5 ms·

What are the best alternatives? I've read about some open source router alternatives (both hardware and software) in the past but forget the names. Also a very

What are the best alternatives? I've read about some open source router alternatives (both hardware and software) in the past but forget the names. Also a very good HW with hardened open software could be great. Any information?

ScottBurson 8y ago
I use a fanless PC running OpenBSD. It's a bit of work to configure, but I think I can trust it.
floil 8y ago
For myself, I switched everything over to Google WiFi's, precisely because they auto-update, and having worked previously on a security-focused team at Google, I trust them to have a competent security team and actually stay on top of the patches. I don't miss fussing with manually updating router firmware. Life is too short. On the other hand, my Nest thermostats were bricked after a software update this week, so maybe today I'm starting to see a crack in my "auto update is best" dogma...
- tatoalo 8y ago
  Same reason I've also switched to G-WiFi, lately I've been having issues with iOS devices disconnecting randomly and after a couple of seconds the connection would have been established again. I've tried playing around with DHCP but nothing changed, maybe my it's my ISP's router which is a pita to work with...(vodafone).
- TeMPOraL 8y ago
  > On the other hand, my Nest thermostats were bricked after a software update this week, so maybe today I'm starting to see a crack in my "auto update is best" dogma... It works best when the vendor can be trusted to only push security updates and occasional quality of life improvements. In general, automatic updates tend to be a vector for bloat, user-hostile features (e.g. spyware), and user-hostile business practices (e.g. remote bricking).
  - Wowfunhappy 8y ago
    Which vendors fit this criteria for you? I am not aware of any, except—somewhat ironically—for some open source projects.
    - walterbell 8y ago
      Microtik has a “bugfix” security update channel that can be selected in their routers mgmt interface. They also provide a “current/stable” channel which delivers new features.
    - TeMPOraL 8y ago
      > Which vendors fit this criteria for you? None. Hence, personally, I dislike auto updates.
- nitrogen 8y ago
  ...maybe today I'm starting to see a crack in my "auto update is best" dogma... For me that crack came when an automatic update to Android removed Exchange server support from my tablet (around 2015). I no longer had a good workflow for keeping up with work communication, which ultimately, as a sometimes-remote dev at the time, cost me a lot of productivity and reputation at that job. Now, anything that involves my productivity or quality of life (e g. thermostat) is on a manual update process as much as possible.
- stdplaceholder 8y ago
  I just checked my OnHub. It is the original, now over 3 years old. It got five updates this year, none of which I noticed. It's too bad that it's nearly guaranteed that they will kill this product line at some point in the future.
geofft 8y ago
Another approach here is that executable stacks, ASLR bypasses, etc. are only ways to make an exploit easier, and reducing your attack surface in the first place is a decent approach. The internet-facing side of my router does nothing interesting (I haven't enabled the onboard VPN, remote management, etc.) and I trust everyone with access to the LAN side of my home wifi not to attempt to exploit my router in the first place. That said, I do wonder how much attack surface is exposed to websites making permissible cross-domain requests (blind GETs from image loads, blind POSTs from <form action="http://192.168.0.1"> http://192.168.0.1">, etc.).
subway 8y ago
There are a ton of ARM based routers out on the market, both in user-friendly products (most current high end routers), and geek-friendly products (EspressoBIN, Turris Mox). I'm personally running OpenWRT on an EspressoBIN with an Atheros card, but I keep eyeing the Turris pretty hard.
- hsivonen 8y ago
  ARM-based products may be stuck on whatever kernel snapshot the board support package had. With x86_64 one can expect proper kernel security updates.
  - ryacko 8y ago
    There is insufficient demand for software warranties. It doesn’t seem unreasonable to ask for a warranty of at least two years, which means one would get two years plus how many additional years the product continues to be sold. Could even encourage security by using read-only flash, only a reboot is needed to clear any viruses.
    - hsivonen 8y ago
      You don't need a warranty to get kernel security patches _in practice_ if you run a mainstream distro on x86_64 hardware (which is available passively-cooled with low power consumption).
    - walterbell 8y ago
      Microsoft has proposed a model where they provide Linux security updates for 10 years, licensed separately from a device vendor that may go out of business. Let's see if Azure Sphere routers make it to market in 2019 - and at what price point. Maybe they can bundle the hardware in a single subscription service, or partner directly with cable companies.
  - subway 8y ago
    The boards I suggested are well supported in Mainline linux (though there are a couple minor patches that haven't yet been merged).
hsivonen 8y ago
Passively-cooled Apollo Lake x86_64 computer (e.g. from Compulab) with wifi and two Ethernet ports running a mainstream distro with proper security updates (e.g. Ubuntu). Self-configured dnsmasq, ufw and hostapd.
- deleted 8y ago
  [deleted]
TimTheTinker 8y ago
If you have a 1500+ sqft house, want an easy setup & excellent coverage, and want pro-level capabilities, try a Ubiquiti UniFi setup. Troy Hunt did this and is converted: https://www.troyhunt.com/ubiquiti-all-the-things-how-i-finally-fixed-my-dodgy-wifi/ https://www.troyhunt.com/ubiquiti-all-the-things-how-i-final... If you've got less square footage (or don't need top speeds everywhere), want to spend less money, and want something really easy to set up, try Ubiquiti AmpliFi. Here's Troy's writeup on that: https://www.troyhunt.com/how-i-finally-fixed-my-parents-dodgy-wifi-with-amplifi/ https://www.troyhunt.com/how-i-finally-fixed-my-parents-dodg... Personally, I am amply served by a quad-core HP thin client ($70 on eBay) running pfSense (w/ Intel server NIC, $25 on eBay) and a Ubiquiti UniFi UAP-AC-LR ($75-90 used on eBay). My living space is 1500 sqft. Internet speed is 150Mb/s up and down, and I get that speed of WiFi nearly all over the house. Total cost was less than $200.
- glup 8y ago
  I've happened on a similar solution after years of testing --- pfSense in a VM (with a dedicated NIC) on my NAS + backup box, and two Ubiquiti AC Pros. By far the fastest, most robust, and easy to configure system, plus nice benefits like pfBlockerNG (similar in functionality to a Pi Hole) and OpenVPN. Tutorials and documentation are generally pretty good for pfSense and UniFi is extremely intuitive.
- vesinisa 8y ago
  I got finally frustrated with the flaky WiFi reception at my parents-in-law's and bought a UniFi AP for them. I am very satisfied - the WiFi reception is now either 5/5 or 4/5 in every room, while the previous Asus WiFi router had no reception in some rooms. But I was rather surprised by the lack of almost any configuration options in the UniFi. No dedicated WebUI, just a few basic configuration options (SSID + WPA2 password) in the mobile app. Do I need to procure a Windows machine and download the Windows app to configure and take full advantage of the AP? What extra options can I set up with the desktop app in addition to the basic configuration options in the mobile app? As said though - it works really well as it is.
  - TimTheTinker 8y ago
walterbell 8y ago
PC Engines APU2 fanless PC has multiple NICs, optional LTE/SSD, AMD CPU and coreboot open-source firmware. Widely used with pfSense and OpenBSD. TPM available via LPC bus.

ScottBurson 8y ago

I use a fanless PC running OpenBSD. It's a bit of work to configure, but I think I can trust it.

floil 8y ago

For myself, I switched everything over to Google WiFi's, precisely because they auto-update, and having worked previously on a security-focused team at Google, I trust them to have a competent security team and actually stay on top of the patches. I don't miss fussing with manually updating router firmware. Life is too short. On the other hand, my Nest thermostats were bricked after a software update this week, so maybe today I'm starting to see a crack in my "auto update is best" dogma...

tatoalo 8y ago
Same reason I've also switched to G-WiFi, lately I've been having issues with iOS devices disconnecting randomly and after a couple of seconds the connection would have been established again. I've tried playing around with DHCP but nothing changed, maybe my it's my ISP's router which is a pita to work with...(vodafone).
TeMPOraL 8y ago
> On the other hand, my Nest thermostats were bricked after a software update this week, so maybe today I'm starting to see a crack in my "auto update is best" dogma... It works best when the vendor can be trusted to only push security updates and occasional quality of life improvements. In general, automatic updates tend to be a vector for bloat, user-hostile features (e.g. spyware), and user-hostile business practices (e.g. remote bricking).
- Wowfunhappy 8y ago
  Which vendors fit this criteria for you? I am not aware of any, except—somewhat ironically—for some open source projects.
  - walterbell 8y ago
    Microtik has a “bugfix” security update channel that can be selected in their routers mgmt interface. They also provide a “current/stable” channel which delivers new features.
  - TeMPOraL 8y ago
    > Which vendors fit this criteria for you? None. Hence, personally, I dislike auto updates.
nitrogen 8y ago
...maybe today I'm starting to see a crack in my "auto update is best" dogma... For me that crack came when an automatic update to Android removed Exchange server support from my tablet (around 2015). I no longer had a good workflow for keeping up with work communication, which ultimately, as a sometimes-remote dev at the time, cost me a lot of productivity and reputation at that job. Now, anything that involves my productivity or quality of life (e g. thermostat) is on a manual update process as much as possible.
stdplaceholder 8y ago
I just checked my OnHub. It is the original, now over 3 years old. It got five updates this year, none of which I noticed. It's too bad that it's nearly guaranteed that they will kill this product line at some point in the future.

geofft 8y ago

Another approach here is that executable stacks, ASLR bypasses, etc. are only ways to make an exploit easier, and reducing your attack surface in the first place is a decent approach. The internet-facing side of my router does nothing interesting (I haven't enabled the onboard VPN, remote management, etc.) and I trust everyone with access to the LAN side of my home wifi not to attempt to exploit my router in the first place. That said, I do wonder how much attack surface is exposed to websites making permissible cross-domain requests (blind GETs from image loads, blind POSTs from <form action="http://192.168.0.1"> http://192.168.0.1">, etc.).

subway 8y ago

There are a ton of ARM based routers out on the market, both in user-friendly products (most current high end routers), and geek-friendly products (EspressoBIN, Turris Mox). I'm personally running OpenWRT on an EspressoBIN with an Atheros card, but I keep eyeing the Turris pretty hard.

hsivonen 8y ago
ARM-based products may be stuck on whatever kernel snapshot the board support package had. With x86_64 one can expect proper kernel security updates.
- ryacko 8y ago
  There is insufficient demand for software warranties. It doesn’t seem unreasonable to ask for a warranty of at least two years, which means one would get two years plus how many additional years the product continues to be sold. Could even encourage security by using read-only flash, only a reboot is needed to clear any viruses.
  - hsivonen 8y ago
    You don't need a warranty to get kernel security patches _in practice_ if you run a mainstream distro on x86_64 hardware (which is available passively-cooled with low power consumption).
  - walterbell 8y ago
    Microsoft has proposed a model where they provide Linux security updates for 10 years, licensed separately from a device vendor that may go out of business. Let's see if Azure Sphere routers make it to market in 2019 - and at what price point. Maybe they can bundle the hardware in a single subscription service, or partner directly with cable companies.
- subway 8y ago
  The boards I suggested are well supported in Mainline linux (though there are a couple minor patches that haven't yet been merged).

hsivonen 8y ago

Passively-cooled Apollo Lake x86_64 computer (e.g. from Compulab) with wifi and two Ethernet ports running a mainstream distro with proper security updates (e.g. Ubuntu). Self-configured dnsmasq, ufw and hostapd.

deleted 8y ago
[deleted]

TimTheTinker 8y ago

If you have a 1500+ sqft house, want an easy setup & excellent coverage, and want pro-level capabilities, try a Ubiquiti UniFi setup. Troy Hunt did this and is converted: https://www.troyhunt.com/ubiquiti-all-the-things-how-i-finally-fixed-my-dodgy-wifi/ https://www.troyhunt.com/ubiquiti-all-the-things-how-i-final... If you've got less square footage (or don't need top speeds everywhere), want to spend less money, and want something really easy to set up, try Ubiquiti AmpliFi. Here's Troy's writeup on that: https://www.troyhunt.com/how-i-finally-fixed-my-parents-dodgy-wifi-with-amplifi/ https://www.troyhunt.com/how-i-finally-fixed-my-parents-dodg... Personally, I am amply served by a quad-core HP thin client ($70 on eBay) running pfSense (w/ Intel server NIC, $25 on eBay) and a Ubiquiti UniFi UAP-AC-LR ($75-90 used on eBay). My living space is 1500 sqft. Internet speed is 150Mb/s up and down, and I get that speed of WiFi nearly all over the house. Total cost was less than $200.

glup 8y ago
I've happened on a similar solution after years of testing --- pfSense in a VM (with a dedicated NIC) on my NAS + backup box, and two Ubiquiti AC Pros. By far the fastest, most robust, and easy to configure system, plus nice benefits like pfBlockerNG (similar in functionality to a Pi Hole) and OpenVPN. Tutorials and documentation are generally pretty good for pfSense and UniFi is extremely intuitive.
vesinisa 8y ago
I got finally frustrated with the flaky WiFi reception at my parents-in-law's and bought a UniFi AP for them. I am very satisfied - the WiFi reception is now either 5/5 or 4/5 in every room, while the previous Asus WiFi router had no reception in some rooms. But I was rather surprised by the lack of almost any configuration options in the UniFi. No dedicated WebUI, just a few basic configuration options (SSID + WPA2 password) in the mobile app. Do I need to procure a Windows machine and download the Windows app to configure and take full advantage of the AP? What extra options can I set up with the desktop app in addition to the basic configuration options in the mobile app? As said though - it works really well as it is.
- TimTheTinker 8y ago

walterbell 8y ago

PC Engines APU2 fanless PC has multiple NICs, optional LTE/SSD, AMD CPU and coreboot open-source firmware. Widely used with pfSense and OpenBSD. TPM available via LPC bus.