access your router and network.

Factory reset exposes your network

A factory reset removes all the protections you configured in this project. Your WiFi password reverts to the default printed on your router sticker, which is publicly known for most Globe models. Only reset if you plan to immediately reconfigure security settings afterwards.

Nice Work!

You just secured your entire home network from top to bottom. Your Globe Fiber router is locked down, your Xiaomi extender is delivering strong second-floor coverage with matching security, and every device on your network is protected from malware at the DNS level.

You've learned how to:

Hardened a Globe Fiber router with strong unique passwords, WPA2-PSK AES encryption, disabled WPS, and MAC address filtering in whitelist mode so only your approved devices can connect.
Switched your network's DNS to Quad9 (9.9.9.9) for automatic malware and phishing protection on every connected device, and verified it with a DNS leak test.
Reset and reconfigured your Xiaomi WiFi extender with new secure credentials and optimized its placement for strong second-floor coverage using the Mi Home app.
Secret Mission: Created an isolated guest network with client isolation so visitors get internet access without being able to see or reach your personal devices.

Ready to quiz yourself?