5 ms·

Ubiquiti EdgeOS based edgerouters are what I prefer as a greybeard sysadmin type who has dealt with everything under the sun. It's VyOS (Vyatta) based, they are

Ubiquiti EdgeOS based edgerouters are what I prefer as a greybeard sysadmin type who has dealt with everything under the sun. It's VyOS (Vyatta) based, they are now complying with gpl afaik, and their hardware is really good for the price/performance ratio. The edgerouter-x or lite can be found for ~$99 and is a great piece of gear. Another option would be your own hardware with pfsense (bsd) or ipfire(linux). Even further would be your own hardware with linux and write your own nftables or bpf.

nvarsj 8y ago
The ERL family is pretty bad as a router, in my experience. There is a longstanding firmware issue that introduces packet loss for routed packets (it doesn't multiplex across the dual cores correctly, which leads to out of order packets). If you really want to use Ubiquiti, I would suggest using an ER-X which is cheaper, doesn't have this problem, and is quadcore. The best option in my opinion is something Intel based running a well known Linux distro with automated security updates that is fully in your control. Shorewall can do everything needed for a home router. This option is a lot more expensive though.
- Bluecobra 8y ago
  Interesting that the more expensive router has this problem. I've been really happy with my ER-X, it works great with my internet service (500Mbs up/500Mbs down). I had some speed issues at first but this was solved by upgrading to the latest firmware and making sure hardware offloading was enabled.
  - larkost 8y ago
    I was a bit annoyed that hardware routing is not automatically enabled for setups that can use it. It is not hard, but you have to stumble upon the fact that that setting exists (only on the command line).
    - Kadin 8y ago
      My recollection is that it's not enabled by default because there were (are?) some features that don't work once you enable it. I assume it's the Deep Packet Inspection and advanced routing type stuff. (Sadly my home internet connection is too slow to make hardware offloading on the edge router matter...)
- tolien 8y ago
  > There is a longstanding firmware issue that introduces packet loss for routed packets Interesting, do you have any more about this? Got an ER-PoE that intermittently loses packets and have never got to the bottom of why (I gave up and bought a non-Ubnt router, just haven’t got around to configuring it yet).
  - nvarsj 8y ago
    https://community.ubnt.com/t5/EdgeRouter/UDP-packet-loss-on-Cavium-based-routers/td-p/1343012 https://community.ubnt.com/t5/EdgeRouter/UDP-packet-loss-on-... I was one of the people involved in some of the measurements on there. I avoid ubnt networking gear in general after that experience (although ER-X seems good and I use one at home as a smart switch). Their specialty is in APs, which work really great.
    - prplhaz4 8y ago
      The last update of the first post says that this was fixed in v1.10.0, and the release notes concur: https://community.ubnt.com/t5/EdgeMAX-Updates-Blog/EdgeMAX-EdgeRouter-software-release-v1-10-0/ba-p/2233263 https://community.ubnt.com/t5/EdgeMAX-Updates-Blog/EdgeMAX-E...
      - nvarsj 8y ago
        I knew I should have checked the release notes before commenting. No idea if it works but that would be a great improvement.
      - tolien 8y ago
        Open to the idea I’ve got a different issue, but I’m still seeing an issue with 1.10.5.
    - tolien 8y ago
      Thanks, and agreed. It was my first Ubnt gear, and I suspect it will be my last. It was so much cheaper than some of the alternatives though (that should probably have been a red flag…) but firmware that’s at best in continuous beta really isn’t good enough.
- arminiusreturns 8y ago
  I think this is batch based. Ubiquiti has had prod line issues intermittently, especially in the earlier batches. I would suggest trying to contact them for a replacement if you are getting packet loss.
  - deleted 8y ago
    [deleted]
technofiend 8y ago
Sorry for the spam, I seem to post this regularly but the Ubiquiti EdgeRouter Lite will happily run OpenBSD. It supports the onboard packet accelerator with some extra configuration.
- Fnoord 8y ago
  I didn't know that, wow. I found some resources on this [1] [2] [3] but it seems like everything is working? Have you tried WireGuard on OpenBSD/octeon? [1] https://www.openbsd.org/octeon.html https://www.openbsd.org/octeon.html [2] https://news.ycombinator.com/item?id=10079210 https://news.ycombinator.com/item?id=10079210 [3] https://an.undulating.space/post/180411-erl-openbsd-upgrade/ https://an.undulating.space/post/180411-erl-openbsd-upgrade/
  - technofiend 8y ago
    Not yet... I bought a brand new one just for testing with OpenBSD vs Vyatta because I'd like to benchmark performance of each.
    - jms703 8y ago
      Are you planning to post your benchmarks? Also, any helpful info on getting OpenBSD running on one of these is welcome!
      - technofiend 8y ago
        Yes I will post benchmarks and rulesets. I plan to make equal rulesets for each OS if possible.
- ptomato 8y ago
  Do you have any documentation on using the onboard packet accelerator with OpenBSD? I thought it was just binary linux blobs.
  - 8y ago
godzillabrennus 8y ago
I am a big fan of PFSense. Not a huge fan of Netgate as a company and the direction they are taking the product. In any case, you can load it onto some fairly low cost hardware for your typical home user. It's fantastic. I am not a huge fan of the Ubiquiti routers. They required loading a config onto them just to get DHCP enabled and NAT setup for a typical 1 WAN and 1 LAN environment. Why on earth they would ship without that config on them when 99.9999% of environments are like that is bewildering to me. Don't know if it's changed since then but I haven't gone back to mess with them since.
- squarefoot 8y ago
  I couldn't recommend PFSense more. Setting up my home firewall years ago using it on a pcengines.ch board was really easy and fun. I used a (now long discontinued) WRAP board back in the day, then when broadband became faster I had to remove it because the slow processor would bottleneck my connection, but I'm looking forward to get faster hardware to have it working again. One day, well over 10 years ago, while I was moving from the old ISP to a new one, they screwed up something and I spent some weeks cut off from the Internet. The WRAP board had a mini-pci connector I already had fitted with a powerful WiFi card, so I connected a high gain directional antenna in place of the low gain one and started monitoring the channels. Back in the day there still were weak WEP encrypted connections, but I was even more lucky because a local ISP which delivered their routers with no default encryption had no less than 3 customers in my neighborhood, one of which, probably an office with no traffic at least since the evening, allowed me to surf a lot faster than my previous connection. PFSense was a godsend because all I had to do was set the rules so that the WLAN interface became a slave seen as the WAN, so I got back online all my cabled home network in a matter of minutes. As a Linux guy I have to admit PFSense and similar products (NAS4Free etc) interface is the best I have ever seen around wrt functionality and ease of use, sadly OpenWRT web interface simply doesn't stand a chance, and I'm not referring to aesthetics as I'm aware OpenWRT is aimed at hardware with orders of magnitude less resources, but pure functionality - in fact I have never been able to configure a small tp-link mr3020 router to use it as a WiFi bridge for my networked but not wireless printer. Yes it can be done and there is a HOWTO on that task, but it doesn't work and low level iptables scripts aren't exactly my strong point. It would be trivial doing that with PFSense, but sadly it cannot fit into that device. /Rant
Youden 8y ago
I like the software but for some reason my SFP port intermittently went out for exactly 2 minutes. I tested it with a couple of different SFP modules to be sure that wasn't the problem and contacted Ubiquiti support, assuming I could get an RMA. For whatever braindead reason, they told me that they wouldn't give me an RMA because they don't "support" 3rd party SFP modules. They wouldn't loan me one to fix the problem, they wouldn't agree to reimburse me if it didn't fix the problem, nothing. Buy their module or deal with broken equipment. I bought one of their SFP modules and to nobody's surprise the problem persisted. At the same time I bought a Mikrotik hAP and again to nobody's surprise, all the SFP modules that "failed" worked with zero problems. At that point Ubiquiti finally granted me an RMA but at that point I went and got a refund instead. After that support experience, I'll never buy Ubiquiti or recommend it again. I'd much rather recommend PC-Engines: https://www.pcengines.ch/ https://www.pcengines.ch/. They're x86 based so you can run whatever on them, cheap and have really good performance.

nvarsj 8y ago

The ERL family is pretty bad as a router, in my experience. There is a longstanding firmware issue that introduces packet loss for routed packets (it doesn't multiplex across the dual cores correctly, which leads to out of order packets). If you really want to use Ubiquiti, I would suggest using an ER-X which is cheaper, doesn't have this problem, and is quadcore. The best option in my opinion is something Intel based running a well known Linux distro with automated security updates that is fully in your control. Shorewall can do everything needed for a home router. This option is a lot more expensive though.

Bluecobra 8y ago
Interesting that the more expensive router has this problem. I've been really happy with my ER-X, it works great with my internet service (500Mbs up/500Mbs down). I had some speed issues at first but this was solved by upgrading to the latest firmware and making sure hardware offloading was enabled.
- larkost 8y ago
  I was a bit annoyed that hardware routing is not automatically enabled for setups that can use it. It is not hard, but you have to stumble upon the fact that that setting exists (only on the command line).
  - Kadin 8y ago
    My recollection is that it's not enabled by default because there were (are?) some features that don't work once you enable it. I assume it's the Deep Packet Inspection and advanced routing type stuff. (Sadly my home internet connection is too slow to make hardware offloading on the edge router matter...)
tolien 8y ago
> There is a longstanding firmware issue that introduces packet loss for routed packets Interesting, do you have any more about this? Got an ER-PoE that intermittently loses packets and have never got to the bottom of why (I gave up and bought a non-Ubnt router, just haven’t got around to configuring it yet).
- nvarsj 8y ago
  https://community.ubnt.com/t5/EdgeRouter/UDP-packet-loss-on-Cavium-based-routers/td-p/1343012 https://community.ubnt.com/t5/EdgeRouter/UDP-packet-loss-on-... I was one of the people involved in some of the measurements on there. I avoid ubnt networking gear in general after that experience (although ER-X seems good and I use one at home as a smart switch). Their specialty is in APs, which work really great.
  - prplhaz4 8y ago
    The last update of the first post says that this was fixed in v1.10.0, and the release notes concur: https://community.ubnt.com/t5/EdgeMAX-Updates-Blog/EdgeMAX-EdgeRouter-software-release-v1-10-0/ba-p/2233263 https://community.ubnt.com/t5/EdgeMAX-Updates-Blog/EdgeMAX-E...
    - nvarsj 8y ago
      I knew I should have checked the release notes before commenting. No idea if it works but that would be a great improvement.
    - tolien 8y ago
      Open to the idea I’ve got a different issue, but I’m still seeing an issue with 1.10.5.
  - tolien 8y ago
    Thanks, and agreed. It was my first Ubnt gear, and I suspect it will be my last. It was so much cheaper than some of the alternatives though (that should probably have been a red flag…) but firmware that’s at best in continuous beta really isn’t good enough.
arminiusreturns 8y ago
I think this is batch based. Ubiquiti has had prod line issues intermittently, especially in the earlier batches. I would suggest trying to contact them for a replacement if you are getting packet loss.
- deleted 8y ago
  [deleted]

technofiend 8y ago

Sorry for the spam, I seem to post this regularly but the Ubiquiti EdgeRouter Lite will happily run OpenBSD. It supports the onboard packet accelerator with some extra configuration.

Fnoord 8y ago
I didn't know that, wow. I found some resources on this [1] [2] [3] but it seems like everything is working? Have you tried WireGuard on OpenBSD/octeon? [1] https://www.openbsd.org/octeon.html https://www.openbsd.org/octeon.html [2] https://news.ycombinator.com/item?id=10079210 https://news.ycombinator.com/item?id=10079210 [3] https://an.undulating.space/post/180411-erl-openbsd-upgrade/ https://an.undulating.space/post/180411-erl-openbsd-upgrade/
- technofiend 8y ago
  Not yet... I bought a brand new one just for testing with OpenBSD vs Vyatta because I'd like to benchmark performance of each.
  - jms703 8y ago
    Are you planning to post your benchmarks? Also, any helpful info on getting OpenBSD running on one of these is welcome!
    - technofiend 8y ago
      Yes I will post benchmarks and rulesets. I plan to make equal rulesets for each OS if possible.
ptomato 8y ago
Do you have any documentation on using the onboard packet accelerator with OpenBSD? I thought it was just binary linux blobs.
- 8y ago

godzillabrennus 8y ago

I am a big fan of PFSense. Not a huge fan of Netgate as a company and the direction they are taking the product. In any case, you can load it onto some fairly low cost hardware for your typical home user. It's fantastic. I am not a huge fan of the Ubiquiti routers. They required loading a config onto them just to get DHCP enabled and NAT setup for a typical 1 WAN and 1 LAN environment. Why on earth they would ship without that config on them when 99.9999% of environments are like that is bewildering to me. Don't know if it's changed since then but I haven't gone back to mess with them since.

squarefoot 8y ago
I couldn't recommend PFSense more. Setting up my home firewall years ago using it on a pcengines.ch board was really easy and fun. I used a (now long discontinued) WRAP board back in the day, then when broadband became faster I had to remove it because the slow processor would bottleneck my connection, but I'm looking forward to get faster hardware to have it working again. One day, well over 10 years ago, while I was moving from the old ISP to a new one, they screwed up something and I spent some weeks cut off from the Internet. The WRAP board had a mini-pci connector I already had fitted with a powerful WiFi card, so I connected a high gain directional antenna in place of the low gain one and started monitoring the channels. Back in the day there still were weak WEP encrypted connections, but I was even more lucky because a local ISP which delivered their routers with no default encryption had no less than 3 customers in my neighborhood, one of which, probably an office with no traffic at least since the evening, allowed me to surf a lot faster than my previous connection. PFSense was a godsend because all I had to do was set the rules so that the WLAN interface became a slave seen as the WAN, so I got back online all my cabled home network in a matter of minutes. As a Linux guy I have to admit PFSense and similar products (NAS4Free etc) interface is the best I have ever seen around wrt functionality and ease of use, sadly OpenWRT web interface simply doesn't stand a chance, and I'm not referring to aesthetics as I'm aware OpenWRT is aimed at hardware with orders of magnitude less resources, but pure functionality - in fact I have never been able to configure a small tp-link mr3020 router to use it as a WiFi bridge for my networked but not wireless printer. Yes it can be done and there is a HOWTO on that task, but it doesn't work and low level iptables scripts aren't exactly my strong point. It would be trivial doing that with PFSense, but sadly it cannot fit into that device. /Rant

Youden 8y ago

I like the software but for some reason my SFP port intermittently went out for exactly 2 minutes. I tested it with a couple of different SFP modules to be sure that wasn't the problem and contacted Ubiquiti support, assuming I could get an RMA. For whatever braindead reason, they told me that they wouldn't give me an RMA because they don't "support" 3rd party SFP modules. They wouldn't loan me one to fix the problem, they wouldn't agree to reimburse me if it didn't fix the problem, nothing. Buy their module or deal with broken equipment. I bought one of their SFP modules and to nobody's surprise the problem persisted. At the same time I bought a Mikrotik hAP and again to nobody's surprise, all the SFP modules that "failed" worked with zero problems. At that point Ubiquiti finally granted me an RMA but at that point I went and got a refund instead. After that support experience, I'll never buy Ubiquiti or recommend it again. I'd much rather recommend PC-Engines: https://www.pcengines.ch/ https://www.pcengines.ch/. They're x86 based so you can run whatever on them, cheap and have really good performance.