The FIRM Guide

The Network Module

The structure and access points of your home network — router, Wi-Fi, ISP, and advanced configuration — so it can be maintained, troubleshot, or handed off.

Where this Module fits

S-03 Module 3 of 6 in the System area — step 1 of 4 on the dependency ladder (System → At-Home → Financial → Estate).

Third — secures the channel everything else travels over.

Adds to The Secure Guide: Network record — router, SSIDs, ISP, device map, config backup.

Adds to The Family Guide: The network's shape, where credentials live (no values), the escalation path.

Every Module adds one section to each guide — that is how the two guides assemble as you work. See what you're building.

Download Text File Nothing is entered on this page — you fill the template in privately.

Text file — the flexible one. Use it as-is, paste it into a spreadsheet, open it in any editor, or paste it into an AI tool to reshape the blank form to fit your family: rename a field, add a row, drop one you don't need.

Print / PDF — the ready-to-use one. Print it and fill it in by hand, or choose Save as PDF and complete it in your own offline PDF app. Either way it stays with you — the finished Secure Guide template goes inside your Vault.

One rule: only ever give an AI tool the blank template. Never paste your real information — passwords, account numbers, anything you'd keep secret — into an AI tool, an online service, or anywhere outside your own Vault. Customizing an empty form is fine; filling it in happens privately, offline. That's the same rule this site follows: nothing sensitive ever leaves your hands.

Secure Guide Starter Template — Network

Store this inside your Vault. Update when hardware, providers, or network layout changes.

Some fields below — VPN profiles, firewall rules, config backups — may not apply to your home or mean much to you yet. That is fine: many Modules carry fields you will grow into. Start with the basics — the equipment, the Wi-Fi passwords in your password manager, a guest network — and fill in the rest as you learn. Keep just one rule as you go: this record is orientation, the password manager is access. Never mix the two.

Homes connect in many ways now — a phone hotspot or a building's shared Wi-Fi counts too. Fill only what applies: the essentials are who provides the connection, which account controls it, and where the passwords live.

Primary SSID or a household label.
Fiber / cable / DSL / fixed wireless (cellular) / satellite / phone hotspot / building Wi-Fi — and the speed, if you know it.
Every box that makes the internet work here — modem or ONT, router or gateway, mesh nodes, cellular or satellite receiver — and where each sits.
A local admin address (e.g., http://192.168.1.1) or the vendor's app — and which account controls it. That account is a recovery dependency: its login and the admin credentials live in the password manager, not here.
Primary + guest SSID and what belongs on each. Wi-Fi passwords go in the password manager.
Who provides the connection — fiber, cable, cellular, or satellite — the plan, the support number, and the PRIMARY ACCOUNT HOLDER'S EMAIL on the account (the address the ISP verifies and sends notices to). Account login is high-friction — password manager.
Pointer to the device inventory (see the Devices Module).
Provider and where the profile/settings live, if used.
Where the router's exported configuration is stored.
Anything non-default a future maintainer should know.
Date of the last device audit and firmware check.
Network; secure-guide; family-guide; System

Family Guide Starter Template — Network

This template contains no sensitive information beyond the optional guest Wi-Fi password — the one password designed to be shared. It can be stored with household documents.

In the matching Secure Guide section: network record — router, SSIDs, ISP, device map, config backup.

That detail is what makes recovery possible — and it is protected in the Vault, which opens with The Vault Key. The key is never written here, by design. The people listed on this page know how it is kept, and the steward's job is to keep that path current, so this page never leads to a locked door.

One sentence on the network's shape (e.g., a family network and a guest network).
Where the network boxes physically sit — the shelf with the modem, the closet with the router, which rooms hold the mesh nodes.
Where the network admin password is kept, by reference (e.g., password manager → Network) — never the password itself.
Optional. The guest-network password may be written here — it exists to be shared. Household and admin passwords never appear on this page.
Steward and cadence.
Escalation path — ISP support number; who to ask about anything unfamiliar.

Anything this page's reader should know that the sections above didn't ask for — the exceptions, the house quirks, the thing you would say out loud while handing this page over.

For more information on how to use these templates, see The Recoverable Family book.

Worked example — Frank's family

Frank got serious about the network after his neighbor's smart doorbell was hacked and used to reach the neighbor's home network. His starting point: a five-year-old router on default settings, a Wi-Fi password made of the family name and a year — and twenty-three connected devices where his inventory listed nineteen. The gap was his to-do list. Three weekends later the household runs two networks, the smart gear is isolated, three unknowns are blocked (no one ever complained), and the monthly audit takes ten minutes.

All details are fictional and illustrative. The assembled example guides live at the example Secure Guide and the example Family Guide.

Secure Guide — Frank's entry

One master entry, updated when hardware, providers, or layout changes. Credentials are referenced to the password manager — never written here.

FrankNet (primary) + FrankNet-Guest — three-node home mesh
Fiber to the home, 1 Gbps
Westvale Fiber ONT in the utility closet; LatticeMesh, three nodes — main node in the upstairs office, satellites in the living room and garage. Firmware auto-update enabled.
The LatticeMesh app, signed in as the household account under Frank's email — plus a local admin page at http://192.168.0.1. That vendor account is the key to the network: its login and the admin password live in the password manager under Network → Router Admin, and Sarah's emergency access covers them.
FrankNet (WPA3): family laptops and phones only. FrankNet-Guest: visitors plus every smart device — doorbell, thermostat, speaker, smart TV, both consoles. Both passwords in the password manager.
Westvale Fiber; account under Frank's email. Support number in this entry and on the utility card in the binder; account login in the password manager.
See the Devices inventory (S-01) — each row carries a network placement (primary / guest). Devices are named in the router (Frank-Laptop, Lily-Phone…) so strangers stand out; the monthly audit reconciles the router list against the inventory.
Router-level NorthTunnel VPN profile for outbound traffic; filtering DNS on the kids' devices. Profiles stored in FrankSecure/System/Network.
network_config_backup.bin plus a hand-drawn network diagram — FrankSecure/System/Network/
Default deny on incoming ports; UPnP disabled; email alert when a new device joins. Three unidentified devices blocked 2026-02 — still unclaimed.
2026-04 monthly audit (ten minutes: router list vs. inventory, firmware confirmed current)
Network; secure-guide; family-guide; System

Family Guide — Frank's entry

This entry sits in the household reference binder. It contains no passwords.

Two Wi-Fi networks: FrankNet for the family's own computers and phones, and FrankNet-Guest for visitors and all the smart gadgets (doorbell, thermostat, speaker, TV, consoles).
The fiber box and the LatticeMesh main unit: the study bookshelf. The two satellite nodes: the upstairs hallway and the family room console.
Password manager → Network — the mesh app login and the Wi-Fi passwords. Never written in this binder.
FrankNet-Guest: “CooperSaysWoof” — shared freely; it's what the network exists for. (The family network's password stays in the password manager.)
Frank — a ten-minute device audit every month. Anything unfamiliar on the network gets blocked first and questioned second.
Internet outage: the ISP support line on the utility card in this binder. Anything odd — a strange device, a password prompt you didn't expect — tell Frank, and don't enter passwords anywhere new.

← Back to System modules