The low-down on home routers – how to buy, what to avoid

Ever had the experience of not realizing you’re a subject-matter-expert until someone brings up a topic on a mailing list and you find yourself uttering a pretty comprehensive brain dump about it? This happened to me about home and SOHO routers recently. So I’m repeating the brain dump here. I expect I’ll get some corrections, because at least one of my regulars – I’m thinking of Dave Taht – knows more about this topic than I do. But here goes…

If you’re looking to buy or upgrade a home router, I’ll start with some important negative advice: Don’t go near hardware with a Broadcomm chip in it. The current too-weak-to-thrive threshold for router hardware is <4MB flash or <32MB RAM; if you buy less than that your forward options will be seriously limited. And most importantly: Don’t trust vendor firmware! Always reflash your router with a current version from one of the major open-source firmware stacks.

If your prompt reaction is “I ain’t got time for that!”, then the Romanian, Bulgarian, and Russian cyber-mafias thank you for your contribution to their bot networks and promise they won’t do anything really bad with your router. But they will sell control of it to the highest bidder, all right.

Yes, it’s that bad out there. You’ll understand something of why by the time you finish reading this.

In fairness to one vendor who seems to be trying to do right, Ubiquiti may be an exception to the vendor-firmware-sucks rule. They have very good buzz among my knowledgeable friends, but I haven’t tested their stuff myself and experience has taught me skepticism in these matters. So I can’t recommend them as an alternative to reflashing yet.

There are two major open-source firmware distributions and several tiddlers. The tiddlers haven’t attracted enough of a community to self-sustain and are best ignored unless you ahem crave adventure.

The majors are OpenWrt and DD-WRT. For a while OpenWRT looked almost moribund and there was a third called LEDE that was an OpenWRT fork, but no more. It looks like LEDE has merged back into OpenWRT and revivified it. They shipped a new stable release at the end of January 2019.

DD-WRT is a different project than either OpenWRT or LEDE. It’s not as well run as OpenWRT, which actually has one builder and stable releases. DD-WRT survives mainly because it has good support for one common SOC that OpenWRT/LEDE doesn’t – IIRC it was some exudation from the never-to-be-sufficiently-damned Broadcomm (“Our products are shitty, but boy are they cheap!”).

I’ve found OpenWRT very solid and reliable; the reason my knowledge of the state of these projects got a bit stale is that my router Just Works and has Just Worked for a long time. I have a plan B to buy one of the Ubuquiti routers if OpenWRT shits the bed, but I’ve never come even close to exercising that option.

(Note: What I’m actually running is CeroWRT, a now fairly old fork of OpenWRT by my friend and semi-regular A&D commenter Dave “Bufferbloat’s-Bane” Taht that he wrote to experiment with improved buffer-queue management; since then his patches were merged upstream to OpenWRT/LEDE and Linux and CeroWRT has been discontinued.)

My current recommendation, therefore, is to flash OpenWRT if you can and DD-WRT only if you must. At 846 vendor/model combinations OpenWRT has pretty broad support.

If I needed a new router today (I don’t, I have a couple of cold spares) I’d trawl e-Bay for a one-generation-back commodity router on the OpenWRT support list that does have 4MB+ flash and 32MB+RAM and doesn’t have a &$@*$! Broadcomm chip in it, buy it, and flash OpenWRTs latest stable release. I’ve had good history with Netgear, so I’d probably look at those first.

Flashing OpenWRT is not a complicated or lengthy process, and you will get the happy feeling that comes from high confidence that your router isn’t infected with vendor malware – a serious issue, some of them have pulled very evil shit like rewriting HTTP traffic to push ads of their choice at you, and if you’re wondering if those ad sites are also likely to be malware vectors the answer is “Why, yes, well spotted.”

Even when the vendors aren’t actively evil, remotely exploitable bugs in router firmware stacks have been depressingly common. The problem is not usually kernel-level but higher up, in the admin stack; simple factory misconfigurations (for example) can leave your device totally vulnerable even when the individual software components are sound.

The pragmatic reason to go with OpenWRT is that it greatly decreases your odds of having this kind of problem out of the box and improves your odds of a prompt fix if there is one. It’s a plain fact that OpenWRT ships buggy releases far less often than vendors do.

These are the major reasons I say “Friends don’t let friends run proprietary router firmware.” Ubiquiti *might* be an exception, I’m prepared to be cautiously optimistic on that score, but in general it is not safe out there in vendor-land. Not even close to safe.

OK, now let’s take a look at why it’s so awful in vendor-land…

You have to start by knowing how routers are developed. Almost nobody in this space spends actual NRE on hardware development beyond what it takes for the cases to look different. What happens instead is that there are a handful of reference designs by chip and SOC vendors that get replicated endlessly. This is why, if you look at OpenWRT’s support page, you’ll notice there are a lot fewer images than there are supported routers. I didn’t do a full count, but it looks like there are less than 30 for those 846 products.

Cisco is an exception to this pattern, but only in the commercial-grade hardware they sell to data centers – their SOHO routers are cheap flank guards for the upper end of their range, built on the same reference designs as RandomRouterCo’s. Ubiquiti is not an exception. I can tell both things by noticing that all the Cisco and Ubiquiti stuff on the OpenWRT support list uses a handful of generic images.

Ubiquiti’s value add, if it’s real (which I’m willing to believe – everything I can see from the outside suggests a smart, well-run company) is going to be mostly putting more talent and money into the software end. Which is exactly what I would do if I were running their business strategy; software differentiation is way less expensive than new hardware design. They might do some of the latter, but probably not at the SOHO end of their range – it’s not cost-effective there.

In a market structured like this, optimal strategy is to buy cheap generic hardware and let open-source obsessives add the value on the software end. The main thing you need to be careful about is flash/RAM capacity; everyone’s incentives favor cutting BOM to the bone, and given the fixed coast of the reference designs the best lever on that is to lowball flash/RAM capacity as much as you think you can get away with without having the product go catatatonic in under 90 days.

There’s also a potential problem with cheapjack Chinese component substitutions that contract manufacturers will do unless you’re watching like a hawk, but everybody has that one. If Cisco and Ubiquiti manufactured in the U.S. it would show in their marketing.

And that’s it. I’ll finish by emphasizing a consequence of these things being variations on a handful of reference designs – flash/RAM capacity and port count are about the only differentiators there are. Even if you wanted to try to buy better quality in the rest of the box by paying more money, that’s remarkably hard to do – they’re like toasters that way, except that you can’t actually bail out by buying a better-designed antique. Alas.

107 comments

    1. >Just say no to it all. Put Linux on an old PC.

      …and use what for ports? Even newer ones tend to have only two. That’s poor fanout.

      1. Also, even assuming a machine that has Wi-Fi built in, the direct power savings alone pay for a purpose-built device in a year or less.

        1. >Also, even assuming a machine that has Wi-Fi built in, the direct power savings alone pay for a purpose-built device in a year or less.

          True. I could maybe see using something like a down-version NUC for this, though.

      2. Good embedded routers only have two wired ports. Many have just one. All the ports you see on the back are generally from an embedded switch.

        Don’t use an *old* PC – power consumption of newer PCs has dropped significantly. Buy a new x86/x64 machine commensurate with your bandwidth, hang as many true 1Gb/10Gb ports off as you’d like, and run the OS/distribution you’re already familiar with. That’s the flexible Free solution with the best update mechanism.

        1. >Don’t use an *old* PC – power consumption of newer PCs has dropped significantly. Buy a new x86/x64 machine commensurate with your bandwidth, hang as many true 1Gb/10Gb ports off as you’d like, and run the OS/distribution you’re already familiar with. That’s the flexible Free solution with the best update mechanism.

          The main problem with this approach has already been pointed out – dedicated routers can have a lower enough power dissipation that buying one instead of running a general-purpose PC can pay off within a year. This will remain the case until general-purpose PCs can be run off 5V/2.5A from a wall wart.

          1. I suspect this will remain the case indefinitely, as purpose-tailored hardware is more efficient than software.

            But even with OpenWRT, you’re headed away from optimal power usage. For example, giving up hardware NAT. And PC-compatible hardware has actually scaled down its power consumption quite well. There are even boards like https://pcengines.ch/apu2.htm designed to be powered from a wall wart.

            Point being if you’re in the market of not just using something off the shelf, consider other options besides extreme-cost-optimized consumer hardware.

            1. >But even with OpenWRT, you’re headed away from optimal power usage. For example, giving up hardware NAT.

              How does the second follow from the first?

              >consider other options besides extreme-cost-optimized consumer hardware.

              As a technical hack, sure – building something around the 4-port PCEngines board looks like it would be fun. But “extreme cost optimization” has benefits to me, too; it means I can get the hardware cheaper. Ubiquity router $58, PCEngines box somewhere north of $120 even if I assemble it myself.

              On the whole I’d prefer the hardware systems integration to be somebody else’s problem unless I’m specifically interested in having an adventure.

              1. > How does the second follow from the first?

                More CPU activity uses more power. And you likely need a beefier CPU for the same throughput.

                > On the whole I’d prefer the hardware systems integration to be somebody else’s problem unless I’m specifically interested in having an adventure.

                If you’re not just using an off the shelf product as-is, then it’s DIY work either way. I got tired of the “adventure” of building images for embedded arm, and decided I would much rather manage a router that is similar to every other host I have.

                Neither solution is strictly better. I can only say that I was in the embedded device camp for quite some time, and moved back when I needed to upgrade for a full gigabit connection.

            2. > For example, giving up hardware NAT

              Seconding this. It’s mostly irrelevant unless you’re on fiber, but if you are, the lack of OSS drivers for (some?) routers’ hardware NAT chips really hurts. I was getting 200Mbit on a 1Gbit connection and it took me a while to figure out why.

          2. Well, not 5 volts, but how about 12v/1.5A? This barebones PC (add SSD and RAM) is reported to run OPNsense and pfSense well, and one guy measured it at 16 W draw under load (just under 7W idling). You can even stuff a wireless card in it if you want to.

            1. >Well, not 5 volts, but how about 12v/1.5A?

              OK, that’s a neat little piece of hardware. But way overkill for a router – I’d rather not pay the extra power dissipation to light up all those ports. Really the only additional port I could ever see wanting on a dedicated router beyond a bunch of Ethernet ports would be USB for diagnostic-console access and/or a GPS, and the GPS is because I have a specific scenario in mind for network tomography that requires high-precision time.

              1. What extra power dissipation? 16 W running under load is too small to care about.

                And I want VGA and keyboard/mouse both to do the initial setup and to make sure I can gain access to it if something goes haywire.

                Yeah, the serial ports are overkill, but they’re cheap, power wise. And I’d rather have them than a bunch of Ethernet ports. All you need is two: one to plug into the cable modem or whatever, and one to plug into your LAN switch.

                1. >Or you can get one of these

                  So, yeah, that’s almost right. But I think I know why it’s 12V rather than 5V – it’s to drive VGA. I’d rather trade away the VGA for lower power dissipation and have a serial diagnostic console attached to the USB port. Also the absence of built-in WiFi is a bit annoying.

                  1. Wi-Fi is something better left to a separate box from your edge router/firewall, both because of constant improvements in the technology and because offloading the WiFi AP from the firewall gives you more horsepower to do VPNs and things like squid and suchlike.

      3. I use a Compaq SFF desktop with a PCI-E GigE card in it.

        The main thing that does is let me run a real firewall between my LAN and the outside Internet, and I get to control what goes through it. I haven’t met a dedicated router that gives me the flexibility that running a real firewall distribution does. (Yes, mine’s pfSense, a BSD derivative, but it Just Works for my purposes.)

        I have a WiFi router, a D-Link DIR-878, but it’s in AP mode and inaccessible outside my LAN.

      4. For small systems, you can use a raspberry pi with a USB hub and a couple USB network cards, assuming your ISP pipe is less than about 100mbit (and you don’t need gigabit intranet).

    2. “Hey, think having to maintain router firmware updates yourself and deal with an OSS UI isn’t enough of a headache and timesink?

      Have I got a deal for you!”

      No, Sweet Jesus, no. I ain’t getting paid to be my own network administrator, or to admin another linux box [especially on “old PC” hardware] for fun.

      (When my AirPort system finally dies or gets too moribund, I’ll be going the Ubiquiti route, myself.)

  1. Not being much of a techie, I have a couple of questions about this.

    * I have lately encountered people who think of a router as a device with a lot of Ethernet cables plugged into it. I’ve never owned such a thing; every router I’ve owned has been running wi-fi, and has been connected to our devices exclusively wirelessly. Are you referring to the first sort, the second, or both?

    * We’ve always bought Apple routers. Do your concerns apply to them?

    * It appears that Apple is no longer producing their own routers, but has gone over to using LinkSys devices. Have you any opinion about their trustworthiness?

    * Do you know if it’s even possible to run a router for Apple devices with nonproprietary software?

    Thanks for whatever answers you can offer!

    1. Usually a router connects to the upstream ISP through a wired Ethernet connection. In a typical home setup it plugs into a cable or fiber modem provided by the ISP; that modem usually only has one Ethernet port. You run a cable from that one port to the WAN port on your router. You can buy devices that combine a cable modem and a router or rent them from your ISP, but I prefer to use a separate router because that allows them to be replaced independently.

      User devices can either plug into Ethernet ports on the router or connect via Wi-Fi. The most common setup port setup on home routers is four client (LAN) Ethernet ports plus one upstream (WAN) Ethernet port. You may need to use a wired connection for initial setup because some routers come with a default configuration that is useless for Wi-Fi (for example, the administrative interface can only be accessed from a wired connection), and some only allow reflashing over a wired connection.

      The additional wired ports may be useful even if you plan to connect all your computers by Wi-Fi. If you discover that a single router doesn’t provide good wireless coverage of your entire house, you can add more access points to extend coverage. Those are best connected to the main router by Ethernet.

    2. Quick answers:

      – A router is a device with a particular role: to help devices in one network communicate with devices in other networks. Cables are just a byproduct of how the communication happens, so the post applies to both.

      – Concerns apply to your routers; vendor is not crucial; firmware transparency and hardware specs are.

      – Same as before: vendor is not that important – except avoid Broadcomm chips. At least some LinkSys router models use Broadcom chips, so check before you buy would be the advice.

      – At least not with OpenWRT – their hardware is not listed in the table of compatible hardware.

    3. A router is by definition a device that connects multiple different networks together and takes care of the transmission between them. Consumer routers universally include additional components: always an Ethernet switch with about 4 ports (a little internal network that could work on its own even if the router software itself is disabled), usually a Wi-Fi access point (Wi-Fi is basically a really fancy wireless Ethernet segment that attaches to a main Ethernet network), and often extras like an integrated cable or DSL modem.

      Eric is talking generally about embedded routers, which are going to be small boxes with support for an “Internet” port and multiple wired “home” ports; the Wi-Fi is usually included but is just one more connection from the network’s perspective.

      My own personal take on Linksys is that they were starting to give Cisco some serious competition in the small-business market, so Cisco bought them and crippled them. They used to be the gold standard for customizability (OpenWRT and DD-WRT are named after one of their classic models), but now they’re mid-to-low tier.

      1. >[LinkSys] used to be the gold standard for customizability (OpenWRT and DD-WRT are named after one of their classic models), but now they’re mid-to-low tier.

        I remember those days. In fact, I used to maintain the FAQ on Linksys blue boxes. :-)

    4. “Do you know if it’s even possible to run a router for Apple devices with nonproprietary software?”

      If you mean “for Apple devices as clients on the network”, sure. Apple’s kit uses IP like anything else and certainly doesn’t need any proprietary software on the router in order to function.

      If you mean “run OSS software on Apple’s routers”, eh … no, nobody seems to support it. Apple’s one of the companies big enough and competing in a high-end market enough to not just use a repackaged reference design.

      (I could *believe* Apple maintains/updates the firmware such that their use of Broadcom chipsets is irrelevant, since the real bugs are in the firmware stack, not the silicon.

      But it doesn’t matter, since their router line is EOL.

      On the plus side, if you got nice new, high-end hardware I’d expect it to outperform even the last-gen Apple stuff, just by being that much newer.)

  2. I think you made a error in units here. The useless lower limit for resources is <4MB FLASH and <32MB of RAM, not GB.

    1. >I think you made a error in units here. The useless lower limit for resources is <4MB FLASH and <32MB of RAM, not GB.

      Corrected, thanks.

      1. >> MB not GB

        > Corrected, thanks.

        The error persists in a different location as well: “that does have 4GB+ flash and 32GB+RAM and doesn’t have a &$@*$! Broadcomm chip”

  3. No mention of Mikrotik/RouterOS at all? They’re a smaller player but definitely in the same market segment as Ubiquiti’s products of the same nature. It is proprietary and they have relatively recent form for being botnetted, but I would have thought that would have attracted a warning to avoid if nothing else.

    I’ve had no trouble using one personally but I’m also not in the target demographic for friends-and-family advice.

    1. They apparently don’t have objections to rebranding their stuff. I know of at least one vendor who uses Mikrotik gear rebranded with their own name. It seems to work really well, but YMMV…

  4. The current too-weak-to-thrive threshold for router hardware is <4GB flash or <32GBRAM; if you buy less than that your forward options will be seriously limited.

    I assume you really meant to say MB instead of GB. i have what was a fairly high-end router a few years ago, and it has 16MB flash and 128MB RAM and it definitely isn’t any slouch. (TP-Link Archer C7, for those curious, running OpenWrt).

  5. I can’t speak to the susceptibility to backdoors, but Mikrotik’s RouterOS runs what appears to be a linux-kernel stack (can even be installed on a standard x86 computer with compatible network cards). While, unlike PFsense, it does NOT support OpenVPN over UDP, the 2011/3011 series are cheap (and there’s a sub$100 if you just want to play with one), with 5-10 independently routed ports (switched in groups of five as well) and have some rather interesting firewall features.

    The fun one for me was setting up firewall rules to create and reference dynamic lists, such that, for example, multiple SSH attempts within a few minutes resulted in a ten day block of the offending IP.

    It also allows for some basic queueing/bandwidth management.

    Apparently the network for the USS Yorktown museum in SC was redone with Mikrotik gear. They pump a lot of bandwidth for security cameras and alarms.

  6. Add a malware adblock script that redirects DNS into a black hole (or local 1 pixel something) after your OpenWRT is up and runnig.

    Gl.Inet has inexpensive and good OpenWRT routers too on Amazon. The hardware is mixed, and they add their own layer but it seems to basically work well. They are very hackable and some have uSD slots – most have a fairly full USB 2.0.

    1. >Gl.Inet has inexpensive and good OpenWRT routers too on Amazon.

      Excellent, thanks. That looks like a good option when I next need to buy or specify one.

    2. To me, having an OS that boots from μSD makes the most sense. The worry about sufficient flash evaporates. You also don’t have to worry about a firmware update bricking it, because you can always rewrite the μSD from another computer, and if the μSD itself is broken, replace it with the backup you made. I’d even do alternating updates; write a new OS image to the backup μSD card, swap and reboot, knowing I had the previous image to quickly fall back to in case of trouble. Only after the update proved to have no problems would I rewrite the previous card with the new image.

      Also, SD has a hardware write lock that can be used to frustrate an attacker trying to make for persistent pwnage. Configure the router to send its logs to a separate device from where the actual code lives (like a logging server on the LAN side).

  7. Dualit makes good toasters, an appliance repairer recommended them.

    Based on appearances, it is large enough to have interior spaces that are easy to repair.

  8. @esr: I used LinkSys back in the day. I had a WRT54G that used a Linux 2.6 kernel. Because it used a Linux kernel, the firmware was open source, and various third party variants existed. I ran one called Tomato happily. (IIRC, Tomato had roots in DD-WRT.)

    These days I have a combo cable modem/wireless router from Arris, a major commercial supplier in that space. It was provided by my Cable company (TimeWarner Cable at the time, subsequently purchased by Charter Communications and rebranded as Spectrum.) My service was being upgraded from 20mbit down to 100 mbit down, a new modem was requires, and they supplied it. (I could get my own, and they list DOCSIS 3.0 compatible kit they will support), but it hasn’t been pressing issue.

    The firmware is proprietary, but that’s not an immense concern for me. It works well, hasn’t had issues, and has a UI adequate to let me configure it as desired. (I am not an online gamer, don’t need to open ports for incoming connections, or set up VPNs or the like.)

    I was pleased that it came configured out of the box with WPA2/PSK security enabled and hardware firewall on. I just needed to set a password for administrative acess. I have unfond memories of the early days where a scan for WiFi networks near me would reveal a depressing number of home networks completely unsecured. These days, everything in range of me is secured save for things that are explicitly public hotspots. This makes me happy.

    But out of curiosity, what specifically makes you froth at the mouth about Broadcom?

    1. >But out of curiosity, what specifically makes you froth at the mouth about Broadcom?

      Bitter experience.

      I learned to hate Broadcomm when they were making Wi-Fi chips for early laptops back in the 90s. Ever since then, whenever I’ve had cause to know that there was a Broadcomm chip in a piece of hardware I had to deal with, it was because that function was flaky and broken.

      It’s not just me. Pretty much anybody who’s ever worked with embedded routers or other similar devices has Broadcomm horror stories to tell.

    2. >These days I have a combo cable modem/wireless router from Arris, a major commercial supplier in that space. It was provided by my Cable company (TimeWarner Cable at the time, subsequently purchased by Charter Communications and rebranded as Spectrum.) My service was being upgraded from 20mbit down to 100 mbit down, a new modem was requires, and they supplied it. (I could get my own, and they list DOCSIS 3.0 compatible kit they will support), but it hasn’t been pressing issue.

      >The firmware is proprietary, but that’s not an immense concern for me. It works well, hasn’t had issues, and has a UI adequate to let me configure it as desired. (I am not an online gamer, don’t need to open ports for incoming connections, or set up VPNs or the like.)

      I don’t know about Charter, but my experience with ISP routers/modems says that they’re just as horrible as storebought ones on factory firmware.

      We have service through AT&T U-verse. You can’t run a LAN on their kit, because local DNS is buggy beyond belief, and their tech support doesn’t care as long as any given machine on your network can communicate with the Internet. If you try to have your machines talk to each other in a meaningful way, things get squirrelly. The first router we had had two DNS bugs: First, that any DNS query for the most recent machine to join the network returned 127.0.0.1. I was trying to ssh from one machine to another, and it was failing. I went to the server physically and tried pinging the client, and got a reply from localhost! The second bug was that hostnames were spot-welded inseparably to MAC addresses. If the hostname for a machine changed, or a WiFi dongle was moved between machines, there would forever after be confusion between the machines involved. We threatened to leave when their tech support didn’t grok the issue, and they sent us a new router. The first bug was fixed, but not the second, so I bought a router to flash with OpenWRT, used it to isolate our home network from the ISP router behind NAT, and never looked back.

      1. >I don’t know about Charter, but my experience with ISP routers/modems says that they’re just as horrible as storebought ones on factory firmware.

        So true. I had one of the ActionTecs Verizon ships with FIOS for a while. *shudder*

        1. Yech. I had one of those, and it couldn’t even begin to keep up with the 85Mbit (symmetric) internet connection.

          I’ve just recently moved and upgraded 1Gbps FIOS – the router they tried to fob off on me wasn’t any better. I benchmarked about 285Mbps though it on the wired connection and decided to punt and switch to a spare machine running pfSense.

          I’m not sure if Verizon’s tendency to supply routers that are insufficient for the service is malice, incompetence or a mix of the two.

    3. It was provided by my Cable company

      This is one of those things I won’t do, for two reasons:

      First, the cable company charges a monthly rental fee, and cable modems are pretty cheap to buy yourself (I’ve had my own since well before DOCSIS 3.0–that one ran for about 12 years, and then we moved and changed cable suppliers and I bought a DOCSIS 3.0–an Arris, btw–which has been running fine for about 3 years and has already paid for itself in avoided rental fees from Comcast).

      Second, I don’t trust my cable company not to try some hanky-panky with the cable modem, for much the same reasons as esr gives for not trusting vendor firmware. (It seems now like ISPs now want to give you the combination devices that have the cable modem and router all in one. This does not increase my confidence.)

      1. Rogers Cable in Ontario provides a Hitron cablemodem/router which is awful. I tried it for a while, using the wifi and with a switch behind it, but ended up changing it to bridge mode ( secret magic from Hogwart’s required), with a now-quite-old Linksys WRT-54G behind it, running Tomato and things are much better.

  9. I *hate* that I can’t put open source firmware on my router. It’s an Actiontec MI424WR, which is the standard router for Verizon FiOS (1 Gbps fiber into my house … oh yeah baby!) and it supports OpenWRT and DD-WRT, but not the MoCA interface that brings Internet into the set-top boxen.

    (Very frustrating … I have Ethernet in the living room, and the STB *has* an Ethernet port, but its firmware doesn’t activate that port!)

    Yes I know, I could just run two routers, but I’m too cheap to pay for the extra electricity and I want the network to be serviceable by someone other than me.

    1. Allegedly you can get the ethernet port on the ONT activated. There’s an ethernet port on the CPE side of my ONT, and one of these days I want to see if it’s live.

      In which case you can run the two routers side by side and just let the FiOS router serve the STB.

      If I ever get a round toit…

      1. You can switch over very easily, just call the support number listed on the sticker, and they’ll move you from MoCA to Ethernet immediately. That’s actually the preferred configuration now, because their new “Quantum” routers support speeds higher than MoCA can handle.

        But that’s not my problem; my router is already on Ethernet. I’m using MoCA to communicate with the TV set-top box, and I don’t *want* two routers.

        1. I don’t care about running two routers. But I’ve already got coax running to where I’d want the Wireless Access Point (and all the ethernet cabling I’ve run along the baseboard goes there too).

          Though, because For Reasons I’ve got the home phone wired into on of the test jacks at the ONT via a cable run out the window ANYWAY, I suppose I could just run a length of ethernet cable along the baseboard from that window back to the site of the router.

          I just got one of the Quantum routers (for which the tech had to replace some hardware on VZ’s side of the ONT). It’s an OK piece of kit for what I do, which is why I haven’t bothered to replace/sideline it yet. But I *know* it’s got a terrible security hole that I should give a damn about.

          1. Ugh. Don’t run wires through windows and along baseboards. Learn to fish cables inside walls and ceilings, and to install nice looking jacks in the walls.

            But if you don’t mind running two routers, all you have to do to the Verizon router is disable the WAN side, disable DHCP, give the LAN side some unused address (like 192.168.1.2 instead of 192.168.1.1), and then attach one of the LAN ports to the rest of your network. At that point it just acts as a bridge between Ethernet and MOCA. You can also disable the wireless if you don’t want to use that.

            No matter what … definitely connect your router to your ONT using Ethernet cable. Then you will be running at 1 Gbps instead of the MoCA maximum of about 250 Mbps.

            1. I’ll do all that in my copious free time, in a house that wasn’t built in 1926 and had a bunch of modifications done by people who fancied themselves home improvement specialists.

              I don’t have the tools or time to do it right, and I really don’t feel like adding another permanent set off “did it wrong because didn’t have the right tools” to the stack of slapdash home improvements in the house.

              I’m *past* doing the busman’s holiday as an IT professional. I’ve got better things to do with my time, and the money to hire it out if I need to. So far doing it right is way down my list of priorities. I’m far more likely to disconnect the physical landline right now because I have it simultaneously ringing my cell, for example.

              1. I hear ya. My old house was built in 1929 and it was a pain to get anything through those plaster-and-lath walls. My current house was built in 1991 and it’s such a pleasure to work with; when I want a new ethernet jack I just drill one hole and drop in from the attic.

                (That having been said, I am amazed that a house built in 1991 wasn’t delivered to the original owner with coaxial and telephone cables pre-wired to every room; that would have made it even easier to upgrade to ethernet.)

  10. Leaving aside embedded routers – there’s an entire set of issues with broadcom-based ethernet controllers and handling virtualized switching properly, specifically at least one known issue related to network performance of VM’s under Hyper-V

  11. I take digital security and privacy quite seriously. I steadfastly avoid smart speakers and other listening devices. I’m on the fence about Google’s new 90 day delete feature and if that is enough assurance to turn my history back on.

    One thing never mentioned in these types of missives is that the hardware is beginning to out pace the software. I’m not deep enough into to the community to know if it due to lack of drivers for proprietary hardware or simple disinterest on the part of the developers. I would be quite interested in any information the community here would like to share.

    Open-WRT does just fine with 802.11AC wave 1 features but as soon as you get hardware that supports wave 2 features they don’t seem to be supported. In the home environment the speed wars were mostly irrelevant as even relatively low end equipment could easily saturate the downlink. This is rapidly changing with Gigabit broadband not exactly ubiquitous yet fairly common.

    The typical 2.5 person household now has 2-3 VoIP devices, multiple streaming dongles, various PEDs as well as laptops and perhaps even gaming machines. In this environment beamforming, mu-mimo and wide channels with high bit encoding methods could be the key to maintaining adequate latency. Of course 802.11ax( /sigh, excuse me Wi-Fi 6) doubles down on these features.

    My current solution is to run a router with Open-WRT as my my Internet facing device and a wave 2 AP in bridge mode. I welcome critiques of this approach.

    1. By “routers” you mean the Jetpack/MiFi devices? Those are cellular-data-only devices with a wifi chipset strapped onto them and enough onboard computing to run a GUI management interface. I suspect the OEMs buy someone else’s WiFi chipset, why roll your own?

      In the enterprise space they support cellular cards that slot into a bunch of different enterprise-grade routers.

      I dug this up about one of the consumer-grade units:

      https://www.anandtech.com/show/4500/novatel-wireless-mifi-4510l-review-the-best-4g-lte-wifi-hotspot/3

      “Just like the Samsung SCH-LC11, at the core of the 4510L is a Qualcomm MDM9600 baseband which is responsible for both LTE and 1x/EVDO data connectivity, attached NAND, Qualcomm RTR8600 multi-band/mode RF transceiver, and a Qualcomm WCN1312 WLAN stack for single spatial stream 802.11n. What’s surprising (at least to me) about both the SCH-LC11 and 4510L is that both lack a discrete application processor for managing both the web front-end and the networking side of things (routing, firewall, NAT). The MDM9600 must have a relatively beefy onboard ARM11 or something for this to be sufficient, and as we’ll show later there are similarities in the configuration portals that made this a dead giveaway even before I took a peek inside.”

      Note: That’s a 8 year old article.

  12. I’ve installed a bunch of Ubiquiti kit for my larg-ish church. We had their “beginner” 3-AP-and-a-router kit, but the router was a Mikrotik based piece of junk, which, bizarrely, halved AP throughput in the “standard” configuration you would normally set it up with. But it was a huge jump in performance over 3 standard, home-oriented routers spread around the building.

    A couple years ago, we built a new sanctuary, and I installed their gateway, a controller, 4 PoE switches, 10 of their HD AP WAP’s, and a dozen cameras and even a few phones (hooked up to FreePBX). Looking at the gateway-enabled stats on the controller, I can see 500 clients humming along on a Sunday, and the AP’s flawlessly handle the hand offs as people move around the campus. Along with upgrading to a gigabit cable connection, I don’t hear anyone complain about “the internet” any more.

    Understanding how their Java-based controller worked was a challenge at first, and, in trying to migrate the configuration from my laptop to the controller, I wound up blowing the whole configuration away and starting over, including needing to visit each AP and hard reset it. (If you just do a simple export/import, you should be fine. I was overthinking it.)

    Their high-end AP’s compete with Cisco’s on specs, and they’re literally less than half the cost. They’ve steadily released upgrades to the controller and all the gear, which has added and improved functionality nicely. I can’t recommend them enough.

  13. In re Ubiquiti

    Ubiquiti is based on the former Vyatta codebase. Assuming you change the password from the default (user ubnt pass ubnt) it’s pretty solid. You can configure via https gui, ssh console and with the latter you can run complex shell or perl scripts – which I know because I developed the first versions of some that my company uses in a commercial product. Plus they provide moderately frequent updates and you can install almost any debian package once you get the versioning right.

    It is important to remember that because the OS is a full featured router and firewall (and many other things) you can do a lot with it. This means you can also do dumb things with it that end up breaking things or opening gaping holes in your firewall if you don’t pay attention. Fortunately in the event that you brick the thing it is relatively easy to remove the usb flash drive and manually delete the broken config from a PC

    Personally I’ve always liked the vyatta codebase (the open source one version is now at vyos.io) and the ubiquiti ports that I’ve played with are solid. I may be biased here because I’ve been running various versions of vyatta/vyos/edgeos since early 2010

    Disclaimer: I have not used Ubiquiti Wifi APs only the edgemax router series

  14. Or avoid the problems altogether by going the Open Source hardware way and buying a Turris. It is, of course, more expensive than the alternatives, but you get a proper router that actually works really well with Linux. 1GiB of RAM, 1.6GHz ARM CPU, 6 Gigabit Ethernet ports, 802.11ac WiFi.

    1. >Or avoid the problems altogether by going the Open Source hardware way and buying a Turris

      I’ve been curious about these for a while. So after you posted this comment I did some trawling with searches…and, alas, the news isn’t good. Apparently they botched an update in December 2018.

      Damn shame, because the Turris is a concept I liked a lot and expected to work out. Looks like they need to improve their execution, though.

      1. Worse things have happened at sea ;)

        So they botched an update…to err is human. Yes, it’s an entire box of eggs in their face, but it’ll get cleared up. They don’t have a track record of such blunders, as far as I can tell.

        I think the author of that review is getting a little het up and throwing the baby out with the bathwater.

        1. I’m not so concerned about botching updates as self-reenabling auto updates. That’s evil.

          1. C’mon man…don’t be too hot to condemn.

            It coulda just been some innocent oversight with a default…

            Never attribute to malice… etc ;)

            1. Whether the evil was intentional is orthogonal to the fact that it is evil.

              1) Auto updates should be on by default, so that people who don’t know what they’re doing will be protected.
              2) Those of us who accept the responsibility for doing our own updates, and turn them off, ought never to have them turned on without our express consent. That means firmware updates must preserve any auto-update opt-out established under previous firmware.

              If someone can’t figure out how to implement these two simple rules, they should not be selling routers. (If it be incompetence rather than malice, I still don’t want any of it, thank you.)

  15. > The main thing you need to be careful about is flash/RAM capacity; everyone’s incentives favor cutting BOM to the bone, and given the fixed coast of the reference designs the best lever on that is to lowball flash/RAM capacity as much as you think you can get away with without having the product go catatatonic in under 90 days.

    I don’t get, though, how, with modern storage costs, lowballing RAM below 256 MiB or so, or flash below a GiB, can contribute to BOM cost at a level above the noise floor. Storage is frickin’ *cheap* these days.

    1. >I don’t get, though, how, with modern storage costs, lowballing RAM below 256 MiB or so, or flash below a GiB, can contribute to BOM cost at a level above the noise floor. Storage is frickin’ *cheap* these days.

      We can observe that the vendors continue to chisel on this, so: not cheap enough.

      See my remarks about the crab-bucket quality of this market. Everybody is running on razor-thin margins, hoping to profit on volume. Mere cents off the BOM can be worth chasing in that situation.

      1. But how small can you get before you can’t even shave cents? There’s got to be a minimum die size that you can feasibly install into a chip package, and if your storage doesn’t fill that die size, I’d expect costs to be almost constant. You could, of course, integrate your storage into your SOC (or other chip integrating disparate things), but at that point I’d expect selecting an SOC that’s produced in bulk to be more determinative of cost than the amount of RAM on the SOC (indeed, if you ask for it to be customized to include less RAM, I’d expect the cost might actually go up, unless your order is a significant fraction of the SOC manufacturer’s sales volume).

        1. >You could, of course, integrate your storage into your SOC (or other chip integrating disparate things), but at that point I’d expect selecting an SOC that’s produced in bulk to be more determinative of cost than the amount of RAM on the SOC

          You’re probably right. What I don’t know is if anyone is making the right kind of SOC yet.

  16. Netgear + Tomato…Never looked back.

    Those Turris routers are expensive but impressive. I like the virtual server feature.

  17. Anybody looking for an upgrade might consider OpenWRT on a PC Engines single-board computer. I have the APU2D4 for my home networks. If you’re tech-capable, I can’t recommend it highly enough for that purpose. The D4 has 3 Intel gigabit ethernet ports that I use for WAN, LAN, and DMZ networks. The system boot firmware is the open-source coreboot. There’s even a serial console to ease administration.

    1. >Anybody looking for an upgrade might consider OpenWRT on a PC Engines single-board computer.

      That 4-port version does look like a nice piece of hardware for the purpose. How do you case it and what do you use as a power supply?

    2. This looks like a pretty good option. Do you add on a WiFi AP and if so, what do you buy to do that?

      1. I didn’t because I decided to go with a separate ceiling-mountable AP, for which I use a Ubiquiti AP AC LITE also running OpenWRT in “dumb AP” mode.

        But I did look into it. The APU boards have a standard mini PCIe slot, and their cases have holes for antennas. PC Engines sells Compex+Qualcomm Wifi cards on their site, along with antennas and other accessories.

        Had I gone this route myself, I probably would have bought one of Intel’s Wifi cards instead.

  18. I have come to essentially the same conclusions. I use Ubiquiti access points at home (backed by a full-blown Linux firewall/router), and I use OpenWRT for my mom’s router.

    I’m default tech support for mom, and OpenWRT is fantastic for a remotely-managed single-site. There are already packages to do most things that I need it to do, and a full shell with cron and scripting for the rest. Dynamic DNS so I can always find it, letsencrypt to keep the SSL certificate current, iptables to allow access in and through from only my home network, etc.

    At the local rifle range, I’m deploying a full Ubiquiti stack – cloud key, security gateway, PoE/VLAN switch, access points. I probably would have deployed OpenWRT there too, but I needed fast roaming, and setting that up on OpenWRT looked sketchy when I was looking into it. I think the Ubiquiti QoS setup is easier to work with too.

    If I was starting over at work, I’d deploy Ubiquiti there too.

  19. You should be aware that a some North American ISPs are requiring customers to use their combination modem/router/wifi boxes now. You used to have the option to buy compatible devices and own them yourself, but you’re now forced to rent the ISP-provided combination for ten dollars a month or so. I’d set my folks up with a router pretty much as described in the article, but this spring the provider replaced it with their own to “bring the equipment into compliance.” Of course not being the owner anymore means it’s no longer your choice what firmware to run.

    I’m not sure whether the motivation is simply to add another charge to the bill or if there’s some reason the company wants root on your router, but the result is the same – and you don’t want to have recently invested in a new one only to have it disallowed soon after.

    1. Of course not being the owner anymore means it’s no longer your choice what firmware to run.

      Huh, my mind keeps trying to come up with a scenario where the ISP’s choice of firmware leads to an issue that could lead to a civil suit. 1000 individuals not securing their router thus botnet isn’t reasonably actionable, 1 ISP not securing 1000 routers thus botnet just might be…

      1. We already have empirical evidence that the overwhelming majority of consumers never update firmware, and thus botnet. Since that situation is painful for the ISP and the majority of their customers won’t know or care, baking in the default ability to manage the customer premise device makes some sense. If the ISP doesn’t update, thus botnet – its no worse than what we already have now.
        It is also already the case, the cable company remotely manages and updates the set-top boxes and has all the automation in place for infrastructure updates to those without making everyone trade in the hardware.

    2. I’m not sure if ours actually does require it, but I didn’t check, I just assumed they did and installed my router of choice with my firmware of choice behind the existing one from the ISP, with our actual LAN behind my router.

      1. I’m curious: what benefit do you derive from this? If the upstream box gets compromised, it doesn’t directly see the clients on the LAN but it can still mess with unencrypted traffic and sell its compute cycles to a botnet as if it were the only router.

        My setup is a Cisco modem and a TP-Link router that I bought for $20 each about five years ago. The router has OpenWRT but as far as I know there’s no equivalent for the modem. That’s saved me about five hundred dollars over renting the ISP option in that time, and I’ll be pretty annoyed if I have to give it up.

          1. It’s been very satisfactory. In fact, I run two of model TL-WR841ND with the older one now serving as a wireless client and providing connectivity to an island with a desktop & printer (fishing cable to it isn’t practical). My advice would be to go a bit bigger than the 4MB/32MB minimum if the price delta isn’t prohibitive – it really is a minimum and means you have limited opportunity to install other packages you may want.

            I’ve had Tenda routers, which are quite similar, become brittle from operating heat, which in turn led to the antenna mounts cracking if handled roughly. I would expect the same to be true of the TP-Link, but with gentle handling they’ve been problem-free over the last five years.

        1. @d5xtgr:
          >I’m curious: what benefit do you derive from this? If the upstream box gets compromised, it doesn’t directly see the clients on the LAN but it can still mess with unencrypted traffic and sell its compute cycles to a botnet as if it were the only router.

          See my comment upthread a ways. I get a functioning LAN without AT&T’s local DNS bugs.

  20. My main blocker with something like this is dealing with AU cable.

    I’m not enough of a hardware geek to say it’s doable and the comments i’ve seen say it’s not. Having said that, i need to revisit that now that i’ve moved to NBN HFC…

  21. So if you are an honest and decent person, please tell us how much you have got from Ubiquiti to advertise them so sneakingly?

  22. Thx for the shout-out…..

    It is long past time you upgraded from cerowrt, but I keep having to do things like fight off the cable industry on no money ( https://lwn.net/Articles/783673/ ) and then collapsing in your basement, or vice versa. I thought about upgrading you
    last time I was there, but that was during the run-up to that fight. After that battle I was reduced to pasting “this machine kills bokonons” on my guitar and doing nothing but playing protest songs for months, unable to get on the internet without falling into a rage-knot.

    Since your environment has the same up/down speeds it had when we started (you should be able to call and get a free bandwidth upgrade), and your household is primarily ethernet, you really don’t need a more modern router of any sort. If there was a feature you needed, perhaps, or a security hole worth patching… Still, if you want to reflash a spare wndr3800 with openwrt 18.06.2 it would be easy to swap in.

    These days for > 100mbit connections I use apu2s, but I’ve still not found a satisfying wifi router to then use. The ubnt-lite and mesh radios are ok, I get 90 days uptime out of those now, with openwrt.

    1. I can say nice things about evenroute. They run a pretty recent version of openwrt and all the latest bufferbloat-fighting stuff – sch_cake ( https://arxiv.org/abs/1804.07617 ) and the fq_codel for wifi code in particular, the owner is on the bufferbloat mailing list, and a value add is that they actively monitor your line for “sag”, which afflicts many a dsl line. It is essentially a reflashed, and well supported archer c7 v2.

      I would like a mildly faster apu2 – if you turn cake on it peaks out on shaping at about 600Mbit. For 100-200Mbit I use edgerouter Xes, which are 50 bucks (reflashed with openwrt of course)

      More than that, I’d like to see the present generation of all-in-one routers like actiontec (which is linux based btw) autoconfigure with sch_cake on it, as well as all the vendor routers (which are mostly based on old versions of openwrt). But the sea of vendor firmware remains nearly as awful as it was when we started the cerowrt effort 8 years ago, and the combo modems/wifi boxes are even worse (see badmodems.com) and as I implied, if your connection isn’t faster than 100mbit you still don’t need anything faster than what was being built 10 years ago, just better software as time goes by.

      I kind of expect to be using my wndr3800s for another 5 years at least.

  23. Question: What’s a person to do if they have a Vonage router (which must be first for $reasons)? Are there OSS-compatible versions?

    Another note:
    When it comes to corporations making these devices, it’s pretty trivial for them to go to a mid-tier manufacturer in China and say “like this one you make, but with this different network adapter”. Chinese companies are working to work up the value chain by bringing that kind of engineering work in-house. Companies who want high-end design work can get it done, and low-end typo-for-typo copies still abound, too.

    1. >Question: What’s a person to do if they have a Vonage router (which must be first for $reasons)? Are there OSS-compatible versions?

      I exercised web-fu but didn’t find a definitive answer.

  24. Question, I need to ensure an always up connection, so have been thinking about either getting cable from two suppliers (and ensuring they are routed though very different routes) or maybe a backup 4G wireless modem.

    I am sure Cisco has some ridiculously expensive hardware to do this, but I wanted it in a more home setting. (BTW how do Cisco get away with charging so much more for basically the same thing by simply slapping a “Server Grade” label on front?)

    However, do have a recommendation on how to bond these channels? I know you can do it within Linux itself, so perhaps the best approach would be a mini fanless PC and configure appropriately (though I guess that would need two separate ethernet cards, so maybe a bigger PC.)

    Your thoughts would be appreciated.

    1. >(BTW how do Cisco get away with charging so much more for basically the same thing by simply slapping a “Server Grade” label on front?

      That’d be those hardware NAT chips. I looked and open-source support for them does seem to be thin or nonexistent.

      >However, do have a recommendation on how to bond these channels? I know you can do it within Linux itself, so perhaps the best approach would be a mini fanless PC and configure appropriately

      That, but…you know, it’s for something like this that the PCEngines stuff starts looking pretty interesting.

      https://pcengines.ch

      Start from an apu4, add a miniPCI second NIC and/or 4G wireless modem. Hardware bill probably around $200. You’re right, bonding in Linux itself, but I’ve never done that myself so I don’t have specific advice.

      The advantage is you pull your power draw down to 12 volts and can run fanless with a heat spreader. This would be a really fun build! If it were me I’d document every step and ship a HOWTO about it.

    2. Have a look at OpenWRT’s mwan3 package.

      I think esr was slightly confused when he suggested adding a “miniPCI second NIC” to the apu4s. Those have four independent ethernet NICs already.

      1. >Those have four independent ethernet NICs already.

        Independent NICs. Right. I carelessly assumed it was done the way embedded routers often are, with one NIC and a built-in switch for the LAN side. Good to know. (Alas, I’m not an expert on low-level networking and the hardware.)

        1. Indeed. For the benefit of anybody following this discussion for build advice, I’ll make explicit what this implies: independent network controllers are necessary for routing and firewalling, but they’re suboptimal for switching, because you have to simulate that behavior in software. For something like the PC Engines apu*s, you want a dedicated hardware switch. I rock a cheap dumb Netgear GS308.

          Just this year, I upgraded my home network from a single old Linksys blue box to a bunch of separate components. I hadn’t thought about documenting that with a HOWTO, but maybe I should.

          1. Oh, to be like my friend the CCIE who’s running a 3750E at home for “professional educational purposes”.

  25. I’m running 2 Ubiquity AP:s at home since a couple of years back. Apart from about 3 freezes when power has been shaky, I haven’t had to touch them at all. I have some software on my workstation to control them, But I have no memory of what it is called. I just used it once to set things up.
    At my office I have 2 Ubiquity APs, that we have a slight problem with. They are first generation, and the control software is no longer supported. We need to keep a virtual machine around with the last debian packages released with support for them. Not that we have touched them many times since we bought them quite a few years ago. Rock solid software and rock solid electronics.

  26. Thank you Eric for this article, and thank you commenters for the in-depth discussions. I’m now operating with OpenWRT on a new TP-Link Archer C7 router. My old ASUS RT-AC66R was no longer supported by Asuswrt-Merlin and I was having frequent dropped connections with the VDSL modem.

    Replacing the router hasn’t solved my dropped connections, but it gives me the tools to isolate and identify the problem. Thanks again for a timely article.

  27. Off-topic, but along the same general lines: Do you have a similar brain-dump regarding current best-practices regarding encryption? E.g., “generate PGP key with X properties; SSH key with Y features; x.509 key from Z issuer; store on A, B, or C smartcard/dongle; enable authentication protocols P and Q; and so forth”?

    1. >Off-topic, but along the same general lines: Do you have a similar brain-dump regarding current best-practices regarding encryption.

      Alas, no.

Leave a Reply to esr Cancel reply

Your email address will not be published. Required fields are marked *