You can set it up on your local network without outside access given to your router.

This can be helpful to block devices like your "dumb TV" through the firewall. You can block them via their MAC address.

You can do this by allowing it to connect and looking at the list of network devices. You should see it's Mac address there. Copy that for any device you don't want connecting later (later meaning before you give your router outside access). You'll create a blocklist in the firewall around those devices. This is helpful to prevent them from ever connecting, even if you forget and plug your TV Ethernet back in.

Get the macs before you factory reset and/or flash a clean openwrt image. If flash a fresh copy. No reason to have that doubt in your head on a used device.

DNS (adgaurd) is a good thing to have set. I'm not an expert on the best options, but forcing a specific DNS through the router is good to setup. Mine is called "DNS Director" I think but I'm using the Asus flavor of wrt which is a bit different.

It forces DNS for all devices on the network, devices can request a different DNS (like Google) even if you have adgaurd setup, this ensures this doesn't happen. You have to lookup the equivalent for openwrt.

But, if you don't want your ISP monitoring your network traffic destinations you'll want to setup a VPN on the router and all devices will be routed through the VPN.

Noting that a VPN is essentially (from a privacy standpoint) just trading your ISP for a different provider that can log your network traffic. So, keep that in mind when choosing one. My rule of thumb, is that if the VPN is being advertised on YouTube channels as ad reads, don't fucking touch it. Paying with crypto or anonymously is essentially pointless. The VPN knows your IP. If they are logging and not reliable they are going to know who you are if you're using the VPN as a home solution. You are trading a definite evil in your ISP for another that is potentially better. A lot of people have a false sense of security with a VPN. So I just wanted to say this.

You're gonna have to do your own work setting it up and learning the individual steps. But, this should at least be some vocabulary and basics to point you in the right direction.

I know everyone is trying to block their TVs and shit this week.

Also, get rid of Ring on your network or any robo vacuums or whatever. Those are security nightmares.

A good thing to setup are VLANS. I would at minimum creatie a VLAN for untrested devices like iot stuff.

You can setup a firewall so you can access the insecure devices but they cant access your trusted network them self.

This gives a good base to expand on.

Create guest networks with AP isolation for IOT and guests. Switch to a good DNS such as Quad9 or NextDNS, enable Wireguard for all devices on your network. Set a strong admin password and disable remote/WAN access to your router.

Check out the list of extra packages available on their website, you'll get ideas for all types of cool stuff you can do.

Cake aqm and doh+dnssec

Hack router.