I put all devices on the DMZ and brace for attack. It’s the only way I can really be sure my network is battle-ready.

Seriously though, I just rely on the firewall in my ISP’s modem, and I try to open as few ports as possible.

I really should get some sort of Tailscale/VPN-esque solution working though…

This is what I do too (tho I do not use ISP modems). I also limit the upload speeds for my Mac - so if the machine does ever get compromised it would take them a few months to copy over all my files

Buy a machine with pfsense in it, there are a bunch of them available in Amazon, not only you get a great firewall, but you also get a bunch of neat features (ad blocking via pfblockerng, easy VPN configuration, etc), it is really worth it IMO.

Some of these machines also allow you to put a SIM chip in it, meaning that you can configure it to be a fallback if your main internet drops for some reason.

Also, keep in mind that these firewalls in the ISP modem are very likely to have backdoors and security holes since they are not updated after some time. So, if you really worry about security, a solution like Pfsense is the way to go.

I use OpenWrt with AdGuard, with separate wired networks for

• work computer (consulting)
• work computer (another company of mine)
• gaming PC
• home server and Apple TV

I also have a wifi for personal use and another wifi that goes through a VPN (vpn runs on the router).

Sounds unnecessarily complex but it started out as a way to learn about networking and there hasn’t been a good reason to change it since.

And also to answer the question, there’s a firewall on the router and also on my computers.