The US Federal Communications Commission has banned new foreign-made consumer internet routers. In an update to its Covered List on Monday 23 March 2026, the FCC added all consumer-grade routers produced outside the United States to the register of equipment it considers not secure enough to use, putting them alongside foreign-made drones, which were banned at the end of last year.
It is a serious piece of policy and it is worth understanding properly. It is also, from where most people sit, close to irrelevant to their actual risk.
Because here is what the ban does not do. It does not touch the router already plugged in behind your TV. It does not touch the one your internet provider shipped you three years ago and has not updated since. It does not apply in Australia at all. And it does nothing about the thing that has changed most in the last eighteen months, which is how cheap it has become to attack a home network at scale.
I have run my own firewall at home for close to twenty years. Not because I predicted this, but because the reasoning has been the same the whole time and it has only got stronger.
What the FCC actually did
The specifics matter, because most of the coverage has blurred them.
The scope is new equipment, not existing equipment. Any router produced outside the US now requires FCC approval before it can be imported, marketed or sold. Devices already authorised can continue to be sold and imported, and anything already in people’s homes is untouched. Nobody has to throw out a router.
“Produced” is defined broadly. It covers manufacturing, assembly, design and development. That is why the ban reaches well past the Chinese brands it was aimed at. Netgear is a US company that builds everything offshore. So do Eero, Google, Linksys, Asus, D-Link, Zyxel and most of the market. The near-total exception is the newer Starlink router, which is assembled in the US.
There is an approval path, and it has teeth. A manufacturer producing outside the US can apply for conditional approval, but the application requires disclosure of foreign investors and influence, plus a plan to move router manufacturing to the United States. The Department of Defense and the Department of Homeland Security can also exempt specific devices. At the time of the announcement neither had listed any.
The stated basis is three named campaigns. The FCC pointed to a national security determination issued three days earlier, and to the intrusion campaigns tracked as Volt, Flax and Salt Typhoon, which targeted US infrastructure and telecommunications between 2024 and 2025 and which US government investigations attributed to actors working within or on behalf of the Chinese state. Those campaigns are not theoretical. CISA’s advisory on Volt Typhoon documents state-sponsored actors establishing persistent access inside critical infrastructure, and a meaningful share of that access ran through small office and home office routers used as relay infrastructure precisely because nobody was watching them.
Why routers, specifically
This is the part worth sitting with, because it explains why a home network is a legitimate target rather than an unlucky one.
Forescout’s 2026 Riskiest Connected Devices report moved routers from fifth place to first across IT environments, and marked the point where network infrastructure overtook endpoints as the highest-risk category overall. Routers and switches now average close to 32 known vulnerabilities per device. Routers alone account for roughly a third of the most critical ones.
Put that next to how a consumer router is actually operated:
- It is internet-facing by definition, twenty-four hours a day.
- It receives firmware updates for a few years at best, then none, while remaining in service for a decade.
- Somewhere between 30% and 40% of routers and connected devices have never had their factory credentials changed.
- Nobody logs it. Nobody monitors it. Most people have never opened its admin page after the day it was installed.
A device with that profile is not a weak link in the chain. It is the chain.
And the honest counterpoint deserves airtime, because it is the strongest criticism of the FCC’s approach. Jason Pearce of Claroty put it well when the ban landed: a router is secure because of its architecture, its software-maintenance discipline and its support lifecycle, not because of the passport of the factory that built it. A badly maintained router assembled in Ohio is still a badly maintained router. Country of origin is a proxy for supply chain control, and a fairly crude one.
Which is the real point. The FCC has addressed a supply chain risk. Your exposure is a maintenance and architecture risk. They are related, but fixing the first does not fix the second.
The Australian position
None of this is law here, and it is worth being clear about what is.
Australia manufactures no consumer routers. The market runs entirely on imported hardware, and the majority of households take whatever their internet provider ships them, configured however the provider configured it. The Australian Signals Directorate has kept an advisory rather than regulatory stance on vendor choice, treating it as a risk-based decision for individuals and organisations. As the Australian Computer Society’s coverage noted, there is no Australian equivalent of the Covered List.
What we do have is the Cyber Security (Security Standards for Smart Devices) Rules 2025, in force since 4 March 2026 under the Cyber Security Act 2024. Consumer smart devices manufactured from that date, routers included, must meet baseline requirements: no universal or predictable default passwords, a free and accessible vulnerability reporting channel, and a declared security update support period that cannot be quietly shortened. Every in-scope device needs a statement of compliance.
That is genuinely good regulation and it will improve the floor over time. It also only applies to devices made from March 2026 onward. The median Australian home router was manufactured years before that, and the standard has nothing to say about it.
So the practical Australian position is this: no import restrictions, a new baseline that applies only to new hardware, an installed base that predates it, and a population largely running provider defaults. The gap is yours to close.
What AI changed
I want to be precise here, because “AI makes hacking easier” is usually said in a way that means nothing.
The specific change is economic. Attacking a home network used to require a human to find the target, identify the firmware, locate a working exploit and adapt it. That labour cost is what kept ordinary households out of scope. There was no money in it.
That cost has collapsed. Automated tooling can now scan a device, fingerprint the firmware version, test a set of candidate exploits and deploy whichever one lands, inside a minute, without a person in the loop. Language models are being used to analyse firmware binaries, identify likely flaws and generate working exploit code. Reporting through 2026 has tracked a sharp rise in automated attacks against connected devices, with botnets iterating their own strategies faster than manual defence can respond.
The consequence is not that attacks got cleverer. It is that they got cheap enough to run against everyone. Mass exploitation of home networks was previously uneconomic. It is now a background process.
That maps directly onto the same shift I have written about on the enterprise side, where the Five Eyes joint statement on AI security makes the same argument about capability diffusion, and where AI agent security controls come down to limiting blast radius rather than preventing compromise. The home version of that principle is identical. Assume something on your network will be compromised. Decide in advance what it can reach.
Why I say home, and not office
Someone will ask why this is framed around home networks. It is deliberate.
Office networks are, broadly, a solved problem. Not perfectly solved, but the structure exists. There is a next-generation firewall. There is segmentation. There is a patching cycle, an asset register, logging, someone whose job includes noticing. When it goes wrong it goes wrong at the level of policy or process, not because nobody thought about it.
Home networks have none of that, and they now carry work. Since 2020 a very large amount of corporate access lives on residential connections. The laptop with the VPN client sits on the same flat network as a smart TV running abandoned firmware, a doorbell camera from a brand that no longer exists, a games console, a printer that has been broadcasting an open management page since 2019, and a NAS with every family document on it.
The average household now runs upwards of twenty connected devices, with essentially nothing protecting them beyond a provider-configured router. That is the actual attack surface. Not the router the FCC just banned from the US market.
What I run, and why
My setup has been the same in principle for close to twenty years, which is the best argument for it.
The provider router does one job: it brings the internet into the building. Nothing trusts it. Where the hardware allows it, it runs in bridge or modem-only mode so it is not routing, not doing DHCP, and not running a Wi-Fi network anybody uses. If it cannot be bridged, everything behind it sits on its own segment and the provider router is treated as hostile infrastructure that happens to be in my hallway.
Behind it sits a firewall I control. For most of that period it has been an ordinary PC turned into an enterprise-grade firewall. Not exotic hardware. An old desktop with a decent network card does the job, and a small fanless appliance does it silently. What makes it enterprise-grade is not the box, it is the software and the ruleset.
It blocks thousands of attacks a day, and I can see every one of them. That visibility is the point. Most people have no idea what arrives at their connection because nothing is recording it. Once you have a log, the abstract argument about home network security becomes a concrete number that goes up every day.
I block entire countries, in both directions. Inbound GeoIP blocking is common enough. The half people skip is outbound. If nothing in my house has any legitimate reason to talk to a given region, then nothing does, and a compromised device on my network cannot reach its command infrastructure or exfiltrate anything to it. Ingress filtering limits who can knock. Egress filtering is what limits the damage when something inside has already been compromised, which is the scenario you should actually be planning for.
Segmentation, not one flat network. Separate VLANs for trusted computers, for IoT and smart-home devices, for guests, and for work. The IoT segment can reach the internet on the ports it needs and cannot reach anything else. When the cheap camera falls over, it falls over alone.
Intrusion detection, DNS filtering, and updates that actually happen. Suricata inline on the WAN, DNS-level blocking of known-bad domains, and a firewall that gets patched because it is a real operating system with a real update path rather than an appliance the vendor abandoned in 2021.
None of this is exotic. All of it is standard practice in any competently run office. The only unusual thing is doing it at home.
Where to start, honestly
Not everyone is going to build a firewall this weekend. So, in order of return on effort.
Thirty minutes, no new hardware. Change the router admin password to something unique. Check for a firmware update and find out when the vendor’s support period ends, because if it has already ended, that device is a liability with a countdown on it. Turn off WPS, UPnP and any remote management or cloud administration feature. Turn off port forwarding you no longer use. Put every guest and every smart device on the guest Wi-Fi network, which is a crude segment but far better than none.
A weekend, modest hardware. Buy or repurpose a small x86 box with two network interfaces. Install pfSense or OPNsense. Put the provider router into bridge mode. Build the ruleset in this order: default deny inbound, explicit allow outbound, then VLANs for IoT, guest, work and trusted, then GeoIP blocking in both directions, then Suricata, then logging with alerts you will actually read. Add a VPN server on the firewall so remote access into your own network never requires an exposed port.
Ongoing, the part people skip. Read the logs weekly for the first month. Not forever, just long enough to learn what normal looks like on your own connection. Everything after that is exception handling.
If you are running a small business out of a home office, treat all of the above as a floor rather than a ceiling, because the compliance obligations that come with holding customer data do not care that the network happens to be residential.
pfSense or OPNsense
The question I get most, so: either. They share ancestry, they do the same job, and both are free.
pfSense has the larger installed base, which means more community documentation and more third-party guides when you hit something odd. OPNsense forked from it, ships a faster release cadence, has a cleaner interface and a more predictable update model.
I teach both, because the choice genuinely is preference. What is not preference is running one of them properly: a ruleset you can explain, segmentation that reflects how you actually use the network, IDS that is tuned rather than screaming, and logs you look at.
The thing to take from this
A regulator in another country decided that the origin of your router is a national security matter. That is a real signal about how seriously edge hardware is now taken, and it is worth registering.
But read what it implies rather than what it says. Routers are considered dangerous enough to warrant an import ban. The ban covers new devices only. Australia has no equivalent. Your device predates the standard that would have improved it. Attacks against home networks have become cheap enough to run indiscriminately. And the only party in a position to do anything about your specific network is you.
The office solved this years ago with a firewall, segmentation and logs. There is no technical reason the same three things cannot sit in your house. There never was. The barrier was that nobody thought a home network was worth defending.
That assumption expired.
Further reading: The Five Eyes joint statement on AI security, AI agent security: the six controls that actually matter, How to spot AI deepfake scams in Australia, Australia’s Scams Prevention Framework, an operator’s guide. Sources: BBC News, FCC Covered List FAQs, Forescout Research, CISA, Department of Home Affairs.