24 ms·

Was shopping for alternatives to my Ubiquiti last night. Seems like there is nothing good out there. Engenius has shit hardware and a cloud controller. Aruba ha

Was shopping for alternatives to my Ubiquiti last night. Seems like there is nothing good out there. Engenius has shit hardware and a cloud controller. Aruba has a cloud controller AND you have to pay for a license. Cisco makes you pay for a license. TP-Link is cloud-based. WTF. Does anyone have a decent WAP where I can use PoE, deploy like 5 of them and have them support roaming between APs, all managed locally? Is that too much to ask?

croutonwagon 6y ago
Ruckus R710 or R510 unleashed. I was talking about Ubnt's horrendous security in another thread just last night. https://news.ycombinator.com/item?id=26628198 https://news.ycombinator.com/item?id=26628198 Or if you just want Wave1 Hardware...R700/R500 You can get these as overstock on the cheap on amazon etc. The unleashed version means it can run the controller on the AP.
- taddevries 6y ago
  The R700/R500 are End-of-Life[1] so be sure you're OK with not getting new firmware. 1. https://support.ruckuswireless.com/product_families/4-eol-ruckus-products https://support.ruckuswireless.com/product_families/4-eol-ru...
  - croutonwagon 6y ago
    Totally agree. And the first gen wave2 stuff (ie:710/510) is probably not too far behind. I do find myself rarely looking for firmware upgrades unless there’s a specific issue I can’t workaround. Even on my ubnt equipment. I find it best to just leave it segmented/network isolated and humming. All these cloud features just increase exposure and grant the vendor leverage to hold you hostage.
traceroute66 6y ago
For those people here saying "go Ruckus unleashed" ... caveat emptor my friends ! I have it on very good authority that Ruckus have started rolling out a change in their pricing model to require a Unleashed license per AP to operate, a move which obviously increases costs to the end-user. Some people might say its a deliberate move prevent cannibalisation of their main business model by nudging people away from Unleashed. I couldn't possibly comment.
- IgorPartola 6y ago
  Your credit card is stolen and your bank disables it -> your network is dead. What a great user experience.
  - 1over137 6y ago
    >Your credit card is stolen and your bank disables it -> your network is dead. What are you describing here? I have a Ruckus Unleashed that I bought without a credit card and it works fine.
- c0nsumer 6y ago
  Can you share info? Because currently for a single site there is no license fee. I've only got one AP at home, but could put a bunch more of wanted. It works so well I wouldn't mind paying some fee, but it'll depend on how much.
  - traceroute66 6y ago
    @c0nsumer My earlier comment was based on a change of policy which happened around 1st March, and any Unleashed quotes as of 1st March (and the two-weeks prior) need to be re-quoted for the new "license per AP" Unleashed model. I've been a bit busy with other work since that bombshell dropped, but if I get a moment I'll try to dig up some pricing. The other thing to note is feature discrepancy between Unleashed and standard. Perhaps of most interest to your average HN contributor was (the last time I checked) IPv6 was not supported on Unleashed firmware, and not much sense of urgency (if any !) to rectify that.
    - c0nsumer 6y ago
      Thanks! I completely glossed over the IPv6 thing... At home I don't get native IPv6 from my ISP, so I just tend to forget about that. Although it would be neat. For me I bought my AP on eBay and just plopped the standalone Unleashed firmware on it and that's all seemed fine. In what I see there's nothing changing? But it sounds like you're running a /much/ larger install.
deleted 6y ago
[deleted]
deleted 6y ago
[deleted]
msh 6y ago
Mikrotik have products that are exactly like that.
Jnr 6y ago
Try Mikrotik. It can do all of the things you listed and more.
jlawer 6y ago
Synology. Isn’t cheap, decent performance though. However it doesn’t seem to be the brands focus
jandrese 6y ago
Also add that all of the SOHO equipment is garbage that drops connections randomly, crashes, or simply can't deal with some WiFi chips. This is the reason I went with the Ubiquity UniFi 6 years ago. It was the only one I tried that didn't constantly drop connections or cost a fortune. But it's only G and I've been considering an upgrade, but there are no good options on the market that don't have stupid cloud management bullshit, are built on garbage hardware, or cost an arm and a leg.
notamy 6y ago
Peplink seems pretty good; they do have a Cloud:tm: management offering called InControl2 but as far as I'm aware it's entirely optional. I've had good luck configuring everything via the local UI. My setup is a Balance Two + a few One AX APs.
- pentae 6y ago
  +1 for Peplink, Surprised more people haven't mentioned them
jsmith99 6y ago
Technically, Ubiquiti does have a local option. You can run the controller locally and disable cloud login.
- IgorPartola 6y ago
  That's how I run it, but it seems they are now pushing ads to local controllers and between this and deprecating recently released devices, I just completely lost trust in them.
  - dgudkov 6y ago
    > it seems they are now pushing ads to local controllers The pervasiveness of adtech doesn't cease to impress me.
    - ClumsyPilot 6y ago
      I really hope that one day it will be remembered the same way we remember ritual sacrafice .
    - iamacyborg 6y ago
      It isn’t adtech, per se.
  - philjohn 6y ago
    Small correction - if you don't have a product that would display stats in a portion of the "single pane of glass" control panel, it displays an ad instead of a "you don't have this product, no data to see here". Scummy? Sure ... especially if you don't have a Ubiquiti gateway but only AP's so the top part of the page is blocked out, but it's not exactly "pushing ads at me!" in the traditional sense - e.g. they're not targetting ads, they're not collecting data.
- pseudalopex 6y ago
  People have reported cloud login can't be disabled now.
benjohnson 6y ago
It's a shame that Mikrotik doesn't have a easy to use global GUI. It's the right hardware, and great firmware and wonderful flexibility - but it needs an easy to use GUI controller to make the simple stuff easy to take over from Ubiquiti.
- sam_lowry_ 6y ago
  Global UI? You mean, AWS-hosted configurator for your network? We just had example of it being security risk. God save Mikrotik from implementing something similar.
  - IgorPartola 6y ago
    No, a local controller that you run on a machine inside your LAN.
    - coder543 6y ago
      That's basically what MikroTik CAPsMAN is, depending on your needs. I think it's specific to Access Points, so not a general purpose centralized controller for MikroTik equipment, but... centralizing access point management seems to be the main thing under discussion here.
      - taldo 6y ago
        CAPsMAN is a royal PITA to set up. You have to manually add all the wifi channels, map each AP to the channels it'll use, and a lot of busywork. Once it's set up, though, it works fine, and lets you upgrade all devices from the manager, etc.
        pilsetnieks 6y ago
        > You have to manually add all the wifi channels, map each AP to the channels it'll use, and a lot of busywork. No, you don't? I mean you can but you don't need to. There are cases when that is useful, true - for example, the automatic channel selection makes some curious choices sometimes.
ptomato 6y ago
Ruckus Unleashed is what you're looking for.
- surfsvammel 6y ago
  They are triple the cost of the UniFi stuff. So not really a drop in replacement.
  - bubblethink 6y ago
    Look on ebay for slightly older models. R710, R720 should be $200-$300. Not a replacement at scale, but the one-off purchase from ebay is fine for home use.
    - antattack 6y ago
      Unfortunately, w/o firmware updates they are just little better than a brick. Especially for WIFI hardware where you cannot control who can access it - better keep your APs patched.
      - bubblethink 6y ago
        Both R710 and R720 are currently supported. I installed an update last week.
        antattack 6y ago
        Yeah, but one cannot upgrade them without purchasing annual support contract from Ruckus.
        bubblethink 6y ago
        No, you do not need one for unleashed.
        6y ago
weaksauce 6y ago
have you checked out eero? https://eero.com/ https://eero.com/ I know someone that works there and they seem pretty happy with the place and product. just saw the amazon link now though so that may be a detriment depending on your view of them. (I have never used their systems or anything so it's not really an endorsement but something to consider)
- pseudalopex 6y ago
  Eero is cloud controlled.
Scramblejams 6y ago
No, TP-Link's Omada controller can be run locally, I do that at home and at my parents' house. It is not cloud-connected unless you turn that on. Runs surprisingly well on a Raspberry Pi 2, actually. I've got a setup similar to what you're asking for. The TP-Link APs (AC1750, AC1350 and AC1200) support PoE, they're in a wireless mesh, support roaming, and all configuration is handled with one interface, no cloud involved. Just make sure that what you're ordering says it supports Omada. They still ship a lot of SMB gear that doesn't, but all the basics are there now.
- IgorPartola 6y ago
  How is the experience otherwise? Roaming? Throughput? Reliability? I generally like their hardware.
  - jackweirdy 6y ago
    Great without it. The major improvement I noticed with it, is 802.11k & v (faster handoff). Without those, it takes a little longer for the device to switch APs at the borders of their coverage. Mostly imperceptible, but the longer handoff times can be enough to kill a phone call over iPhone WiFi calling
  - agurk 6y ago
    I run a similar setup with a bunch of EAP-225 APs controlled by a local instance of their Omada software (running on x64 rather that on ARM). I've been very happy with roaming/throughput/reliability generally. The EAP-225 is 2x2, which they don't readily announce. Their newer and more expensive units are available as 4x4. That being said they're so cheap, I've been happy just to throw more onto the network. For the software to manage them it uses some kind of multicast identification scheme to find new APs. If you're on a different subnet then it won't be able to automatically see them. They have a tool to connect to the AP and give it the management server IP, but that's Windows only. The other option (that I went for) is just to create a management VLAN (good practice anyway) that the controller and APs live on. This is specifically supported by the APs.
  - Scramblejams 6y ago
Abishek_Muthian 6y ago
> Does anyone have a decent WAP where I can use PoE There are PoE devices with OpenWRT support[1] and should be possible to enable 802.11r if they have the support. They can be managed locally even with self-signed certificate. [1] https://openwrt.org/toh/views/toh_poe-powered https://openwrt.org/toh/views/toh_poe-powered
- IgorPartola 6y ago
  I use OpenWRT now and would really rather avoid it. I want a central controller, not having every AP have its own UI. Plus firmware updates area always an adventure.
  - the8472 6y ago
    OpenWRT also provides SSH access and CLI tools, so if needed things can be automated the old-fashioned way.
    - oblio 6y ago
      I don't know about you, but I "automate the old-fashioned way" at my day job, I want the damned thing to just work without me bothering with "SSH access and CLI tools" at home.
      - fock 6y ago
        and how many APs do you have at home?
        oblio 6y ago
        Right now? 1. But that's about to change, that's why I'm reading these comments. I was planning on buying a bunch of Ubiquiti APs.
  - josteink 6y ago
    > Plus firmware updates area always an adventure. To somewhat eliminate the chances of adventure, I’ve profiled the setup for each of my many OpenWRT devices and created unique profiles for them in a (reasonably) simple Git repo[1]. All I need to do to get device-specific firmware is to update the OpenWRT version-number in a single makefile and the rest happens automatically. I’ve even setup Github Actions to build the firmware for me (basically, run make), so I can even get/build new firmware from my phone. I’ve yet to have any issues when flashing these builds. It used to be much worse when flashing the regular “official” OpenWRT image and restoring packages afterwards. Couldn’t be simpler! (With the regular Linuxy you-have-to-build-it-yourself-first clause) [1] https://github.com/josteink/openwrt-build https://github.com/josteink/openwrt-build
resfirestar 6y ago
> Does anyone have a decent WAP where I can use PoE, deploy like 5 of them and have them support roaming between APs, all managed locally? Is that too much to ask? Not as comprehensive as Ubiquiti’s management interface but the CAPsMAN feature on Mikrotik routers and APs does cover this use case.
betterunix2 6y ago
Mikrotik, but unfortunately getting reasonable throughput for wireless clients is a serious challenge (I always have better results with openwrt on the same hardware). Still, nice to have local control and not have to rely on some cloud service just to use the hardware I bought.
- Jnr 6y ago
  I wonder what is reasonable WiFi throughput for you? With my 5 year old Mikrotik hAP AC I am able to get up to 500 Mbit/s on lan. And my old phone now shows 250 Mbit/s on speedtest.net both directions. How much more are we talking about? Have I missed some big hardware upgrade recently?
  - betterunix2 6y ago
    Using 80Mhz channels I found the default configuration never exceeded 200Mbit/s using iperf. For me "reasonable" is closer to 800Mbit/s, which is roughly the theoretical limit for 80Mhz with 2 spatial streams. I run my tests with my devices sitting 1 meter from the AP. This is on a hAP AC, and like I said, I get much better performance (close to the theoretical max) running OpenWRT on the same unit. I have had similar issues with the RB4011 and cAP AC, and in both the NYC area and suburban Virginia (so it is not just an issue of spectrum crowding in the city).
    - Jnr 6y ago
      Yeah, that sounds a bit slow. I suggest checking if faspath and fasttrack is working. I remember that when I had hAP AC using firewall rules inside lan, it also did not go much faster. Good indication was CPU usage. If it used 100% CPU at ~200Mbit/s then it was firewall slowing things down.
dolni 6y ago
So the question for becomes: is there just not a good enthusiast market for this stuff? I have met a number of people who are "network nerds", so I'm inclined to think the market does exist. With any of the plethora of consumer devices (Linksys, Netgear, D-Link) it's a dice roll whether your gear is complete garbage or not. A lot of the time, you're coming up snake eyes. I've got some Ubiquiti gear I bought a couple years ago. Like you, I want good quality gear that I can manage myself. I don't need a bunch of fancy corporate garbage, like link aggregation or cloud management. Give me solid, hardware accelerated routing and switching, flexibility over my local DNS, and maybe some VLANing. I was running Linux on a small x86 box as my last network router. Maybe it's time to get back to that. That or go back to banging rocks together. Haven't decided which, yet.
- IgorPartola 6y ago
  I can't imagine that there isn't a market for this. Look at the number of people recommending Ubiquiti stuff to each other. There are entire YouTube channels dedicated to it. If your whole living space or small office can be covered with a single access point, get a 3-in-1 combo that has a WAP, a router, and a small switch. But if you don't, you are left with, what exactly? There is also some demand for mesh stuff, for people who rent and don't want to run Ethernet cable. My plan: OPNsense on a PC Engines board for router + firewall, an unmanaged PoE-providing switch for switching, and something from 2-8 WAPs for indoor/outdoor Wi-Fi.
  - bonestamp2 6y ago
    I had a PC Engines board for awhile and I really liked it, but make sure the one you order can support your internet bandwidth. When I upgraded to 1 gig internet, I was pulling around 450mbps on my PC Engines apu1d4. I ended up getting a Ubiquiti Unifi Secure Gateway and then I was able to pull the full 1 gig. It's pretty hard to recommend Unifi based on how they handled this breach, but the hardware itself has performed very well. Hopefully the new PC Engines boards can accommodate your needs.
    - IgorPartola 6y ago
wikibob 6y ago
Eero is amazing. It Just Works. Apple style. Plug it in. Never fuck with it. Rock solid.
- discardable_dan 6y ago
  They are amazon-owned. I'd be shocked if they weren't collecting and reporting telemetry.
  - astrange 6y ago
    Telemetry is an extremely important part of making things just work. There's no other way to find the unknown unknowns.
    - heavyset_go 6y ago
      That's awfully convenient for the company offering those products, but I want to control what happens on my network, even if that's inconvenient for some hardware vendor. Case studies, focus groups, surveys and interviews are great ways to find the unknown unknowns. Of course, you need to pay people to participate in them, and then you need to pay expensive employees to conduct, collect and analyze the results. It's often just cheaper to spy on customers, though, and pretend that there is no other possible way to conduct business.
      - sofixa 6y ago
        > Case studies, focus groups, surveys and interviews are great ways to find the unknown unknowns. Of course, you need to pay people to participate in them, and then you need to pay expensive employees to conduct, collect and analyze the results No they're not, because the vast majority of people simply won't be bothered, and most people probably aren't as reliable as concrete data.
        heavyset_go 6y ago
        People will be bothered if you pay them. DigitalOcean does this with focus groups for developers, and offers $500+ each for an hour or two of developers' time.
mattmcknight 6y ago
You are going to end up paying for a license to cover security updates. I use Fortinet, not cheap.
Lammy 6y ago
I have exactly this setup with three Aruba Instant APs (WiFi 5), but afaict they’ve combined the Instant product line with their cloud offering or something? I’m not entirely sure where they’re going with it, but I am very happy with the setup I have.
Saris 6y ago
As far as I know, TP-Link doesn't require any cloud based service, or even a local controller. They can work fine without any of it and you just manage them locally/directly.
- jandrese 6y ago
  I've never had good luck with TP-Link hardware though. Constant crashes/disconnections once you get past a few devices on the network, mysterious failures, hardware quickly getting dumped into the unsupported list, and so on. I've sworn off of them entirely.
- SamuelAdams 6y ago
  Yep, this is what I do. I used the EAP245 and now the EAP 660 HD. Both were rock solid devices. Managed locally via a web browser. Plugs into a netgear switch, into a pfsense router.
- deleted 6y ago
  [deleted]
- yumraj 6y ago
  TP-Link is a Chinese company. Doesn't inspire much confidence..
  - imwillofficial 6y ago
    And Cisco does? With it’s known back doors from the NSA?
    - VectorLock 6y ago
      Whataboutism aside, Cisco inspires even less confidence. Source: Used to work for Cisco.
    - bbarnett 6y ago
      Never, ever happened. Ever. You're conflating "NSA secretly rerouting shipping company deliveries to end-users, installing their firmware, then senting it on" with "Cisco willingly did that". Cisco was unaware, and once aware (thanks to Snowden), Cisco took steps to try to prevent it, by altering shipping destinations, at the last minute, on route.
takeda 6y ago
Isn't enough to just disable cloud access? Edit: I got upvoted by somebody, but as an UI user I'm genuinely looking for an answer. If it's still possible to get inside if devices aren't connected to UIs cloud.
- IgorPartola 6y ago
  That’s a part of it. But also: 1. They are now pushing ads to their local controllers. That is a shady tactic. It also means the controller is phoning home. It means they might have an XSS in that code now or in the future. 2. They just deprecated a bunch of relatively new hardware. If I’m going to invest a non-trivial amount into their hardware I want to know it’ll keep working for a long time. 3. They lost trust due to this breach. How can I trust their code to secure my locks network if they can’t secure their own?
klagermkii 6y ago
With TP-Link you can run the Omada controller for their EAP line on a local device (I have it running on a Pi4).
gertrunde 6y ago
The TP-link offering looks very similar to Ubiquiti from a quick scan a month or two back. Both will run from locally hosted controllers if desired. I've been seeing more Cisco "Meraki Go" kit around as well, which looks to target the same use cases as Ubiquiti (very very similar gear, WAPs, low end switches & gateways), albeit without a local controller option, but at least without the usual steep Meraki subscription charges.
Vedor 6y ago
Not 100% sure if that's what you are looking for (I don't do much network works) but I think that Camsat's GlobalCAM-4.5G may be worth checking, with one catch: the company targets CCTV market. Still, that's just a router, without any special license fees or mandatory clouds.
oblio 6y ago
Maybe Plume Homepass: https://www.plume.com/homepass/ https://www.plume.com/homepass/ ? I'm not sure if they're 100% equivalent, but it seems to cover a good part of the Ubiquiti feature.
- HowardStark 6y ago
  Interesting. Subscription-based services in the home seem like a disaster waiting to happen. Unless you can self host in the event of a company shut-down, you're beholden to a company and their solvency. Can't see anything on their website for a transition plan in the event of shutdown (and of course, why would they post that and potentially signal lack of confidence in their longevity).
antattack 6y ago
Omada EAP245. You can use appliance and/or software controller that you can run locally, to manage your APs no cloud needed. https://www.tp-link.com/us/business-networking/ceiling-mount-access-point/eap245/ https://www.tp-link.com/us/business-networking/ceiling-mount...
- nicolas314 6y ago
  And if you only have one, no need to run Omada. Completely controlled from the AP web interface.
jiveturkey 6y ago
ubiquiti is fine. you don't have to use the cloud controller. CLI works just fine, at least the products I have used.
- IgorPartola 6y ago
  The featured article seems to say to me that they are far from fine.
heavyset_go 6y ago
Look into Mikrotik hardware and OpenWRT. Of the Mikrotik-based hardware I'm familiar with, they support PoE. OpenWRT supports roaming and mesh networks, and is a local solution, as opposed to a cloud-based one. There are no licenses you need to pay for, either.
- briangerman 6y ago
  I just ordered a mikrotik 10gb https://mikrotik.com/product/crs305_1g_4s_in https://mikrotik.com/product/crs305_1g_4s_in. The guys at work recommended it so hoping for the best!
  - sigstoat 6y ago
    i've got one of those, and another mikrotik 10gb switch. whatever the 16 port one is. they've been working nicely. i have good luck with fiber SFP+ modules, but it seems picky about 1G copper SFP modules, fwiw.
    - briangerman 6y ago
      really i ordered cisco ones do those work?
      - sigstoat 6y ago
        like actual cisco-brand ones, or cisco compatible ones? i checked my order history, it looks like ipolex and 10gtk 1000bT copper modules have had troubles in my mikrotik switches. the mikrotik brand works fine. and every 10G fiber module i've tried has worked (lots of fs.com, and i think 10gtek, and probably some other brand off amazon)
  - old-gregg 6y ago
    HN community is in an endless loop of switching vendors: https://news.ycombinator.com/item?id=18200119 https://news.ycombinator.com/item?id=18200119 IMO using what we have intelligently is easier. Uniquiti hardware has the Edge line of routers and switches that are not cloud-controlled, not listen on any ports, and not establish any connections on your behalf.
swiley 6y ago
If you don't feel like configuring hostapd and dnsmasq I'm pretty sure there's an nmcli one-liner that will have network manager run a WAP for you. I use 'hotspot' on my phone all the time. WAPs have been absolute crap for years.
motiejus 6y ago
Turris series.
awillen 6y ago
So one might call them... ubiquitous? I'm so sorry. I'll go now.
kryogen1c 6y ago
maybe their different product lines are managed differently, but all my Unifi WAPs, router, and switches are managed on a local controller that i installed and maintain myself. i recall some features being locked behind a UBNT account, but that was only reporting-type stuff IIRC https://help.ui.com/hc/en-us/articles/360012282453-UniFi-Set-up-a-UniFi-Network-Controller https://help.ui.com/hc/en-us/articles/360012282453-UniFi-Set...
WrtCdEvrydy 6y ago
TP-Link Omada is locally controlled (through a smartphone) but you can buy the Omada Cloud to control it remotely. It works with their small 16 port (8 PoE switch).
azernik 6y ago
Disclaimer: worked for Meraki (now Cisco Meraki) for several years. Generally, halfway decent wireless APs are all targeted at the enterprise market. Consumer hardware is a brutal race to the bottom, as lay consumers aren't qualified to compare options based on anything but price and UI. Ubiquiti was an outlier in trying to bring enterprise features to the consumer market The problem for enthusiasts and small business/home office setups like yours are that both the enterprise market (e.g. Meraki) and the premium consumer market (e.g. Google WiFi) focus heavily on ease of management - cloud controllers are table stakes these days, not a controversial feature. Part of that premium that Meraki, Aruba, and that class of enterprise supplier charge is about having a trustworthy and secured backend. Note, however, that roaming between APs is a feature of the 802.11 standard; you just need to have all your APs on the same layer 2 (802.x) network, and using the same SSID and credentials. No fancy hardware required, and you can even mix and match vendors.
- fullstop 6y ago
  Surely 802.11r has a purpose, yes?
  - betterunix2 6y ago
    Faster handoffs between APs.
  - cassianoleal 6y ago
    Yes, roaming by sharing SSID and passcode is a world of pain. 802.11r solves all those pains, I've been using it on OpenWRT for months without a glitch.
    - synergy20 6y ago
      how do you enable 802.11r on openwrt? on which model of router
      - mikehotel 6y ago
        Install the wpad pkg and 802.11r should show up in wireless config screens. See https://forum.openwrt.org/t/802-11r-fast-roaming-in-luci/11730 https://forum.openwrt.org/t/802-11r-fast-roaming-in-luci/117...
deleted 6y ago
[deleted]
__d 6y ago
Maybe a bit too soon, but has anyone tried Maxwell? https://www.crowdsupply.com/andy-haas/maxwell https://www.crowdsupply.com/andy-haas/maxwell
api 6y ago
Get Linux boards and USB-3 WiFi dongles with well-supported chipsets and roll your own? The other alternative is to go way up-market and buy industrial gear. Consumer gear is shit due to a race to the bottom mentality. 90% of consumers buy the cheapest. This is also what turned every TV and appliance into a feature-encrusted shitbox full of spyware.
- edoceo 6y ago
  I think you can do it with Pi-Zero and BATMAN? I gotta find my notes.
Godel_unicode 6y ago
You can absolutely manage ubiquiti local. Even with a ridiculously named local appliance called a cloud key. Their cameras are unfortunately another story.
topher_t 6y ago
I hear Cardi B and Megan Thee Stallion have some pretty excellent WAP's.
tubularhells 6y ago
Mikrotik is nice and does all of those things. Just needs actual expertise at network administration to set up. Once done though, it's fire and forget.
cassianoleal 6y ago
I have a Turris Omnia for my main router. It's a solid piece of kit. The OS, TurrisOS, is based on OpenWRT and for a while they were having trouble keeping up-to-date but that's been sorted in recent releases. There are great features like auto-updates and BTRFS snapshots and the ability to rollback to previous known good if you screw up a config. I also run LXC containers on it for things like PiHole (not on the internal flash but the main board takes an M.2 SSD). The Turris MOX is a modular Turris system that you can assemble from the parts that you need. I have a small Gl.iNet router upstairs flashed with upstream OpenWRT that I use as a WiFi access point and have setup 802.11r for BSSID roaming. Have been using this setup for months and handoff has been completely transparent.
- emptysongglass 6y ago
  These guys burned me so hard. Something on my Omnia burned out. I offered to pay to have it shipped and fixed and shipped back. They stopped emailing me back. It was a horrible, horrible support experience.
  - cassianoleal 6y ago
    Ugh, sorry to hear that. :( They can be a little nasty to users on the forum as well but in general I really like the product.
chrisweekly 6y ago
Happy enough w my Netgear ORBI (2-node mesh router covers my 3500sq ft house; handoff is fine)
1over137 6y ago
>Seems like there is nothing good out there Check out Ruckus. I've found their 'unleashed' stuff quite nice (no affiliation, just a customer).
TranceMan 6y ago
Have a look into Ruckus with their local zone director offering.
glsdfgkjsklfj 6y ago
i did the same research 3mo ago. Was torn between a Ubiquiti (mostly because a coworker was bugging me) and a Ruckus Unleashed. I wish i had gone with the Ruckus. The lie that you can easily self host your own controller for ubiquiti is vastly exaggerated. Spent several hours of a Saturday patching extremely ancient versions of mongodb and compiling stuff. Not to mention that if you have a VM and turn the controller off, several features of the APs will stop working. and range for their Pro AP is lacking at most. I wish ubiquiti just published the damn shell commands so i could be able to manage it without the silly troublesome "controller" which is just an annoying web ui. So condescending and inefficient just for the sake of exploiting the customer base for lock-in effect. They are just a little cisco.
roody15 6y ago
Aruba sells IAP instant models that do this. No cloud required. (also sell campus controller local no cloud ... but this route is pricey)
- DrPhish 6y ago
  Yup IAP with airwave management is a sweet setup...if you can afford it! Even better combined with clearpass and 802.1x
friend-monoid 6y ago
Is pfSense, vyos, stuff like that out of fashion? Or too hard to maintain? Automating that stuff with ansible should solve the central management bit...
- ghostpepper 6y ago
  Can you run pfsense on an AP or switch or does it only handle gateway/firewall/routing tasks?
  - friend-monoid 6y ago
    Yeah, of course you can. It's just a freebsd with some configuration stuff on top, it can run hostap, switch, it can do lagg and span ports and all the other stuff you'd expect... not sure how common it is though
bonestamp2 6y ago
> all managed locally? Other than ubiquiti I assume you mean? Not that I know of. I want the old ubiquiti back where customers, not stock price and ad revenue, was the focus.
fl0wenol 6y ago
You're in the boat of deploying OpenWRT or similar low-cost APs presenting the same SSID on a shared VLAN, plugging them into your favorite PoE switch, and manually configuring their channel strengths, etc. It isn't so bad if it's a one-and-done thing, but all of the out-of-the-box solutions are very IoT. Enterprise solutions with your self-contained WLAN controller and APs (not including PoE switches) are typically pretty pricey (>$5k, can spend a lot more).
hrez 6y ago
For me OpenWRT does that. No cloud.
r1ch 6y ago
I'm a big fan of flashing OpenWRT on supported APs. You lose central management and setup takes time, but I'm very happy with the stability and no worries about cloud services or vendor lock-in etc.
xwolfi 6y ago
My Synologies do that across several locations in my city. Not sure what PoE is, but Synology has site to site vpn which is amazing !
- wadkar 6y ago
  PoE is probably Power over Ethernet. With that you don’t have to worry about laying down electrical line to power the APs. The APs draw power from the Ethernet line itself
newhotelowner 6y ago
Ruckus seems pretty good. You can use their unleashed APs without cloud/controller/subscription. POE, and can connect up to 75 devices. I just installed at my hotel. We had ubiquiti, but the power outage usually corrupts the controller, and requires constant resetting.
jauer 6y ago
Aruba doesn't require a cloud controller, that's just the "Instant On" version. I used to run Aruba Instant (not the "instant on", no controller), but gave those APs to a friend and now run an Aruba 7005 controller with 2x303H and a 324. Support/Licensing costs are totally worth it for having trouble-free WiFi with no cloud dependencies (context: using and supported UniFi in various roles since the first UAP came out, and I think was free for UWC attendees, though I could be confusing that with their first camera), but am network nerd that's comfortable with enterprise wifi.
- apple4ever 6y ago
  The controller is like $1300 right? Or am I looking at the wrong think. I'm a network nerd that would love enterprise wifi but that seems way out of my price range.
  - jauer 6y ago
    I patiently watch eBay, so mine cost far less.
vngzs 6y ago
I realize I'm a bit late to the party, but GL-iNet does this. They run OpenWRT, too! PoE support can be hit or miss, but being able to truly own my devices without compromising on features is amazing. You probably want something like [0], which has PoE support and an optional Cloud connection. You can roll your own automation with (e.g.) SSH access since they are just Linux machines. [0]: https://www.gl-inet.com/products/gl-ap1300/ https://www.gl-inet.com/products/gl-ap1300/
nimbius 6y ago
you can build one but PoE might not be in the cards unless you want to convert the injected power back to a 5v barrel. Alix makes a decent router board that can host Linux and dual PCI cards means 5 and 2.4 ghz AP's. the total would be ~200 for each "AP" but they would be pretty massively powerful. https://www.pcengines.ch/alix.htm https://www.pcengines.ch/alix.htm
c0nsumer 6y ago
Ruckus with the Unleashed firmware. I bought an R610 AP on eBay a few months back, flashed it with the Ruckus firmware (legally available to all from their site), and it does exactly what you want. On-prem only, no cloud, one of the APs will act as a controller/manager for the others, and they can all communicate via wired or meshing off of each other. One of them can even be a NAT thing if you want. I think I paid around $160 because someone had a bunch of off-lease ones. But if you look up anything that supports the Unleashed firmware you'll be good. 802.1ax is the hotness right now, so the slightly older (but still work great) ones are a LOT cheaper. I replaced a Ubiquiti setup with a Ruckus R610 and small fanless running OPNsense (Protectli) with a basic switch and POE injector and it's excellent. Sure, it's not single pane of glass for it all, but the AP is rock solid and OPNsense is a solid known quantity. I've got no regrets.
- hyperpl 6y ago
  Same here, I ditched my Ubiquiti and went with Ruckus and I could not be happier. I'm just so sorry that I ever bought into Ubiquiti's marketing when I purchased their AP. The Ruckus performs so much better and the mgmt software is light years better than Ubiquiti. I also run a Protectli but on OpenBSD (from pfsense originally).
tumblewit 6y ago
Most unifi APs have openwrt ports
newman314 6y ago
I was under the impression that Omada had a non-cloud configuration?
kelnos 6y ago
I bought some Ubiquiti gear a year ago (a pair of AC-AP Pros), and immediately after I got them I reflashed them with OpenWRT. Haven't had even one issue with them. I get that people with larger networks would find centralized management useful, but I'm fine just managing a couple APs, a router, and a couple switches on their own. They're pretty much set-it-and-forget-it devices anyway.
bayindirh 6y ago
I’m running a TP-Link VR2100 and a bunch of RE200 repeaters in mesh mode. Nothing is cloud based. All cloud based management stuff is optional and provides TP-Link’s own DDNS support and remote access only. You don’t have to use it.
merlyn 6y ago
Sure plenty of solutions out there, but its all going to be Enterprise priced. $600-$700 an AP, plus whatever is going to be the controller. In this space, you'll find cloud based options, controller based options, and standalone. If you are willing to go this price range, I think FortiAPs feeding back to a Fortigate FW is rock solid solution. But a FortiAP-431F is $616. And a base FG60F as controller is $535 + service if you need it. And although you probably won't need repair options, support/maintenance is a yearly fee ontop of that. Ubiquity was definately a unique company offering many of the enterprise features for consumer pricing.
rexarex 6y ago
At least a few years ago you could self host Aruba.
ergo14 6y ago
TP-Link is not cloud based - you can run the controller locally. https://www.tp-link.com/pl/support/download/omada-software-controller/v4/#Controller_Software https://www.tp-link.com/pl/support/download/omada-software-c... - Downloadable here.
Angostura 6y ago
Agree about TP-Link. I bought some Deco mesh kit for the house and am generally pleased with its performance. However the fact that I can’t configure them locally is a massive turn-off from buying the stuff in the future. I use the TPLink forums to put local management in as a feature request. Perhaps if enough people make a noise?
unionpivo 6y ago
i use microtik. It needs some getting used to, but preform well. They have their clod versions also, but they keep putting out non cloud devices.
philjohn 6y ago
Unifi cloud controller is optional, but they don't make it easy to figure that out. Setting up a UDM first thing I did was add a local super admin account, then disable remote access. That way, if their cloud auth servers are down I'm not affected as I use the local admin account.
bornabox 6y ago
Check out Mikrotik. Quite similar range of products to Ubiquiti, very configureable, maybe it fits your needs...
kardianos 6y ago
Mikrotik CAPsMAN
Kim_Bruning 6y ago
Would you be willing to qualify your statements wrt Engenius? I've had good experience with them in the past, has something changed?
stiray 6y ago
Mikrotik. https://mikrotik.com/ https://mikrotik.com/ Or something like this: https://www.aliexpress.com/wholesale?&SearchText=pfsense+wifi https://www.aliexpress.com/wholesale?&SearchText=pfsense+wif... Again, dont expect it to be simple. Be prepared to learn.
smolder 6y ago
Check out pepwave, I have a couple of their APs with no cloud management involved. I think there are probably roaming features...

croutonwagon 6y ago

Ruckus R710 or R510 unleashed. I was talking about Ubnt's horrendous security in another thread just last night. https://news.ycombinator.com/item?id=26628198 https://news.ycombinator.com/item?id=26628198 Or if you just want Wave1 Hardware...R700/R500 You can get these as overstock on the cheap on amazon etc. The unleashed version means it can run the controller on the AP.

taddevries 6y ago
The R700/R500 are End-of-Life[1] so be sure you're OK with not getting new firmware. 1. https://support.ruckuswireless.com/product_families/4-eol-ruckus-products https://support.ruckuswireless.com/product_families/4-eol-ru...
- croutonwagon 6y ago
  Totally agree. And the first gen wave2 stuff (ie:710/510) is probably not too far behind. I do find myself rarely looking for firmware upgrades unless there’s a specific issue I can’t workaround. Even on my ubnt equipment. I find it best to just leave it segmented/network isolated and humming. All these cloud features just increase exposure and grant the vendor leverage to hold you hostage.

traceroute66 6y ago

For those people here saying "go Ruckus unleashed" ... caveat emptor my friends ! I have it on very good authority that Ruckus have started rolling out a change in their pricing model to require a Unleashed license per AP to operate, a move which obviously increases costs to the end-user. Some people might say its a deliberate move prevent cannibalisation of their main business model by nudging people away from Unleashed. I couldn't possibly comment.

IgorPartola 6y ago
Your credit card is stolen and your bank disables it -> your network is dead. What a great user experience.
- 1over137 6y ago
  >Your credit card is stolen and your bank disables it -> your network is dead. What are you describing here? I have a Ruckus Unleashed that I bought without a credit card and it works fine.
c0nsumer 6y ago
Can you share info? Because currently for a single site there is no license fee. I've only got one AP at home, but could put a bunch more of wanted. It works so well I wouldn't mind paying some fee, but it'll depend on how much.
- traceroute66 6y ago
  @c0nsumer My earlier comment was based on a change of policy which happened around 1st March, and any Unleashed quotes as of 1st March (and the two-weeks prior) need to be re-quoted for the new "license per AP" Unleashed model. I've been a bit busy with other work since that bombshell dropped, but if I get a moment I'll try to dig up some pricing. The other thing to note is feature discrepancy between Unleashed and standard. Perhaps of most interest to your average HN contributor was (the last time I checked) IPv6 was not supported on Unleashed firmware, and not much sense of urgency (if any !) to rectify that.
  - c0nsumer 6y ago
    Thanks! I completely glossed over the IPv6 thing... At home I don't get native IPv6 from my ISP, so I just tend to forget about that. Although it would be neat. For me I bought my AP on eBay and just plopped the standalone Unleashed firmware on it and that's all seemed fine. In what I see there's nothing changing? But it sounds like you're running a /much/ larger install.

deleted 6y ago

[deleted]

deleted 6y ago

[deleted]

msh 6y ago

Mikrotik have products that are exactly like that.

Jnr 6y ago

Try Mikrotik. It can do all of the things you listed and more.

jlawer 6y ago

Synology. Isn’t cheap, decent performance though. However it doesn’t seem to be the brands focus

jandrese 6y ago

Also add that all of the SOHO equipment is garbage that drops connections randomly, crashes, or simply can't deal with some WiFi chips. This is the reason I went with the Ubiquity UniFi 6 years ago. It was the only one I tried that didn't constantly drop connections or cost a fortune. But it's only G and I've been considering an upgrade, but there are no good options on the market that don't have stupid cloud management bullshit, are built on garbage hardware, or cost an arm and a leg.

notamy 6y ago

Peplink seems pretty good; they do have a Cloud:tm: management offering called InControl2 but as far as I'm aware it's entirely optional. I've had good luck configuring everything via the local UI. My setup is a Balance Two + a few One AX APs.

pentae 6y ago
+1 for Peplink, Surprised more people haven't mentioned them

jsmith99 6y ago

Technically, Ubiquiti does have a local option. You can run the controller locally and disable cloud login.

IgorPartola 6y ago
That's how I run it, but it seems they are now pushing ads to local controllers and between this and deprecating recently released devices, I just completely lost trust in them.
- dgudkov 6y ago
  > it seems they are now pushing ads to local controllers The pervasiveness of adtech doesn't cease to impress me.
  - ClumsyPilot 6y ago
    I really hope that one day it will be remembered the same way we remember ritual sacrafice .
  - iamacyborg 6y ago
    It isn’t adtech, per se.
- philjohn 6y ago
  Small correction - if you don't have a product that would display stats in a portion of the "single pane of glass" control panel, it displays an ad instead of a "you don't have this product, no data to see here". Scummy? Sure ... especially if you don't have a Ubiquiti gateway but only AP's so the top part of the page is blocked out, but it's not exactly "pushing ads at me!" in the traditional sense - e.g. they're not targetting ads, they're not collecting data.
pseudalopex 6y ago
People have reported cloud login can't be disabled now.

benjohnson 6y ago

It's a shame that Mikrotik doesn't have a easy to use global GUI. It's the right hardware, and great firmware and wonderful flexibility - but it needs an easy to use GUI controller to make the simple stuff easy to take over from Ubiquiti.

sam_lowry_ 6y ago
Global UI? You mean, AWS-hosted configurator for your network? We just had example of it being security risk. God save Mikrotik from implementing something similar.
- IgorPartola 6y ago
  No, a local controller that you run on a machine inside your LAN.
  - coder543 6y ago
    That's basically what MikroTik CAPsMAN is, depending on your needs. I think it's specific to Access Points, so not a general purpose centralized controller for MikroTik equipment, but... centralizing access point management seems to be the main thing under discussion here.
    - taldo 6y ago
      CAPsMAN is a royal PITA to set up. You have to manually add all the wifi channels, map each AP to the channels it'll use, and a lot of busywork. Once it's set up, though, it works fine, and lets you upgrade all devices from the manager, etc.
      - pilsetnieks 6y ago
        > You have to manually add all the wifi channels, map each AP to the channels it'll use, and a lot of busywork. No, you don't? I mean you can but you don't need to. There are cases when that is useful, true - for example, the automatic channel selection makes some curious choices sometimes.

ptomato 6y ago

Ruckus Unleashed is what you're looking for.

surfsvammel 6y ago
They are triple the cost of the UniFi stuff. So not really a drop in replacement.
- bubblethink 6y ago
  Look on ebay for slightly older models. R710, R720 should be $200-$300. Not a replacement at scale, but the one-off purchase from ebay is fine for home use.
  - antattack 6y ago
    Unfortunately, w/o firmware updates they are just little better than a brick. Especially for WIFI hardware where you cannot control who can access it - better keep your APs patched.
    - bubblethink 6y ago
      Both R710 and R720 are currently supported. I installed an update last week.
      - antattack 6y ago
        Yeah, but one cannot upgrade them without purchasing annual support contract from Ruckus.
        bubblethink 6y ago
        No, you do not need one for unleashed.
        6y ago

weaksauce 6y ago

have you checked out eero? https://eero.com/ https://eero.com/ I know someone that works there and they seem pretty happy with the place and product. just saw the amazon link now though so that may be a detriment depending on your view of them. (I have never used their systems or anything so it's not really an endorsement but something to consider)

pseudalopex 6y ago
Eero is cloud controlled.

Scramblejams 6y ago

No, TP-Link's Omada controller can be run locally, I do that at home and at my parents' house. It is not cloud-connected unless you turn that on. Runs surprisingly well on a Raspberry Pi 2, actually. I've got a setup similar to what you're asking for. The TP-Link APs (AC1750, AC1350 and AC1200) support PoE, they're in a wireless mesh, support roaming, and all configuration is handled with one interface, no cloud involved. Just make sure that what you're ordering says it supports Omada. They still ship a lot of SMB gear that doesn't, but all the basics are there now.

IgorPartola 6y ago
How is the experience otherwise? Roaming? Throughput? Reliability? I generally like their hardware.
- jackweirdy 6y ago
  Great without it. The major improvement I noticed with it, is 802.11k & v (faster handoff). Without those, it takes a little longer for the device to switch APs at the borders of their coverage. Mostly imperceptible, but the longer handoff times can be enough to kill a phone call over iPhone WiFi calling
- agurk 6y ago
  I run a similar setup with a bunch of EAP-225 APs controlled by a local instance of their Omada software (running on x64 rather that on ARM). I've been very happy with roaming/throughput/reliability generally. The EAP-225 is 2x2, which they don't readily announce. Their newer and more expensive units are available as 4x4. That being said they're so cheap, I've been happy just to throw more onto the network. For the software to manage them it uses some kind of multicast identification scheme to find new APs. If you're on a different subnet then it won't be able to automatically see them. They have a tool to connect to the AP and give it the management server IP, but that's Windows only. The other option (that I went for) is just to create a management VLAN (good practice anyway) that the controller and APs live on. This is specifically supported by the APs.
- Scramblejams 6y ago

Abishek_Muthian 6y ago

> Does anyone have a decent WAP where I can use PoE There are PoE devices with OpenWRT support[1] and should be possible to enable 802.11r if they have the support. They can be managed locally even with self-signed certificate. [1] https://openwrt.org/toh/views/toh_poe-powered https://openwrt.org/toh/views/toh_poe-powered

IgorPartola 6y ago
I use OpenWRT now and would really rather avoid it. I want a central controller, not having every AP have its own UI. Plus firmware updates area always an adventure.
- the8472 6y ago
  OpenWRT also provides SSH access and CLI tools, so if needed things can be automated the old-fashioned way.
  - oblio 6y ago
    I don't know about you, but I "automate the old-fashioned way" at my day job, I want the damned thing to just work without me bothering with "SSH access and CLI tools" at home.
    - fock 6y ago
      and how many APs do you have at home?
      - oblio 6y ago
        Right now? 1. But that's about to change, that's why I'm reading these comments. I was planning on buying a bunch of Ubiquiti APs.
- josteink 6y ago
  > Plus firmware updates area always an adventure. To somewhat eliminate the chances of adventure, I’ve profiled the setup for each of my many OpenWRT devices and created unique profiles for them in a (reasonably) simple Git repo[1]. All I need to do to get device-specific firmware is to update the OpenWRT version-number in a single makefile and the rest happens automatically. I’ve even setup Github Actions to build the firmware for me (basically, run make), so I can even get/build new firmware from my phone. I’ve yet to have any issues when flashing these builds. It used to be much worse when flashing the regular “official” OpenWRT image and restoring packages afterwards. Couldn’t be simpler! (With the regular Linuxy you-have-to-build-it-yourself-first clause) [1] https://github.com/josteink/openwrt-build https://github.com/josteink/openwrt-build

resfirestar 6y ago

> Does anyone have a decent WAP where I can use PoE, deploy like 5 of them and have them support roaming between APs, all managed locally? Is that too much to ask? Not as comprehensive as Ubiquiti’s management interface but the CAPsMAN feature on Mikrotik routers and APs does cover this use case.

betterunix2 6y ago

Mikrotik, but unfortunately getting reasonable throughput for wireless clients is a serious challenge (I always have better results with openwrt on the same hardware). Still, nice to have local control and not have to rely on some cloud service just to use the hardware I bought.

Jnr 6y ago
I wonder what is reasonable WiFi throughput for you? With my 5 year old Mikrotik hAP AC I am able to get up to 500 Mbit/s on lan. And my old phone now shows 250 Mbit/s on speedtest.net both directions. How much more are we talking about? Have I missed some big hardware upgrade recently?
- betterunix2 6y ago
  Using 80Mhz channels I found the default configuration never exceeded 200Mbit/s using iperf. For me "reasonable" is closer to 800Mbit/s, which is roughly the theoretical limit for 80Mhz with 2 spatial streams. I run my tests with my devices sitting 1 meter from the AP. This is on a hAP AC, and like I said, I get much better performance (close to the theoretical max) running OpenWRT on the same unit. I have had similar issues with the RB4011 and cAP AC, and in both the NYC area and suburban Virginia (so it is not just an issue of spectrum crowding in the city).
  - Jnr 6y ago
    Yeah, that sounds a bit slow. I suggest checking if faspath and fasttrack is working. I remember that when I had hAP AC using firewall rules inside lan, it also did not go much faster. Good indication was CPU usage. If it used 100% CPU at ~200Mbit/s then it was firewall slowing things down.

dolni 6y ago

So the question for becomes: is there just not a good enthusiast market for this stuff? I have met a number of people who are "network nerds", so I'm inclined to think the market does exist. With any of the plethora of consumer devices (Linksys, Netgear, D-Link) it's a dice roll whether your gear is complete garbage or not. A lot of the time, you're coming up snake eyes. I've got some Ubiquiti gear I bought a couple years ago. Like you, I want good quality gear that I can manage myself. I don't need a bunch of fancy corporate garbage, like link aggregation or cloud management. Give me solid, hardware accelerated routing and switching, flexibility over my local DNS, and maybe some VLANing. I was running Linux on a small x86 box as my last network router. Maybe it's time to get back to that. That or go back to banging rocks together. Haven't decided which, yet.

IgorPartola 6y ago
I can't imagine that there isn't a market for this. Look at the number of people recommending Ubiquiti stuff to each other. There are entire YouTube channels dedicated to it. If your whole living space or small office can be covered with a single access point, get a 3-in-1 combo that has a WAP, a router, and a small switch. But if you don't, you are left with, what exactly? There is also some demand for mesh stuff, for people who rent and don't want to run Ethernet cable. My plan: OPNsense on a PC Engines board for router + firewall, an unmanaged PoE-providing switch for switching, and something from 2-8 WAPs for indoor/outdoor Wi-Fi.
- bonestamp2 6y ago
  I had a PC Engines board for awhile and I really liked it, but make sure the one you order can support your internet bandwidth. When I upgraded to 1 gig internet, I was pulling around 450mbps on my PC Engines apu1d4. I ended up getting a Ubiquiti Unifi Secure Gateway and then I was able to pull the full 1 gig. It's pretty hard to recommend Unifi based on how they handled this breach, but the hardware itself has performed very well. Hopefully the new PC Engines boards can accommodate your needs.
  - IgorPartola 6y ago

wikibob 6y ago

Eero is amazing. It Just Works. Apple style. Plug it in. Never fuck with it. Rock solid.

discardable_dan 6y ago
They are amazon-owned. I'd be shocked if they weren't collecting and reporting telemetry.
- astrange 6y ago
  Telemetry is an extremely important part of making things just work. There's no other way to find the unknown unknowns.
  - heavyset_go 6y ago
    That's awfully convenient for the company offering those products, but I want to control what happens on my network, even if that's inconvenient for some hardware vendor. Case studies, focus groups, surveys and interviews are great ways to find the unknown unknowns. Of course, you need to pay people to participate in them, and then you need to pay expensive employees to conduct, collect and analyze the results. It's often just cheaper to spy on customers, though, and pretend that there is no other possible way to conduct business.
    - sofixa 6y ago
      > Case studies, focus groups, surveys and interviews are great ways to find the unknown unknowns. Of course, you need to pay people to participate in them, and then you need to pay expensive employees to conduct, collect and analyze the results No they're not, because the vast majority of people simply won't be bothered, and most people probably aren't as reliable as concrete data.
      - heavyset_go 6y ago
        People will be bothered if you pay them. DigitalOcean does this with focus groups for developers, and offers $500+ each for an hour or two of developers' time.

mattmcknight 6y ago

You are going to end up paying for a license to cover security updates. I use Fortinet, not cheap.

Lammy 6y ago

I have exactly this setup with three Aruba Instant APs (WiFi 5), but afaict they’ve combined the Instant product line with their cloud offering or something? I’m not entirely sure where they’re going with it, but I am very happy with the setup I have.

Saris 6y ago

As far as I know, TP-Link doesn't require any cloud based service, or even a local controller. They can work fine without any of it and you just manage them locally/directly.

jandrese 6y ago
I've never had good luck with TP-Link hardware though. Constant crashes/disconnections once you get past a few devices on the network, mysterious failures, hardware quickly getting dumped into the unsupported list, and so on. I've sworn off of them entirely.
SamuelAdams 6y ago
Yep, this is what I do. I used the EAP245 and now the EAP 660 HD. Both were rock solid devices. Managed locally via a web browser. Plugs into a netgear switch, into a pfsense router.
deleted 6y ago
[deleted]
yumraj 6y ago
TP-Link is a Chinese company. Doesn't inspire much confidence..
- imwillofficial 6y ago
  And Cisco does? With it’s known back doors from the NSA?
  - VectorLock 6y ago
    Whataboutism aside, Cisco inspires even less confidence. Source: Used to work for Cisco.
  - bbarnett 6y ago
    Never, ever happened. Ever. You're conflating "NSA secretly rerouting shipping company deliveries to end-users, installing their firmware, then senting it on" with "Cisco willingly did that". Cisco was unaware, and once aware (thanks to Snowden), Cisco took steps to try to prevent it, by altering shipping destinations, at the last minute, on route.

takeda 6y ago

Isn't enough to just disable cloud access? Edit: I got upvoted by somebody, but as an UI user I'm genuinely looking for an answer. If it's still possible to get inside if devices aren't connected to UIs cloud.

IgorPartola 6y ago
That’s a part of it. But also: 1. They are now pushing ads to their local controllers. That is a shady tactic. It also means the controller is phoning home. It means they might have an XSS in that code now or in the future. 2. They just deprecated a bunch of relatively new hardware. If I’m going to invest a non-trivial amount into their hardware I want to know it’ll keep working for a long time. 3. They lost trust due to this breach. How can I trust their code to secure my locks network if they can’t secure their own?

klagermkii 6y ago

With TP-Link you can run the Omada controller for their EAP line on a local device (I have it running on a Pi4).

gertrunde 6y ago

The TP-link offering looks very similar to Ubiquiti from a quick scan a month or two back. Both will run from locally hosted controllers if desired. I've been seeing more Cisco "Meraki Go" kit around as well, which looks to target the same use cases as Ubiquiti (very very similar gear, WAPs, low end switches & gateways), albeit without a local controller option, but at least without the usual steep Meraki subscription charges.

Vedor 6y ago

Not 100% sure if that's what you are looking for (I don't do much network works) but I think that Camsat's GlobalCAM-4.5G may be worth checking, with one catch: the company targets CCTV market. Still, that's just a router, without any special license fees or mandatory clouds.

oblio 6y ago

Maybe Plume Homepass: https://www.plume.com/homepass/ https://www.plume.com/homepass/ ? I'm not sure if they're 100% equivalent, but it seems to cover a good part of the Ubiquiti feature.

HowardStark 6y ago
Interesting. Subscription-based services in the home seem like a disaster waiting to happen. Unless you can self host in the event of a company shut-down, you're beholden to a company and their solvency. Can't see anything on their website for a transition plan in the event of shutdown (and of course, why would they post that and potentially signal lack of confidence in their longevity).

antattack 6y ago

Omada EAP245. You can use appliance and/or software controller that you can run locally, to manage your APs no cloud needed. https://www.tp-link.com/us/business-networking/ceiling-mount-access-point/eap245/ https://www.tp-link.com/us/business-networking/ceiling-mount...

nicolas314 6y ago
And if you only have one, no need to run Omada. Completely controlled from the AP web interface.

jiveturkey 6y ago

ubiquiti is fine. you don't have to use the cloud controller. CLI works just fine, at least the products I have used.

IgorPartola 6y ago
The featured article seems to say to me that they are far from fine.

heavyset_go 6y ago

Look into Mikrotik hardware and OpenWRT. Of the Mikrotik-based hardware I'm familiar with, they support PoE. OpenWRT supports roaming and mesh networks, and is a local solution, as opposed to a cloud-based one. There are no licenses you need to pay for, either.

briangerman 6y ago
I just ordered a mikrotik 10gb https://mikrotik.com/product/crs305_1g_4s_in https://mikrotik.com/product/crs305_1g_4s_in. The guys at work recommended it so hoping for the best!
- sigstoat 6y ago
  i've got one of those, and another mikrotik 10gb switch. whatever the 16 port one is. they've been working nicely. i have good luck with fiber SFP+ modules, but it seems picky about 1G copper SFP modules, fwiw.
  - briangerman 6y ago
    really i ordered cisco ones do those work?
    - sigstoat 6y ago
      like actual cisco-brand ones, or cisco compatible ones? i checked my order history, it looks like ipolex and 10gtk 1000bT copper modules have had troubles in my mikrotik switches. the mikrotik brand works fine. and every 10G fiber module i've tried has worked (lots of fs.com, and i think 10gtek, and probably some other brand off amazon)
- old-gregg 6y ago
  HN community is in an endless loop of switching vendors: https://news.ycombinator.com/item?id=18200119 https://news.ycombinator.com/item?id=18200119 IMO using what we have intelligently is easier. Uniquiti hardware has the Edge line of routers and switches that are not cloud-controlled, not listen on any ports, and not establish any connections on your behalf.

swiley 6y ago

If you don't feel like configuring hostapd and dnsmasq I'm pretty sure there's an nmcli one-liner that will have network manager run a WAP for you. I use 'hotspot' on my phone all the time. WAPs have been absolute crap for years.

motiejus 6y ago

Turris series.

awillen 6y ago

So one might call them... ubiquitous? I'm so sorry. I'll go now.

kryogen1c 6y ago

maybe their different product lines are managed differently, but all my Unifi WAPs, router, and switches are managed on a local controller that i installed and maintain myself. i recall some features being locked behind a UBNT account, but that was only reporting-type stuff IIRC https://help.ui.com/hc/en-us/articles/360012282453-UniFi-Set-up-a-UniFi-Network-Controller https://help.ui.com/hc/en-us/articles/360012282453-UniFi-Set...

WrtCdEvrydy 6y ago

TP-Link Omada is locally controlled (through a smartphone) but you can buy the Omada Cloud to control it remotely. It works with their small 16 port (8 PoE switch).

azernik 6y ago

Disclaimer: worked for Meraki (now Cisco Meraki) for several years. Generally, halfway decent wireless APs are all targeted at the enterprise market. Consumer hardware is a brutal race to the bottom, as lay consumers aren't qualified to compare options based on anything but price and UI. Ubiquiti was an outlier in trying to bring enterprise features to the consumer market The problem for enthusiasts and small business/home office setups like yours are that both the enterprise market (e.g. Meraki) and the premium consumer market (e.g. Google WiFi) focus heavily on ease of management - cloud controllers are table stakes these days, not a controversial feature. Part of that premium that Meraki, Aruba, and that class of enterprise supplier charge is about having a trustworthy and secured backend. Note, however, that roaming between APs is a feature of the 802.11 standard; you just need to have all your APs on the same layer 2 (802.x) network, and using the same SSID and credentials. No fancy hardware required, and you can even mix and match vendors.

fullstop 6y ago
Surely 802.11r has a purpose, yes?
- betterunix2 6y ago
  Faster handoffs between APs.
- cassianoleal 6y ago
  Yes, roaming by sharing SSID and passcode is a world of pain. 802.11r solves all those pains, I've been using it on OpenWRT for months without a glitch.
  - synergy20 6y ago
    how do you enable 802.11r on openwrt? on which model of router
    - mikehotel 6y ago
      Install the wpad pkg and 802.11r should show up in wireless config screens. See https://forum.openwrt.org/t/802-11r-fast-roaming-in-luci/11730 https://forum.openwrt.org/t/802-11r-fast-roaming-in-luci/117...

deleted 6y ago

[deleted]

__d 6y ago

Maybe a bit too soon, but has anyone tried Maxwell? https://www.crowdsupply.com/andy-haas/maxwell https://www.crowdsupply.com/andy-haas/maxwell

api 6y ago

Get Linux boards and USB-3 WiFi dongles with well-supported chipsets and roll your own? The other alternative is to go way up-market and buy industrial gear. Consumer gear is shit due to a race to the bottom mentality. 90% of consumers buy the cheapest. This is also what turned every TV and appliance into a feature-encrusted shitbox full of spyware.

edoceo 6y ago
I think you can do it with Pi-Zero and BATMAN? I gotta find my notes.

Godel_unicode 6y ago

You can absolutely manage ubiquiti local. Even with a ridiculously named local appliance called a cloud key. Their cameras are unfortunately another story.

topher_t 6y ago

I hear Cardi B and Megan Thee Stallion have some pretty excellent WAP's.

tubularhells 6y ago

Mikrotik is nice and does all of those things. Just needs actual expertise at network administration to set up. Once done though, it's fire and forget.

cassianoleal 6y ago

I have a Turris Omnia for my main router. It's a solid piece of kit. The OS, TurrisOS, is based on OpenWRT and for a while they were having trouble keeping up-to-date but that's been sorted in recent releases. There are great features like auto-updates and BTRFS snapshots and the ability to rollback to previous known good if you screw up a config. I also run LXC containers on it for things like PiHole (not on the internal flash but the main board takes an M.2 SSD). The Turris MOX is a modular Turris system that you can assemble from the parts that you need. I have a small Gl.iNet router upstairs flashed with upstream OpenWRT that I use as a WiFi access point and have setup 802.11r for BSSID roaming. Have been using this setup for months and handoff has been completely transparent.

emptysongglass 6y ago
These guys burned me so hard. Something on my Omnia burned out. I offered to pay to have it shipped and fixed and shipped back. They stopped emailing me back. It was a horrible, horrible support experience.
- cassianoleal 6y ago
  Ugh, sorry to hear that. :( They can be a little nasty to users on the forum as well but in general I really like the product.

chrisweekly 6y ago

Happy enough w my Netgear ORBI (2-node mesh router covers my 3500sq ft house; handoff is fine)

1over137 6y ago

>Seems like there is nothing good out there Check out Ruckus. I've found their 'unleashed' stuff quite nice (no affiliation, just a customer).

TranceMan 6y ago

Have a look into Ruckus with their local zone director offering.

glsdfgkjsklfj 6y ago

i did the same research 3mo ago. Was torn between a Ubiquiti (mostly because a coworker was bugging me) and a Ruckus Unleashed. I wish i had gone with the Ruckus. The lie that you can easily self host your own controller for ubiquiti is vastly exaggerated. Spent several hours of a Saturday patching extremely ancient versions of mongodb and compiling stuff. Not to mention that if you have a VM and turn the controller off, several features of the APs will stop working. and range for their Pro AP is lacking at most. I wish ubiquiti just published the damn shell commands so i could be able to manage it without the silly troublesome "controller" which is just an annoying web ui. So condescending and inefficient just for the sake of exploiting the customer base for lock-in effect. They are just a little cisco.

roody15 6y ago

Aruba sells IAP instant models that do this. No cloud required. (also sell campus controller local no cloud ... but this route is pricey)

DrPhish 6y ago
Yup IAP with airwave management is a sweet setup...if you can afford it! Even better combined with clearpass and 802.1x

friend-monoid 6y ago

Is pfSense, vyos, stuff like that out of fashion? Or too hard to maintain? Automating that stuff with ansible should solve the central management bit...

ghostpepper 6y ago
Can you run pfsense on an AP or switch or does it only handle gateway/firewall/routing tasks?
- friend-monoid 6y ago
  Yeah, of course you can. It's just a freebsd with some configuration stuff on top, it can run hostap, switch, it can do lagg and span ports and all the other stuff you'd expect... not sure how common it is though

bonestamp2 6y ago

> all managed locally? Other than ubiquiti I assume you mean? Not that I know of. I want the old ubiquiti back where customers, not stock price and ad revenue, was the focus.

fl0wenol 6y ago

You're in the boat of deploying OpenWRT or similar low-cost APs presenting the same SSID on a shared VLAN, plugging them into your favorite PoE switch, and manually configuring their channel strengths, etc. It isn't so bad if it's a one-and-done thing, but all of the out-of-the-box solutions are very IoT. Enterprise solutions with your self-contained WLAN controller and APs (not including PoE switches) are typically pretty pricey (>$5k, can spend a lot more).

hrez 6y ago

For me OpenWRT does that. No cloud.

r1ch 6y ago

I'm a big fan of flashing OpenWRT on supported APs. You lose central management and setup takes time, but I'm very happy with the stability and no worries about cloud services or vendor lock-in etc.

xwolfi 6y ago

My Synologies do that across several locations in my city. Not sure what PoE is, but Synology has site to site vpn which is amazing !

wadkar 6y ago
PoE is probably Power over Ethernet. With that you don’t have to worry about laying down electrical line to power the APs. The APs draw power from the Ethernet line itself

newhotelowner 6y ago

Ruckus seems pretty good. You can use their unleashed APs without cloud/controller/subscription. POE, and can connect up to 75 devices. I just installed at my hotel. We had ubiquiti, but the power outage usually corrupts the controller, and requires constant resetting.

jauer 6y ago

Aruba doesn't require a cloud controller, that's just the "Instant On" version. I used to run Aruba Instant (not the "instant on", no controller), but gave those APs to a friend and now run an Aruba 7005 controller with 2x303H and a 324. Support/Licensing costs are totally worth it for having trouble-free WiFi with no cloud dependencies (context: using and supported UniFi in various roles since the first UAP came out, and I think was free for UWC attendees, though I could be confusing that with their first camera), but am network nerd that's comfortable with enterprise wifi.

apple4ever 6y ago
The controller is like $1300 right? Or am I looking at the wrong think. I'm a network nerd that would love enterprise wifi but that seems way out of my price range.
- jauer 6y ago
  I patiently watch eBay, so mine cost far less.

vngzs 6y ago

I realize I'm a bit late to the party, but GL-iNet does this. They run OpenWRT, too! PoE support can be hit or miss, but being able to truly own my devices without compromising on features is amazing. You probably want something like [0], which has PoE support and an optional Cloud connection. You can roll your own automation with (e.g.) SSH access since they are just Linux machines. [0]: https://www.gl-inet.com/products/gl-ap1300/ https://www.gl-inet.com/products/gl-ap1300/

nimbius 6y ago

you can build one but PoE might not be in the cards unless you want to convert the injected power back to a 5v barrel. Alix makes a decent router board that can host Linux and dual PCI cards means 5 and 2.4 ghz AP's. the total would be ~200 for each "AP" but they would be pretty massively powerful. https://www.pcengines.ch/alix.htm https://www.pcengines.ch/alix.htm

c0nsumer 6y ago

Ruckus with the Unleashed firmware. I bought an R610 AP on eBay a few months back, flashed it with the Ruckus firmware (legally available to all from their site), and it does exactly what you want. On-prem only, no cloud, one of the APs will act as a controller/manager for the others, and they can all communicate via wired or meshing off of each other. One of them can even be a NAT thing if you want. I think I paid around $160 because someone had a bunch of off-lease ones. But if you look up anything that supports the Unleashed firmware you'll be good. 802.1ax is the hotness right now, so the slightly older (but still work great) ones are a LOT cheaper. I replaced a Ubiquiti setup with a Ruckus R610 and small fanless running OPNsense (Protectli) with a basic switch and POE injector and it's excellent. Sure, it's not single pane of glass for it all, but the AP is rock solid and OPNsense is a solid known quantity. I've got no regrets.

hyperpl 6y ago
Same here, I ditched my Ubiquiti and went with Ruckus and I could not be happier. I'm just so sorry that I ever bought into Ubiquiti's marketing when I purchased their AP. The Ruckus performs so much better and the mgmt software is light years better than Ubiquiti. I also run a Protectli but on OpenBSD (from pfsense originally).

tumblewit 6y ago

Most unifi APs have openwrt ports

newman314 6y ago

I was under the impression that Omada had a non-cloud configuration?

kelnos 6y ago

I bought some Ubiquiti gear a year ago (a pair of AC-AP Pros), and immediately after I got them I reflashed them with OpenWRT. Haven't had even one issue with them. I get that people with larger networks would find centralized management useful, but I'm fine just managing a couple APs, a router, and a couple switches on their own. They're pretty much set-it-and-forget-it devices anyway.

bayindirh 6y ago

I’m running a TP-Link VR2100 and a bunch of RE200 repeaters in mesh mode. Nothing is cloud based. All cloud based management stuff is optional and provides TP-Link’s own DDNS support and remote access only. You don’t have to use it.

merlyn 6y ago

Sure plenty of solutions out there, but its all going to be Enterprise priced. $600-$700 an AP, plus whatever is going to be the controller. In this space, you'll find cloud based options, controller based options, and standalone. If you are willing to go this price range, I think FortiAPs feeding back to a Fortigate FW is rock solid solution. But a FortiAP-431F is $616. And a base FG60F as controller is $535 + service if you need it. And although you probably won't need repair options, support/maintenance is a yearly fee ontop of that. Ubiquity was definately a unique company offering many of the enterprise features for consumer pricing.

rexarex 6y ago

At least a few years ago you could self host Aruba.

ergo14 6y ago

TP-Link is not cloud based - you can run the controller locally. https://www.tp-link.com/pl/support/download/omada-software-controller/v4/#Controller_Software https://www.tp-link.com/pl/support/download/omada-software-c... - Downloadable here.

Angostura 6y ago

Agree about TP-Link. I bought some Deco mesh kit for the house and am generally pleased with its performance. However the fact that I can’t configure them locally is a massive turn-off from buying the stuff in the future. I use the TPLink forums to put local management in as a feature request. Perhaps if enough people make a noise?

unionpivo 6y ago

i use microtik. It needs some getting used to, but preform well. They have their clod versions also, but they keep putting out non cloud devices.

philjohn 6y ago

Unifi cloud controller is optional, but they don't make it easy to figure that out. Setting up a UDM first thing I did was add a local super admin account, then disable remote access. That way, if their cloud auth servers are down I'm not affected as I use the local admin account.

bornabox 6y ago

Check out Mikrotik. Quite similar range of products to Ubiquiti, very configureable, maybe it fits your needs...

kardianos 6y ago

Mikrotik CAPsMAN

Kim_Bruning 6y ago

Would you be willing to qualify your statements wrt Engenius? I've had good experience with them in the past, has something changed?

stiray 6y ago

Mikrotik. https://mikrotik.com/ https://mikrotik.com/ Or something like this: https://www.aliexpress.com/wholesale?&SearchText=pfsense+wifi https://www.aliexpress.com/wholesale?&SearchText=pfsense+wif... Again, dont expect it to be simple. Be prepared to learn.

smolder 6y ago

Check out pepwave, I have a couple of their APs with no cloud management involved. I think there are probably roaming features...