4 ms·

I'm currently in the process of moving my home network from Ubiquiti to an open solution with a few Mikrotik RBM11Gs to serve as APs, and will probably also rep

by imiric 5y ago

I'm currently in the process of moving my home network from Ubiquiti to an open solution with a few Mikrotik RBM11Gs to serve as APs, and will probably also replace my Netgate SG-3100 with pfSense with likely a PC Engines machine. All will probably be running OpenWrt, though if that's too limiting / buggy, I'll just use plain Linux or OpenBSD on them. The major benefit of this setup is that you don't depend on some manufacturer for updates. Given Ubiquiti's and Netgate's recently hostile actions towards users and open source, this provides a great peace of mind. The other benefit is that you're free to upgrade your hardware as needed, which particularly for WiFi cards is great to have. Right now I'm sticking with WiFi 5 because of the costs, but in the future upgrading to 6E would just be a matter of changing the cards (assuming they're supported by the OS). Speaking of cards, I went with Compex WLE1216V5-20, which have an Atheros chip and are thus much better supported on Linux than Broadcom, etc.

ericd 5y ago
I've been considering replacing my EdgeRouter with a pfsense box (probably the Netgate 6100), have you been dissatisfied with your Netgate?
- magicalhippo 5y ago
  Unless something radical has changed in the last half year or so, pfSense will be a giant PITA if you have "residential" IPv6. That is, anything but a completely static prefix.
  - ericd 5y ago
    Oh interesting, thanks for the heads up.
  - technofiend 5y ago
    I am unhappy with pfsense's inability to push gigabit traffic on my hardware, but IPV6 works fine for me. I'd be curious what isp you have and what your issue is.
    - magicalhippo 5y ago
      My ISP has a dynamic prefix, so it changes "willy-nilly", sometimes per day. With pfSense, the issue was primarily two-fold. First was the fact that all the firewall rules and such did not support dynamic prefixes. Major PITA right there. Second was the DNS server, that is, when using pfSense as a DNS server I couldn't figure out how to prevent it from sending the public IPv6 address to clients. Thus when the (public) prefix changed, DNS stopped working on the clients. Some of this might have improved since I last used it, but I switched to OpenWRT and haven't looked back for a second.
- imiric 5y ago
  I also have an EdgeRouter, but will probably replace that last since it works fine and doesn't require any of the Ubiquiti Controller / Cloud shenanigans. I've had intermittent LAN dropouts on the SG3100 that I couldn't explain from the logs. That in addition to Netgate's hostility towards open source with how they're handling pfSense, and the whole pfSense+ product, just puts a bad taste in my mouth when it comes to supporting the company. For the hardware and software stack they provide, the devices are very overpriced IMO. Same with Ubiquiti, though at least with Ubiquiti you're paying for a set-it-and-forget-it network, as long as you're willing to fully invest in their ecosystem. They're the Apple of network prosumer equipment. But my main interest in abandoning both is investing in devices that I can upgrade and maintain independently and at my own pace. It will also be cheaper in the long run, though it does require some tinkering to setup.
  - ericd 5y ago
    Got it, thanks very much for the summary! Agreed that the EdgeRouter is fine, but the one I have is a bit anemic (ER Lite), and I've been disappointed with Ubiquiti's push for increased telemetry/phoning home, so I didn't want to buy a more powerful ER to replace it.
  - locusm 5y ago
    I find Ubiquiti wifi to be excellent and their EdgeRouter line has been reliable too but the routing products are just missing basic stuff.
  - tw04 5y ago
    Why not just go to opnsense? That’s what most folks have moved to that have gotten fed up with netgates shenanigans.
    - imiric 5y ago
      I thought about it, but WiFi cards are generally better supported on Linux, and since I'll be running OpenWrt on the APs, I'd prefer having a unified OS for both APs and the router. I guess it will depend on how much I like OpenWrt :) I don't have any experience with it.
donmcronald 5y ago
Have you ever looked at VyOS (https://vyos.io/ https://vyos.io/)? IIRC EdgeOS was a fork of Vyatta and Vyatta became VyOS. Their LTS pricing doesn't work for small businesses, but the rolling release might be an option for home use. It's sad that everyone only wants to accept huge amounts of cash these days. Take VyOS as an example. The smallest licensing option they have is $6k per year for unlimited installs. That makes it completely unobtainable for a person that I build firewalls for, so we don't even evaluate it. In terms of percentages, we could probably add about 15% to every firewall sold and that could be passed along to a software vendor. If we had a self serve portal where we could download LTS releases and generate lifetime licenses we'd send them 15% of our firewall (sales) revenue and they'd basically never hear from us. In real numbers that would be about $1-1.5k a year as long as we could pay per device as we sell/install them. Using pfSense as an example it'd be in the range of $10k since we started using pfSense and, in the last 5 years, I think I've only had 1 issue I couldn't figure out on my own where I had to go ask on their forum.
- broknbottle 5y ago
  Take a look at DANOS. It’s the open source version of ATT’s Vyatta. https://www.danosproject.org/ https://www.danosproject.org/ https://danosproject.atlassian.net/wiki/spaces/DAN/pages/819201/Releases https://danosproject.atlassian.net/wiki/spaces/DAN/pages/819...
- imiric 5y ago
  I haven't, but I remember Vyatta from many years ago, and I'm looking for something less enterprisey. If OpenWrt becomes a problem, I just might fall back to plain Linux or OpenBSD. Though OpenWrt is quite stable and fully featured from what I've read. I really don't need anything special for home use.
simplyaccont 5y ago
i build in the past a few times APs with compex cards. the problem it's that some of them have extra large form factor and won't fit standard mpcie slots. i had to build an adapter :/ eventually instead of upgrading to new iteration i got a couple of netgear r7800 and flashed them with openwrt. the router is on separate x86 box

by imiric 5y ago

ericd 5y ago

I've been considering replacing my EdgeRouter with a pfsense box (probably the Netgate 6100), have you been dissatisfied with your Netgate?

magicalhippo 5y ago
Unless something radical has changed in the last half year or so, pfSense will be a giant PITA if you have "residential" IPv6. That is, anything but a completely static prefix.
- ericd 5y ago
  Oh interesting, thanks for the heads up.
- technofiend 5y ago
  I am unhappy with pfsense's inability to push gigabit traffic on my hardware, but IPV6 works fine for me. I'd be curious what isp you have and what your issue is.
  - magicalhippo 5y ago
    My ISP has a dynamic prefix, so it changes "willy-nilly", sometimes per day. With pfSense, the issue was primarily two-fold. First was the fact that all the firewall rules and such did not support dynamic prefixes. Major PITA right there. Second was the DNS server, that is, when using pfSense as a DNS server I couldn't figure out how to prevent it from sending the public IPv6 address to clients. Thus when the (public) prefix changed, DNS stopped working on the clients. Some of this might have improved since I last used it, but I switched to OpenWRT and haven't looked back for a second.
imiric 5y ago
I also have an EdgeRouter, but will probably replace that last since it works fine and doesn't require any of the Ubiquiti Controller / Cloud shenanigans. I've had intermittent LAN dropouts on the SG3100 that I couldn't explain from the logs. That in addition to Netgate's hostility towards open source with how they're handling pfSense, and the whole pfSense+ product, just puts a bad taste in my mouth when it comes to supporting the company. For the hardware and software stack they provide, the devices are very overpriced IMO. Same with Ubiquiti, though at least with Ubiquiti you're paying for a set-it-and-forget-it network, as long as you're willing to fully invest in their ecosystem. They're the Apple of network prosumer equipment. But my main interest in abandoning both is investing in devices that I can upgrade and maintain independently and at my own pace. It will also be cheaper in the long run, though it does require some tinkering to setup.
- ericd 5y ago
  Got it, thanks very much for the summary! Agreed that the EdgeRouter is fine, but the one I have is a bit anemic (ER Lite), and I've been disappointed with Ubiquiti's push for increased telemetry/phoning home, so I didn't want to buy a more powerful ER to replace it.
- locusm 5y ago
  I find Ubiquiti wifi to be excellent and their EdgeRouter line has been reliable too but the routing products are just missing basic stuff.
- tw04 5y ago
  Why not just go to opnsense? That’s what most folks have moved to that have gotten fed up with netgates shenanigans.
  - imiric 5y ago
    I thought about it, but WiFi cards are generally better supported on Linux, and since I'll be running OpenWrt on the APs, I'd prefer having a unified OS for both APs and the router. I guess it will depend on how much I like OpenWrt :) I don't have any experience with it.

donmcronald 5y ago

Have you ever looked at VyOS (https://vyos.io/ https://vyos.io/)? IIRC EdgeOS was a fork of Vyatta and Vyatta became VyOS. Their LTS pricing doesn't work for small businesses, but the rolling release might be an option for home use. It's sad that everyone only wants to accept huge amounts of cash these days. Take VyOS as an example. The smallest licensing option they have is $6k per year for unlimited installs. That makes it completely unobtainable for a person that I build firewalls for, so we don't even evaluate it. In terms of percentages, we could probably add about 15% to every firewall sold and that could be passed along to a software vendor. If we had a self serve portal where we could download LTS releases and generate lifetime licenses we'd send them 15% of our firewall (sales) revenue and they'd basically never hear from us. In real numbers that would be about $1-1.5k a year as long as we could pay per device as we sell/install them. Using pfSense as an example it'd be in the range of $10k since we started using pfSense and, in the last 5 years, I think I've only had 1 issue I couldn't figure out on my own where I had to go ask on their forum.

broknbottle 5y ago
Take a look at DANOS. It’s the open source version of ATT’s Vyatta. https://www.danosproject.org/ https://www.danosproject.org/ https://danosproject.atlassian.net/wiki/spaces/DAN/pages/819201/Releases https://danosproject.atlassian.net/wiki/spaces/DAN/pages/819...
imiric 5y ago
I haven't, but I remember Vyatta from many years ago, and I'm looking for something less enterprisey. If OpenWrt becomes a problem, I just might fall back to plain Linux or OpenBSD. Though OpenWrt is quite stable and fully featured from what I've read. I really don't need anything special for home use.

simplyaccont 5y ago

i build in the past a few times APs with compex cards. the problem it's that some of them have extra large form factor and won't fit standard mpcie slots. i had to build an adapter :/ eventually instead of upgrading to new iteration i got a couple of netgear r7800 and flashed them with openwrt. the router is on separate x86 box