How to get a reliable home router/WiFi box in 2018

My apprentice and A&D regular Ian Bruene had bad experiences with a cheap home router/WiFi recently, and ranted about it on a channel where I and several other comparatively expert people hang out. He wanted to know how to get a replacement solid enough to leave with non-techie relatives.

The ensuing conversation was very productive, so I’m summarizing it here as a public-service announcement. I’ve put the year in the title because some of the information in it could go stale quickly. I will try to mark each element of the advice with an expected-lifetime estimate.

Even before seeing any of the comments on this post I’m going to say you should read them too. Some of my regulars are more expert than I am about this area.

First, a couple of rules that will not age:

For each candidate product, use a search engine to find out (a) what Wi-Fi chipset it is using and (b) whether the firmware is vendor-proprietary or a port of OpenWRT. (OpenWRT has a sibling, dd-wrt, that is also acceptable but in less active development.)

1. If the chipset was made by Broadcom, stay the hell away. Their Wi-Fi and wired Ethernet chips are notoriously shitty and have been for decades – I remember trouble with them as far back as early Linux days in the 1990s.

2. If the firmware is not OpenWRT/dd-wrt, assume that you will need to re-flash the device. The quality of vendor proprietary firmware is, in general, abysmal – not just worse than you imagine, but worse than you probably can imagine. Don’t rely on it unless you like the idea of being pwned by a Bulgarian botnet.

UPDATE: Some routers contain proprietary chips with closed-source drivers that OpenWRT/dd-wrt can’t drive. This is usually not an issue unless you have an unusually fast Internet connection, like well above 15MB/sec. If you do, check on the OpenWRT site and elsewhere for reviews confirming that OpenWRT will support your speed.

An increasing number of vendors do the right thing and ship OpenWRT/dd-wrt from the factory. Read this excellent post by Jim Gettys for some candidates. Specific product recommendation in it may age, but a vendor that is not crappy will probably continue to be not-crappy.

Any current OpenWRT/dd-wrt device will be fully de-bufferbloated. You can’t rely on this from closed-source vendor firmware.

If you want to go cheaper than the $150 or so you’ll pay for a device with preinstalled OpenWRT, you probably can’t do better than buying an N600 on eBay and flashing it with OpenWRT yourself.

I call out this particular platform because:

(a) It’s cheap and easy to get, and probably has all the features you want except Gigabit Ethernet in some older revisions; check for that, the changeover seems to have been between the 3400 and 3800 revisions.

(b) I use one (a 3800) myself and can certify that it’s rock-solid stable; my last service interruption was 381 days ago and that was due to a power outage that outlasted my UPS’s dwell time.

(c) It’s based on a MIPS chipset that was Tier 1 for OpenWRT for a long time and got a lot of love from the core developers.

UPDATE: Note that the 3800 rev of the N600 is out of production but you can find it on eBay, the 3700v4 is also known good and actually has more flash capacity than the 3800.

In conclusion, my thanks and praise go out to Dave Taht and the OpenWRT team in general. They’ve fully fulfilled the promise of open source – best quality, best practices and best reliability.

86 thoughts on “How to get a reliable home router/WiFi box in 2018

  1. About 2 years ago I left consumer grade gear behind and started sourcing my wifi gear from Ubiquiti. Since then my setup just works flawlessly and I haven’t had to tinker with the network at all. Going this route has actually saved money vs consumer options.

    Setup is probably too hard for non-techies, although the commercial software is more condusive to remotely managing an access point for an SMB (or Grandma). The equipment is superior and comes without the danger of bricking or burden of intensely researching consumer grade hardware compatibility for ddWRT/OpenWRT installs.

    In addition to challenges with 2.4ghz oversaturation in a densely populated area I was inspired by this post:
    https://www.troyhunt.com/ubiquiti-all-the-things-how-i-finally-fixed-my-dodgy-wifi/

    • >About 2 years ago I left consumer grade gear behind and started sourcing my wifi gear from Ubiquiti.

      Note to others: These are OpenWRT devices. Jim Gettys mentions the EdgeRouter in his post.

      • Good bet, really. But budget… X-D

        How much is my little $40 marvel box compared to your Ubiquiti gear?

        If I was setting up for my farm, I’d be doing that without question (I’m a BIG fan of their offerings)- but $200+ and a heck of a lot larger for someone needing “portable”, you get where I’m going there.

        • $150 for a good mimo wireless router isn’t at all unreasonable, and this includes automatic meshing with thier mesh wireless extenders if you need them.

          https://store.amplifi.com/products/amplifi-mesh-router

          I used Ubiquiti professionally, and I can vouch for the fact that they are rock-solid platforms, even when sitting on top of a pole in the Texas summer. They should easily be able to stand live hidden behind your TV in the living room. :)

        • I paid $60. If your happy with the $40 gear that’s all that matters. Consumer grade gear + open source firmware served me well for over a decade.

          If you start troubleshooting intermittent connectivity issues when pushing moderate to heavy throughput you’ll realize that you just need a box with more power; that’s when its time to look at a router designed to do more than email and netflix.

      • On the wireless Ubuquuiti devices, as of late 2017, it’s not exactly straightforward to get an alternative firmware like Open-WRT installed. While Open-WRT supports the hardware, but you either have to downgrade the firmware and use mtd to overwrite the update partitions, or break out the soldering iron to get a serial console attached.

        I managed to get an unifi ap AC-lite flashed with open-wrt two years ago, but lack of actual buttons to reset the firmware makes me itchy every time I need to change some sort of setting.

    • Some have dealt with the burden. :-D

      I link to two on the small as indicated in comments later in the thread.

      If you’re looking for the low-end answers, I linked to them. You’re talking the high-end (which should be given **SERIOUS** consideration for many of the situations there)

  2. IF your needs are somewhat meager, or you’re road-warrioring like myself, there’s a couple of gems from off of Amazon that meets all of the above (a, b, and c in the examples above):

    https://www.amazon.com/GL-iNet-GL-AR300M-Pre-installed-Performance-Compatible/dp/B01K6MHRJI/ref=sr_1_4?s=arts-crafts&ie=UTF8&qid=1533327447&sr=8-4&keywords=gl.inet (external antennas)

    https://www.amazon.com/GL-iNet-GL-AR300M16-Pre-installed-Performance-Programmable/dp/B0777L5YN6/ref=sr_1_2?s=arts-crafts&ie=UTF8&qid=1533327791&sr=8-2&keywords=gl.inet (internal antennas)

    Don’t let the size fool you. It’s a full-on N-300 router with emphasis on wireless. Just need a router? You can pick up a USB powered 10/100 switch to plug into it for more ports. Want wireless? Need a 3G/4G hotspot? This will do it.

    Stock firmware is just a UI/simplification/bolt-on on top of OpenWRT (and you have access to the full monty from the simplified UI with an additional login). They’ve got instructions to make a custom OpenWRT build as needed.

    Most of the rest of it is crap. Some of it hax0red off of OpenWRT with proprietary crap (Gives ASUS and Linksys a nasty look their direction)

    Oh, since I mentioned Linksys… Unless you get a v1 (and I *do* mean this) of the WRT3200ACM, it’s _*TRASH*_ and you should avoid it like it was the black plague- they moved to a hardware configuration that has only come into being supported recently. (As an aside, it’s a PRIME example of what Eric’s talking to about Broadcom hardware… X-D)

  3. The *ONLY* Broadcom devices you should be bothering with for this sort of thing is a RaspberryPI 2/3/3+

    It’s supported solidly by the project and it’s a step up from the micro devices I’m talking to with it being able to support more radios, etc. It’s only drawback is if you’re pushing more than ~400mbits/s rate through the USB link as they’re still using a single USB 2.0 root hub.

    There’s other gems out there if you’re willing to do a bit of roll your own like with the RaspberryPI variant. Let me check to see if any of the other gems might have landed.

  4. My principal bound these days is to need to shape the “badwidth” from various ISPs with sch_cake. That eats cpus for breakfast.

    For more oomph, these days I use for ~gbit

    https://www.pcengines.ch/apu2c2.htm

    Or some variety of i3 nuc with intel ethernet for > gbit.

    I then give up and put the wifi AP somewhere central.

    wifiwise ~500mbit:

    https://www.amazon.com/gp/product/B010UR8AM2/ref=oh_aui_search_detailpage?ie=UTF8&psc=1

    and am looking for a currently made dual core arm based replacement of that.

    edgerouter X is decent to shape ~200mbit.

    Nothing has ever beat those 3800s for reliability though. They are “classic”. If all you need is 60mbits shaped.

    I use a lot of ubnt gear. Their ac-lites are pretty good but lack on flash. Nanostations are rocks in the field, but slow nowadays.

    All reflashed with openwrt. I was seriously tempted to upgrade eric last time I was in his basement but wanted to wait til the final release last week, and didn’t want to mess with his uptime…. and he has no compelling need to get on the upgrade treadmill. Next time. Maybe.

  5. This release of openwrt is 4000 fixes and features the best openwrt release ever.

    Personal Plug 1: Ath9k, ath10k, mt76 wifi chipsets are fully debloated with the fq_codel for wifi with the *yawn* usual 10×1 latency reduction and throughput increase per here: https://www.usenix.org/system/files/conference/atc17/atc17-hoiland-jorgensen.pdf

    there’s even ecn support.

    “modern” commercial routers are starting to ship “airtime fairness”, I don’t know if they picked all of the fq_codel stuff up, but it’s on the thousands of routers openwrt supports, with those chipsets. And I’d love more feedback from the field.

    Plug 2: For those installing the latest openwrt release, please try using sch_cake in your QOS/SQM (“luci-app-sqm”) system. It’s the latest effort out of the bufferbloat project and does things like per-host fair queuing and ack-fitering and really good framing for docsis, and dsl, letting you hit 99.999% of the configured rate. Not all the options made the gui on this release.

    (It eats cpus for breakfast though, if you run out, switch back to the htb+fq_codel sqm model)

    It went into the linux mainline kernel last month also, and toke got it to scale past 50gbit on xeon class hw.

    https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git/commit/net/sched?id=046f6fd5daefac7f5abdafb436b30f63bc7c602b

    Now, everyone can have cake: https://arxiv.org/abs/1804.07617

  6. Lastly, I’m embarrassed about getting equal stature with the openwrt team in a sentence above. I’ve had nothing to do with openwrt’s governance ever, and I’ve mostly sat out this past release cycle. They’re great folk. Their community really cares about performance and reliability.

    Me… I focused only two *REALLY* difficult components of the overall effort there these past 2 years (mentioned in my previous post), and even then others did 99.99999% the work this time around. I sat on my boat and cheered everybody on, and just did testing here and there. I raise my glass to all of them. Thx.

    All that stuff is now linux mainline where anybody can just turn it on and use it, in any distro, which I’m really happy about.

    What I am happiest about is that the principles we needed to operate under, and the problems we worked so diligently to impart that needed fixing, back in the 2011-1014 cerowrt project era have been adopted and worked on by so many others, to produce such great router software, and that our future along the edge of the internet, once looking dim, is looking mildly brighter.

    I’m personally at a crossroads. I don’t know what to do next. 5G/802.11ax *bug* me, but I can’t get in there and fix ’em from where I sit currently. Life in userspace might be nice. Babeld and the hnetd protocol need love. And, mmm… the wind’s up and blowing my way.

  7. Given just about any consumer-grade WiFi box, DD-WRT, AdvancedTomato, and OpenWRT are all highly interesting. What is also interesting are the assortment of hardware hacks which are published for the more popular units!

    I am using a NEATGEAR EA6300 (which turns out to be the EA6400 inside). Pretty box with pretty lights.

    Inside, the internal WiFi antennas look like chewing gum wrapper tinfoil. The heat sinks appear sufficient, but often have poor application of thermal bonding. …and careful with the power brick because not enough AMPs and the thing just sits there getting hot…

    I hacked mine to include three external RP-SMA antennas, a detailed cleaning and reapplication of thermal goo. There is a guy who has carved down a laptop cooling tray for forced airflow.

    The really cool, replacement router firmware will often even report on chip temps!

  8. Ubiquiti gets updates once every few months, while in my experience openwrt updates once every few years. That alone is the price of admission

  9. I’ve got an Asus RT-N56U, which uses a Ralink chipset. I don’t have OpenWRT installed on it, but I did install the Padavan firmware from https://bitbucket.org/padavan/rt-n56u/. I just upgraded it to version 3.4.3.9-099, and ran a quick test; it appears to have been de-bufferbloated. Since we have Comcast’s highest-speed Internet service and Gigabit Ethernet throughout our home, I’m certainly interested in squeezing as much performance out of it as I can!

  10. I know this one violates the “no broadcom” rule but I upgraded my wifi about a year ago to a Netgear Nighthawk AC1900. It’s pricey, ~$150 at a Best Buy, but it got consistent good reviews and high marks in my research at the time.
    The main feature for me though, was that it is supported by OpenWrt with a ready made build for it. I reflashed it and have had no regrets with the purchase. It is available with OpenWrt preinstalled as well.
    FWIW, i also recommended this router to my father when he came asking. He has 0 technical expertise. He was able to set it up and get it running without problem and had also had 0 issues with it.

  11. I have an Asus RT-AC68U (yes, broadcom chipset), and ran into an issue with firmware replacement that might apply to other routers.

    It has a proprietary hardware acceleration chip for NAT, and the various OSS firmwares don’t support it. Without acceleration, its upstream caps out at 200-300Mbit, bottlenecked on CPU. Typical home users will never notice, but if you’re on gigabit fibre or similar, switching to pure OSS firmware costs you most of your upstream speed.

    I don’t know if other manufacturers use similar proprietary chips, but I’m guessing if Asus does it, others probably do as well. So it might be worth adding a note: “if you have super-high-speed internet, look for router reviews indicating that it can actually hit speed X using firmware Y.”

    (for the AC68U, the least bad alternative is the Merlin firmware, a deshittified variant of the stock firmware that’s OSS where possible but still includes binary blobs for the proprietary functions. Other popular models may have something similar available)

  12. Mikrotik’s Routerboards (https://mikrotik.com/ ) are great as routers and wifi access points. You might need some kind of modem if you don’t already have an ethernet presentation (either native or PPPoE will do). Often (in the UK at least) you can put the ISP in to bridge or modem-only mode and use that tho’.

    They’re Linux based with a custom userland.

  13. Eric.

    This is highly off topic (apologies), but I was wondering what your thoughts are regarding the official finding of “no known motive” wrt the Vegas mass shooting. I seem to recall you knowing someone who was involved in the investigation.

    • >I seem to recall you knowing someone who was involved in the investigation.

      I do, but he’s not talking about it. I’ll poke him this week.

      • > >I seem to recall you knowing someone who was involved in the investigation.

        > I do, but he’s not talking about it. I’ll poke him this week.

        Aaaannnd what did he say?….

        • >Aaaannnd what did he say?….

          Paraphrasing slightly…this is best left alone. Heavily but deniably implied: dude was a U.S. intelligence asset who went nuts, and the people who used to run him don’t want anyone poking around his backtrail.

          • Eric what reasoning if any did you apply to accept this at face value and not question whether your source is compartmentalized? How convenient for the alleged single shooter to go nuts when the physical and other evidence points to him being a cover for a false-flag. He was likely a U.S. intel asset, but playing what role? The suicide appears to be faked and other evidence implicates the collusion of hotel security:

            https://rense.com/general96/paddockblood.html
            http://archive.is/https://medium.com/@ConsciousOptix*

            Charles Boyd commented on Youtube:

            > If this guy got all those guns into the rooms, where are the suitcases at when the crime scene photos were taken & leaked? Has there been any forensic reports showing which guns / tools he used? Assuming they all would have his finger prints & DNA all on everything. Has there been anything new that has come to light that proves he acted alone? Where is the security footage from the hallway where he shot the security guard? Where is the footage showing him taking these to his room on the floor he was booked?

            • >Eric what reasoning if any did you apply to accept this at face value and not question whether your source is compartmentalized?

              My source might in fact be compartmentalized; I don’t know that. I’ve just reported what he told me.

            • You know, when you’re linking to rense as evidence for something, you might want to step back, maybe have a cup of tea, and rethink your life choices.

  14. I stopped using out of the box firmware several years ago after being introduced to DD-WRT when I lived with our host’s and mine mutual friend Phil in Philadelphia. Right now, I’ve got a pair of Netgear WRT3700 v4’s running a repeated wireless WAN in the house and they work flawlessly. I wish more manufacturers would use OpenWRT or DD-WRT – especially with recent reports of exploits related to FTP functions that remain unsecured.

  15. I opted for a Netgear WNR3500L (~$50).

    The wifi performance kinda sucked out of the box, but I dropped Tomato on it and *boom* it has been rocking ever since.

  16. I want to throw out an obscure computer term I saw years ago in a computer science book.

    That word is “nybble.”
    Anyone remember this term? It is half an octet. So two nybbles makes up one byte.

    I have never heard anyone use this term out in the real world or even on the web.

    Anyone ever use it?

    • >Anyone ever use it?

      Occasionally, usually in discussions involving hex-pair notation for bytes. It’s common knowledge but not common production.

    • Know it but don’t commonly use it.

      I imagine people ‘above a certain age’ are more familiar with it than others.

      Now get off my lawn.

      • Google ‘COBOL tutorial’, first pick will be including nibbles explanation, or more likely, reference with no explanation.

    • This term saw quite a bit of use back in the Apple ][ days.

      It’s still a thing. I just found it (as “nibble”) in the latest Intel 64 architecture manual.

  17. I am sort of confused why the router matters. Our computers are secured, but the router is whatever the ISP provided, the modem has WiFi built into it. Will they really risk not updating the firmware whenever a breach is found at millions of consumers? I am talking about UPC, which is infamous in multiple European countries for outages during work hours, but still. And, I mean, suppose they don’t and the router itself is pwnable, but the computer is secure, firewall, antivir, malwarebytes, what exactly happens?

    These days I do everything from a VPN (NordVPN) anyway, because legislators and big firms are more and more trying to pwn the whole Internet… which is offtopic, but ontopic in the sense of the additional security that means.

    • >Will they really risk not updating the firmware whenever a breach is found at millions of consumers?

      Yes. Good luck getting any update pushes at all on routers with proprietary firmware.

      >I mean, suppose they don’t and the router itself is pwnable, but the computer is secure, firewall, antivir, malwarebytes, what exactly happens? – it will probably never happen.

      They MITM your machine, redirect your web searches, use it in botnets, hijack your credentials – it can get really bad.

      • He means, here, the routers the ISP is leasing out, though.

        Centurylink or AT+T are big enough to have the leverage to get updates, and have an interest in not having their customers botnetted and using more bandwidth or attacking other hosts, so for once the interests align to “wanting updates”.

        (Above also reminds us why we should always, always use SSL for everything.

        That way a MITM attack will cause cert warnings and be detectable.

        I mean, I’m surprised this site doesn’t even allow https, let alone prefer it where available!)

    • > …but the router is whatever the ISP provided, the modem has WiFi built into it…

      In the US market, these premises aren’t always true. In fact, the most restrictive ISP I’ve ever used required use of their (non-WiFi) modem, but didn’t supply anything else. On my current ISP, all the equipment, including modem, is mine to choose and administer.

    • Well then, see the brickerbot ‘possible’ history and answer yourself how much can you trust ISPs: https://archive.fo/PQAnU
      Which seems to be “worse than you probably can imagine” in real.

      Attacks described in this doc took place, and were covered by media before this, ehm, diary, appeared. So at least we know he describes real attacks. But whether it is a real Don Kichote’s coming out, or a full fake I can’t tell due to lack of skills and knowledge. If someone more talented can shed some light on that, I’d be grateful.

  18. Anyone got a good tutorial on how to bypass the FiOS router? I don’t think I can remove it entirely since the STB seems to use it for $THINGS$, but I’d like to be able to connect my actual home network to a router of my own and shut down everything I don’t otherwise need the FiOS box for.

    ISTR there’s an ethernet port on the CPE side of the ONT that I can hook up to, but I have to ask Verizon nicely to turn it on?

    • It’d depend on the specific modem, but the internet does suggest the various FiOS routers support bridging mode.

  19. And then there is the whole topic of how to set up the policy on chosen firewall/router. Firewall policy being my specialization, I would be very interested to know how many people on your forum allow *all outbound* traffic – which is only one of several ten thousand pound gorillas in the room for many organizations large and small. I would guess that most people allow pretty much anything outbound – which is terrible policy. And most don’t partition their home/office network sufficiently, if at all. All those smart TV’s, smart phones, smart front doors etc, what a lovely group of pwnd devices they are sitting right next to your laptops and your home brew servers.

    • >I would guess that most people allow pretty much anything outbound – which is terrible policy.

      What do you recommend blocking?

      • Everything. And then selectively allow what you know you want to leave your home network. And then to save yourself some sanity in troubleshooting why things don’t work, log your outbound rejections.

        So, one’s workstation would be allowed to speak dns, http(s), ftp(s), ssh, rsync, ntp(s), irc(s), etc, to the wider Internet. The Xbox is only permitted to speak dns, http(s) and kerberos, and only to the IP range that hosts Microsoft’s online gaming services. The printer’s phone home capability is disabled per the configuration it reports on it’s front panel, so if it’s lying about that, well, tough shit, it’s not allowed to ftp “anonymous” ink usage reports to HP. The IoT light bulb needs to be able to speak http(s), because a friend hacked it to scrape the website of one’s local supermarket and flash yellow when there’s a sale on steak, and the wife is amused by this new (actually useful) functionality.

        • When I was a teen, my dad made use of a Windows security product called ZoneAlarm. I have no idea about the reputability of the company that made it / whether they still exist, but the basic concept was something I have sorely missed ever since: Everything was blocked by default, and network access attempts were reported to the user with the option to block always, block and ask again next time, allow and ask again next time, or always allow (as I recall) for that specific program, with separate settings for LAN and Internet traffic. It would really, really be nice to have a similar FOSS product for use on Linux desktops. The real time nature of it was wonderful.

          • >When I was a teen, my dad made use of a Windows security product called ZoneAlarm.

            That’s clever, and doesn’t sound like it would be difficult to write under Linux.

            • A lot of Windows firewalls work this way, but they take advantage of one fact: the firewall is running on the same computer as the software. So they link the port rules to the executable (well, technically, the pathname of the executable). Even the built-in Windows firewall does this, but has a bunch of preinstalled rules to make it a lot less annoying to ordinary users.

              • The built-in Windows firewall will deny-with-opt-in for new software to “public networks” and allow-with-opt-out for “private ones.” (I was going to say “unknown” but I’ve seen it pop the dialog for quite well-known software packages. Changing the settings is a UAC-required function).

                It defaults to marking unknown networks as “public” at least as of Win 7.

          • I clearly way older than you, but I do remember ZoneAlarm. I recall thinking it wasn’t a bad bit of software that served a useful purpose and just Did The Damn Job.

            It had a kinda prophylactic interactive firewall feel to it. Easy to use.

            Heh…whaddya know, they’re still alive & kicking:

            https://www.zonealarm.com/software/free-firewall/

            Seems like a linux variant would take the form of an interactive notification bar app that makes it easy to configure the regular linux firewall, as well as monitoring network interfaces for outgoing (maybe incoming also?) traffic.

            • >Seems like a linux variant would take the form of an interactive notification bar app that makes it easy to configure the regular linux firewall, as well as monitoring network interfaces for outgoing (maybe incoming also?) traffic.

              Helluva good mid-complexity project for somebody. Well-defined objectives, easy architecture, high impact. Ian, you paying attention?

              • I’m not Ian, but the problem of how to design such a thing that would afford a non-power-user the luxury of ignorance without accidentally making it a vector for privilege escalation (since the firewall commands themselves must run as root) intrigues me.

                I think i just got nerd-sniped.

                • >the problem of how to design such a thing

                  Two pieces:

                  (1) a bot that watches packet logs and ships JSON notifications about new port traffic (inbound or outbound). This runs on the router facing your ISP.

                  (2) A status-bar app that reads the notifications, interacts with you, and uses secured ssh to edit the kernel packet filter files on the router.

                  • I was thinking less of notifications & permission for the firewall at the local network border, and more for the host-local firewall. Though the design was somewhat similar: A simple daemon that monitors the log produced by an outbound rule which blocks all non-whitelisted executables and fires off a notification for new events, and a privileged script/executable that receives messages of what to allow/block and updates iptables accordingly. Though immediately the problems of what IPC mechanism(s) between them to use, or what serialization format came to mind. But you’ve just answered that; sockets would allow this to work both at the host and network level, and most languages (I hope) have sane JSON facilities.

                    I shall find you and Ian on IRC to discuss this further.

                    • >I was thinking less of notifications & permission for the firewall at the local network border, and more for the host-local firewall.

                      I can’t see why one would even bother with that. Surely it’s better to block malicious traffic at the LAN edge than replicating the effort at each host?

                      In any case, it’s clear that the two different pieces have to be able to run on different machines.

                      >and a privileged script/executable that receives messages of what to allow/block and updates iptables accordingly. Though immediately the problems of what IPC mechanism(s) between them to use, or what serialization format came to mind.

                      In my original design sketch for this, there was a custom rule-editing bot on the router. But then I had a rush of brains to the head and realized that if we ship editing commands to the router via ssh we (a) minimize the amount of code that needs to run there (which is good because consumer-grade routers have limited flash and RAM) and (b) we can delegate our security and authentication issues to sshd.

                      My working name for this is TuxAlarm.

                    • Surely it’s better to block malicious traffic at the LAN edge than replicating the effort at each host?

                      Call me crazy, but I’d hope for defense in depth, (LAN and host/client) with different code running on the host so a vulnerability on the LAN side didn’t mean the same vulnerability exists on the host/client side.

                    • Well….ZoneAlarm didn’t require any ‘bot’ running anywhere else to feed it info.

                      It should be able to work when you’re connected to J Random WiFi .

                      Feature creep?

                    • >Feature creep?

                      No, just that we want the front end to run on your desktop but control firewalling on your edge router.

                  • This will make me popular…

                    I vote for the client side being multi-platform so it could be run on Linux, OSX or Windows. If written in say, Go, a lot of the OS specific stuff is already abstracted away.

                    Ok, I’ll go back to my corner now.

          • I used to use ZoneAlarm myself, and I too, loved that functionality. It was nice to know what on my computer was trying to access and when. The initial setup was a bit noisy as it learned the commonly used applications, and then quieted down afterward once my normal usage patterns were known. Though it was a source of annoyance on occasion when trying out a new video game (such usually ran full screen), and said game couldn’t access Internet because I’d missed the notification.

            I eventually ended up ditching ZoneAlarm for another product. While I loved the functionality, its network driver was kinda shitty. About every 30 days, Windows would bluescreen, and with the same error code. Finally I looked it up, and found out it was ZoneAlarm’s fault. Replaced ZoneAlarm, and I then could go for months between reboots. And this was on Windows 98, which was never a paragon of stability to begin with.

    • My home rule is nested routers. My ISP’s gateway/router hosts a guest SSID, a hard-wired weather station gateway, and my internal router. The internal unit hosts the family SSID and some hardwired devices.

      My Roku and blu-ray players use the guest SSID.

  20. ” This is usually not an issue unless you have an unusually fast Internet connection, like above 15MB/sec”

    15MB/sec is unusually fast?

    Common around here is 100Mb/s. The fastest consumer internet one can get is 10Gb/s. Even in my mountain hut, where I use 4G I still get around 100Mb/s down.

      • Possibly not. When you deduct framing overhead and inter-frame gap time your 100Mbits per second is more like 10MBytes per second, not 12.5Mbps as you would expect. I see this all the time dealing with backup traffic. GbE links barely move 100MBps of backup traffic..

        A 150Mbps up-link is pretty fast.

        • If you are on fibre you get a symmetric link. 200Mbit/s is common. 1Gb/s will set you back about 800$ a year. There is a provider offering 10Gbit/s over fibre, but that‘s a marketing gimmick. At those speeds you actually start to encounter bottlenecks elsewhere.

          I live up in the mountains. No fibre here.
          I’ve also gone the Ubiquiti route, but I did not get their “cloud key”, but am in stead running the controller on a PC Engines box with Fedora. My internet link uses an outdoor LTE router (Zyxel, wish Ubiquiti would make such a thing…) and I’m getting decent speeds (150Mbit/s down, up to 50 up). I’m however looking at getting an Airfibre going to some where that has fibre…

  21. Ubiquiti looks interesting, I’ll have to check them out, thanks to everyone who suggested it.

    I’ve actually gotten excellent up time and performance from a Netgear R7000, with DD-WRT 3.0 r36070 on it (Kong’s build) for the last year; that router is all Broadcom chips, oddly enough.

    I chose it because Kong (DD-WRT developer) used it himself. It auto-updates to stable versions with a program called “ddup”, which is convenient (don’t have to manually flash updates).

    • >that router is all Broadcom chips, oddly enough.

      No random hangs and mystery slowdowns? I’m astonished.

      Me, I’m still staying the @!%^#! away from anything Broadcom. Twice bitten, three times shy.

      • Well, picking the same hardware as one of the lead developers does lead to a greater chance of success.

      • Nope, none. But, before flashing the DD-WRT firmware for the first time, I invoked Cthulhu’s name three times. Common sense, really, when setting up a router: Get latest firmware, set strong WPA2 and web interface passwords, summon elder gods…right?

        I don’t blame you if you’ve been burned in the past, though. I’d do the same.

          • >Is it still a sacrifice if you use a communist?

            No. The technical term for sacrifing one communist is “a good start”. Extra points if you include a side of Nazi, but those are much more difficult to find.

        • Don’t be silly Patrick. Anyone with a basic grasp of Lovecraftian theory knows that you invoke Yog Sothoth for routing! “Yog-Sothoth knows the gate. Yog-Sothoth is the gate. Yog-Sothoth is the key and guardian of the gate.”

          And while Cthulhu does enjoy the taste of either Commie or Nazi, Yog Sothoth prefers the many-layered taste of a professional political grifter, regardless of their falsely-stated ideology.

          • ” “Yog-Sothoth knows the gate. Yog-Sothoth is the gate. Yog-Sothoth is the key and guardian of the gate.”

            Sounds more like he’s the go to guy for firewall issues.

  22. I’ve been looking at the gear that works with DD-WRT, and it all seems to be, at best, mid-grade consumer gear that (unfortunately) looks to an untutored customer like… mid-grad consumer gear. (The customer can’t see the amazing software, just the fact that it looks like you bought it at Walmart…)

    Is anyone putting DD-WRT on something that vaguely resembles rack-mountable professional gear?

    • >Is anyone putting DD-WRT on something that vaguely resembles rack-mountable professional gear?

      Can’t find any sign of that. And since its one competitive advantage over OpenWRT seems to be its NDA with Broadcom and ability to use their proprietary blobs, one would expect it to more and more specialize in supporting Broadcom gear that OpenWRT can’t. I rather doubt you’re going to find those chips in pro-grade gear.

      • Let me ask the obvious follow-up: Is anyone putting OpenWRT on something that vaguely resembles rack-mountable professional gear?

        • >Let me ask the obvious follow-up: Is anyone putting OpenWRT on something that vaguely resembles rack-mountable professional gear?

          This Reddit thread suggests it’s unlikely. But I’m not an expert in this area.

      • Someone correct me if I’m wrong, but last time I looked seriously at DD-WRT it looked very much like a near dead project.

        I’m glad to hear OpenWRT is going strong.

        • >Someone correct me if I’m wrong, but last time I looked seriously at DD-WRT it looked very much like a near dead project.

          Doesn’t look super-healthy to me, either, based on the website content. I patched references to it into the post because for people struck with Broadcom hardware it looks less bad than random vendor blobware.

          • I spent considerable time on the DD-WRT website the other day, and their documentation looks to be much better than OpenWRT’s, so I hope the project survives. One of the things that seems to be missing from both sets of documentation is a good document about the basic theory of a router based on Linux. (Does anyone know where to find such a thing?)

            I’m sure I could use either project for my own stuff, even without the theory, but I like to deep-dive into the theory because that makes diagnosis much easier. I’ve got a basic Juniper cert and studied for a basic Cisco cert, so I know general router theory but I have no idea what they’re doing to make that work under Linux.

Leave a Reply

Your email address will not be published. Required fields are marked *