6 ms·

Is it me or are the standards for 'home routers' just basically horrible? I don't work as a security researcher or anything but in my time I've found multiple r

Is it me or are the standards for 'home routers' just basically horrible? I don't work as a security researcher or anything but in my time I've found multiple router vulnerabilities across manufactures. Everything from exposed admin interfaces (with default creds), issues with firewalls, UPnP accessible outside..., incredibly naïve credential management, its like home routers are swiss cheese by default. What do HN people tend to run that doesn't give them issues? I'd especially be interested in routers that have good IPv6 support (maybe impossible but still.)

spydum 2y ago
opnsense. you dont need to run these garbage consumer routers. downside is if your ISP still provides a modem/CPE. but some times you can put those into bridge mode and make them less of a risk
- WhackyIdeas 2y ago
  Is something like that really that necessary though, sure it has a lot of features but for a simple router it takes 15mins to follow a guide on openbsd.org to set up a simple router which works really well and is really secure.
  - vladvasiliu 2y ago
    Given GP's question, they're likely not someone who would spontaneously whip up an openbsd router. Maybe they don't care to fiddle with a command line, read up on dhcp servers, ipv6 router advertisements, pf configuration and what have you. In such a case, throwing opnsense on some machine, clicking around on three pages and calling it a day isn't that bad. The experience is close enough to an off-the-shelf router (except for the installation part), all the while getting a much better security situation.
    - WhackyIdeas 2y ago
      I actually found it easier understanding the openbsd router than pfsense when I tried it. The abstraction confused me personally.
- IgorPartola 2y ago
  I had so much trouble getting opnsense to work with Frontier fiber. Apparently Frontier does a non standard thing with their DHCP packets by tagging them as VLAN 0 and opnsense DHCP client was just silently dropping those. OpenWRT and Frontier’s router were fine. After three days I figured it out and now just have to compile my own version when I upgrade. I did submit a PR but not sure if it made it into a release.
- uyzstvqs 2y ago
  Definitely the best choice. You will still need APs for wireless, but they're behind your OPNsense firewall, so not connected directly to WAN like AP+router combos.
  - ac29 2y ago
    An internal AP in a gateway device isnt "directly connected to WAN" any more than an external AP. In both cases it is behind a firewall (and NAT, if applicable).
vladvasiliu 2y ago
Like the sibling, I run opnsense. There are other similar things you can run, or maybe just a vanilla Linux / FreeBSD / OpenBSD. I have it installed on an HP EliteDesk 800G2 SFF that my office was going to throw away. It has an i5-6500, 32 GB RAM, two Samsung 840 EVO SSDs and a 2x10Gb Mellanox card. Before the Mellanox, it had an intel 4x1Gb, i350 IIRC. I've run the PC with the intel card connected to a power meter and it was pulling 14-15W while running OPNsense and HomeAssistant, both in dedicated VMs. Some of the dedicated routers may be better than that, but when you factor in the price of the unit, mine isn't too bad, despite the rise in electricity costs here in France. I don't have any other 10 Gb/s machine to test its max performance, but it could run PF with NAT at 2.5 Gb/s without breaking a sweat.
ixwt 2y ago
A friend of my recently purchased the GL-iNet Flint 2[0], and is quite happy with it. It by default runs OpenWRT. There's a recent video on LTT's sub channel ShortCircuit about it [1]. [0]: https://www.gl-inet.com/products/gl-mt6000/ https://www.gl-inet.com/products/gl-mt6000/ [1]: https://youtu.be/dKrUehjd7I8 https://youtu.be/dKrUehjd7I8
flyinghamster 2y ago
I had been running a Ubiquiti ERPoE-5, but after about seven years of service, the power electronics inside crapped out. The power brick is fine, with a steady 48V output, but the internals always ran ridiculously hot, and time finally caught up with it. I'm getting by with a cheap TP-Link for now, but I'm thinking of getting a mini-PC with two NICs and enough oomph to run virtual machines well, and then putting VyOS on a VM. I've always liked the ERPoE's CLI capabilities (which were also a fork of Vyatta). I could probably put much of my former ERPoE config into a VyOS system.
- flyinghamster 2y ago
  ...aaaaand, I just took a gander over at VyOS. They really need to make it abundantly clear in their "how to build" documentation that unless you're a paying customer or recognized contributor, you no longer can build an LTS release. That is not at all mentioned in the build instructions, and so there's no point in doing a local build [ETA: unless you're customizing the code] when the nightlies are available for download. I then looked at their subscription pricing and realized that individuals are not their market, not at all. So, yeah, if I want to run VyOS, I have to put up with rolling releases. :( https://blog.vyos.io/community-contributors-userbase-and-lts-builds https://blog.vyos.io/community-contributors-userbase-and-lts...
  - sofixa 2y ago
    As a happy VyOS nightly user, They used to have donation options, where in exchange for a regular donation you get LTS releases, (via Patreon and OpenCollective) but both have been decommissioned. I'm not a huge fan of how that was done and how hard it is to find up to date information on that. Nightlies are pretty stable in my experience, and with the off-device backups, a full recovery will be relatively painless.
    - flyinghamster 2y ago
      Thanks for the vote of confidence (and I can always throw VMs onto ZFS volumes), but I think I'll chalk it up as "I'm not its target market" and move on. Their documentation talks of snapshot releases and such, but there's absolutely no information on actually finding them. It doesn't give me a warm, fuzzy feeling. Bad actors have forced them to pull all the rugs except the nightlies, it seems.
kmlx 2y ago
ubiquiti hardware and software.
- nottorp 2y ago
  You can't use that without signing in to their 'cloud' services at least once.
  - blinkingled 2y ago
    I recently got a UDM and don't recall having to sign in and I was able to set it up and everything functions including automatic updates. Where did you have to sign in and for what product?
    - nottorp 2y ago
      Are you absolutely sure? At some point they changed to doing everything via the 'cloud'. Obviously their customers didn't like that so they gradually backed down. I want to upgrade my unifi AP so I ask on HN or other forums once in a while. Last answer I got was that you can disable the need for cloud but you still have to sign on somewhere once to be able to disable it. So I repeat: are you absolutely sure you didn't need to give Ubiquity any info or go through their servers this time? Because I'd love to get a new access point...
      - rekoil 2y ago
        With the APs you can set them up in standalone mode without the need for a controller at all, but you get more out of them with a controller so if you have the means to run a controller you absolutely should. With the controller you're heavily incentivised to sign in, but you don't have to. With their "Cloud Gateways" (e.g. UDM Pro, UDR, UX, UCG-Ultra) it used to be difficult if not impossible to get them into a usable state without signing into a UI account, but that is no longer the case since a few years ago. There are some exceptions, if you wanna use their cameras you lose out on some features if you don't sign into the cloud to activate those, specifically facial recognition stuff.
msh 2y ago
I have a synology WRX560 router (yes, synology does routers). They have a decent security track record and provide long software support with official EOL/EOS statements. IPv6 works very well. The two other options I can think of is ubiquity and mikrotik.
ray_v 2y ago
I like GL.inet -- although, the fact that they're a Chinese company could be a bit of a concern. They lean heavily on Open WRT for software, but apparently some of the drivers used are "mostly opensource" ... whatever that means. https://forum.gl-inet.com/t/gl-inet-can-we-trust-them-becaus-china-is-the-boss/14812 https://forum.gl-inet.com/t/gl-inet-can-we-trust-them-becaus... Curious to see HN folks take on them.
- Aspos 2y ago
  They make decent hardware which comes with with modified end-of-life versions of OpenWRT. And their customizations are quite questionable and smell fishy. And no, can't install newer versions of OpenWRT. At least that's my experience with GL.iNet MT2500A (Brume 2). I happily use their older travel routers though.
  - ray_v 2y ago
    I had picked up their GL-MT3000 "Baryl" travel router -- which is a really great little device. I was pretty impressed, so when my home router (Ubiquity EdgeRouter X ) died a few weeks back, I replaced it with the GL.iNet GL-MT6000 "Flint 2" (https://www.gl-inet.com/products/gl-mt6000/ https://www.gl-inet.com/products/gl-mt6000/). So far the Flint 2 has been pretty solid and nice to know that it's built on top of Open WRT -- and I assume it's fairly easy to convert it fully to an Open WRT device if so wanted.
  - yjftsjthsd-h 2y ago
    > And no, can't install newer versions of OpenWRT. That depends on the model.
_mlbt 2y ago
I’m a huge fan of Eero for set and forget no nonsense home routers. I bought a three pack and they cover our entire home easily with about 10-15 minutes of initial setup.
- ray_v 2y ago
  The only think I don't like about the Eero is all the "subscribe to a monthly service to unlock features that should just come out of the box" -- I use Eeros for the smart TVs / smart phones etc. and then have another wired / wifi network set up for PCs and small servers that I run from home. It seems to work out pretty well.
rekoil 2y ago
I like Ubiquiti personally, but there are some risks, they've had a few security incidents (mainly due to a bad employee though, its looked much better recently), and their cloud-management isn't end-to-end-encrypted so that's not usable if you care about security. Their hardware is simple to manage and excellent for the low-ish price though! E.g. the UDM-Pro which is a 10 Gbit capable router for €350, and the UCG-Ultra looks great for budget networks.

spydum 2y ago

opnsense. you dont need to run these garbage consumer routers. downside is if your ISP still provides a modem/CPE. but some times you can put those into bridge mode and make them less of a risk

WhackyIdeas 2y ago
Is something like that really that necessary though, sure it has a lot of features but for a simple router it takes 15mins to follow a guide on openbsd.org to set up a simple router which works really well and is really secure.
- vladvasiliu 2y ago
  Given GP's question, they're likely not someone who would spontaneously whip up an openbsd router. Maybe they don't care to fiddle with a command line, read up on dhcp servers, ipv6 router advertisements, pf configuration and what have you. In such a case, throwing opnsense on some machine, clicking around on three pages and calling it a day isn't that bad. The experience is close enough to an off-the-shelf router (except for the installation part), all the while getting a much better security situation.
  - WhackyIdeas 2y ago
    I actually found it easier understanding the openbsd router than pfsense when I tried it. The abstraction confused me personally.
IgorPartola 2y ago
I had so much trouble getting opnsense to work with Frontier fiber. Apparently Frontier does a non standard thing with their DHCP packets by tagging them as VLAN 0 and opnsense DHCP client was just silently dropping those. OpenWRT and Frontier’s router were fine. After three days I figured it out and now just have to compile my own version when I upgrade. I did submit a PR but not sure if it made it into a release.
uyzstvqs 2y ago
Definitely the best choice. You will still need APs for wireless, but they're behind your OPNsense firewall, so not connected directly to WAN like AP+router combos.
- ac29 2y ago
  An internal AP in a gateway device isnt "directly connected to WAN" any more than an external AP. In both cases it is behind a firewall (and NAT, if applicable).

vladvasiliu 2y ago

Like the sibling, I run opnsense. There are other similar things you can run, or maybe just a vanilla Linux / FreeBSD / OpenBSD. I have it installed on an HP EliteDesk 800G2 SFF that my office was going to throw away. It has an i5-6500, 32 GB RAM, two Samsung 840 EVO SSDs and a 2x10Gb Mellanox card. Before the Mellanox, it had an intel 4x1Gb, i350 IIRC. I've run the PC with the intel card connected to a power meter and it was pulling 14-15W while running OPNsense and HomeAssistant, both in dedicated VMs. Some of the dedicated routers may be better than that, but when you factor in the price of the unit, mine isn't too bad, despite the rise in electricity costs here in France. I don't have any other 10 Gb/s machine to test its max performance, but it could run PF with NAT at 2.5 Gb/s without breaking a sweat.

ixwt 2y ago

A friend of my recently purchased the GL-iNet Flint 2[0], and is quite happy with it. It by default runs OpenWRT. There's a recent video on LTT's sub channel ShortCircuit about it [1]. [0]: https://www.gl-inet.com/products/gl-mt6000/ https://www.gl-inet.com/products/gl-mt6000/ [1]: https://youtu.be/dKrUehjd7I8 https://youtu.be/dKrUehjd7I8

flyinghamster 2y ago

I had been running a Ubiquiti ERPoE-5, but after about seven years of service, the power electronics inside crapped out. The power brick is fine, with a steady 48V output, but the internals always ran ridiculously hot, and time finally caught up with it. I'm getting by with a cheap TP-Link for now, but I'm thinking of getting a mini-PC with two NICs and enough oomph to run virtual machines well, and then putting VyOS on a VM. I've always liked the ERPoE's CLI capabilities (which were also a fork of Vyatta). I could probably put much of my former ERPoE config into a VyOS system.

flyinghamster 2y ago
...aaaaand, I just took a gander over at VyOS. They really need to make it abundantly clear in their "how to build" documentation that unless you're a paying customer or recognized contributor, you no longer can build an LTS release. That is not at all mentioned in the build instructions, and so there's no point in doing a local build [ETA: unless you're customizing the code] when the nightlies are available for download. I then looked at their subscription pricing and realized that individuals are not their market, not at all. So, yeah, if I want to run VyOS, I have to put up with rolling releases. :( https://blog.vyos.io/community-contributors-userbase-and-lts-builds https://blog.vyos.io/community-contributors-userbase-and-lts...
- sofixa 2y ago
  As a happy VyOS nightly user, They used to have donation options, where in exchange for a regular donation you get LTS releases, (via Patreon and OpenCollective) but both have been decommissioned. I'm not a huge fan of how that was done and how hard it is to find up to date information on that. Nightlies are pretty stable in my experience, and with the off-device backups, a full recovery will be relatively painless.
  - flyinghamster 2y ago
    Thanks for the vote of confidence (and I can always throw VMs onto ZFS volumes), but I think I'll chalk it up as "I'm not its target market" and move on. Their documentation talks of snapshot releases and such, but there's absolutely no information on actually finding them. It doesn't give me a warm, fuzzy feeling. Bad actors have forced them to pull all the rugs except the nightlies, it seems.

kmlx 2y ago

ubiquiti hardware and software.

nottorp 2y ago
You can't use that without signing in to their 'cloud' services at least once.
- blinkingled 2y ago
  I recently got a UDM and don't recall having to sign in and I was able to set it up and everything functions including automatic updates. Where did you have to sign in and for what product?
  - nottorp 2y ago
    Are you absolutely sure? At some point they changed to doing everything via the 'cloud'. Obviously their customers didn't like that so they gradually backed down. I want to upgrade my unifi AP so I ask on HN or other forums once in a while. Last answer I got was that you can disable the need for cloud but you still have to sign on somewhere once to be able to disable it. So I repeat: are you absolutely sure you didn't need to give Ubiquity any info or go through their servers this time? Because I'd love to get a new access point...
    - rekoil 2y ago
      With the APs you can set them up in standalone mode without the need for a controller at all, but you get more out of them with a controller so if you have the means to run a controller you absolutely should. With the controller you're heavily incentivised to sign in, but you don't have to. With their "Cloud Gateways" (e.g. UDM Pro, UDR, UX, UCG-Ultra) it used to be difficult if not impossible to get them into a usable state without signing into a UI account, but that is no longer the case since a few years ago. There are some exceptions, if you wanna use their cameras you lose out on some features if you don't sign into the cloud to activate those, specifically facial recognition stuff.

msh 2y ago

I have a synology WRX560 router (yes, synology does routers). They have a decent security track record and provide long software support with official EOL/EOS statements. IPv6 works very well. The two other options I can think of is ubiquity and mikrotik.

ray_v 2y ago

I like GL.inet -- although, the fact that they're a Chinese company could be a bit of a concern. They lean heavily on Open WRT for software, but apparently some of the drivers used are "mostly opensource" ... whatever that means. https://forum.gl-inet.com/t/gl-inet-can-we-trust-them-becaus-china-is-the-boss/14812 https://forum.gl-inet.com/t/gl-inet-can-we-trust-them-becaus... Curious to see HN folks take on them.

Aspos 2y ago
They make decent hardware which comes with with modified end-of-life versions of OpenWRT. And their customizations are quite questionable and smell fishy. And no, can't install newer versions of OpenWRT. At least that's my experience with GL.iNet MT2500A (Brume 2). I happily use their older travel routers though.
- ray_v 2y ago
  I had picked up their GL-MT3000 "Baryl" travel router -- which is a really great little device. I was pretty impressed, so when my home router (Ubiquity EdgeRouter X ) died a few weeks back, I replaced it with the GL.iNet GL-MT6000 "Flint 2" (https://www.gl-inet.com/products/gl-mt6000/ https://www.gl-inet.com/products/gl-mt6000/). So far the Flint 2 has been pretty solid and nice to know that it's built on top of Open WRT -- and I assume it's fairly easy to convert it fully to an Open WRT device if so wanted.
- yjftsjthsd-h 2y ago
  > And no, can't install newer versions of OpenWRT. That depends on the model.

_mlbt 2y ago

I’m a huge fan of Eero for set and forget no nonsense home routers. I bought a three pack and they cover our entire home easily with about 10-15 minutes of initial setup.

ray_v 2y ago
The only think I don't like about the Eero is all the "subscribe to a monthly service to unlock features that should just come out of the box" -- I use Eeros for the smart TVs / smart phones etc. and then have another wired / wifi network set up for PCs and small servers that I run from home. It seems to work out pretty well.

rekoil 2y ago

I like Ubiquiti personally, but there are some risks, they've had a few security incidents (mainly due to a bad employee though, its looked much better recently), and their cloud-management isn't end-to-end-encrypted so that's not usable if you care about security. Their hardware is simple to manage and excellent for the low-ish price though! E.g. the UDM-Pro which is a 10 Gbit capable router for €350, and the UCG-Ultra looks great for budget networks.