The Router Your ISP Gave You Is Lying

I caught my lightbulb talking to Shenzhen at 3:12 AM. So I built a $20 SOC that fits in my palm.

Photo by Jonathan on Unsplash

Your network is compromised and your router is designed to not tell you.

I didn’t notice it for months. Cheap Tuya bulb from Amazon. Smart TV that I never actually made smart. Kid’s tablet with a modded game. All of them on the same flat network that my ISP router calls “secure” because it has a password from 2019 printed on the bottom.

Then I put a tap in front of it.

Not a fancy enterprise tap. A $26 yellow box from Amazon called a GL.iNet Mango. OpenWrt inside, two ethernet ports, and just enough compute to be rude. I flashed it, put it between the modem and everything else, and told it to log DNS.

Within 12 minutes:

The bulb pinged a3.tuyaeu.com and 47.XXX.XXX in Shenzhen every 30 seconds

• The TV hit doubleclick and a telemetry endpoint 400 times an hour even while “off”

• A photo editing app on my phone tried to upload 1.2GB of camera roll in the background after I denied it cloud access

Your router sees this. It just doesn’t show you. Because showing you would mean you would ask questions, and ISP routers don’t answer questions. They serve ads for their own security upsell.

That was the problem that had to survive contact with reality. So I documented the fix.

The $20 SOC: What It Actually Is

This isn’t a Pi-hole tutorial. This is a defensive listening post.

The build is simple because resilient things are simple. GL.iNet GL-MT300N-V2, 16MB flash, 128MB RAM, USB stick for logs. You flash OpenWrt clean, you don’t use the vendor skin, and you turn it into three things at once:

1. A DNS sinkhole that kills ads, trackers, and C2 at the lookup

2. A lightweight IDS that watches for what your devices are actually doing

3. A packet archive that keeps receipts when vendors lie

You can grab the starter kit and test the logic before you commit. The free lite version lives here: 20-soc-lite on GitHub — it has the base configs, the install scripts, and the exact firewall rules I run.

The full manual is the field version: part list, flash sequence, failure modes, and the configs that don’t break when your power blips. If you want the build that you can deploy tonight without spending a weekend swearing at luci, that’s in the tiny SOC manual.

What You See When You Finally Look

Once you have it inline, you don’t need threat intel feeds. Your own house is threat intel.

My first week logs:

• Tuesday 02:47: Smart plug tries to resolve mqtt.iotc.eu 14,000 times. It’s retrying with no backoff. That’s a cheap SDK bug that becomes a DDoS on your own network.
• Wednesday 19:12: Guest’s Android tries play.googleapis.com but also data.flurry.com and a known adware domain from a sideloaded APK. Blocked at DNS, device still works.
• Friday 03:12: The bulb. Every 30 seconds. For no reason.

This is why the normal advice fails. People tell you to “check your privacy settings.” There is no privacy setting for a lightbulb that ships with hardcoded DNS. There is only a network that enforces policy at the edge.

When you own the edge, you stop negotiating with firmware.

Build Log: From Yellow Box to Watchtower

Hardware:

• GL.iNet GL-MT300N-V2 (Mango) ∼$20–26 on sale

Get Aeon Flex, Elriel Assoc. 2133 [NEON MAXIMA]’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

• 32GB+ USB 3.0 stick, cheap, for logs

• 1 short ethernet cable

• Laptop for flashing

Software stack I run in production:

• OpenWrt 23.05 clean

• AdGuard Home (not Pi-hole, lower RAM jitter on this box)

• banIP for feed blocking

• tcpdump + logrotate to USB, not to RAM

• A 3-line cron that yells if a new MAC shows up

No cloud. No account. No subscription to “protect your network.” It draws 1.8W. Less than a nightlight.

Here is the exact block I use to catch new devices and rogue DNS bypass attempts. This is from the full defensive monitor field guide:

# /etc/config/firewall - force all DNS to AdGuard, log new clients
# Drop port 53 escape attempts, redirect DoT/DoH, alert on unknown MAC

iptables -I FORWARD -p udp --dport 53 ! -d 192.168.8.1 -j LOG --log-prefix "DNS_ESCAPE: "
iptables -I FORWARD -p udp --dport 53 ! -d 192.168.8.1 -j DNAT --to 192.168.8.1
iptables -I FORWARD -p tcp --dport 853 -j LOG --log-prefix "DOT_BLOCK: "
iptables -I FORWARD -p tcp --dport 853 -j REJECT
iptables -I FORWARD -p tcp --dport 443 -m string --string "dns-query" --algo bm -j LOG --log-prefix "DOH_TRY: "

# watch for new MACs - dump to USB
arp | awk '{print $4}' | sort -u > /mnt/usb/known_macs.txt
# cron: */5 * * * * /bin/sh /root/check_new_mac.sh

It’s ugly. It works. When a device tries to hardcode 8.8.8.8 to get around your sinkhole, you log it and you redirect it. When your TV tries DoH to hide telemetry, you see it.

That is the difference between a security blog post and a security system. One tells you to be afraid. The other gives you receipts.

Why This Survives the AI Bubble

Everyone is building agents that can write phishing emails in 12 languages. Nobody is building $20 boxes that catch them when they phone home.

We automated offense and forgot to automate defense for normal people.

A Mango with a USB stick will not get a funding round. It will not get you a LinkedIn Thought Leader badge. It will do something better: it will keep working when OpenAI is down, when your ISP’s “Advanced Security” upsell expires, and when the next zero-day in a cheap camera turns your living room into a botnet node.

This is defensive computing. It’s the skill that was valuable before ChatGPT and will be valuable after whatever comes next. Learn to build the watchtower, not just the city.

I took the same box camping last month. No power brick, just a 10k battery. It ran for 14 hours, sinkholing the entire campsite’s traffic off a phone tether, logging everything to the stick. No cloud dashboard needed.

Builders own. Tenants get eviction notices disguised as Terms of Service updates.

The Field Archive Version

If you want to tinker, start with the lite repo. If you want the version that has survived 3 ISPs, 2 apartment moves, and one very angry smart fridge that tried to mine crypto, grab the full build.

The complete manual has:

• AdGuard Home low-RAM tuning that doesn’t OOM every 6 hours

•light rules for IoT, not for enterprise networks

• USB log archiving that doesn’t corrupt on power loss

• Panic purge: one command to wipe logs and revert to dumb passthrough if you need to

It’s documented like a field archive, not a Medium slideshow. Every step was a problem that had to survive contact with reality.

You can get it here: The $20 SOC manual

No fluff. No “in this article we will explore.” Just a yellow box, a USB stick, and a network that finally tells the truth.

less cloud. less noise. more ownership.

The $20 SOC: Build a Tiny Defensive Network Monitor