How to get a reliable home router/WiFi box in 2018

My apprentice and A&D regular Ian Bruene had bad experiences with a cheap home router/WiFi recently, and ranted about it on a channel where I and several other comparatively expert people hang out. He wanted to know how to get a replacement solid enough to leave with non-techie relatives.

The ensuing conversation was very productive, so I’m summarizing it here as a public-service announcement. I’ve put the year in the title because some of the information in it could go stale quickly. I will try to mark each element of the advice with an expected-lifetime estimate.

Even before seeing any of the comments on this post I’m going to say you should read them too. Some of my regulars are more expert than I am about this area.

First, a couple of rules that will not age:

For each candidate product, use a search engine to find out (a) what Wi-Fi chipset it is using and (b) whether the firmware is vendor-proprietary or a port of OpenWRT. (OpenWRT has a sibling, dd-wrt, that is also acceptable but in less active development.)

1. If the chipset was made by Broadcom, stay the hell away. Their Wi-Fi and wired Ethernet chips are notoriously shitty and have been for decades – I remember trouble with them as far back as early Linux days in the 1990s.

2. If the firmware is not OpenWRT/dd-wrt, assume that you will need to re-flash the device. The quality of vendor proprietary firmware is, in general, abysmal – not just worse than you imagine, but worse than you probably can imagine. Don’t rely on it unless you like the idea of being pwned by a Bulgarian botnet.

UPDATE: Some routers contain proprietary chips with closed-source drivers that OpenWRT/dd-wrt can’t drive. This is usually not an issue unless you have an unusually fast Internet connection, like well above 15MB/sec. If you do, check on the OpenWRT site and elsewhere for reviews confirming that OpenWRT will support your speed.

An increasing number of vendors do the right thing and ship OpenWRT/dd-wrt from the factory. Read this excellent post by Jim Gettys for some candidates. Specific product recommendation in it may age, but a vendor that is not crappy will probably continue to be not-crappy.

Any current OpenWRT/dd-wrt device will be fully de-bufferbloated. You can’t rely on this from closed-source vendor firmware.

If you want to go cheaper than the $150 or so you’ll pay for a device with preinstalled OpenWRT, you probably can’t do better than buying an N600 on eBay and flashing it with OpenWRT yourself.

I call out this particular platform because:

(a) It’s cheap and easy to get, and probably has all the features you want except Gigabit Ethernet in some older revisions; check for that, the changeover seems to have been between the 3400 and 3800 revisions.

(b) I use one (a 3800) myself and can certify that it’s rock-solid stable; my last service interruption was 381 days ago and that was due to a power outage that outlasted my UPS’s dwell time.

(c) It’s based on a MIPS chipset that was Tier 1 for OpenWRT for a long time and got a lot of love from the core developers.

UPDATE: Note that the 3800 rev of the N600 is out of production but you can find it on eBay, the 3700v4 is also known good and actually has more flash capacity than the 3800.

In conclusion, my thanks and praise go out to Dave Taht and the OpenWRT team in general. They’ve fully fulfilled the promise of open source – best quality, best practices and best reliability.

110 comments

  1. About 2 years ago I left consumer grade gear behind and started sourcing my wifi gear from Ubiquiti. Since then my setup just works flawlessly and I haven’t had to tinker with the network at all. Going this route has actually saved money vs consumer options.

    Setup is probably too hard for non-techies, although the commercial software is more condusive to remotely managing an access point for an SMB (or Grandma). The equipment is superior and comes without the danger of bricking or burden of intensely researching consumer grade hardware compatibility for ddWRT/OpenWRT installs.

    In addition to challenges with 2.4ghz oversaturation in a densely populated area I was inspired by this post:
    https://www.troyhunt.com/ubiquiti-all-the-things-how-i-finally-fixed-my-dodgy-wifi/

    1. >About 2 years ago I left consumer grade gear behind and started sourcing my wifi gear from Ubiquiti.

      Note to others: These are OpenWRT devices. Jim Gettys mentions the EdgeRouter in his post.

      1. Good bet, really. But budget… X-D

        How much is my little $40 marvel box compared to your Ubiquiti gear?

        If I was setting up for my farm, I’d be doing that without question (I’m a BIG fan of their offerings)- but $200+ and a heck of a lot larger for someone needing “portable”, you get where I’m going there.

        1. $150 for a good mimo wireless router isn’t at all unreasonable, and this includes automatic meshing with thier mesh wireless extenders if you need them.

          https://store.amplifi.com/products/amplifi-mesh-router

          I used Ubiquiti professionally, and I can vouch for the fact that they are rock-solid platforms, even when sitting on top of a pole in the Texas summer. They should easily be able to stand live hidden behind your TV in the living room. :)

        2. I paid $60. If your happy with the $40 gear that’s all that matters. Consumer grade gear + open source firmware served me well for over a decade.

          If you start troubleshooting intermittent connectivity issues when pushing moderate to heavy throughput you’ll realize that you just need a box with more power; that’s when its time to look at a router designed to do more than email and netflix.

      2. On the wireless Ubuquuiti devices, as of late 2017, it’s not exactly straightforward to get an alternative firmware like Open-WRT installed. While Open-WRT supports the hardware, but you either have to downgrade the firmware and use mtd to overwrite the update partitions, or break out the soldering iron to get a serial console attached.

        I managed to get an unifi ap AC-lite flashed with open-wrt two years ago, but lack of actual buttons to reset the firmware makes me itchy every time I need to change some sort of setting.

    2. Some have dealt with the burden. :-D

      I link to two on the small as indicated in comments later in the thread.

      If you’re looking for the low-end answers, I linked to them. You’re talking the high-end (which should be given **SERIOUS** consideration for many of the situations there)

  2. IF your needs are somewhat meager, or you’re road-warrioring like myself, there’s a couple of gems from off of Amazon that meets all of the above (a, b, and c in the examples above):

    https://www.amazon.com/GL-iNet-GL-AR300M-Pre-installed-Performance-Compatible/dp/B01K6MHRJI/ref=sr_1_4?s=arts-crafts&ie=UTF8&qid=1533327447&sr=8-4&keywords=gl.inet (external antennas)

    https://www.amazon.com/GL-iNet-GL-AR300M16-Pre-installed-Performance-Programmable/dp/B0777L5YN6/ref=sr_1_2?s=arts-crafts&ie=UTF8&qid=1533327791&sr=8-2&keywords=gl.inet (internal antennas)

    Don’t let the size fool you. It’s a full-on N-300 router with emphasis on wireless. Just need a router? You can pick up a USB powered 10/100 switch to plug into it for more ports. Want wireless? Need a 3G/4G hotspot? This will do it.

    Stock firmware is just a UI/simplification/bolt-on on top of OpenWRT (and you have access to the full monty from the simplified UI with an additional login). They’ve got instructions to make a custom OpenWRT build as needed.

    Most of the rest of it is crap. Some of it hax0red off of OpenWRT with proprietary crap (Gives ASUS and Linksys a nasty look their direction)

    Oh, since I mentioned Linksys… Unless you get a v1 (and I *do* mean this) of the WRT3200ACM, it’s _*TRASH*_ and you should avoid it like it was the black plague- they moved to a hardware configuration that has only come into being supported recently. (As an aside, it’s a PRIME example of what Eric’s talking to about Broadcom hardware… X-D)

  3. The *ONLY* Broadcom devices you should be bothering with for this sort of thing is a RaspberryPI 2/3/3+

    It’s supported solidly by the project and it’s a step up from the micro devices I’m talking to with it being able to support more radios, etc. It’s only drawback is if you’re pushing more than ~400mbits/s rate through the USB link as they’re still using a single USB 2.0 root hub.

    There’s other gems out there if you’re willing to do a bit of roll your own like with the RaspberryPI variant. Let me check to see if any of the other gems might have landed.

  4. My principal bound these days is to need to shape the “badwidth” from various ISPs with sch_cake. That eats cpus for breakfast.

    For more oomph, these days I use for ~gbit

    https://www.pcengines.ch/apu2c2.htm

    Or some variety of i3 nuc with intel ethernet for > gbit.

    I then give up and put the wifi AP somewhere central.

    wifiwise ~500mbit:

    https://www.amazon.com/gp/product/B010UR8AM2/ref=oh_aui_search_detailpage?ie=UTF8&psc=1

    and am looking for a currently made dual core arm based replacement of that.

    edgerouter X is decent to shape ~200mbit.

    Nothing has ever beat those 3800s for reliability though. They are “classic”. If all you need is 60mbits shaped.

    I use a lot of ubnt gear. Their ac-lites are pretty good but lack on flash. Nanostations are rocks in the field, but slow nowadays.

    All reflashed with openwrt. I was seriously tempted to upgrade eric last time I was in his basement but wanted to wait til the final release last week, and didn’t want to mess with his uptime…. and he has no compelling need to get on the upgrade treadmill. Next time. Maybe.

  5. This release of openwrt is 4000 fixes and features the best openwrt release ever.

    Personal Plug 1: Ath9k, ath10k, mt76 wifi chipsets are fully debloated with the fq_codel for wifi with the *yawn* usual 10×1 latency reduction and throughput increase per here: https://www.usenix.org/system/files/conference/atc17/atc17-hoiland-jorgensen.pdf

    there’s even ecn support.

    “modern” commercial routers are starting to ship “airtime fairness”, I don’t know if they picked all of the fq_codel stuff up, but it’s on the thousands of routers openwrt supports, with those chipsets. And I’d love more feedback from the field.

    Plug 2: For those installing the latest openwrt release, please try using sch_cake in your QOS/SQM (“luci-app-sqm”) system. It’s the latest effort out of the bufferbloat project and does things like per-host fair queuing and ack-fitering and really good framing for docsis, and dsl, letting you hit 99.999% of the configured rate. Not all the options made the gui on this release.

    (It eats cpus for breakfast though, if you run out, switch back to the htb+fq_codel sqm model)

    It went into the linux mainline kernel last month also, and toke got it to scale past 50gbit on xeon class hw.

    https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git/commit/net/sched?id=046f6fd5daefac7f5abdafb436b30f63bc7c602b

    Now, everyone can have cake: https://arxiv.org/abs/1804.07617

  6. Lastly, I’m embarrassed about getting equal stature with the openwrt team in a sentence above. I’ve had nothing to do with openwrt’s governance ever, and I’ve mostly sat out this past release cycle. They’re great folk. Their community really cares about performance and reliability.

    Me… I focused only two *REALLY* difficult components of the overall effort there these past 2 years (mentioned in my previous post), and even then others did 99.99999% the work this time around. I sat on my boat and cheered everybody on, and just did testing here and there. I raise my glass to all of them. Thx.

    All that stuff is now linux mainline where anybody can just turn it on and use it, in any distro, which I’m really happy about.

    What I am happiest about is that the principles we needed to operate under, and the problems we worked so diligently to impart that needed fixing, back in the 2011-1014 cerowrt project era have been adopted and worked on by so many others, to produce such great router software, and that our future along the edge of the internet, once looking dim, is looking mildly brighter.

    I’m personally at a crossroads. I don’t know what to do next. 5G/802.11ax *bug* me, but I can’t get in there and fix ’em from where I sit currently. Life in userspace might be nice. Babeld and the hnetd protocol need love. And, mmm… the wind’s up and blowing my way.

  7. Given just about any consumer-grade WiFi box, DD-WRT, AdvancedTomato, and OpenWRT are all highly interesting. What is also interesting are the assortment of hardware hacks which are published for the more popular units!

    I am using a NEATGEAR EA6300 (which turns out to be the EA6400 inside). Pretty box with pretty lights.

    Inside, the internal WiFi antennas look like chewing gum wrapper tinfoil. The heat sinks appear sufficient, but often have poor application of thermal bonding. …and careful with the power brick because not enough AMPs and the thing just sits there getting hot…

    I hacked mine to include three external RP-SMA antennas, a detailed cleaning and reapplication of thermal goo. There is a guy who has carved down a laptop cooling tray for forced airflow.

    The really cool, replacement router firmware will often even report on chip temps!

  8. Ubiquiti gets updates once every few months, while in my experience openwrt updates once every few years. That alone is the price of admission

  9. I’ve got an Asus RT-N56U, which uses a Ralink chipset. I don’t have OpenWRT installed on it, but I did install the Padavan firmware from https://bitbucket.org/padavan/rt-n56u/. I just upgraded it to version 3.4.3.9-099, and ran a quick test; it appears to have been de-bufferbloated. Since we have Comcast’s highest-speed Internet service and Gigabit Ethernet throughout our home, I’m certainly interested in squeezing as much performance out of it as I can!

  10. I know this one violates the “no broadcom” rule but I upgraded my wifi about a year ago to a Netgear Nighthawk AC1900. It’s pricey, ~$150 at a Best Buy, but it got consistent good reviews and high marks in my research at the time.
    The main feature for me though, was that it is supported by OpenWrt with a ready made build for it. I reflashed it and have had no regrets with the purchase. It is available with OpenWrt preinstalled as well.
    FWIW, i also recommended this router to my father when he came asking. He has 0 technical expertise. He was able to set it up and get it running without problem and had also had 0 issues with it.

  11. I have an Asus RT-AC68U (yes, broadcom chipset), and ran into an issue with firmware replacement that might apply to other routers.

    It has a proprietary hardware acceleration chip for NAT, and the various OSS firmwares don’t support it. Without acceleration, its upstream caps out at 200-300Mbit, bottlenecked on CPU. Typical home users will never notice, but if you’re on gigabit fibre or similar, switching to pure OSS firmware costs you most of your upstream speed.

    I don’t know if other manufacturers use similar proprietary chips, but I’m guessing if Asus does it, others probably do as well. So it might be worth adding a note: “if you have super-high-speed internet, look for router reviews indicating that it can actually hit speed X using firmware Y.”

    (for the AC68U, the least bad alternative is the Merlin firmware, a deshittified variant of the stock firmware that’s OSS where possible but still includes binary blobs for the proprietary functions. Other popular models may have something similar available)

  12. Mikrotik’s Routerboards (https://mikrotik.com/ ) are great as routers and wifi access points. You might need some kind of modem if you don’t already have an ethernet presentation (either native or PPPoE will do). Often (in the UK at least) you can put the ISP in to bridge or modem-only mode and use that tho’.

    They’re Linux based with a custom userland.

  13. Eric.

    This is highly off topic (apologies), but I was wondering what your thoughts are regarding the official finding of “no known motive” wrt the Vegas mass shooting. I seem to recall you knowing someone who was involved in the investigation.

    1. >I seem to recall you knowing someone who was involved in the investigation.

      I do, but he’s not talking about it. I’ll poke him this week.

      1. > >I seem to recall you knowing someone who was involved in the investigation.

        > I do, but he’s not talking about it. I’ll poke him this week.

        Aaaannnd what did he say?….

        1. >Aaaannnd what did he say?….

          Paraphrasing slightly…this is best left alone. Heavily but deniably implied: dude was a U.S. intelligence asset who went nuts, and the people who used to run him don’t want anyone poking around his backtrail.

          1. Eric what reasoning if any did you apply to accept this at face value and not question whether your source is compartmentalized? How convenient for the alleged single shooter to go nuts when the physical and other evidence points to him being a cover for a false-flag. He was likely a U.S. intel asset, but playing what role? The suicide appears to be faked and other evidence implicates the collusion of hotel security:

            https://rense.com/general96/paddockblood.html
            http://archive.is/https://medium.com/@ConsciousOptix*

            Charles Boyd commented on Youtube:

            > If this guy got all those guns into the rooms, where are the suitcases at when the crime scene photos were taken & leaked? Has there been any forensic reports showing which guns / tools he used? Assuming they all would have his finger prints & DNA all on everything. Has there been anything new that has come to light that proves he acted alone? Where is the security footage from the hallway where he shot the security guard? Where is the footage showing him taking these to his room on the floor he was booked?

            1. >Eric what reasoning if any did you apply to accept this at face value and not question whether your source is compartmentalized?

              My source might in fact be compartmentalized; I don’t know that. I’ve just reported what he told me.

            2. You know, when you’re linking to rense as evidence for something, you might want to step back, maybe have a cup of tea, and rethink your life choices.

              1. It’s still a much more reliable source than, say, CNN or NYT, which many seriously misguided people mistake for being truth-correlated.

  14. I stopped using out of the box firmware several years ago after being introduced to DD-WRT when I lived with our host’s and mine mutual friend Phil in Philadelphia. Right now, I’ve got a pair of Netgear WRT3700 v4’s running a repeated wireless WAN in the house and they work flawlessly. I wish more manufacturers would use OpenWRT or DD-WRT – especially with recent reports of exploits related to FTP functions that remain unsecured.

  15. I opted for a Netgear WNR3500L (~$50).

    The wifi performance kinda sucked out of the box, but I dropped Tomato on it and *boom* it has been rocking ever since.

  16. I want to throw out an obscure computer term I saw years ago in a computer science book.

    That word is “nybble.”
    Anyone remember this term? It is half an octet. So two nybbles makes up one byte.

    I have never heard anyone use this term out in the real world or even on the web.

    Anyone ever use it?

    1. >Anyone ever use it?

      Occasionally, usually in discussions involving hex-pair notation for bytes. It’s common knowledge but not common production.

    2. Know it but don’t commonly use it.

      I imagine people ‘above a certain age’ are more familiar with it than others.

      Now get off my lawn.

      1. Google ‘COBOL tutorial’, first pick will be including nibbles explanation, or more likely, reference with no explanation.

    3. This term saw quite a bit of use back in the Apple ][ days.

      It’s still a thing. I just found it (as “nibble”) in the latest Intel 64 architecture manual.

      1. Yeah the term sounded very Apple ][.

        Like take a nybble of the apple right?

        I had an Apple IIgs myself the special Woz edition.

  17. I am sort of confused why the router matters. Our computers are secured, but the router is whatever the ISP provided, the modem has WiFi built into it. Will they really risk not updating the firmware whenever a breach is found at millions of consumers? I am talking about UPC, which is infamous in multiple European countries for outages during work hours, but still. And, I mean, suppose they don’t and the router itself is pwnable, but the computer is secure, firewall, antivir, malwarebytes, what exactly happens?

    These days I do everything from a VPN (NordVPN) anyway, because legislators and big firms are more and more trying to pwn the whole Internet… which is offtopic, but ontopic in the sense of the additional security that means.

    1. >Will they really risk not updating the firmware whenever a breach is found at millions of consumers?

      Yes. Good luck getting any update pushes at all on routers with proprietary firmware.

      >I mean, suppose they don’t and the router itself is pwnable, but the computer is secure, firewall, antivir, malwarebytes, what exactly happens? – it will probably never happen.

      They MITM your machine, redirect your web searches, use it in botnets, hijack your credentials – it can get really bad.

      1. He means, here, the routers the ISP is leasing out, though.

        Centurylink or AT+T are big enough to have the leverage to get updates, and have an interest in not having their customers botnetted and using more bandwidth or attacking other hosts, so for once the interests align to “wanting updates”.

        (Above also reminds us why we should always, always use SSL for everything.

        That way a MITM attack will cause cert warnings and be detectable.

        I mean, I’m surprised this site doesn’t even allow https, let alone prefer it where available!)

        1. > Centurylink or AT+T are big enough to have the leverage to get updates

          I’ve got a CenturyLink Zyxel C1100Z, and the latest firmware is over a year old. It’s *crap* firmware.

          They have the leverage to do good work, but they don’t feel like it.

    2. > …but the router is whatever the ISP provided, the modem has WiFi built into it…

      In the US market, these premises aren’t always true. In fact, the most restrictive ISP I’ve ever used required use of their (non-WiFi) modem, but didn’t supply anything else. On my current ISP, all the equipment, including modem, is mine to choose and administer.

    3. Well then, see the brickerbot ‘possible’ history and answer yourself how much can you trust ISPs: https://archive.fo/PQAnU
      Which seems to be “worse than you probably can imagine” in real.

      Attacks described in this doc took place, and were covered by media before this, ehm, diary, appeared. So at least we know he describes real attacks. But whether it is a real Don Kichote’s coming out, or a full fake I can’t tell due to lack of skills and knowledge. If someone more talented can shed some light on that, I’d be grateful.

    4. I have the bridge/router/Wifi unit that CenturyLink sold me. It’s got a crap interface for example the “modem status” icon is *yellow* all the time. Every 3-4 months when I open it up I see the yellow for modem status and go looking for what’s wrong.

      I’m thinking of adding auxiliary access points, but it *almost* covers the house…

  18. Anyone got a good tutorial on how to bypass the FiOS router? I don’t think I can remove it entirely since the STB seems to use it for $THINGS$, but I’d like to be able to connect my actual home network to a router of my own and shut down everything I don’t otherwise need the FiOS box for.

    ISTR there’s an ethernet port on the CPE side of the ONT that I can hook up to, but I have to ask Verizon nicely to turn it on?

    1. It’d depend on the specific modem, but the internet does suggest the various FiOS routers support bridging mode.

  19. And then there is the whole topic of how to set up the policy on chosen firewall/router. Firewall policy being my specialization, I would be very interested to know how many people on your forum allow *all outbound* traffic – which is only one of several ten thousand pound gorillas in the room for many organizations large and small. I would guess that most people allow pretty much anything outbound – which is terrible policy. And most don’t partition their home/office network sufficiently, if at all. All those smart TV’s, smart phones, smart front doors etc, what a lovely group of pwnd devices they are sitting right next to your laptops and your home brew servers.

    1. >I would guess that most people allow pretty much anything outbound – which is terrible policy.

      What do you recommend blocking?

      1. Everything. And then selectively allow what you know you want to leave your home network. And then to save yourself some sanity in troubleshooting why things don’t work, log your outbound rejections.

        So, one’s workstation would be allowed to speak dns, http(s), ftp(s), ssh, rsync, ntp(s), irc(s), etc, to the wider Internet. The Xbox is only permitted to speak dns, http(s) and kerberos, and only to the IP range that hosts Microsoft’s online gaming services. The printer’s phone home capability is disabled per the configuration it reports on it’s front panel, so if it’s lying about that, well, tough shit, it’s not allowed to ftp “anonymous” ink usage reports to HP. The IoT light bulb needs to be able to speak http(s), because a friend hacked it to scrape the website of one’s local supermarket and flash yellow when there’s a sale on steak, and the wife is amused by this new (actually useful) functionality.

        1. When I was a teen, my dad made use of a Windows security product called ZoneAlarm. I have no idea about the reputability of the company that made it / whether they still exist, but the basic concept was something I have sorely missed ever since: Everything was blocked by default, and network access attempts were reported to the user with the option to block always, block and ask again next time, allow and ask again next time, or always allow (as I recall) for that specific program, with separate settings for LAN and Internet traffic. It would really, really be nice to have a similar FOSS product for use on Linux desktops. The real time nature of it was wonderful.

          1. >When I was a teen, my dad made use of a Windows security product called ZoneAlarm.

            That’s clever, and doesn’t sound like it would be difficult to write under Linux.

            1. A lot of Windows firewalls work this way, but they take advantage of one fact: the firewall is running on the same computer as the software. So they link the port rules to the executable (well, technically, the pathname of the executable). Even the built-in Windows firewall does this, but has a bunch of preinstalled rules to make it a lot less annoying to ordinary users.

              1. The built-in Windows firewall will deny-with-opt-in for new software to “public networks” and allow-with-opt-out for “private ones.” (I was going to say “unknown” but I’ve seen it pop the dialog for quite well-known software packages. Changing the settings is a UAC-required function).

                It defaults to marking unknown networks as “public” at least as of Win 7.

          2. I clearly way older than you, but I do remember ZoneAlarm. I recall thinking it wasn’t a bad bit of software that served a useful purpose and just Did The Damn Job.

            It had a kinda prophylactic interactive firewall feel to it. Easy to use.

            Heh…whaddya know, they’re still alive & kicking:

            https://www.zonealarm.com/software/free-firewall/

            Seems like a linux variant would take the form of an interactive notification bar app that makes it easy to configure the regular linux firewall, as well as monitoring network interfaces for outgoing (maybe incoming also?) traffic.

            1. >Seems like a linux variant would take the form of an interactive notification bar app that makes it easy to configure the regular linux firewall, as well as monitoring network interfaces for outgoing (maybe incoming also?) traffic.

              Helluva good mid-complexity project for somebody. Well-defined objectives, easy architecture, high impact. Ian, you paying attention?

              1. I’m not Ian, but the problem of how to design such a thing that would afford a non-power-user the luxury of ignorance without accidentally making it a vector for privilege escalation (since the firewall commands themselves must run as root) intrigues me.

                I think i just got nerd-sniped.

                1. >the problem of how to design such a thing

                  Two pieces:

                  (1) a bot that watches packet logs and ships JSON notifications about new port traffic (inbound or outbound). This runs on the router facing your ISP.

                  (2) A status-bar app that reads the notifications, interacts with you, and uses secured ssh to edit the kernel packet filter files on the router.

                  1. I was thinking less of notifications & permission for the firewall at the local network border, and more for the host-local firewall. Though the design was somewhat similar: A simple daemon that monitors the log produced by an outbound rule which blocks all non-whitelisted executables and fires off a notification for new events, and a privileged script/executable that receives messages of what to allow/block and updates iptables accordingly. Though immediately the problems of what IPC mechanism(s) between them to use, or what serialization format came to mind. But you’ve just answered that; sockets would allow this to work both at the host and network level, and most languages (I hope) have sane JSON facilities.

                    I shall find you and Ian on IRC to discuss this further.

                    1. >I was thinking less of notifications & permission for the firewall at the local network border, and more for the host-local firewall.

                      I can’t see why one would even bother with that. Surely it’s better to block malicious traffic at the LAN edge than replicating the effort at each host?

                      In any case, it’s clear that the two different pieces have to be able to run on different machines.

                      >and a privileged script/executable that receives messages of what to allow/block and updates iptables accordingly. Though immediately the problems of what IPC mechanism(s) between them to use, or what serialization format came to mind.

                      In my original design sketch for this, there was a custom rule-editing bot on the router. But then I had a rush of brains to the head and realized that if we ship editing commands to the router via ssh we (a) minimize the amount of code that needs to run there (which is good because consumer-grade routers have limited flash and RAM) and (b) we can delegate our security and authentication issues to sshd.

                      My working name for this is TuxAlarm.

                    2. Surely it’s better to block malicious traffic at the LAN edge than replicating the effort at each host?

                      Call me crazy, but I’d hope for defense in depth, (LAN and host/client) with different code running on the host so a vulnerability on the LAN side didn’t mean the same vulnerability exists on the host/client side.

                    3. Well….ZoneAlarm didn’t require any ‘bot’ running anywhere else to feed it info.

                      It should be able to work when you’re connected to J Random WiFi .

                      Feature creep?

                    4. >Feature creep?

                      No, just that we want the front end to run on your desktop but control firewalling on your edge router.

                    5. I too can see a use case for the “local firewall” setup. (And, just for the record, I object to the concept of a firewall running on the machine it’s supposed to protect. By now, the word’s too firmly entrenched to change, though.) For my home LAN, yes, I want an easy way to configure the edge router’s firewall. But for a machine that I operate on someone else’s network, the local firewall is useful.

                    6. I too can see a use case for the “local firewall” setup. (And, just for the record, I object to the concept of a firewall running on the machine it’s supposed to protect. By now, the word’s too firmly entrenched to change, though.)

                      I too was originally opposed to this idea–if the attacker can assault your TCP stack you’re about to lose.

                      But I have come around to thinking that it’s a good thing.

                      Mostly because (as noted above) defense in depth, and also laptops roaming.

                2. >I think i just got nerd-sniped.

                  Jeremy, if you do this, I’ll pitch in and help. So will Ian; he likes the idea too.

                  1. This will make me popular…

                    I vote for the client side being multi-platform so it could be run on Linux, OSX or Windows. If written in say, Go, a lot of the OS specific stuff is already abstracted away.

                    Ok, I’ll go back to my corner now.

                    1. Sounds like reinventing iptables or firewalld. Or am I missing something about this thread? Yes, you should run a firewall on your host and on the edge. Think of the Pentagon ring system multi-layered approach. Yes, you should block everything incoming AND outgoing and “only allow that which is required”.

          3. I used to use ZoneAlarm myself, and I too, loved that functionality. It was nice to know what on my computer was trying to access and when. The initial setup was a bit noisy as it learned the commonly used applications, and then quieted down afterward once my normal usage patterns were known. Though it was a source of annoyance on occasion when trying out a new video game (such usually ran full screen), and said game couldn’t access Internet because I’d missed the notification.

            I eventually ended up ditching ZoneAlarm for another product. While I loved the functionality, its network driver was kinda shitty. About every 30 days, Windows would bluescreen, and with the same error code. Finally I looked it up, and found out it was ZoneAlarm’s fault. Replaced ZoneAlarm, and I then could go for months between reboots. And this was on Windows 98, which was never a paragon of stability to begin with.

    2. My home rule is nested routers. My ISP’s gateway/router hosts a guest SSID, a hard-wired weather station gateway, and my internal router. The internal unit hosts the family SSID and some hardwired devices.

      My Roku and blu-ray players use the guest SSID.

      1. > internal router.

        Read that as “infernal router”.

        When I redo the network to add additional access points the router is getting named Dante, the CenturyLink SSID will be limbo and the internal SSID will be Dis.

        Because it amuses me.

      2. “Home network” is a quaint term that refers to a time long ago. Nowadays, the present day home network can mean any of the functions listed below (and the list is growing):
        1) home office and/or work laptops and workstations
        2) servers that support the above
        3) IP phones, printers, scanners, fax machine
        4) home control system
        5) alarm system
        6) security cameras, door bells
        7) TV’s, multi media, audio systems
        8) house control systems, thermostats, A/C, pool, climate, water, heat, boiler, solar
        9) lighting control
        10) guest WIFI Internet access
        11) in house systems WIFI
        12) home office/business WIFI
        13) home occupants smart phones
        14) gaming systems
        15) valuables safe, firearms safe, other highly protected systems
        16) DEV, QA, UAT zones (if required)
        ALL of these functions require distinct partitioning to/from each other and to/from the Internet. The To/From in ‘each other’ and ‘the Internet’ have taken on a new level of importance over recent years due to both security AND privacy concerns. The days of plopping stuff onto one or two networks are over. The “zero trust” model should be applied to home networks just as much as it is now done in corporations large and small.

  20. ” This is usually not an issue unless you have an unusually fast Internet connection, like above 15MB/sec”

    15MB/sec is unusually fast?

    Common around here is 100Mb/s. The fastest consumer internet one can get is 10Gb/s. Even in my mountain hut, where I use 4G I still get around 100Mb/s down.

      1. Possibly not. When you deduct framing overhead and inter-frame gap time your 100Mbits per second is more like 10MBytes per second, not 12.5Mbps as you would expect. I see this all the time dealing with backup traffic. GbE links barely move 100MBps of backup traffic..

        A 150Mbps up-link is pretty fast.

        1. If you are on fibre you get a symmetric link. 200Mbit/s is common. 1Gb/s will set you back about 800$ a year. There is a provider offering 10Gbit/s over fibre, but that‘s a marketing gimmick. At those speeds you actually start to encounter bottlenecks elsewhere.

          I live up in the mountains. No fibre here.
          I’ve also gone the Ubiquiti route, but I did not get their “cloud key”, but am in stead running the controller on a PC Engines box with Fedora. My internet link uses an outdoor LTE router (Zyxel, wish Ubiquiti would make such a thing…) and I’m getting decent speeds (150Mbit/s down, up to 50 up). I’m however looking at getting an Airfibre going to some where that has fibre…

        2. The standard MTU on the Internet is still 1500 octets which means your framing and IF gap is a tiny percentage and has very little affect on network performance. So the practical limit for UDP traffic is above 99% of the available network speed. Resulting in darn close to 12.5M bytes per second. For TCP, it is around 97% (with all TCP protocol optimizations enabled – see the voluminous related RFC’s). So the value you gave is too low for TCP and UDP. At 100Mbps, you will see TCP operate at a maximum about 12.125M bytes/s as long as there is no other traffic on the line causing contention. As soon as some contending traffic appears, TCP will back off and find a new lower rate but the brilliance of optimal TCP is that it will quickly settle on a number that is still very close to 100% of whatever is available to it. Lower numbers (such as your quoted 10Mbytes/s) are usually the result of transit delay or the end points themselves. Or, in the case of the Internet, it will be peering points congestion, QoS, asynchronous routing, or ISP routing delays.

  21. Ubiquiti looks interesting, I’ll have to check them out, thanks to everyone who suggested it.

    I’ve actually gotten excellent up time and performance from a Netgear R7000, with DD-WRT 3.0 r36070 on it (Kong’s build) for the last year; that router is all Broadcom chips, oddly enough.

    I chose it because Kong (DD-WRT developer) used it himself. It auto-updates to stable versions with a program called “ddup”, which is convenient (don’t have to manually flash updates).

    1. >that router is all Broadcom chips, oddly enough.

      No random hangs and mystery slowdowns? I’m astonished.

      Me, I’m still staying the @!%^#! away from anything Broadcom. Twice bitten, three times shy.

      1. Well, picking the same hardware as one of the lead developers does lead to a greater chance of success.

      2. Nope, none. But, before flashing the DD-WRT firmware for the first time, I invoked Cthulhu’s name three times. Common sense, really, when setting up a router: Get latest firmware, set strong WPA2 and web interface passwords, summon elder gods…right?

        I don’t blame you if you’ve been burned in the past, though. I’d do the same.

          1. >Is it still a sacrifice if you use a communist?

            No. The technical term for sacrifing one communist is “a good start”. Extra points if you include a side of Nazi, but those are much more difficult to find.

              1. Either or both together may be a desired delicacy or cause indigestion. No one will know what the Elder Gods want until the outcome. If the above does not work try lawyers and/or politicians.

        1. Don’t be silly Patrick. Anyone with a basic grasp of Lovecraftian theory knows that you invoke Yog Sothoth for routing! “Yog-Sothoth knows the gate. Yog-Sothoth is the gate. Yog-Sothoth is the key and guardian of the gate.”

          And while Cthulhu does enjoy the taste of either Commie or Nazi, Yog Sothoth prefers the many-layered taste of a professional political grifter, regardless of their falsely-stated ideology.

          1. ” “Yog-Sothoth knows the gate. Yog-Sothoth is the gate. Yog-Sothoth is the key and guardian of the gate.”

            Sounds more like he’s the go to guy for firewall issues.

  22. I’ve been looking at the gear that works with DD-WRT, and it all seems to be, at best, mid-grade consumer gear that (unfortunately) looks to an untutored customer like… mid-grad consumer gear. (The customer can’t see the amazing software, just the fact that it looks like you bought it at Walmart…)

    Is anyone putting DD-WRT on something that vaguely resembles rack-mountable professional gear?

    1. >Is anyone putting DD-WRT on something that vaguely resembles rack-mountable professional gear?

      Can’t find any sign of that. And since its one competitive advantage over OpenWRT seems to be its NDA with Broadcom and ability to use their proprietary blobs, one would expect it to more and more specialize in supporting Broadcom gear that OpenWRT can’t. I rather doubt you’re going to find those chips in pro-grade gear.

      1. Let me ask the obvious follow-up: Is anyone putting OpenWRT on something that vaguely resembles rack-mountable professional gear?

        1. >Let me ask the obvious follow-up: Is anyone putting OpenWRT on something that vaguely resembles rack-mountable professional gear?

          This Reddit thread suggests it’s unlikely. But I’m not an expert in this area.

      2. Someone correct me if I’m wrong, but last time I looked seriously at DD-WRT it looked very much like a near dead project.

        I’m glad to hear OpenWRT is going strong.

        1. >Someone correct me if I’m wrong, but last time I looked seriously at DD-WRT it looked very much like a near dead project.

          Doesn’t look super-healthy to me, either, based on the website content. I patched references to it into the post because for people struck with Broadcom hardware it looks less bad than random vendor blobware.

          1. I spent considerable time on the DD-WRT website the other day, and their documentation looks to be much better than OpenWRT’s, so I hope the project survives. One of the things that seems to be missing from both sets of documentation is a good document about the basic theory of a router based on Linux. (Does anyone know where to find such a thing?)

            I’m sure I could use either project for my own stuff, even without the theory, but I like to deep-dive into the theory because that makes diagnosis much easier. I’ve got a basic Juniper cert and studied for a basic Cisco cert, so I know general router theory but I have no idea what they’re doing to make that work under Linux.

  23. > Call me crazy, but I’d hope for defense in depth, (LAN and host/client) with different code running on the host so a vulnerability on the LAN side didn’t mean the same vulnerability exists on the host/client side.

    I have a network of virtual machines running on my laptop, and if anyone started building hardware the way I want hardware to be built, I’d soon have a network of *physical* machines in my laptop. The firewall can run on the machine attached to the WiFi uplink.

    > Mostly because (as noted above) defense in depth, and also laptops roaming.

    Most of the LANs I connect to are full of malware-magnet hosts controlled by random unknown parties. I don’t bother with LAN-edge firewalls much any more because the monsters already live in my house, as it were. About the only thing a LAN-edge firewall does for me these days is prevent port scans and C&C connections from using up too much WiFi bandwidth.

    If there’s a wireless interface of any kind involved, the endpoint hosts are vulnerable to radio attacks that a LAN-edge firewall can do nothing about, unless your LAN-edge firewall is literally the wall of a Faraday cage. So the endpoints all need to implement firewalls, and it sure would be nice if they could all be configured the same way at the same time.

    > I too was originally opposed to this idea–if the attacker can assault your TCP stack you’re about to lose.

    TCP stacks seem to be pretty slim attack surfaces these days. Just get the victim to run some Javascript and pwn everything without having to care whether there was a firewall or not. SSL uptake makes this harder to filter at the edges, leading to a requirement for a filter to exist inside the endpoint host.

    Until we stop mashing code from a thousand untrustworthy entities onto a single low-budget endpoint device just to display a cat photo or pay a routine bill, the greatest threat will always come from whatever we let through the firewall, not what the firewall filters out.

    1. > > I too was originally opposed to this idea–if the attacker can assault your TCP stack you’re about to lose.

      > TCP stacks seem to be pretty slim attack surfaces these days.

      By “originally” I meant 10-15 years ago.

      > the greatest threat will always come from whatever we let through the firewall, not what the firewall filters out.

      That is axiomatic.

    2. Except that stopping the threat is only one part of the problem. What you do when the enemy invades your territory is entirely different from stopping them in the first place. So the defensive action is to partition everything within your own territory (your home) with reasonable controls that will stop the enemy from roaming freely within. In that case, partitioning of your territory using a firewall (or two or more) is an extremely useful tool in stopping or at least minimizing the free roaming actions of the enemy. And these days, the enemy is as much about privacy as it is about stealing things or money or reputation. Also, ransoming your data and various other unwanted outcomes. Jeremy said above, that a a firewall is just an ACL. I had to restrain myself from commenting about that common misconception. The price of an entry level Fortinet or Palo Alto firewall is worth paying. Failing that, by a Cisco 5500 ASA from ebay and configure that to its maximum possible best practice state. But please do firewall!

  24. I’ve spent the past few days reading about pfSense and even bought a ridiculously over-powered Chinese fanless mini-PC with 4 (Intel!) lan ports to run it on. No discussion of such things here is like stepping into an alternate universe — my research into this has clearly fallen into a different one. Or perhaps it’s that you’re intent on Wifi AP and router in one box and I’m separating those things.

    Anyway, I’m looking forward to playing with things like DNSSEC, DNS over TLS, tunelling things through VPN, blocking ads with pi-hole, intrusion detection… How much of this box of toys turns out to be useful will be an interesting learning experience, at least.

    “the monsters already live in my house” — putting less trusted things on a separate network must help with this somewhat.

    1. I’ve run pfSense for years as my external firewall. Cheap, effective, well worth doing.

    2. >“the monsters already live in my house” — putting less trusted things on a separate network must help with this somewhat.

      And we don’t pay rent, either.

      Ideally, you should have at least three networks:
      1) Trusted network for devices you own and feel good about being able to talk to each other.
      2) Guest network for friends’ cell/tablet/laptop wifi to get them out on the Internet but not into network 1 or 3
      3) IoT. (Obligatory: The “S” in “IoT” stands for “Security”.) Keep these things away from your friends’ stuff so they’ll remain your friends. Only let them on the Internet for things you know they actually need.

  25. Breaking this out because the narrowing margins are horrible. (You should look at changing the CSS for reply right margin indent to something a lot smaller.):

    ESR>I can’t see why one would even bother with that. Surely it’s better to block malicious traffic at the LAN edge than replicating the effort at each host?

    Because a software firewall can do egress controls a hardware (external) firewall can’t. The software firewall can see what executable has requested a socket opened to an IP not on the LAN, and can allow it if that application has been whitelisted for the connection, but not allow some malicious program to piggyback on that authorization to do its dirty deeds. The software firewall kills that connection before it reaches the LAN edge. It never gets out on the wire.

    The biggest problem with software firewalls today is that pretty much everything runs as a browser plugin, so authorizing Firefox or Chrome to access the Internet means letting malicious plugins do so too.

    1. Which is why you really need an application aware firewall. So mucking around with low cost firewalls is pretty much a waste of time. If you’re up to the task of getting pfSense working with HTTPS decryption and Squid (plus WCCP) then go right ahead. Be my guest. But setting up that combination and maintaining it over reasonable lengths of time is just too much time and effort when you can buy a Fortinet or Palo Alto with boat loads more features and functions. More up front cost but dramatically lower costs over time AND far, far superior security posture. I like and use open source whenever I can. For firewalls, not so much.

      1. I had a quick look at Fortinet. The FortiGate-30E seems affordable for a home user. The model (buy device, pay for service to keep it updated & configured) seems similar to the much cheaper Cujo, which I looked into a while back. Of that, people were talking about the risk of running a closed source device made by newcomers that can see everything. I suppose you’re relying on the makers’ motivation to maintain the brand. It’s hard to evaluate the different risks without a lot more experience than I currently have. On the other hand, doing better than the ISP’s default box is probably not that hard.

        Edit: lower costs over time may not actually work out for a geek home user who likes to play with toys (where maintenance is not entirely a cost). Fortinet service looks like $200+/year.

  26. I can recommend the Turris Omnia. Due to regulations and such it is difficult to obtain one in the USA, but it is easily obtainable in Europe. It is also plenty fast for CAKE. It has a fork of Openwrt since at the time openwrt did not have support for the device. Support has been upstreamed though.

    I have one running to go from “F” to “A” on bufferbloat.

  27. Stumbled upon this quite accidentally: I was forwarding esr’s https://plus.google.com/+EricRaymond/posts/L78B1c7mPZ5 post about the Robin Trower – Somebody Calling to my friend (who is admirer of pinkfloydish sound bands) and then explaining to him who the esr is I came here again.

    While in moderate need of new WIFI router (my old low-end ASUS RT-N12 is disconnecting WIFI randomly and my wife really don’t like this; also it’s 2.4GHz only and I want dual-band to saturate my shiny WAN connection better) I find this review VERY helpful.

    I also always wanted to have WIFI router I can ssh into (which seems to be possible with OpenWRT) I found preowned Netgear N600 (wndr3700 v2) on local craigslist clone for a wonderful €13 and I hopefully am going to get it mondays.

    Thanks for the post, you are my computing hero!

    1. Got that Netgear N600 from that guy few days later, flashed the OpenWrt the same evening, made few stupid network config errors but managed to make it up and running (and secure) within a few hours.
      Its rock stable since then.
      Thanks again for the router recommendation!

Leave a comment

Your email address will not be published. Required fields are marked *