5 ms·

I'm currently upgrading my home network, trying various options, and one of the headaches is provenance of the equipment. By provenance, I mean where it's desi

by neilv 2y ago

I'm currently upgrading my home network, trying various options, and one of the headaches is provenance of the equipment. By provenance, I mean where it's designed, where it's manufactured, who has brand oversight of it, who controls the firmware, who runs the IoT phoning-home servers, etc. (I don't have high security requirements for home, but I pay attention to such things out of curiosity.)

alias_neo 2y ago
The closest I've been able to get is to buy a Protectli box, replace the AMI with Coreboot that you can compile yourself, and install OPN/PFSense. It's still Chinese hardware, but it's warrantied by Protectcli and you have control over the bits you can change. My first move out of the consumer "junk" was Ubiquiti EdgeRouters but their software quality declined a few years back, and my models got no more updates, then my main router died. My overkill i3 6-port Protectcli box has been running great ever since; first with pfSense now OPNSense; I'll only replace it when it dies or I want 10GbE routing.
- dvdbloc 2y ago
  What solution do you use for wireless access points? That’s generally my problem, you can find plenty of solid hardware to run pfSense on but as soon as you look at access points everything seems to be proprietary something or from questionable sources.
  - alias_neo 2y ago
    I currently use a bunch of Unifi APs, not got full-house coverage yet, but I have key areas and run their management software on a Raspberry Pi. They've mostly been solid, and aren't too expensive. I did replace the one in the hall (on the ceiling) outside my living room recently though, upgrading it from an AP-AC-Pro to an U6-Pro and the range is significantly worse on the same WiFi spec, making the living room TV basically unusable for streaming, despite being flawless on the older AP. I'm going to try the newer U7 Pros and if that doesn't work out, I'll start looking at alternatives, but I suspect anything acceptable will be more expensive. I run ethernet almost everywhere so WiFi is just for our mobiles/laptops/tablets/IoT, but the TV in the living room currently has no easy way to get cables to so that AP is critical.
  - toast0 2y ago
    Try to get something that runs OpenWRT (or can run it) and isn't like super tight on flash space. Although I'm having some issues with my latest batch of access points; I have a few clients that seem to have more trouble staying associated, and I was hoping to use 802.11r, k and v and DAWN, but I had to turn all of them off because too many subsets of the clients wouldn't work with some of those. I'm coming to the realization that mixed 2.4 ghz/5ghz access points aren't a great idea. If I wanted consistent 5 ghz coverage, I'd need a lot more access points, but I'd want to turn the 2.4ghz radios off on most of them because 2.4ghz goes too far.
  - VTimofeenko 2y ago
    Ruckus is awesome. R710 and similar models are pretty cheap off-lease on ebay.
  - ssl-3 2y ago
    I use Mikrotik access points at home. They're not the simplest to configure, but they aren't daunting to someone who has been futzing around with networking for awhile. I like that they allow me to implement whatever weird stuff I can dream up, and that I can generally implement that weird stuff all in the GUI. The hardware is relatively inexpensive and seems to be rather stable, the company is based in Latvia, and the manufacturing (or at least the board-stuffing and injection-molding) seems to primarily be done in Europe. Some of their stuff is pretty flexible about what kinds of PoE is can work with. All of the Mikrotik stuff I'm aware of runs their Linux-based RouterOS. This means they all get the same user interface -- the same for a "switch," for an "access point," and for a "router." I like that this blurs the lines between different device classes. For instance, my access points have two Ethernet ports on them, and two radios. I can use them as simple access points, or as routers, or as switches... or all of this at the same time. Whatever I want to do with them is fine: It's just a highly-configurable device with n hardware interfaces available on it. I could replace the separate switch and OpenWRT router that I have on a shelf in the basement with a singular Mikrotik switch that did both jobs if I wanted to. (I probably would not, and it probably would never make sense to do so, but their software allows me to do as many nonsensical things as I choose. That's a good thing.)
- mikece 2y ago
  How much of a difference does it make to use Coreboot rather than AMI? (I'm running OPNsense on a Protectli box currently...)
  - alias_neo 2y ago
    It really depends. Coreboot is open source and you can review the code, it's also much lighter (though fewer things can be tweaked), vs AMI which we don't know/can't check what it contains. For me, wanting as much open source in the stack as possible, it gives me peace of mind, but it really depends on the individual. All I can really suggest, is to take a look at the Coreboot site[0] and see if it sounds like something you'd want. [0]https://www.coreboot.org/ https://www.coreboot.org/
- Infernal 2y ago
  FWIW I thought my EdgeRouter X died a few years back, power light would blink but wouldn't boot up - turned out to be a dying wall wart. Swapped it out for one I had lying around that happened to match voltage/current/connector and that was maybe 3 years ago.
- radicality 2y ago
  +1, I have basically the same setup. Protectli FW6 with Coreboot and opnsense. Been working solid for a few years now.
nobody9999 2y ago
>I'm currently upgrading my home network, trying various options, and one of the headaches is provenance of the equipment. If you're concerned about provenance (or even if you're not), I suggest using a general purpose device and rolling your own ala pfSense[0]/OPNSense[1], etc, or just use one of the BSDs or Linux and use native tools or one of the many router/firewall distros[2] [0] https://www.pfsense.org/ https://www.pfsense.org/ [1] https://opnsense.org/ https://opnsense.org/ [2] https://en.wikipedia.org/wiki/List_of_router_and_firewall_distributions https://en.wikipedia.org/wiki/List_of_router_and_firewall_di...
- neilv 2y ago
  One of the things I learned while building such a server-based box is that eBay is awash in counterfeit high-end Intel NICs. Regarding pfSense and OPNsense, I recently built and used a nice OPNsense box, including IPS, but decided to go back to OpenWrt for home use, because OpenWrt actually worked a bit better for the things I needed. I might use pfSense (or maybe OPNsense) router for a startup office of more than several people, though (until we can cost-justify a dedicated IT infra&support specialist). With OpenWrt on the WiFi APs.
  - nobody9999 2y ago
    >One of the things I learned while building such a server-based box is that eBay is awash in counterfeit high-end Intel NICs. Assuming you mean NUCs[0] and not NICs, I'm sure you're correct. That said, there are many other fanless miniPCs which are both less expensive and, as such, much less likely to be counterfeited. >Regarding pfSense and OPNsense, I recently built and used a nice OPNsense box, including IPS, but decided to go back to OpenWrt for home use, because OpenWrt actually worked a bit better for the things I needed. A fair point. The device I use as a router/firewall came pre-installed with OPNSense, which I immediately wiped and replaced with a vanilla Linux install and customised it to my own taste. I mentioned OPN/pfSense not because I use them, but because they offer a fairly complete solution without having strong networking knowledge. Rolling your own is, IMNSHO, definitely superior to those, as well as to OpenWRT. As for WiFi, I restrict my APs to just bridging to my wired network and have implemented strong egress filtering to control outbound access. >I might use pfSense (or maybe OPNsense) router for a startup office of more than several people, though (until we can cost-justify a dedicated IT infra&support specialist). With OpenWrt on the WiFi APs. That's not a bad idea at all. Although you might also consider one or more of the other distros/packages in the Wikipedia link[1] I included in my previous comment. Good luck! [0] https://en.wikipedia.org/wiki/Next_Unit_of_Computing https://en.wikipedia.org/wiki/Next_Unit_of_Computing [1] https://en.wikipedia.org/wiki/List_of_router_and_firewall_distributions https://en.wikipedia.org/wiki/List_of_router_and_firewall_di...
klowner 2y ago
I'm extremely fond of Mikrotik gear, they're capable of pretty much anything and really reasonably priced. They're out of Latvia. The only thing is they're definitely not designed for regular consumers, you at least need familiarity with Linux networking.
- AnarchismIsCool 2y ago
  I have some of their stuff and really like it. It's not fully plug and play, but it's some of the best kit on the market for tech people.
- TiredOfLife 2y ago
  > The only thing is they're definitely not designed for regular consumers, you at least need familiarity with Linux networking. Mikrotik has had quickset (a single page configuration for home use) for 8+ years, Android Home app for 3+ years
  - baq 2y ago
    The one time I tried to use the quickset page was to set up an AP and it did. I was rather surprised that it didn’t configure an IP address to access the admin page afterwards…
  - greycol 2y ago
    It's a hard problem because when you start asking questions about what an unqualified home user needs it's easy to say just one more thing. port forwarding? ofcourse how else can the kid have a minecraft server with friends dynamic dns? then the friends don't need to search "what's my ip" every time parental controls? to schedule how much time they can play minecraft... I like Mikrotik but for anyone trying to go beyond the barebones default firewall/router/ap on the quickset page you need to be prepared to learn. i.e. To make a DHCP reservation, you go through the menus until you click IP, then you realise you don't click on DHCP client to set up a DHCP client you go into DHCP server and try to give a device a reservation which requires the step of making it static first then seperately setting it's IP. The complaint basically boils down to: they have all the options there and available and the least common task is just as easy to do as the 2nd most common (after initial basic setup), and if a task touches multiple parts of the config you need to touch each of those parts. Great for someone who knows what they're doing but for a home user it would be great to have more quickset pages for the 2nd to 10th most common tasks (as intagible as that list is).
rpcope1 2y ago
This is what makes me concerned about ever needing to upgrade from my PC Engines APU2. It's about as open as a piece of hardware can get, including using coreboot, but now that they've wound down, there's not a lot of good options that occupy the same niche.
- transpute 2y ago
  PC Engines was a Swiss company with Taiwan manufacturing. Since APU2 schematics are open, rebooting PC Engines as a US company could be initiated by US leadership requesting AMD to restart production of the AMD GX-412TC SoC, until AMD can ship a Ryzen Embedded alternative with comparable power efficiency. The lack of a replacement SoC forced the end of APU2 and PC Engines. National policy tools are not limited to banning negative examples, they can also encourage scaling of positive existence proofs.
- deleted 2y ago
  [deleted]
throwaway48476 2y ago
Openwrt now has official hardware.
1vuio0pswjnm7 2y ago
"By provenance, I mean where it's designed, where it's manufactured, who has brand oversight of it, who controls the firmware, who runs the IoT phoning-home servers, etc." Arguably the most important area of "provenance" is who controls the software ("firmware"). (Perhaps the hardware owner should control the software, e.g., compile and install OpenWRT.) The report on which this submission appears to be based mentions "command injection" as the vulnerability being exploited. https://www.cyfirma.com/research/comprehensive-analysis-of-cve-2024-21833-vulnerability-in-tp-link-routers-threat-landscape-exploitation-risks-and-mitigation-strategies/ https://www.cyfirma.com/research/comprehensive-analysis-of-c... https://www.microsoft.com/en-us/security/blog/2024/10/31/chinese-threat-actor-storm-0940-uses-credentials-from-password-spray-attacks-from-a-covert-network/ https://www.microsoft.com/en-us/security/blog/2024/10/31/chi...
AlienRobot 2y ago
I got a solar panel that I can control with an app on a smartphone. I still don't understand why because it's not fully installed. I thought this was just a DC generator plugged into a DC-to-AC converter (an "inverter") and nature did its thing to autobalance the flow of electricity. I'm excited to find out what the app does and why these panels need a WiFi password.
2lazy2pwdmgr 2y ago
Put a (Deciso or other) opnsense router in front of everything and use that to control exactly what can talk to what and what can talk to the outside world.
xtiansimon 2y ago
I guess you’re also evaluating/replacing your ISP’s modem and router. I just changed my plan with my optical internet provider, and didn’t occur there was an option.

by neilv 2y ago

alias_neo 2y ago

The closest I've been able to get is to buy a Protectli box, replace the AMI with Coreboot that you can compile yourself, and install OPN/PFSense. It's still Chinese hardware, but it's warrantied by Protectcli and you have control over the bits you can change. My first move out of the consumer "junk" was Ubiquiti EdgeRouters but their software quality declined a few years back, and my models got no more updates, then my main router died. My overkill i3 6-port Protectcli box has been running great ever since; first with pfSense now OPNSense; I'll only replace it when it dies or I want 10GbE routing.

dvdbloc 2y ago
What solution do you use for wireless access points? That’s generally my problem, you can find plenty of solid hardware to run pfSense on but as soon as you look at access points everything seems to be proprietary something or from questionable sources.
- alias_neo 2y ago
  I currently use a bunch of Unifi APs, not got full-house coverage yet, but I have key areas and run their management software on a Raspberry Pi. They've mostly been solid, and aren't too expensive. I did replace the one in the hall (on the ceiling) outside my living room recently though, upgrading it from an AP-AC-Pro to an U6-Pro and the range is significantly worse on the same WiFi spec, making the living room TV basically unusable for streaming, despite being flawless on the older AP. I'm going to try the newer U7 Pros and if that doesn't work out, I'll start looking at alternatives, but I suspect anything acceptable will be more expensive. I run ethernet almost everywhere so WiFi is just for our mobiles/laptops/tablets/IoT, but the TV in the living room currently has no easy way to get cables to so that AP is critical.
- toast0 2y ago
  Try to get something that runs OpenWRT (or can run it) and isn't like super tight on flash space. Although I'm having some issues with my latest batch of access points; I have a few clients that seem to have more trouble staying associated, and I was hoping to use 802.11r, k and v and DAWN, but I had to turn all of them off because too many subsets of the clients wouldn't work with some of those. I'm coming to the realization that mixed 2.4 ghz/5ghz access points aren't a great idea. If I wanted consistent 5 ghz coverage, I'd need a lot more access points, but I'd want to turn the 2.4ghz radios off on most of them because 2.4ghz goes too far.
- VTimofeenko 2y ago
  Ruckus is awesome. R710 and similar models are pretty cheap off-lease on ebay.
- ssl-3 2y ago
  I use Mikrotik access points at home. They're not the simplest to configure, but they aren't daunting to someone who has been futzing around with networking for awhile. I like that they allow me to implement whatever weird stuff I can dream up, and that I can generally implement that weird stuff all in the GUI. The hardware is relatively inexpensive and seems to be rather stable, the company is based in Latvia, and the manufacturing (or at least the board-stuffing and injection-molding) seems to primarily be done in Europe. Some of their stuff is pretty flexible about what kinds of PoE is can work with. All of the Mikrotik stuff I'm aware of runs their Linux-based RouterOS. This means they all get the same user interface -- the same for a "switch," for an "access point," and for a "router." I like that this blurs the lines between different device classes. For instance, my access points have two Ethernet ports on them, and two radios. I can use them as simple access points, or as routers, or as switches... or all of this at the same time. Whatever I want to do with them is fine: It's just a highly-configurable device with n hardware interfaces available on it. I could replace the separate switch and OpenWRT router that I have on a shelf in the basement with a singular Mikrotik switch that did both jobs if I wanted to. (I probably would not, and it probably would never make sense to do so, but their software allows me to do as many nonsensical things as I choose. That's a good thing.)
mikece 2y ago
How much of a difference does it make to use Coreboot rather than AMI? (I'm running OPNsense on a Protectli box currently...)
- alias_neo 2y ago
  It really depends. Coreboot is open source and you can review the code, it's also much lighter (though fewer things can be tweaked), vs AMI which we don't know/can't check what it contains. For me, wanting as much open source in the stack as possible, it gives me peace of mind, but it really depends on the individual. All I can really suggest, is to take a look at the Coreboot site[0] and see if it sounds like something you'd want. [0]https://www.coreboot.org/ https://www.coreboot.org/
Infernal 2y ago
FWIW I thought my EdgeRouter X died a few years back, power light would blink but wouldn't boot up - turned out to be a dying wall wart. Swapped it out for one I had lying around that happened to match voltage/current/connector and that was maybe 3 years ago.
radicality 2y ago
+1, I have basically the same setup. Protectli FW6 with Coreboot and opnsense. Been working solid for a few years now.

nobody9999 2y ago

>I'm currently upgrading my home network, trying various options, and one of the headaches is provenance of the equipment. If you're concerned about provenance (or even if you're not), I suggest using a general purpose device and rolling your own ala pfSense[0]/OPNSense[1], etc, or just use one of the BSDs or Linux and use native tools or one of the many router/firewall distros[2] [0] https://www.pfsense.org/ https://www.pfsense.org/ [1] https://opnsense.org/ https://opnsense.org/ [2] https://en.wikipedia.org/wiki/List_of_router_and_firewall_distributions https://en.wikipedia.org/wiki/List_of_router_and_firewall_di...

neilv 2y ago
One of the things I learned while building such a server-based box is that eBay is awash in counterfeit high-end Intel NICs. Regarding pfSense and OPNsense, I recently built and used a nice OPNsense box, including IPS, but decided to go back to OpenWrt for home use, because OpenWrt actually worked a bit better for the things I needed. I might use pfSense (or maybe OPNsense) router for a startup office of more than several people, though (until we can cost-justify a dedicated IT infra&support specialist). With OpenWrt on the WiFi APs.
- nobody9999 2y ago
  >One of the things I learned while building such a server-based box is that eBay is awash in counterfeit high-end Intel NICs. Assuming you mean NUCs[0] and not NICs, I'm sure you're correct. That said, there are many other fanless miniPCs which are both less expensive and, as such, much less likely to be counterfeited. >Regarding pfSense and OPNsense, I recently built and used a nice OPNsense box, including IPS, but decided to go back to OpenWrt for home use, because OpenWrt actually worked a bit better for the things I needed. A fair point. The device I use as a router/firewall came pre-installed with OPNSense, which I immediately wiped and replaced with a vanilla Linux install and customised it to my own taste. I mentioned OPN/pfSense not because I use them, but because they offer a fairly complete solution without having strong networking knowledge. Rolling your own is, IMNSHO, definitely superior to those, as well as to OpenWRT. As for WiFi, I restrict my APs to just bridging to my wired network and have implemented strong egress filtering to control outbound access. >I might use pfSense (or maybe OPNsense) router for a startup office of more than several people, though (until we can cost-justify a dedicated IT infra&support specialist). With OpenWrt on the WiFi APs. That's not a bad idea at all. Although you might also consider one or more of the other distros/packages in the Wikipedia link[1] I included in my previous comment. Good luck! [0] https://en.wikipedia.org/wiki/Next_Unit_of_Computing https://en.wikipedia.org/wiki/Next_Unit_of_Computing [1] https://en.wikipedia.org/wiki/List_of_router_and_firewall_distributions https://en.wikipedia.org/wiki/List_of_router_and_firewall_di...

klowner 2y ago

I'm extremely fond of Mikrotik gear, they're capable of pretty much anything and really reasonably priced. They're out of Latvia. The only thing is they're definitely not designed for regular consumers, you at least need familiarity with Linux networking.

AnarchismIsCool 2y ago
I have some of their stuff and really like it. It's not fully plug and play, but it's some of the best kit on the market for tech people.
TiredOfLife 2y ago
> The only thing is they're definitely not designed for regular consumers, you at least need familiarity with Linux networking. Mikrotik has had quickset (a single page configuration for home use) for 8+ years, Android Home app for 3+ years
- baq 2y ago
  The one time I tried to use the quickset page was to set up an AP and it did. I was rather surprised that it didn’t configure an IP address to access the admin page afterwards…
- greycol 2y ago
  It's a hard problem because when you start asking questions about what an unqualified home user needs it's easy to say just one more thing. port forwarding? ofcourse how else can the kid have a minecraft server with friends dynamic dns? then the friends don't need to search "what's my ip" every time parental controls? to schedule how much time they can play minecraft... I like Mikrotik but for anyone trying to go beyond the barebones default firewall/router/ap on the quickset page you need to be prepared to learn. i.e. To make a DHCP reservation, you go through the menus until you click IP, then you realise you don't click on DHCP client to set up a DHCP client you go into DHCP server and try to give a device a reservation which requires the step of making it static first then seperately setting it's IP. The complaint basically boils down to: they have all the options there and available and the least common task is just as easy to do as the 2nd most common (after initial basic setup), and if a task touches multiple parts of the config you need to touch each of those parts. Great for someone who knows what they're doing but for a home user it would be great to have more quickset pages for the 2nd to 10th most common tasks (as intagible as that list is).

rpcope1 2y ago

This is what makes me concerned about ever needing to upgrade from my PC Engines APU2. It's about as open as a piece of hardware can get, including using coreboot, but now that they've wound down, there's not a lot of good options that occupy the same niche.

transpute 2y ago
PC Engines was a Swiss company with Taiwan manufacturing. Since APU2 schematics are open, rebooting PC Engines as a US company could be initiated by US leadership requesting AMD to restart production of the AMD GX-412TC SoC, until AMD can ship a Ryzen Embedded alternative with comparable power efficiency. The lack of a replacement SoC forced the end of APU2 and PC Engines. National policy tools are not limited to banning negative examples, they can also encourage scaling of positive existence proofs.
deleted 2y ago
[deleted]

throwaway48476 2y ago

Openwrt now has official hardware.

1vuio0pswjnm7 2y ago

"By provenance, I mean where it's designed, where it's manufactured, who has brand oversight of it, who controls the firmware, who runs the IoT phoning-home servers, etc." Arguably the most important area of "provenance" is who controls the software ("firmware"). (Perhaps the hardware owner should control the software, e.g., compile and install OpenWRT.) The report on which this submission appears to be based mentions "command injection" as the vulnerability being exploited. https://www.cyfirma.com/research/comprehensive-analysis-of-cve-2024-21833-vulnerability-in-tp-link-routers-threat-landscape-exploitation-risks-and-mitigation-strategies/ https://www.cyfirma.com/research/comprehensive-analysis-of-c... https://www.microsoft.com/en-us/security/blog/2024/10/31/chinese-threat-actor-storm-0940-uses-credentials-from-password-spray-attacks-from-a-covert-network/ https://www.microsoft.com/en-us/security/blog/2024/10/31/chi...

AlienRobot 2y ago

I got a solar panel that I can control with an app on a smartphone. I still don't understand why because it's not fully installed. I thought this was just a DC generator plugged into a DC-to-AC converter (an "inverter") and nature did its thing to autobalance the flow of electricity. I'm excited to find out what the app does and why these panels need a WiFi password.

2lazy2pwdmgr 2y ago

Put a (Deciso or other) opnsense router in front of everything and use that to control exactly what can talk to what and what can talk to the outside world.

xtiansimon 2y ago

I guess you’re also evaluating/replacing your ISP’s modem and router. I just changed my plan with my optical internet provider, and didn’t occur there was an option.