11 ms·

A lot of these routers have DD-WRT, OpenWRT, FreshTomato or maybe pfsense support. Since the manufacturers long ago abandoned security updates and feature upgra

A lot of these routers have DD-WRT, OpenWRT, FreshTomato or maybe pfsense support. Since the manufacturers long ago abandoned security updates and feature upgrades an open source firmware will vastly improve the security and the devices functionality. Not all routers can run one of these firmwares but many can and I wouldn't choose a device that didn't in the future. Its relatively easy to setup a basic secure home router using a Raspberry pi 4 and USB Ethernet and then attach one to a hub and the other to the modem and you have a 1 gbit/s capable routing device that can do SQM and remove bufferbloat and not a lot of consumer routers can remotely achieve that level of performance. It is more hassle than the manufacturers firmware, but its also a surprisingly good way to extend a routers usable life and functionality as well. VPNs, Virtual LAN, File and web servers or just better QoS you can do just about anything you might want.

paulmd 5y ago
The lack of ongoing support from device manufacturers is really awful. There were some major UPnP vulnerabilities (last year, as well as some previous ones iirc) and a parade of attacks against WPA of various levels and very few devices ever get patched for them - including high-spec devices. Running open-source firmware is basically necessary to have any chance against all these attacks, because manufacturers simply won't do the work. There really really needs to be some regulation on this, internet of things devices as well. Give a defined minimum software update lifespan on the box at time of purchase and require that it be at least 3 years from the date of sale, for example.
- throw0101a 5y ago
  > The lack of ongoing support from device manufacturers is really awful. One of the reasons why I specifically when with Asus: they've got pretty good long-term support. There's also third-party firmware that uses the open source nature of most/all of the code (e.g., Asuswrt-Merlin).
  - 3np 5y ago
    Maybe I just had bad luck but my two most recent Asus Wi-Fi routers are dead, unsupported, and no Linux/OpenWRT.
    - throw0101a 5y ago
      The model I have: * https://openwrt.org/toh/asus/rt-ac68u https://openwrt.org/toh/asus/rt-ac68u Also: * https://www.asuswrt-merlin.net https://www.asuswrt-merlin.net
    - bserge 5y ago
      OpenWRT does not work well with Broadcom devices in general. Some are supported (you can port it yourself actually) but most won't work. Fortunately, it does work with Atheros, Qualcomm, MediaTek/Ralink and I think some other chips.
  - opan 5y ago
    I avoid Asus due to how often they use Broadcom chips and lack OpenWrt support.
    - deleted 5y ago
      [deleted]
- xxpor 5y ago
  Without auto updates, a whole load of good that'll do. 99.9% of people are (justifiably) scared to even log in to their router, let alone update it or flash open source FW. There's frankly a lot to be said about Comcast's current proprietary router model that's basically a completely managed box. You don't even log into the router directly, you manage it on xfinity.com.
  - brokenmachine 5y ago
    > You don't even log into the router directly, you manage it on xfinity.com. Lol, no thanks. The very last thing I need is an ISP controlling my LAN.
    - antihero 5y ago
      Then get your own router and use their one as a glorified modem (some ISP routers will actually have a modem mode where they act purely as a modem)
      - wil421 5y ago
        Xfinity will allow you to bring both a modem and a router. AT&T will not because their gateway/router does authentication into their network. Some people on the UniFi forums were able to pass authentication back to the gateway but it reduced speed.
      - brokenmachine 5y ago
        I'm not with xfinity but that is what I do.
    - deleted 5y ago
      [deleted]
  - josteink 5y ago
    > You don't even log into the router directly, you manage it on xfinity.com. That's absolutely the worst thing I can imagine. My current ISP (Telia) tried to replace their at-home FTTH box with one which can only be managed through their company portal (https://telia.no/minside https://telia.no/minside). I threatened with immediate service-termination unless they returned the old box which could be managed locally. I mean... There's lines I'm not willing to cross and a router which I'm not allowed to manage locally is simply not allowed in my house.
- dtaht 5y ago
  Please contact me via email - dave dot taht at gmail dot com. Working on a successor to this: http://www.taht.net/~d/fcc_saner_software_practices.pdf http://www.taht.net/~d/fcc_saner_software_practices.pdf
  - tverr_bjelke 5y ago
    Alas I just don't know what role and impact this document will have. But "VintCerf, Co-Inventor of the Internet" really made me smile!
  - egberts1 5y ago
    site is down for me. In New York
waltbosz 5y ago
Does anyone maintain a list like this one for vulnerabilities in open source router firmware ?
- PaulKeeble 5y ago
  Given they are all continuously updating its unlikely such a list would exist. The way this usually works for open source software is that the vulnerability isn't made public until the software patch has already been issued and its very rare to get anything other than "security issue fixed" in the changelogs anyway. The answer should be on the latest version of the firmware no outstanding known vulnerabilities or very few. The entire problem is that most of these routers haven't received updates in years from the manufacturers, they are abandoned. The open source firmware's are not abandoned and are continuously getting updates for their underlying packages from Linux/NetBSD even if they aren't doing substantial development themselves. What vulnerabilities that do exist and are not getting fixed will be in the hardware binaries for wifi for the FreshTomato supported routers and those usually listed as poor or no wifi support in openWRT, that is about it.
  - chasil 5y ago
    The last release of Gargoyle was last year, and Shibby Tomato went silent several years ago, probably taking a lot of older routers out of 3rd-party ROM updates. Many router ROMS don't come out as often as is necessary to address exploits in a timely manner.
    - wtallis 5y ago
      Most router ROMs are developed in the same haphazard fashion as phone ROMs on xda-developers. Only a few like OpenWRT are actually run like a desktop Linux distro, with a well-defined and managed release process and stable branches.
      - chasil 5y ago
        Gargoyle is based on OpenWRT, but has extensive options for bandwidth control of individual devices/MACs, plus the ability to force everything to use Tor. I don't know how UDP would work over that routing, and if QUIC would work (at all). I imagine that this can be done with OpenWRT, but many plugins and custom configuration would be required to achieve equivalent functionality.
londons_explore 5y ago
Most VDSL routers don't have any decent support on DD-WRT or OpenWRT due to the proprietary firmware blobs required for all the DSP algorithms inside the modem. Sadly, that means a massive chunk of the world connected by ADSL/VDSL can't use this advice.
- globular-toast 5y ago
  You could do what I do and run your own router on PC hardware and get a separate DSL modem. There aren't a lot to choose from, but you should be able to find one at least.
- PaulKeeble 5y ago
  You can but you need your own device that supports an open source firmware. The ISP provided modem you can potentially put in modem mode at which point its just the interface to the wire and you can then run your own router in PPPoE mode to interface to it and out to the internet. If the ISP provided device can't do that then turn off its NAT, firewall and wifi and just configure it to connect to the internet and plug into anetwork port just your router from the routers WAN port and then use DHCP WAN configuration. Then all your devices only go into your device. The only device exposed by the poor security of the manufacturer is the modem itself and your network is defended by your personal device. There are a bunch of other ways to do it but you can absolutely have your network defended by your own device running open source firmware and still use the device the ISP has provided mostly as a modem. I use a DHCP WAN on my router which outputs to the ISPs provided router which is just a modem at this point and not a lot else. It still runs DHCP and DNS and all that other junk but my home network doesn't use any of it. I use Virtual LANs internally for some development services I use so the default ISP routers are useless to me and after issues with various routers with VDSL modems I gave up and have used openWRT ever since. I also use separate access points for wifi since its another area openWRT is a little behind just due to how long drivers take to come out.
  - londons_explore 5y ago
    And then you have fun with the fact the ISP resets all the devices back to defaults once a week... And if you have to live with it in its default config you have double-NAT and games and web conferencing stuff doesn't work properly. It's just a bad compromise.
bserge 5y ago
I've been seeing "buffer bloat" a lot recently. Why have people started caring about it? It's really not a problem in most cases and SQM adds nothing but extra CPU usage. It's just the new "QoS". Back in the day, if you didn't use QoS, you were a loser :D
dv_dt 5y ago
I generally don’t buy a home wifi router unless it runs one of the open source router distros for this very same reason.
megous 5y ago
Broadcom wifi chips on these SBCs work sort of fine in ac mode (you can maybe get ~150mbit/s in practice), but it could be much better. Anyway, it so nice to have a router with 8GiB ram or 32GiB storage, instead of these ram/storage starved devices that are sold as wifi routers usually that can barely support openwrt. Being able to use Arch Linux or Debian, and the latest mainline kernel and have replaceable storage is just so much more flexible in what you can do. I'll be trying Quartz64-A with some well supported 3x3 or 2x2 mimo PCIe wifi cards, soon. (Router use excludes Intel Wifi cards, sadly) I hope that will be an amazing wifi router for me. I already run one as a non-wifi router: https://megous.com/dl/tmp/599ba099a6893863.png https://megous.com/dl/tmp/599ba099a6893863.png (well there's a USB wifi card visible there, but that's just a secondary wifi network for untrusted devices, I'd like something much better for my primary wifi)
- mjevans 5y ago
  I've been using one of the miniPC type OpenWRT supported devices as my core router. Though rather than adding wifi to the base I dangled my old wifi with OpenWRT off of it since my theory of instability on routers is that wifi makes everything suck. https://pcengines.ch/apu3c2.htm https://pcengines.ch/apu3c2.htm
  - megous 5y ago
    Yes, I have similar setup. I used microtik wifi router previously, and it's still a primary wifi ap for me, but all ports are bridged together including a wan port, and it now just serves as a 5xGLAN switch + wifi ap. All the DHCP, DNS and other services are on Quartz64.
- 3np 5y ago
  > Router use excludes Intel Wifi cards, sadly Why? Do you have any other manufacturer you could recommend for a reasonable price? What are you using for your Quartz?
  - megous 5y ago
    Why would you buy an expensive card that doesn't allow AP mode on anything ac or ax? "Hello IAmMrZ Thank you for your patience in this matter. After checking this further, we would like to inform you that the engineering team confirmed that Intel® wireless products follow regulatory compliance and it is expected that AP mode cannot be enabled in non-2.4 GHz channels. We hope this clarifies your concerns. Best regards, Andrew G. Intel Customer Support Technician" https://community.intel.com/t5/Wireless/Intel-AX210-Gentoo-Linux-OS-Unable-To-Enable-AP-Operation-at-Any/m-p/1292581 https://community.intel.com/t5/Wireless/Intel-AX210-Gentoo-L... I'll be trying realtek 8822ce and 8852ae based pcie cards, using mainline Linux rtw88/89 drivers. Qualcomm based cards are also quite common in high end wifi routers. But they are pricey.

paulmd 5y ago

The lack of ongoing support from device manufacturers is really awful. There were some major UPnP vulnerabilities (last year, as well as some previous ones iirc) and a parade of attacks against WPA of various levels and very few devices ever get patched for them - including high-spec devices. Running open-source firmware is basically necessary to have any chance against all these attacks, because manufacturers simply won't do the work. There really really needs to be some regulation on this, internet of things devices as well. Give a defined minimum software update lifespan on the box at time of purchase and require that it be at least 3 years from the date of sale, for example.

throw0101a 5y ago
> The lack of ongoing support from device manufacturers is really awful. One of the reasons why I specifically when with Asus: they've got pretty good long-term support. There's also third-party firmware that uses the open source nature of most/all of the code (e.g., Asuswrt-Merlin).
- 3np 5y ago
  Maybe I just had bad luck but my two most recent Asus Wi-Fi routers are dead, unsupported, and no Linux/OpenWRT.
  - throw0101a 5y ago
    The model I have: * https://openwrt.org/toh/asus/rt-ac68u https://openwrt.org/toh/asus/rt-ac68u Also: * https://www.asuswrt-merlin.net https://www.asuswrt-merlin.net
  - bserge 5y ago
    OpenWRT does not work well with Broadcom devices in general. Some are supported (you can port it yourself actually) but most won't work. Fortunately, it does work with Atheros, Qualcomm, MediaTek/Ralink and I think some other chips.
- opan 5y ago
  I avoid Asus due to how often they use Broadcom chips and lack OpenWrt support.
  - deleted 5y ago
    [deleted]
xxpor 5y ago
Without auto updates, a whole load of good that'll do. 99.9% of people are (justifiably) scared to even log in to their router, let alone update it or flash open source FW. There's frankly a lot to be said about Comcast's current proprietary router model that's basically a completely managed box. You don't even log into the router directly, you manage it on xfinity.com.
- brokenmachine 5y ago
  > You don't even log into the router directly, you manage it on xfinity.com. Lol, no thanks. The very last thing I need is an ISP controlling my LAN.
  - antihero 5y ago
    Then get your own router and use their one as a glorified modem (some ISP routers will actually have a modem mode where they act purely as a modem)
    - wil421 5y ago
      Xfinity will allow you to bring both a modem and a router. AT&T will not because their gateway/router does authentication into their network. Some people on the UniFi forums were able to pass authentication back to the gateway but it reduced speed.
    - brokenmachine 5y ago
      I'm not with xfinity but that is what I do.
  - deleted 5y ago
    [deleted]
- josteink 5y ago
  > You don't even log into the router directly, you manage it on xfinity.com. That's absolutely the worst thing I can imagine. My current ISP (Telia) tried to replace their at-home FTTH box with one which can only be managed through their company portal (https://telia.no/minside https://telia.no/minside). I threatened with immediate service-termination unless they returned the old box which could be managed locally. I mean... There's lines I'm not willing to cross and a router which I'm not allowed to manage locally is simply not allowed in my house.
dtaht 5y ago
Please contact me via email - dave dot taht at gmail dot com. Working on a successor to this: http://www.taht.net/~d/fcc_saner_software_practices.pdf http://www.taht.net/~d/fcc_saner_software_practices.pdf
- tverr_bjelke 5y ago
  Alas I just don't know what role and impact this document will have. But "VintCerf, Co-Inventor of the Internet" really made me smile!
- egberts1 5y ago
  site is down for me. In New York

waltbosz 5y ago

Does anyone maintain a list like this one for vulnerabilities in open source router firmware ?

PaulKeeble 5y ago
Given they are all continuously updating its unlikely such a list would exist. The way this usually works for open source software is that the vulnerability isn't made public until the software patch has already been issued and its very rare to get anything other than "security issue fixed" in the changelogs anyway. The answer should be on the latest version of the firmware no outstanding known vulnerabilities or very few. The entire problem is that most of these routers haven't received updates in years from the manufacturers, they are abandoned. The open source firmware's are not abandoned and are continuously getting updates for their underlying packages from Linux/NetBSD even if they aren't doing substantial development themselves. What vulnerabilities that do exist and are not getting fixed will be in the hardware binaries for wifi for the FreshTomato supported routers and those usually listed as poor or no wifi support in openWRT, that is about it.
- chasil 5y ago
  The last release of Gargoyle was last year, and Shibby Tomato went silent several years ago, probably taking a lot of older routers out of 3rd-party ROM updates. Many router ROMS don't come out as often as is necessary to address exploits in a timely manner.
  - wtallis 5y ago
    Most router ROMs are developed in the same haphazard fashion as phone ROMs on xda-developers. Only a few like OpenWRT are actually run like a desktop Linux distro, with a well-defined and managed release process and stable branches.
    - chasil 5y ago
      Gargoyle is based on OpenWRT, but has extensive options for bandwidth control of individual devices/MACs, plus the ability to force everything to use Tor. I don't know how UDP would work over that routing, and if QUIC would work (at all). I imagine that this can be done with OpenWRT, but many plugins and custom configuration would be required to achieve equivalent functionality.

londons_explore 5y ago

Most VDSL routers don't have any decent support on DD-WRT or OpenWRT due to the proprietary firmware blobs required for all the DSP algorithms inside the modem. Sadly, that means a massive chunk of the world connected by ADSL/VDSL can't use this advice.

globular-toast 5y ago
You could do what I do and run your own router on PC hardware and get a separate DSL modem. There aren't a lot to choose from, but you should be able to find one at least.
PaulKeeble 5y ago
You can but you need your own device that supports an open source firmware. The ISP provided modem you can potentially put in modem mode at which point its just the interface to the wire and you can then run your own router in PPPoE mode to interface to it and out to the internet. If the ISP provided device can't do that then turn off its NAT, firewall and wifi and just configure it to connect to the internet and plug into anetwork port just your router from the routers WAN port and then use DHCP WAN configuration. Then all your devices only go into your device. The only device exposed by the poor security of the manufacturer is the modem itself and your network is defended by your personal device. There are a bunch of other ways to do it but you can absolutely have your network defended by your own device running open source firmware and still use the device the ISP has provided mostly as a modem. I use a DHCP WAN on my router which outputs to the ISPs provided router which is just a modem at this point and not a lot else. It still runs DHCP and DNS and all that other junk but my home network doesn't use any of it. I use Virtual LANs internally for some development services I use so the default ISP routers are useless to me and after issues with various routers with VDSL modems I gave up and have used openWRT ever since. I also use separate access points for wifi since its another area openWRT is a little behind just due to how long drivers take to come out.
- londons_explore 5y ago
  And then you have fun with the fact the ISP resets all the devices back to defaults once a week... And if you have to live with it in its default config you have double-NAT and games and web conferencing stuff doesn't work properly. It's just a bad compromise.

bserge 5y ago

I've been seeing "buffer bloat" a lot recently. Why have people started caring about it? It's really not a problem in most cases and SQM adds nothing but extra CPU usage. It's just the new "QoS". Back in the day, if you didn't use QoS, you were a loser :D

dv_dt 5y ago

I generally don’t buy a home wifi router unless it runs one of the open source router distros for this very same reason.

megous 5y ago

Broadcom wifi chips on these SBCs work sort of fine in ac mode (you can maybe get ~150mbit/s in practice), but it could be much better. Anyway, it so nice to have a router with 8GiB ram or 32GiB storage, instead of these ram/storage starved devices that are sold as wifi routers usually that can barely support openwrt. Being able to use Arch Linux or Debian, and the latest mainline kernel and have replaceable storage is just so much more flexible in what you can do. I'll be trying Quartz64-A with some well supported 3x3 or 2x2 mimo PCIe wifi cards, soon. (Router use excludes Intel Wifi cards, sadly) I hope that will be an amazing wifi router for me. I already run one as a non-wifi router: https://megous.com/dl/tmp/599ba099a6893863.png https://megous.com/dl/tmp/599ba099a6893863.png (well there's a USB wifi card visible there, but that's just a secondary wifi network for untrusted devices, I'd like something much better for my primary wifi)

mjevans 5y ago
I've been using one of the miniPC type OpenWRT supported devices as my core router. Though rather than adding wifi to the base I dangled my old wifi with OpenWRT off of it since my theory of instability on routers is that wifi makes everything suck. https://pcengines.ch/apu3c2.htm https://pcengines.ch/apu3c2.htm
- megous 5y ago
  Yes, I have similar setup. I used microtik wifi router previously, and it's still a primary wifi ap for me, but all ports are bridged together including a wan port, and it now just serves as a 5xGLAN switch + wifi ap. All the DHCP, DNS and other services are on Quartz64.
3np 5y ago
> Router use excludes Intel Wifi cards, sadly Why? Do you have any other manufacturer you could recommend for a reasonable price? What are you using for your Quartz?
- megous 5y ago
  Why would you buy an expensive card that doesn't allow AP mode on anything ac or ax? "Hello IAmMrZ Thank you for your patience in this matter. After checking this further, we would like to inform you that the engineering team confirmed that Intel® wireless products follow regulatory compliance and it is expected that AP mode cannot be enabled in non-2.4 GHz channels. We hope this clarifies your concerns. Best regards, Andrew G. Intel Customer Support Technician" https://community.intel.com/t5/Wireless/Intel-AX210-Gentoo-Linux-OS-Unable-To-Enable-AP-Operation-at-Any/m-p/1292581 https://community.intel.com/t5/Wireless/Intel-AX210-Gentoo-L... I'll be trying realtek 8822ce and 8852ae based pcie cards, using mainline Linux rtw88/89 drivers. Qualcomm based cards are also quite common in high end wifi routers. But they are pricey.