Advanced Router Settings for a Small Business

Once the basics are in place – a network name, a strong password, the firmware up to date – a small business usually runs into a handful of settings that the home-user guide never needed. Reaching a server from outside, keeping a printer at the same address, prioritising a video call over a backup upload: each is a specific setting with a specific purpose, and each carries a trade-off worth understanding before you turn it on. This is a practical tour of the advanced settings a small office actually uses, what each one does, when you need it, and how to change it without locking yourself out or opening a door you did not mean to. It picks up where how to set up your router from your phone leaves off, and assumes a router you own.

Port forwarding

By default a router blocks connections that start from the internet, which is exactly what you want – it means nothing outside can reach the devices inside. Port forwarding deliberately opens one specific door: it maps an external port to a particular internal device and port, so that, say, a connection to your public address on a chosen port is handed to a server inside. You use it to reach something from outside: a server, a camera recorder, a remote-access service. The caution is the whole point. Every forward is an opening, so forward only what you genuinely need, send it to a fixed internal address, and verify afterwards from the internet side that only the intended port is reachable – a scan of your own public address confirms this, as covered in how to read a port scan of your own devices. Where you would otherwise forward several ports for remote access, a VPN into the network is usually the safer choice, exposing one well-guarded entry instead of many.

Fixed internal addresses

Anything you forward to, or rely on at a steady location – a server, a printer, a recorder – needs an address that does not change. Left to itself, the router hands out addresses dynamically and a device may get a different one after a reboot, which quietly breaks a forward or a saved connection. The clean fix is a DHCP reservation: you tell the router to always give a particular device the same address, keyed to its hardware address (MAC). It is better than configuring a fixed address by hand on the device, because the router stays the single source of truth and there are no clashes. Note that phones and laptops using randomized MAC addresses complicate reservations; servers and fixed equipment use their real address, so they reserve cleanly.

Dynamic DNS

Most consumer and many business-grade internet connections get a public address that can change without warning. That is a problem the moment you depend on reaching your network from outside, because the address you forwarded to yesterday may be someone else’s today. Dynamic DNS (DDNS) solves it: a small client – on the router or a device inside – tells a DDNS provider whenever the public address changes, and keeps a fixed hostname pointed at it. You then reach the network by name instead of by an address you would otherwise have to look up constantly. It is what makes port forwarding and remote access practical on a connection without a static address.

Static routes

Most small networks never need a static route, and it is worth knowing why before you add one. A router already knows how to reach the networks directly attached to it and how to send everything else toward the internet. A static route is an explicit instruction for a case it cannot infer on its own: traffic for a particular network must be sent via a particular gateway – for example, a second subnet behind another router, or a separate segment reached through a specific device. If you have segmented your network, this is where the segments are taught how to reach one another deliberately; the broader picture is in network segmentation with guest and IoT VLANs. If you have a single flat network, you almost certainly do not need to touch this.

Quality of Service (QoS)

When one big upload can make a video call stutter, the cause is usually contention: everything shares the same connection, and a bulk transfer happily consumes all of it. Quality of Service lets the router prioritise some traffic over the rest, so that latency-sensitive things – calls, video, anything real-time – get served ahead of a backup or a large download that will not notice a brief wait. This matters because real-time media cannot recover a late packet, so protecting its timing is what keeps a call clear; the reasoning is in TCP vs UDP. Keep the rules simple: prioritise the few things that genuinely suffer under load, rather than trying to rank everything.

Firewall rules

The router’s firewall is what enforces “blocked by default, allowed by exception”. The inbound default should stay deny – nothing from outside reaches in unless a forward or rule explicitly permits it. On a segmented network the same discipline applies between segments: allow only the traffic that genuinely needs to cross, and deny the rest, so a guest or device segment cannot freely reach the trusted one. Each rule you add is something to account for later, so keep the set small and write down why each one exists.

Change it safely

Advanced settings are also the ones that can lock you out or quietly expose something, so the method matters as much as the setting:

• Change one thing at a time and test it before the next, so a problem has an obvious cause.
• Write down what you changed and why – the rule whose purpose nobody remembers is the one that becomes a risk.
• Keep firmware current; these features and their security fixes arrive in updates.
• Verify exposure from the outside. After any forward, scan your own public address to confirm only the intended port answers and nothing else slipped open.

Where the app fits

The settings themselves live in the router’s own admin interface, not in a phone app – but a phone is useful for getting there and for checking your work. The Router Setup tool in IP Tools (Android) or WiFi Tools (iOS) helps you find the router’s address and open its admin page, and IP Info shows your gateway and public address, which you need when setting up forwarding or DDNS. After you make a change, the Port Scanner lets you confirm from outside that only the ports you intended are reachable. Reading the router’s address is covered on the Router Setup help page, and your current addresses on the IP Info help page.

FAQ

What is port forwarding used for?
It opens a specific external port and directs connections to a chosen internal device, so you can reach something inside the network from the internet – a server, a recorder, a remote-access service. Forward only what you need and verify afterwards that nothing else is exposed.

Why do I need dynamic DNS?
Because most connections have a public address that changes. Dynamic DNS keeps a fixed hostname pointed at your current address, so remote access and port forwarding keep working without you tracking the address by hand.

Do I need static routes on a small network?
Usually not. A single flat network does not need them. You add a static route only when traffic for a particular network must go via a specific gateway, such as a second subnet or a separate segment behind another device.

What does QoS actually do?
It tells the router to prioritise latency-sensitive traffic – calls and video – over bulk transfers, so a large upload or download does not make a real-time call stutter. Keep the rules to the few things that genuinely suffer under load.