What is a good, secure home router?  - Page 1
Forum section: electronics / general

author: MarkS
author_rank: Unknown
timestamp: December 25, 2024, 06:20:46 pm
content: I'm not willing to just buy one, given all of the security breaches of late and I know next to nothing about networking. What brands/models would you guys recommend?

author: madires
author_rank: Super Contributor
timestamp: December 25, 2024, 06:27:29 pm
content: In that case I would recommend an AVM Fritz!Box. They care about security and provide updates for many years.

author: MarkS
author_rank: Unknown
timestamp: December 25, 2024, 07:01:48 pm
content: Quote from: madires on December 25, 2024, 06:27:29 pmOk. Good good. 😳 Now one easily purchased in the US, and for under $200?

author: alpher
author_rank: Frequent Contributor
timestamp: December 25, 2024, 07:14:56 pm
content: https://mikrotik.com/used to be decent performer, worth looking into.

author: MarkS
author_rank: Unknown
timestamp: December 25, 2024, 09:25:25 pm
content: Quote from: alpher on December 25, 2024, 07:14:56 pmThe hAP ax² looks to be exactly what I'm looking for! Thank you!

author: tunk
author_rank: Super Contributor
timestamp: December 25, 2024, 11:03:56 pm
content: You could also look at a router where you can install OpenWRT.

author: MarkS
author_rank: Unknown
timestamp: December 25, 2024, 11:09:26 pm
content: Quote from: tunk on December 25, 2024, 11:03:56 pmThe reason I want this is because my cable modem/router is walled off from all but the ISP. This, of course, sucks! I want to add a seperate router so that I can use a PiHole. I really do not much care for networking and just want to plug it in, set up PiHole and forget it. Plug and play works best for me.

author: 5U4GB
author_rank: Super Contributor
timestamp: December 26, 2024, 09:33:09 am
content: If you just want a set-and-forget with the features you mention, a Firewalla is a good bet. If you don't mind doing a bit of work on it yourself, OpnSense on any router-style hardware would be an equivalent solution.

author: madires
author_rank: Super Contributor
timestamp: December 26, 2024, 09:56:21 am
content: PiHole with Fritz!Box:https://docs.pi-hole.net/routers/fritzbox/

author: MarkS
author_rank: Unknown
timestamp: December 26, 2024, 02:12:04 pm
content: Quote from: madires on December 26, 2024, 09:56:21 amI have no doubt that AVM make excellent routers, but Fritz!Box is far too expensive for me. It also seems to be difficult to find in the US. All links I can find lead to German sellers, even Amazon.

author: voltsandjolts
author_rank: Unknown
timestamp: December 28, 2024, 12:46:45 pm
content: Draytek have a fairly solid reputation this side of the pond but not sure about USA availability.https://www.draytek.co.uk/

author: bingo600
author_rank: Super Contributor
timestamp: February 06, 2025, 06:12:16 pm
content: pfSense / OPNsense ... But a steep learning curve.

author: JohanH
author_rank: Frequent Contributor
timestamp: February 06, 2025, 06:48:18 pm
content: Been running an Ubiquiti ERLite-3 for 10 years now. Still going strong. The Ubiquiti Edgemax OS is basically a Debian based OS with Ubiquiti's web interface on top. The routing parts have its roots in Vyatta, so you can efficiently manage everything from the command line. It's a bit old, but they've kept updating the OS so far (although a bit infrequently). I've been running IPv6 tunnels and still have a custom ad-block blacklist with dnsmasq (that's basically pihole...). The web interface lacks some features, e.g. IPv6 is lacking and no Wireguard, but as said, you can install extra packages and do everything on the command line. There's hardware off-loading and routing over two interfaces works fine up to 1 Gbit/s up and down (tested with fiber). If it were to break down, I would maybe switch to their ER-4 model (basically same hardware). I don't think I need faster than 1Gbit/1Gbit for a few years.Otherwise, I've heard much good about Mikrotik.And yes, pfsense/opnsense is nice if you like the network stack. Personally I'd go with VyOS if I were to go all in.Btw, my router sits in a metal cabinet, so there's no point having wifi in the same box. I've got three separate wired wifi access points at strategic places in the house.

author: JohanH
author_rank: Frequent Contributor
timestamp: February 06, 2025, 07:01:27 pm
content: Quote from: MarkS on December 25, 2024, 06:20:46 pmApologies for the too many technical details in the previous post. Maybe not so good advice for someone that doesn't know much about networking. But it's always good to learn something, we all have to use networks and the Internet.

author: pqass
author_rank: Super Contributor
timestamp: February 06, 2025, 07:49:15 pm
content: I was just going to chime in saying that I've been very satisfied with my Ubiquiti ER-X router/firewall for many years but after just visiting theirsite, they've re-vamped their entire line! I think all EdgeRouter products are now called Cloud Gateways. That explains why my last software update was from July 2023.I might have to go back to FreeBSD on a spare PC. It's more work to configure but you have total control.

author: JohanH
author_rank: Frequent Contributor
timestamp: February 06, 2025, 08:36:24 pm
content: Quote from: pqass on February 06, 2025, 07:49:15 pmIt's a pity, because it was a great product. The Edgerouter line are still for sale in many places, but I'm afraid they are discontinuing them slowly. There's no money in a product that runs for 10 years. There's been talk about it for long time in the community ever since they introduced the "cloud" products and stopped frequent releases to the Edgerouter OS. The 2.0 OS release has been in Beta/RC for two years now.I guess I really have to consider a PC and VyOS soon. Regular desktop PCs are no good, because they draw too much power. I have a Lenovo Tiny that I run Xcp-ng virtualisation on for media and such and it's a fantastic piece of kit. Low power and takes almost no space.

author: JohanH
author_rank: Frequent Contributor
timestamp: February 06, 2025, 08:55:24 pm
content: So here's something that could be interesting for other eevblog members as well (maybe already mentioned in the forum?). I really like the concept router this guy is creating, but the router is probably going to be way too expensive for me. The reason he started it was that he was fed up with Fritzbox and the like that were closed and controlled by the ISPs.(Luckily for me my own fiber ISP lets me bridge their CPE and run my own router).It's kind of an open built high end home router that will run open source software and he's taking the viewers through the whole design process. Kind of interesting:Edit. Couldn't find mention of it elsewhere in the forum. He has already over 20 videos in the series! If nothing else, just to follow the design process, it's interesting to watch.

author: mwb1100
author_rank: Frequent Contributor
timestamp: February 07, 2025, 12:47:38 am
content: I got a Linksys E8450 that I plan to install OpenWRT on. Getting OpenWRT on this router looks not exactly straightforward; however, I'm pretty sure I'll muddle through. But done once, updating should be a breeze. I've heard good things about OpenWRT.The E8450 (and the equivalent Belkin RT3200) can be found on eBay for $40-$50 pretty regularly.

author: SiliconWizard
author_rank: Super Contributor
timestamp: February 07, 2025, 02:36:33 am
content: I have OpenWrt on one EA8500 and the install went smoothly. Follow their wiki as they provide relatively clear instructions. In my case, I didn't have to fiddle or open it, but IIRC, I had to downgrade it to a specific official version to allow upgrading it easily with OpenWrt, otherwise the install method would be less trivial.

author: Nominal Animal
author_rank: Super Contributor
timestamp: February 08, 2025, 01:59:23 pm
content: For me, the main thing is to get it to run on open source, OpenWRT/FriendlyWRT/pfSense/opnSense/Debian, because I'm a meddler, and I just don't trust vendors to not shaft their users by leaving options open for future monetization of basic functionality.In many places I see the 2.4 GHz band being quite full already, so dual band WiFi is a must. Similarly, I prefer GbE wired ethernet, at least two, preferably three connectors, for the kind of physical Ethernet separation I prefer to do.With these kinds of requirements, there are a lot of possibilities, from OpenWRT-compatible routers, to Mikrotik/Radxa/FriendlyElec boards I can populate with additional hardware. Because I'm a meddler, I don't like to rely on a single vendor or model at all, and like to play with this stuff.If you find you do need a 4G/LTE modem, but don't have miniPCIe (or M.2 B-key, which some LTE modems use), I can warmly recommendADT-Link WS17adapter for miniPCIe USB 2.0 LTE modems like Mikrotik R11eL-EC200A-EU and Huawei ME909s-120 and similar. For miniPCIe USB 3.0, use WS18 instead. I had to test half a dozen various adapters from eBay and AliExpress, before I discovered the WS17. All others had heating issues to varying degrees, especially with higher transmission powers (further away from the LTE tower), but WS17 remained utterly cool, and even allows changing the VCC to 3.8V (preferred by many LTE modems, better for more powerful antenna pairs) by just replacing one SMD resistor. Construction is multiple layers of PCB material, and documentation includes schematics; props to ADT-Link for this.I build my own 4G/LTE routers from off the shelf components. More about thathere, in JohanH's thread mentioned above.

author: madires
author_rank: Super Contributor
timestamp: February 08, 2025, 02:46:50 pm
content: BTW, OpenWrt 24.10.0 was released on Thursday. In case you want to go that route choose a supported router with an MT7986 for FTTH or MT7621 for DSL. Minimum flash size should be 16 MB and RAM 128 MB (the more the better) to support future OpenWrt releases. I'd recommend to get a model with USB port for adding a USB stick when needed (helps with small flash size). One of my oldest routers is an TL-WDR4300 (12 years old, 8 MB flash), just upgraded to 24.10.0.

author: radiolistener
author_rank: Super Contributor
timestamp: February 28, 2025, 09:40:32 pm
content: Quote from: Nominal Animal on February 08, 2025, 01:59:23 pmWhat cheap and good models can you recommend for open-source firmware?

author: Nominal Animal
author_rank: Super Contributor
timestamp: March 01, 2025, 11:13:09 am
content: If you want me to recommend aspecificrouter/network appliance for you, I'd need to know your exact requirements first. ("Nothing special, just an ordinary router" does not cut it; I need specifics.)TheOpenWRT Oneseems particularly interesting for us meddlers; if not for anything else, for supporting the OpenWRT project.I usually do the reverse: select between a limited number of options available to me. Customer protections are quite strong in Finland, so I prefer to buy new hardware locally if possible (so I can return them without a hassle if I get a b0rked unit), but the selection is quite limited. I check out each possibility, usingOpenWRT Table of Hardware, and read the device page noting limitations and unsupported features in particular. Starting at theOpenWRT buyer's guide, and checking the available devices in your price and feature range against the OpenWRT ToH, is your best bet.I do not have any specific models I personally like, because theyallhave their downsides; better just pick one that fits your specific use case the best. I personally also add custom hardware on top (especially display modules via USB control for status display for non-technical humans), and customized firewall stuff (mostly to stop the annoyance of port sniffing and bot attacks), so I tend to look more for network appliances that can perform the duties of a router. I also like to use OpenVPN (community/open source) for remote connections inwards, so the router being able to support that with sufficient bandwidth is nice. Benchmarked, not just listed in sales materials.I also do not trust any specific brand, I look at individual devices. Even the modelrevisionmatters, because the manufacturers can switch even SoC families between revisions. If you trust a vendor, or a model, be prepared to be disappointed.As a practical approach, I do recommend you consider routers with full OpenWRT support, but with stock firmware you can also accept. That way, youknowyou can use the device, even if you switch to OpenWRT. OpenWRT isn't some magic hammer either, and it does have its own quirks; but, being open source, just gives you an opportunity to fix those quirks (or get somebody to help you fix those, depending on whether you pay or find someone with enough interest). No free lunch, I'm afraid.

author: DiTBho
author_rank: Super Contributor
timestamp: March 01, 2025, 03:19:44 pm
content: Quote from: Nominal Animal on March 01, 2025, 11:13:09 amLike Ubiquiti with the RSP (RouterStation/Pro).They promised and advertised "full miniPCI support", then you found the hardware misses PCI_IO transactions, so you can only buy miniPCI cards that only operate with PCI_mem transactions.They promised clean hw design, then you found the SD card CS is shared with the RTC, and in a silly way, so you have to write ugly patches for both the Linux and FreeBSD kernels.And there are many other things I could mention in this list, but I won't.The point here is that these are all things that were not known when they advertised their router, things that have been discovered over timeSo... it seems the right approach here is to look for hw that has at least 2-3 years of history behind it.Possibly with feedbacks from those who developed it.

author: coppice
author_rank: Super Contributor
timestamp: March 01, 2025, 03:30:32 pm
content: Quote from: DiTBho on March 01, 2025, 03:19:44 pmUbiquiti has a really patchy history. One generation of products makes everyone happy, and the next pisses them off. Rinse and repeat since the company began. Only buy a product from them that has been thoroughly recommended by a source you trust. When they make a good product people do really praise them.

author: 5U4GB
author_rank: Super Contributor
timestamp: March 02, 2025, 08:43:05 am
content: If you don't care about name brands, there's a million Aliexpress devices with multiple NICs and so on that you can shovel OpnSense or OpenWRT onto which were designed for this sort of thing.