The low-down on home routers – how to buy, what to avoid(esr.ibiblio.org)
esr.ibiblio.org
The low-down on home routers – how to buy, what to avoid
http://esr.ibiblio.org/?p=8330
28 comments
I second getting away from embedded land, and moving to a full-capability machine.
I've come full circle to just running an i5 with Linux/nftables (my first router was a k5 with ipfwadm). I already had the i5, and gigabit VPN can use the horsepower.
I wanted to like pfSense, but I didn't want to learn a whole new net stack to debug firewall rules. Not that you have to dig that deep to simply use pfSense, but I ran into some config problem and missed the insight I take for granted on Linux.
Reading the comments on the OP is kind of funny, too: ESR regarding an "old PC" as a router:
> and use what for ports? Even newer ones tend to have only two. That's poor fanout.
The ports you see on an embedded router are actually just a tagged switch. A good CPU has two internal ports connected to that switch, but many have only one. Some switch chips can eg accelerate NAT, but OpenWRT is going to erase that. So embedded router bandwidth is actually quite poor, meanwhile you can essentially stick as many true 1Gb/10Gb ports in a PC router as you desire.
I've come full circle to just running an i5 with Linux/nftables (my first router was a k5 with ipfwadm). I already had the i5, and gigabit VPN can use the horsepower.
I wanted to like pfSense, but I didn't want to learn a whole new net stack to debug firewall rules. Not that you have to dig that deep to simply use pfSense, but I ran into some config problem and missed the insight I take for granted on Linux.
Reading the comments on the OP is kind of funny, too: ESR regarding an "old PC" as a router:
> and use what for ports? Even newer ones tend to have only two. That's poor fanout.
The ports you see on an embedded router are actually just a tagged switch. A good CPU has two internal ports connected to that switch, but many have only one. Some switch chips can eg accelerate NAT, but OpenWRT is going to erase that. So embedded router bandwidth is actually quite poor, meanwhile you can essentially stick as many true 1Gb/10Gb ports in a PC router as you desire.
I keep hearing this, but does Ubiquiti actually provide good speeds?
I got an Asus AC 5300, it works great. I can get 450 Mbps downloads and uploads easily, and get good coverage.
I've also installed the Linksys Velop mesh system for a number of people now, and I can crank out similar speeds with that.
The speed ratings I have seen for the Ubiquiti products are half that, at best.
Here's another thread which mentions this issue: https://community.ubnt.com/t5/UniFi-Wireless/UniFi-AP-AC-LR-...
I got an Asus AC 5300, it works great. I can get 450 Mbps downloads and uploads easily, and get good coverage.
I've also installed the Linksys Velop mesh system for a number of people now, and I can crank out similar speeds with that.
The speed ratings I have seen for the Ubiquiti products are half that, at best.
Here's another thread which mentions this issue: https://community.ubnt.com/t5/UniFi-Wireless/UniFi-AP-AC-LR-...
Here is an explanation for expected throughput of various WiFi standards https://www.speedguide.net/faq/what-is-the-actual-real-life-...
The Unifi product line works well for environments where non-network savy people are involved. I've installed them in a number of non-profits, my relative and friends homes with great success. By success, I get no questions or complaints about WiFi coverage or access. Ubiquiti has done a pretty incredible job of making multiple AP setup and management easy for a low price.
For people who want a router + APs, I recommend the USG Gateway, Unifi Cloud Key, and one or more AP-AC-Lite's. As an alternative to the USG Gateway, I use Ubiquiti Edgerouter POE's or ER-X's.
I've used a USG myself, but may switch to a pfsense router as the USG lacks some advanced features that aren't available in the USG.
Background: In the 90's I built my own firewalls, then moved to SG300's from an Australian company that eventually got purchased by McAfee (I think?), then to DD-WRT on WRT54G's, then Tomato, then Asuswrt-Merlin, and then to the USG. Why not continue on the opensource route? I just wanted a firewall that worked and was easy to maintain. The Ubiquiti Edge Router and Unifi Security Gateway met most of my requirements and I've been satisfied. I'm happy to answer any questions.
The Unifi product line works well for environments where non-network savy people are involved. I've installed them in a number of non-profits, my relative and friends homes with great success. By success, I get no questions or complaints about WiFi coverage or access. Ubiquiti has done a pretty incredible job of making multiple AP setup and management easy for a low price.
For people who want a router + APs, I recommend the USG Gateway, Unifi Cloud Key, and one or more AP-AC-Lite's. As an alternative to the USG Gateway, I use Ubiquiti Edgerouter POE's or ER-X's.
I've used a USG myself, but may switch to a pfsense router as the USG lacks some advanced features that aren't available in the USG.
Background: In the 90's I built my own firewalls, then moved to SG300's from an Australian company that eventually got purchased by McAfee (I think?), then to DD-WRT on WRT54G's, then Tomato, then Asuswrt-Merlin, and then to the USG. Why not continue on the opensource route? I just wanted a firewall that worked and was easy to maintain. The Ubiquiti Edge Router and Unifi Security Gateway met most of my requirements and I've been satisfied. I'm happy to answer any questions.
Thanks for the review of Ubiquiti in general. I'm still not sure I see a great use case, however.
If the customer can get away with a single wifi router (eg. Asus AC 5300) that will generally be easiest for them to manage (eg. easy to reset if necessary, no concern that older devices are connecting to the wrong access point). It also gives very strong download speeds (around 450Mbps for a gigabit connection).
If the customer needs multiple devices the Linksys Mesh system has worked very well. I can connect the nodes to each other wired or wirelessly, and I can get speeds in a similar range as a single router (450Mbps). The Linksys app is dead simple to setup and restart the system, and clients have even been able to apply firmware updates from their phone without issue.
I don't consider the Ubiquiti software easy to use for general consumers, so I would only install their products if I was planning to fully manage the network for them, i.e. they would have to call me in the event that the power went out and the system didn't come back up correctly or something.
Regardless of ease-of-use, I am more concerned about the speed. It seems like the Ubiquiti access point I have installed top out around 200 Mbps, so I don't even want to use them for my own house.
My guess was that the Ubiquiti devices were designed for use in an office setting, where making sure that everyone can connect is more important than enabling the fastest speed for say 5-10 devices.
If the customer can get away with a single wifi router (eg. Asus AC 5300) that will generally be easiest for them to manage (eg. easy to reset if necessary, no concern that older devices are connecting to the wrong access point). It also gives very strong download speeds (around 450Mbps for a gigabit connection).
If the customer needs multiple devices the Linksys Mesh system has worked very well. I can connect the nodes to each other wired or wirelessly, and I can get speeds in a similar range as a single router (450Mbps). The Linksys app is dead simple to setup and restart the system, and clients have even been able to apply firmware updates from their phone without issue.
I don't consider the Ubiquiti software easy to use for general consumers, so I would only install their products if I was planning to fully manage the network for them, i.e. they would have to call me in the event that the power went out and the system didn't come back up correctly or something.
Regardless of ease-of-use, I am more concerned about the speed. It seems like the Ubiquiti access point I have installed top out around 200 Mbps, so I don't even want to use them for my own house.
My guess was that the Ubiquiti devices were designed for use in an office setting, where making sure that everyone can connect is more important than enabling the fastest speed for say 5-10 devices.
Hard to say, since I'm in a very heavy wireless environment (my Macbook sees 30-40 different SSIDs). I still get 200-250 Mbps (real speed, to a device connected to the same network) with only 2x2 radios on both ends. More importantly, that's reliable too. I've never seen it drop to less than that, and I've never had even a single problem connecting to WiFi, random reconnects, etc.
Maybe I could get more out of it if I tried switching channels or something, but I'm pretty happy with it as it is. If my Internet speeds were anywhere close to that maybe I'd try their "AC-PRO".
Maybe I could get more out of it if I tried switching channels or something, but I'm pretty happy with it as it is. If my Internet speeds were anywhere close to that maybe I'd try their "AC-PRO".
>If I needed a new router today (I don’t, I have a couple of cold spares) I’d trawl e-Bay for a one-generation-back commodity router on the OpenWRT support list that does have 4GB+ flash and 32GB+RAM and doesn’t have a &$@*$! Broadcomm chip in it, buy it, and flash OpenWRTs latest stable release.
This is the blogpost in a nutshell. Save yourself some time.
This is the blogpost in a nutshell. Save yourself some time.
I have a different recommendation. Now that WiFi standards have stopped evolving so fast, used commercial-grade WiFi access points are a fantastic deal. I replaced AirPort Extreme with a pair of used Ruckus R600s. (They’re AP’s so you need a separate router. I use a Linux server as an access point, which allows using the CAKE packet scheduler at > 1 gbps.) They are $150-200 on eBay. The Airport is great, but gets a bit squirrely when your internet connection can deliver packets faster than the WiFi can offload them. With the R600, same-room performance stayed the same, but off-axis performance improved dramatically. In the bedroom right above the access point, I used to get 100 Mbps or so. Swapping out the R600 raised that to 300 Mbps. (The Ruckus has some cool directional antenna technology.)
I have an Ubiquiti ER-6P. I'm pretty pleased with it. The newest OS is based on Debian stretch and it has generous ram, cpu, and storage (for a router).
The web gui is pretty nice, I can ssh (openssh not dropbear) into it (even with a ssh key), and there's a command line available if I need it. The security updates come out often, Ubiquiti seem responsive to the community, and the upgrade procedure is sane.
Ubiquiti allow backing up the entire state of the router, in a human friendly configuration format that's easy to hand edit.
They offer full IPv6, radvd, and sanely handling a IPV6 /60 from Comcast and providing each router port with it's own /64. Simple stuff I know, but often missing in home routers. Similar was quite complex or broken on DDwrt and OpenWRT, in a previous iteration of home router I actually had to steal pieces for both to get things working with IPv6. The main problem is there was an issue with a compatible IPv6 dhcp client to accept the /60 from Comcast. Additionally I had to use a binary blob to get some of the most of my previous Asus router.
I've built a router from scratch before, but the Ubiquiti hardware is silent, well done, and their debian based OS makes all the normal router stuff easy. And my favorite feature is the ability to use apt for package management.
I've never had a crash, currently it's been up only 65 days because of a power outage.
The web gui is pretty nice, I can ssh (openssh not dropbear) into it (even with a ssh key), and there's a command line available if I need it. The security updates come out often, Ubiquiti seem responsive to the community, and the upgrade procedure is sane.
Ubiquiti allow backing up the entire state of the router, in a human friendly configuration format that's easy to hand edit.
They offer full IPv6, radvd, and sanely handling a IPV6 /60 from Comcast and providing each router port with it's own /64. Simple stuff I know, but often missing in home routers. Similar was quite complex or broken on DDwrt and OpenWRT, in a previous iteration of home router I actually had to steal pieces for both to get things working with IPv6. The main problem is there was an issue with a compatible IPv6 dhcp client to accept the /60 from Comcast. Additionally I had to use a binary blob to get some of the most of my previous Asus router.
I've built a router from scratch before, but the Ubiquiti hardware is silent, well done, and their debian based OS makes all the normal router stuff easy. And my favorite feature is the ability to use apt for package management.
I've never had a crash, currently it's been up only 65 days because of a power outage.
Would just like to put the Orange Pi out there: wielding 2 Ethernet ports, WiFi and other creature comforts for < $20 USD [1]. It's more than adequate for running as a Pi Hole [2] as well as having enough left over to do other interesting tasks. Would recommend from personal experience some form of cooling is you plan to really push it.
[1] http://linuxgizmos.com/tiny-hacker-board-features-dual-ether...
[2] https://pi-hole.net/
[1] http://linuxgizmos.com/tiny-hacker-board-features-dual-ether...
[2] https://pi-hole.net/
I use this router: https://www.turris.cz/en/omnia/ and I am quite pleased with it.
Not totally relevant, but if you have AT&T Gigafiber (and you don't have TV or landline phone service), you can actually bypass AT&T's god-awful router by getting an UBNT EdgeRouter or USG and setting up eap_proxy [0].
[0] https://github.com/jaysoffian/eap_proxy/
[0] https://github.com/jaysoffian/eap_proxy/
One commercial alternative I can recommend are AVM products, somewhat popular in Europe (AVM is German).
Good hardware, frequently with open alternatives.
I currently use Fritz 4040 with 1Gbps fiber, with original firmware, works like a charm.
Excellent wifi.
Good hardware, frequently with open alternatives.
I currently use Fritz 4040 with 1Gbps fiber, with original firmware, works like a charm.
Excellent wifi.
Fritzboxes are quite sparse. E.g there is no per-client resource use, meaningful QoS, no way to assign custom dns suffixes and no way to set static dns records. These are just some of the limitations I've run into recently, I forgot about the older ones. People have been asking for these features for literally a decade and a half, so I'm not holding my breath. My isp gives me a fritzbox for free, otherwise I can't recommend them for power users.
I’m on Zen Internet in the UK and was supplied a Fritz router with the connection. WiFi was great but didn’t reach throughout the house (old, lots of brick internal walls).
I noticed they claimed they could do mesh WiFi so I tried to buy their extenders. They are built to plug directly into European power sockets, though, and when I asked AVM they advised against using an adapter for the UK and instead buying some second hand routers.
I bought two the same as my original (2nd hand on eBay, cheaper than the extenders would have been) and set them up.
It was trickier to set them up than the extenders would have been but it’s all working and pretty solid so far. I was very happy with their support.
I noticed they claimed they could do mesh WiFi so I tried to buy their extenders. They are built to plug directly into European power sockets, though, and when I asked AVM they advised against using an adapter for the UK and instead buying some second hand routers.
I bought two the same as my original (2nd hand on eBay, cheaper than the extenders would have been) and set them up.
It was trickier to set them up than the extenders would have been but it’s all working and pretty solid so far. I was very happy with their support.
Fritz!Box 7490 here, I love it to pieces. Best router I ever owned. But I agree that the admin interface is a bit too simplified and doesn’t allow for any advanced configuration.
5490 owner here. I feel like a bit of a dangus for asking this, but have you checked that you are in fact currently using the "advanced view" option?
I was disappointed with the configurability as well until I discovered that option.
Is there any opinion here about Apple’s routers (airport express, airport extreme)?
They have discontinued the product line but software updates have continued and they say they will be supported for a while.
Are they safe to use, in the context of this blog post?
They have discontinued the product line but software updates have continued and they say they will be supported for a while.
Are they safe to use, in the context of this blog post?
I had a few Airport Extreme and Express in the past and I think they are awesome and under rated. They were rock solid. Never had an issue with them and they always performed great. I also trust Apple to do the right thing in terms of security.
> If I needed a new router today I’d trawl e-Bay for a one-generation-back commodity router on the OpenWRT support list that does have 4GB+ flash and 32GB+RAM
You'd need to look hard to find a router with such specs.
You'd need to look hard to find a router with such specs.
Just bought a Mikrotik router. Can't wait to get it home and start tinkering.
I got a few mikrotiks at home and friends/family. They are quite nice as they offer about every networking option the Linux kernel has to offer. However they don't expose the Linux userland so they are not as hackable as openwrt. For example getting wireguard to run on one is not practically possible at the moment. That said they offer a really stable solution with a good (though steep learning curve) UI and terminal interface. And even the smallest cheapest models come with everything included (bgp, MPLS, IPsec, openvpn, advances firewalling and queueing, centralised AP management).
If you like to have a Linux router with every knob on a panel this is for you, if you want (and will have to) open the panel to tweak with the wires, not so much.
If you like to have a Linux router with every knob on a panel this is for you, if you want (and will have to) open the panel to tweak with the wires, not so much.
I've heard of Mikrotik, seemed popular with SysAdmin types, at least until they were widely targeted by some malicious folks looking to compromise SysAdmins to exploit the networks they manage.
Found one of many mentions (sorry for the long URL): https://www.trendmicro.com/vinfo/us/security/news/cybercrime...
I heard something about software limiting the routers, so you had to pay for license upgrades to get full functionality out of their routers. Any truth to that?
Found one of many mentions (sorry for the long URL): https://www.trendmicro.com/vinfo/us/security/news/cybercrime...
I heard something about software limiting the routers, so you had to pay for license upgrades to get full functionality out of their routers. Any truth to that?
The amount of security weaknesses in Mikrotik is low and they get immediately patched. Those guys do excellent software updates and there are tons of resources to get help at.
Regarding the pay for a license to get the full functionality. There is no chance a home or ordinary office user will ever hit any limitations within a stock license. The upgrade might be needed only for the ultimate stuff in realm of BGP tunnels and stuff alike.
Regarding the pay for a license to get the full functionality. There is no chance a home or ordinary office user will ever hit any limitations within a stock license. The upgrade might be needed only for the ultimate stuff in realm of BGP tunnels and stuff alike.
My memory isn't perfect, but from the past few years I've had Mikrotiks, I don't remember any effective attacks against properly configured devices. By "proper configuration" I mean disabled telnet, no management access from the internet, and other really basic precautions.
The 200 000 devices mentioned in the article you linked all had management port exposed to the whole world, which is something that should never be done.
The 200 000 devices mentioned in the article you linked all had management port exposed to the whole world, which is something that should never be done.
I went with one of these: https://pcengines.ch/apu2.htm