Networking and router hardening expert providing live chat help

Joe B.

Reviewed for technical accuracy

Specialities: Windows 11/10, macOS, Routers & Firewalls (Asuswrt‑Merlin, OpenWrt, UniFi, MikroTik, TP‑Link, Netgear), DNS/Pi‑hole, Security Hardening

Disable automatic router firmware updates safely — keep security feeds/IPS rules (Asus, TP‑Link, Netgear, UniFi, MikroTik, Synology, DrayTek)

Technician avatar Technician
Hey! We can block auto‑firmware updates on your home/office router while keeping security updates like IPS/IDS signatures, malware domain lists, and threat‑intel feeds. Tell me the brand/model (e.g., Asuswrt‑Merlin, OpenWrt, UniFi, MikroTik RouterOS, TP‑Link, Netgear, Synology SRM, DrayTek) and whether you have a Pi‑hole/AdGuard Home or any DNS sinkhole in place.
Customer
Asus router (RT‑AX series) with AiProtection. After a reboot it did a forced firmware auto‑update that broke my VPN settings. I want to stop automatic firmware updates but still get security database updates from Trend Micro.
Technician avatar Technician
Got it. Many vendors separate two channels: firmware OTA (full image) and security feeds (reputation lists, malware/parental control categories, IPS rules). The trick is to block the firmware check/upgrade endpoints while allowlisting security signature CDN domains. We can do this via router firewall rules, DNS overrides (Pi‑hole), or host‑level rules on a gateway machine. You’ll still perform manual firmware updates during a maintenance window after you back up settings.
Customer
Where exactly do I turn off auto‑update on Asus? And what domains do I block vs allow?
Technician avatar Technician
Asuswrt / Asuswrt‑Merlin — stop firmware OTA but keep AiProtection:
1) In the web UI: Administration → Firmware Upgrade → set Auto firmware update = Off. Also disable Check for updates on boot if present.
2) Create DNS/Firewall blocks for common firmware update hosts (examples vendors use: *.asus.com OTA paths or specific update endpoints; we’ll identify your model’s exact FQDNs from logs).
3) Allowlist security feeds used by AiProtection/Trend Micro so malicious site blocking and intrusion prevention still refresh daily.
4) Optional: on Merlin, use dnsmasq addn-hosts or ipset + iptables/nftables to block firmware CDNs while permitting security signature CDNs.
5) Manual update policy: quarterly or when a critical CVE drops — download the image, verify checksum/signature, back up config, then flash.
Customer
I also have a UniFi gateway at work. Can we block controller firmware auto‑updates but keep IDS/IPS rules current?
Technician avatar Technician
UniFi (UDM/UXG/USG): set Automatic updates to Off for Network Application and Device Firmware. Keep Threat Management enabled with IDS/IPS signatures set to Auto or a scheduled refresh. If you want a belt‑and‑suspenders approach, add DNS blocks for the firmware metadata endpoints while allowlisting the signature feed CDN. You’ll still approve device firmware manually inside the controller. This maintains CVE protection coverage without surprise reboots.
Customer
No Pi‑hole yet. Can I do this with host rules on my Windows server that acts as the DNS forwarder?
Technician avatar Technician
Yes — host‑level blocks work well if your Windows server is the resolver.
• Use DNS Policies (Windows Server), or deploy AdGuard Home/Pi‑hole on the server/VM.
• Create a blocklist for vendor firmware update domains and allowlist entries for security definition feeds (IPS/URL‑filtering).
• For fallback, add an egress firewall rule on the server/router to deny firmware CDN IPs while permitting security services and NTP.
• Log requests to confirm you’re hitting the blocked firmware check endpoints while security signatures continue to refresh.
Customer
What about OpenWrt and MikroTik? I want manual firmware only, but regular package/security updates.
Technician avatar Technician
OpenWrt: disable attended sysupgrade auto tasks; leave opkg feeds enabled for package/security updates. Use uci or LuCI to schedule signature list refresh for adblock/banIP or Suricata IPS while you perform manual firmware sysupgrade quarterly.
MikroTik RouterOS: set Auto Upgrade to None; keep Threat Feed/Cloud lists or Address‑list updates via scheduled scripts. Approve long‑term or stable firmware manually after backups.
Customer
Do you have a safe domain list to block vs allow? I don’t want to kill parental controls or malware blocking.
Technician avatar Technician
Domain strategy: rather than a random “mega list,” we observe your router’s logs for 24–48 hours, then:
• Block the vendor’s firmware metadata, OTA manifest, and image CDN FQDNs (per model).
• Allow security signature and reputation list CDNs (AiProtection/Trend Micro, UniFi signatures, etc.), time sync (NTP), and DNS over TLS/HTTPS if configured.
• Keep parental control/URL filtering endpoints allowlisted so categories update.
We’ll test by forcing an update check: firmware fetch fails (expected) while security DB refresh succeeds.
Customer
How do I handle critical CVEs? I don’t want to be stuck on a vulnerable build forever.
Technician avatar Technician
Manual update policy that keeps you safe:
1) Subscribe to vendor advisories or a CVE/NIST feed for your model.
2) Maintain quarterly maintenance windows (or faster if a critical CVSS > 8 advisory appears).
3) Before flashing: back up config, export VLAN/VPN settings, download firmware, verify checksum/signature.
4) After upgrade: verify WPA3/WPA2‑AES, Admin password/2FA, VPN settings, and re‑apply any custom firewall/DNS rules.
This approach avoids surprise reboots yet keeps your attack surface low.
Customer
Can you summarize the steps for blocking auto firmware updates with Pi‑hole while allowing security feeds?
Technician avatar Technician
Pi‑hole / AdGuard Home recipe:
• Point the router’s DNS to Pi‑hole.
• Create a local deny list for the router’s firmware OTA domains (observed in logs).
• Add an allowlist for security/threat DB FQDNs.
• Enable query logging; trigger a manual firmware check and a security DB refresh from the router UI to validate the policy.
• Optionally, pair with a firewall egress rule that blocks firmware CDN IP ranges while permitting signature CDN and NTP.
Customer
Perfect. Let’s implement this without breaking Wi‑Fi or VPN.
Technician avatar Technician
Summary: Use router/host rules to block automatic firmware updates while keeping security — allow IDS/IPS signatures, malware domain feeds, and parental control categories. Vendors: Asus/Asuswrt‑Merlin, UniFi, OpenWrt, MikroTik, TP‑Link, Netgear, Synology, DrayTek. Add DNS blocks + firewall egress filters, disable Auto update in UI, and run a manual firmware update policy for CVEs. Need help? Open the chat.

Quick answer: the accepted fix

Accepted fix to block router auto‑firmware updates while keeping security features: turn Auto update = Off in the router UI; create DNS/host blocks for firmware OTA endpoints; allowlist security definition/signature CDNs; and schedule manual firmware updates during maintenance windows after backups and checksum verification.

Auto‑update disabled but security intact — what changes under the hood?

Firmware OTA checks call vendor manifest and image servers. Blocking those FQDNs (or egress IPs) prevents forced upgrades and surprise reboots. Security feeds (IDS/IPS signatures, malicious domain lists, parental control categories) use different CDNs; we allowlist them so protection continues. If you see failed reputation updates, you likely blocked a shared CDN host — loosen just that entry.

How to verify you blocked firmware but kept security updates

Open router logs and force an update check. You should see firmware manifest/image blocked by DNS or firewall, while security DB/IDS signatures show a successful refresh. Test browsing to a known phishing test domain to ensure malicious site blocking still works. For UniFi/Asus, the UI will still show new firmware available without auto‑installing it.

Router hardening — practical checklist

Prevent unwanted upgrades while keeping protections current.

Quick path: disable Automatic firmware updates → add DNS/host blocks for OTA → allow security feeds (IDS/IPS, malware/URL filtering, parental controls) → schedule manual update policy for critical CVEs → back up and verify after each upgrade. Where possible, use WPA3, disable UPnP, enforce strong admin passwords & 2FA, and restrict remote administration to a VPN.

Disclaimer: This information is AI-generated and intended for general guidance only. For advice specific to your environment, please consult a verified expert on Whizz-Tech before making decisions.

Getting Started Is Easy

Ask for help, 24/7

Members enjoy round-the-clock access to 12,000+ verified Experts, including network engineers and security specialists.

Expert will respond in minutes

We match you with an Expert who specializes in your router platform — Asus, UniFi, OpenWrt, MikroTik, TP‑Link, Netgear, and more.

Save time & money

Avoid downtime and broken VPNs. We’ll harden your network without disruptive auto‑updates.

FAQ

Is it safe to disable automatic firmware updates on a router?

Yes — if you keep security feeds (IPS/IDS signatures, malicious domain lists) updating and follow a manual firmware policy for critical CVEs. We block OTA endpoints but allow security CDNs.

How do I block firmware updates but keep AiProtection/IDS signatures?

Disable Auto update in the UI, then use DNS/host rules to block firmware manifest/image domains and allowlist security signature endpoints. Verify by forcing an update check and reviewing logs.

Will blocking firmware updates break parental controls or malware blocking?

Not if you allowlist the security/reputation CDNs the feature uses. We test category refresh after applying rules.

What platforms does this work on?

Asus/Asuswrt‑Merlin, UniFi, OpenWrt, MikroTik RouterOS, TP‑Link, Netgear, Synology SRM, DrayTek, and most gateways that expose logs/DNS settings. Host‑level rules via Pi‑hole/AdGuard Home or Windows DNS also work.

How often should I do a manual firmware update?

Quarterly is typical, or immediately for critical CVEs. Always back up, verify checksums, and schedule a maintenance window.

Common issues and quick fixes when disabling auto updates
SymptomLikely causeQuick fix
Router still updates overnight Hidden OTA endpoint not blocked; auto‑update toggle still on Turn Auto update = Off; add DNS/firewall blocks for firmware manifest/CDN FQDNs
Security database stops updating Allowlist missing for threat‑intel CDN Add allowlist entries; test IDS/URL filtering refresh
VPN or Wi‑Fi breaks after manual flash Settings not backed up; incompatible defaults Back up config; verify WPA2/WPA3, VPN profiles; restore and retest
UniFi keeps prompting to upgrade Controller policy allows auto approve Disable Automatic updates; require manual approval per device

Step‑by‑step (DNS/host + firewall rules)

  1. Disable Automatic firmware updates in the router UI and stop check on boot.
  2. Enable logging. Attempt a manual firmware check to capture firmware endpoints.
  3. On Pi‑hole/AdGuard/Windows DNS, add deny rules for those FQDNs; on the router/firewall, add an egress block for their IP ranges.
  4. Allowlist security definition and IDS/IPS CDNs; verify updates still succeed.
  5. Set a manual firmware policy: quarterly or on critical CVE; verify checksum and back up configs before flashing.

Step‑by‑step (OpenWrt / UniFi / Asus examples)

  1. OpenWrt: disable attended‑sysupgrade tasks; keep opkg update for packages; schedule adblock/Suricata signature refresh.
  2. UniFi: Settings → Updates → toggle off automatic firmware; keep Threat Management signatures on Auto; approve device updates manually.
  3. Asus/Asuswrt‑Merlin: Admin → Firmware → disable Auto; add dnsmasq overrides or iptables/nft blocks for OTA hosts; keep AiProtection feeds allowed.

Sources

Matt Verified Icon
Matt ● replies in < 1 min
Technician Expert
⭐⭐⭐⭐⭐ Trusted by 27,000+ customers
Avatar
Alex · Expert's Assistant
5 Tech Support Specialists are online right now.