Every router is different. The names below are the common ones — the setting on yours may be called something slightly different, but it exists.
Point DNS at Heron
The single most useful change. Log into your router, find the DNS setting — sometimes called "Static DNS," "DNS Server," or "Primary DNS" — and set it to Heron's local address. After you save, every device that obeys DHCP will start sending its lookups through Heron. This is what makes the log complete.
Disable UPnP
Universal Plug and Play lets devices on your network open ports to the outside without asking. It is convenient and it is a hole. Devices that phone home love UPnP because it lets them punch out in ways you did not configure. Turn it off. Anything that genuinely needs an inbound port can be configured manually.
Change the admin password
The default admin credentials for most consumer routers are public. If your router is reachable on the LAN with a password that is printed on a sticker, anyone on your Wi-Fi owns your network. Change it to something only you know. This has nothing to do with DNS, and everything to do with the gate.
Use WPA3 if available
WPA3 is the current standard. If your router and devices support it, use it. If they do not, WPA2 with a long, unique passphrase is still acceptable. Avoid WEP and anything called "WPA2 Mixed" if you can — the mixed mode downgrades to the weakest device on the network.
Split the guest network
If your router has a guest network, use it for devices you do not trust — smart TVs, cheap IoT sensors, anything that feels chatty. Guest networks isolate those devices from the rest of your LAN. They still reach the internet through the router, so they still appear in the DNS log if you point the guest network at Heron too.
Hardening is not one big change. It is five small ones that compound. Start with DNS — the rest is upkeep.
Keep the firmware updated
Router vulnerabilities are found regularly and rarely patched by the vendor. If your router offers automatic updates, turn them on. If it does not, check for updates a few times a year. A router running a three-year-old firmware is the most common way a "secure" home network stops being one.