5 ms·

Grab a decent microtik router and a few Ubiquiti Unifi AP's, setup automatic updates, and never touch them again.

adrianpike 8y ago
What do you recommend router-wise? I'm currently using an EdgeRouter PoE and have been happy with it, but I'm setting up a home network at a condo and am researching options.
- amiga-workbench 8y ago
  I'm actually just running a hAP lite for home use, one of my friends works for a WISP and they're using EdgeRouter's on their towers, he seems pretty damn happy with them. I don't have much going on with my router, a few open ports, blocked domains and its running a L2TP over IPsec VPN for when I want to access my home IP cams. I bought the older RB2011UiAS-RM years ago for work to replace their two crappy BT business hubs and setup dual DSL failover with a 3G dongle as a backup. I've never had to reboot any of them due to a malfunction or crash, they just keep going and the performance is top notch for the medium size business they're servicing.
- berbec 8y ago
  It's hard to beat a $50 craigslist dual+ core box, a second nic and pfSense. I have a dell optiplex 780. I paid $15 for a second nic. It's great.
  - justinsaccount 8y ago
    > It's hard to beat a $50 craigslist dual+ core box, a second nic and pfSense unless you pay for your own power. An edge router lite uses <10w. How much does it cost to run the pfsense box over the course of 2 years?
    - FooHentai 8y ago
      Those dells pull about 30W at near-idle. Let's assume 40W given an extra NIC and the workload running. US domestic power averages about 12.3 cents per kWh. So 36 bucks a year versus 8 bucks per year for the ERL.
    - inferiorhuman 8y ago
      Don't forget that the ERL will cook itself to death unless you improve the cooling. The case itself will reach temps of about 40C under normal operating conditions. https://community.ubnt.com/t5/EdgeRouter/CPU-fan-mod-cpu-temperature/td-p/431105/page/3 https://community.ubnt.com/t5/EdgeRouter/CPU-fan-mod-cpu-tem...
      - Fnoord 8y ago
        > Don't forget that the ERL will cook itself to death unless you improve the cooling. It will? No, that implies it is inevitably going to happen with every device which is not the case. A better wording is it might, depending on (unclear) circumstances.
        inferiorhuman 8y ago
        > It will? No, that implies it is inevitably going to happen with every device which is not the case. A better wording is it might, depending on (unclear) circumstances. At those temperatures (40C exterior temp at idle) cooking to death is pretty certain. Look at the complaints of glitchy ERLs as a proxy for impending death. Meanwhile it's pretty clear that the Octeon runs hot and UBNT didn't provide sufficient cooling.
        Fnoord 8y ago
        Again, I am not denying there are people who have issues what I am saying is we don't have enough data to figure what the signal/noise ratio is regarding dying devices.
inferiorhuman 8y ago
While not necessarily exploitable Ubiquiti ships known vulnerable packages. Let's not forget their u-boot fiasco and GPL violations.
yumraj 8y ago
why not Ubiquity edgerouter? I use the ERX, so curious what makes microtik better?
- amiga-workbench 8y ago
  I just haven't used them before, judging from the quality of my AP's they should work just fine. I don't know how flexible they are though, RouterOS might be a bit of a pig to use but it can do pretty much anything you want, the Ubiquiti gear is very user friendly and that usually means less flexible.
  - Fnoord 8y ago
    Yes, the GUI apps are user-friendly (though UNMS requires a VM and Unifi Controller requires Java; they should merge these 2 which they are doing I think, ditching the latter). If you want to, you can SSH into the machines. The disabled bash completion will bring you back to the 80s and reevaluate how "user friendly" it is (it does work as root, but then you gotta be root all the time...). I call this part of user-friendliness, and not in a positive way. Regardless, I'm happy with the Ubiquity gear I got. The entry level hardware is cheap yet good quality. If you want the more advanced stuff, that's expensive though. 16 port managed switch with PoE costs nearly 300 EUR while 8 port costs 100 EUR.
unluckier 8y ago
So... two of the routers affected by the recent VPNFilter malware? Interesting choice.
- alyandon 8y ago
  The vulnerability exploited by VPNFilter was apparently patched by Mikrotik in March 2017.
- kinsomo 8y ago
  > So... two of the routers affected by the recent VPNFilter malware? Interesting choice. If you're looking for a router that's never had a documented security flaw, you're probably going to buy a no-name brand that's full of them (because no one's looked yet, so it has a "clean" record). The factors that you really need to look for are 1) good engineering practices for security, and 2) prompt and effective response to flaws. 1) can hard to verify completely, but you can get a sense of 2) based on patch cycles. I have a Mikrotik router at home, and I chose it because their products are inexpensive and aimed at professionals, which means the software support is much better than consumer routers. Mine is quite old, but it still gets patches.
  - inferiorhuman 8y ago
    I wasn't aware that the Unifi stuff was vulnerable to the latest VPN stuff. I own a few ER-Xs and a Unifi AP. They're reasonable kit, but I wouldn't recommend them at all as a set it and forget it system. - Ubiquiti has a track record of GPL violations (e.g. u-boot which dovetails nicely with a security vuln) - The Unifi AP is tolerable for a simple home env but not much else. - Ubiquiti support is non-existent. They basically slapped a slick GUI on Vyatta and resold it. It's nice, but they don't have much in the way of developers. So, for instance, they still haven't fixed the hardware acceleration bugs in the ER-X or the WPA2 enterprise issues in the Unifi AP. - Ubiquiti hardware itself is hit and miss. The ER-L, for instance, is known to overheat and cook itself to death. There was a mixup with some of the PoE stuff (UBNT historically used non-standard PoE) meaning you're not entirely sure what's in the box. UBNT hardware cheap and you can hack on it, so that's nice. But, being aimed at professionals and actually suitable for professionals are two separate issues.

What do you recommend router-wise? I'm currently using an EdgeRouter PoE and have been happy with it, but I'm setting up a home network at a condo and am researching options.

amiga-workbench 8y ago
I'm actually just running a hAP lite for home use, one of my friends works for a WISP and they're using EdgeRouter's on their towers, he seems pretty damn happy with them. I don't have much going on with my router, a few open ports, blocked domains and its running a L2TP over IPsec VPN for when I want to access my home IP cams. I bought the older RB2011UiAS-RM years ago for work to replace their two crappy BT business hubs and setup dual DSL failover with a 3G dongle as a backup. I've never had to reboot any of them due to a malfunction or crash, they just keep going and the performance is top notch for the medium size business they're servicing.
berbec 8y ago
It's hard to beat a $50 craigslist dual+ core box, a second nic and pfSense. I have a dell optiplex 780. I paid $15 for a second nic. It's great.
- justinsaccount 8y ago
  > It's hard to beat a $50 craigslist dual+ core box, a second nic and pfSense unless you pay for your own power. An edge router lite uses <10w. How much does it cost to run the pfsense box over the course of 2 years?
  - FooHentai 8y ago
    Those dells pull about 30W at near-idle. Let's assume 40W given an extra NIC and the workload running. US domestic power averages about 12.3 cents per kWh. So 36 bucks a year versus 8 bucks per year for the ERL.
  - inferiorhuman 8y ago
    Don't forget that the ERL will cook itself to death unless you improve the cooling. The case itself will reach temps of about 40C under normal operating conditions. https://community.ubnt.com/t5/EdgeRouter/CPU-fan-mod-cpu-temperature/td-p/431105/page/3 https://community.ubnt.com/t5/EdgeRouter/CPU-fan-mod-cpu-tem...
    - Fnoord 8y ago
      > Don't forget that the ERL will cook itself to death unless you improve the cooling. It will? No, that implies it is inevitably going to happen with every device which is not the case. A better wording is it might, depending on (unclear) circumstances.
      - inferiorhuman 8y ago
        > It will? No, that implies it is inevitably going to happen with every device which is not the case. A better wording is it might, depending on (unclear) circumstances. At those temperatures (40C exterior temp at idle) cooking to death is pretty certain. Look at the complaints of glitchy ERLs as a proxy for impending death. Meanwhile it's pretty clear that the Octeon runs hot and UBNT didn't provide sufficient cooling.
        Fnoord 8y ago
        Again, I am not denying there are people who have issues what I am saying is we don't have enough data to figure what the signal/noise ratio is regarding dying devices.

inferiorhuman 8y ago

While not necessarily exploitable Ubiquiti ships known vulnerable packages. Let's not forget their u-boot fiasco and GPL violations.

yumraj 8y ago

why not Ubiquity edgerouter? I use the ERX, so curious what makes microtik better?

amiga-workbench 8y ago
I just haven't used them before, judging from the quality of my AP's they should work just fine. I don't know how flexible they are though, RouterOS might be a bit of a pig to use but it can do pretty much anything you want, the Ubiquiti gear is very user friendly and that usually means less flexible.
- Fnoord 8y ago
  Yes, the GUI apps are user-friendly (though UNMS requires a VM and Unifi Controller requires Java; they should merge these 2 which they are doing I think, ditching the latter). If you want to, you can SSH into the machines. The disabled bash completion will bring you back to the 80s and reevaluate how "user friendly" it is (it does work as root, but then you gotta be root all the time...). I call this part of user-friendliness, and not in a positive way. Regardless, I'm happy with the Ubiquity gear I got. The entry level hardware is cheap yet good quality. If you want the more advanced stuff, that's expensive though. 16 port managed switch with PoE costs nearly 300 EUR while 8 port costs 100 EUR.

unluckier 8y ago

So... two of the routers affected by the recent VPNFilter malware? Interesting choice.

alyandon 8y ago
The vulnerability exploited by VPNFilter was apparently patched by Mikrotik in March 2017.
kinsomo 8y ago
> So... two of the routers affected by the recent VPNFilter malware? Interesting choice. If you're looking for a router that's never had a documented security flaw, you're probably going to buy a no-name brand that's full of them (because no one's looked yet, so it has a "clean" record). The factors that you really need to look for are 1) good engineering practices for security, and 2) prompt and effective response to flaws. 1) can hard to verify completely, but you can get a sense of 2) based on patch cycles. I have a Mikrotik router at home, and I chose it because their products are inexpensive and aimed at professionals, which means the software support is much better than consumer routers. Mine is quite old, but it still gets patches.
- inferiorhuman 8y ago
  I wasn't aware that the Unifi stuff was vulnerable to the latest VPN stuff. I own a few ER-Xs and a Unifi AP. They're reasonable kit, but I wouldn't recommend them at all as a set it and forget it system. - Ubiquiti has a track record of GPL violations (e.g. u-boot which dovetails nicely with a security vuln) - The Unifi AP is tolerable for a simple home env but not much else. - Ubiquiti support is non-existent. They basically slapped a slick GUI on Vyatta and resold it. It's nice, but they don't have much in the way of developers. So, for instance, they still haven't fixed the hardware acceleration bugs in the ER-X or the WPA2 enterprise issues in the Unifi AP. - Ubiquiti hardware itself is hit and miss. The ER-L, for instance, is known to overheat and cook itself to death. There was a mixup with some of the PoE stuff (UBNT historically used non-standard PoE) meaning you're not entirely sure what's in the box. UBNT hardware cheap and you can hack on it, so that's nice. But, being aimed at professionals and actually suitable for professionals are two separate issues.