What is a good, secure home router?

[MarkS]

I'm not willing to just buy one, given all of the security breaches of late and I know next to nothing about networking. What brands/models would you guys recommend?

[madires]

In that case I would recommend an AVM Fritz!Box. They care about security and provide updates for many years.

[MarkS]

In that case I would recommend an AVM Fritz!Box. They care about security and provide updates for many years.

Ok. Good good. 😳 Now one easily purchased in the US, and for under $200?

[alpher]

https://mikrotik.com/
used to be decent performer, worth looking into.

[MarkS]

https://mikrotik.com/
used to be decent performer, worth looking into.

The hAP ax² looks to be exactly what I'm looking for! Thank you!

[tunk]

You could also look at a router where you can install OpenWRT.

[MarkS]

You could also look at a router where you can install OpenWRT.

The reason I want this is because my cable modem/router is walled off from all but the ISP. This, of course, sucks! I want to add a seperate router so that I can use a PiHole. I really do not much care for networking and just want to plug it in, set up PiHole and forget it. Plug and play works best for me.

[5U4GB]

If you just want a set-and-forget with the features you mention, a Firewalla is a good bet.  If you don't mind doing a bit of work on it yourself, OpnSense on any router-style hardware would be an equivalent solution.

[madires]

PiHole with Fritz!Box: https://docs.pi-hole.net/routers/fritzbox/

[MarkS]

PiHole with Fritz!Box: https://docs.pi-hole.net/routers/fritzbox/

I have no doubt that AVM make excellent routers, but Fritz!Box is far too expensive for me. It also seems to be difficult to find in the US. All links I can find lead to German sellers, even Amazon.

[voltsandjolts]

Draytek have a fairly solid reputation this side of the pond but not sure about USA availability.
https://www.draytek.co.uk/

[bingo600]

pfSense / OPNsense ... But a steep learning curve.

[JohanH]

Been running an Ubiquiti ERLite-3 for 10 years now. Still going strong. The Ubiquiti Edgemax OS is basically a Debian based OS with Ubiquiti's web interface on top. The routing parts have its roots in Vyatta, so you can efficiently manage everything from the command line. It's a bit old, but they've kept updating the OS so far (although a bit infrequently). I've been running IPv6 tunnels and still have a custom ad-block blacklist with dnsmasq (that's basically pihole...). The web interface lacks some features, e.g. IPv6 is lacking and no Wireguard, but as said, you can install extra packages and do everything on the command line. There's hardware off-loading and routing over two interfaces works fine up to 1 Gbit/s up and down (tested with fiber). If it were to break down, I would maybe switch to their ER-4 model (basically same hardware). I don't think I need faster than 1Gbit/1Gbit for a few years.

Otherwise, I've heard much good about Mikrotik.

And yes, pfsense/opnsense is nice if you like the network stack. Personally I'd go with VyOS if I were to go all in.

Btw, my router sits in a metal cabinet, so there's no point having wifi in the same box. I've got three separate wired wifi access points at strategic places in the house.

[JohanH]

and I know next to nothing about networking.

Apologies for the too many technical details in the previous post. Maybe not so good advice for someone that doesn't know much about networking. But it's always good to learn something, we all have to use networks and the Internet.

[pqass]

I was just going to chime in saying that I've been very satisfied with my Ubiquiti ER-X router/firewall for many years but after just visiting their site, they've re-vamped their entire line!  I think all EdgeRouter products are now called Cloud Gateways.  That explains why my last software update was from July 2023.

I might have to go back to FreeBSD on a spare PC.  It's more work to configure but you have total control.

[JohanH]

I was just going to chime in saying that I've been very satisfied with my Ubiquiti ER-X router/firewall for many years but after just visiting their site, they've re-vamped their entire line!  I think all EdgeRouter products are now called Cloud Gateways.  That explains why my last software update was from July 2023.

I might have to go back to FreeBSD on a spare PC.  It's more work to configure but you have total control.

It's a pity, because it was a great product. The Edgerouter line are still for sale in many places, but I'm afraid they are discontinuing them slowly. There's no money in a product that runs for 10 years. There's been talk about it for long time in the community ever since they introduced the "cloud" products and stopped frequent releases to the Edgerouter OS. The 2.0 OS release has been in Beta/RC for two years now.

I guess I really have to consider a PC and VyOS soon. Regular desktop PCs are no good, because they draw too much power. I have a Lenovo Tiny that I run Xcp-ng virtualisation on for media and such and it's a fantastic piece of kit. Low power and takes almost no space.

[JohanH]

So here's something that could be interesting for other eevblog members as well (maybe already mentioned in the forum?). I really like the concept router this guy is creating, but the router is probably going to be way too expensive for me. The reason he started it was that he was fed up with Fritzbox and the like that were closed and controlled by the ISPs.
(Luckily for me my own fiber ISP lets me bridge their CPE and run my own router).

It's kind of an open built high end home router that will run open source software and he's taking the viewers through the whole design process. Kind of interesting:



Edit. Couldn't find mention of it elsewhere in the forum. He has already over 20 videos in the series! If nothing else, just to follow the design process, it's interesting to watch.

[mwb1100]

I got a Linksys E8450 that I plan to install OpenWRT on.  Getting OpenWRT on this router looks not exactly straightforward; however, I'm pretty sure I'll muddle through.  But done once, updating should be a breeze.  I've heard good things about OpenWRT. 

The E8450 (and the equivalent Belkin RT3200) can be found on eBay for $40-$50 pretty regularly.

[SiliconWizard]

I have OpenWrt on one EA8500 and the install went smoothly. Follow their wiki as they provide relatively clear instructions. In my case, I didn't have to fiddle or open it, but IIRC, I had to downgrade it to a specific official version to allow upgrading it easily with OpenWrt, otherwise the install method would be less trivial.

[Nominal Animal]

For me, the main thing is to get it to run on open source, OpenWRT/FriendlyWRT/pfSense/opnSense/Debian, because I'm a meddler, and I just don't trust vendors to not shaft their users by leaving options open for future monetization of basic functionality.

In many places I see the 2.4 GHz band being quite full already, so dual band WiFi is a must.  Similarly, I prefer GbE wired ethernet, at least two, preferably three connectors, for the kind of physical Ethernet separation I prefer to do.

With these kinds of requirements, there are a lot of possibilities, from OpenWRT-compatible routers, to Mikrotik/Radxa/FriendlyElec boards I can populate with additional hardware.  Because I'm a meddler, I don't like to rely on a single vendor or model at all, and like to play with this stuff.

If you find you do need a 4G/LTE modem, but don't have miniPCIe (or M.2 B-key, which some LTE modems use), I can warmly recommend ADT-Link WS17 adapter for miniPCIe USB 2.0 LTE modems like Mikrotik R11eL-EC200A-EU and Huawei ME909s-120 and similar.  For miniPCIe USB 3.0, use WS18 instead.  I had to test half a dozen various adapters from eBay and AliExpress, before I discovered the WS17.  All others had heating issues to varying degrees, especially with higher transmission powers (further away from the LTE tower), but WS17 remained utterly cool, and even allows changing the VCC to 3.8V (preferred by many LTE modems, better for more powerful antenna pairs) by just replacing one SMD resistor.  Construction is multiple layers of PCB material, and documentation includes schematics; props to ADT-Link for this.

I build my own 4G/LTE routers from off the shelf components.  More about that here, in JohanH's thread mentioned above.

[madires]

BTW, OpenWrt 24.10.0 was released on Thursday. In case you want to go that route choose a supported router with an MT7986 for FTTH or MT7621 for DSL. Minimum flash size should be 16 MB and RAM 128 MB (the more the better) to support future OpenWrt releases. I'd recommend to get a model with USB port for adding a USB stick when needed (helps with small flash size). One of my oldest routers is an TL-WDR4300 (12 years old, 8 MB flash), just upgraded to 24.10.0.

[radiolistener]

With these kinds of requirements, there are a lot of possibilities, from OpenWRT-compatible routers, to Mikrotik/Radxa/FriendlyElec boards I can populate with additional hardware.  Because I'm a meddler, I don't like to rely on a single vendor or model at all, and like to play with this stuff.

What cheap and good models can you recommend for open-source firmware?

[Nominal Animal]

If you want me to recommend a specific router/network appliance for you, I'd need to know your exact requirements first.  ("Nothing special, just an ordinary router" does not cut it; I need specifics.)

The OpenWRT One seems particularly interesting for us meddlers; if not for anything else, for supporting the OpenWRT project.

I usually do the reverse: select between a limited number of options available to me.  Customer protections are quite strong in Finland, so I prefer to buy new hardware locally if possible (so I can return them without a hassle if I get a b0rked unit), but the selection is quite limited.  I check out each possibility, using OpenWRT Table of Hardware, and read the device page noting limitations and unsupported features in particular. Starting at the OpenWRT buyer's guide, and checking the available devices in your price and feature range against the OpenWRT ToH, is your best bet.

I do not have any specific models I personally like, because they all have their downsides; better just pick one that fits your specific use case the best.  I personally also add custom hardware on top (especially display modules via USB control for status display for non-technical humans), and customized firewall stuff (mostly to stop the annoyance of port sniffing and bot attacks), so I tend to look more for network appliances that can perform the duties of a router.  I also like to use OpenVPN (community/open source) for remote connections inwards, so the router being able to support that with sufficient bandwidth is nice.  Benchmarked, not just listed in sales materials.

I also do not trust any specific brand, I look at individual devices.  Even the model revision matters, because the manufacturers can switch even SoC families between revisions.  If you trust a vendor, or a model, be prepared to be disappointed.

As a practical approach, I do recommend you consider routers with full OpenWRT support, but with stock firmware you can also accept.  That way, you know you can use the device, even if you switch to OpenWRT.  OpenWRT isn't some magic hammer either, and it does have its own quirks; but, being open source, just gives you an opportunity to fix those quirks (or get somebody to help you fix those, depending on whether you pay or find someone with enough interest).  No free lunch, I'm afraid.

[DiTBho]

If you trust a vendor, or a model, be prepared to be disappointed.

Like Ubiquiti with the RSP (RouterStation/Pro).

They promised and advertised "full miniPCI support", then you found the hardware misses PCI_IO transactions, so you can only buy miniPCI cards that only operate with PCI_mem transactions.
They promised clean hw design, then you found the SD card CS is shared with the RTC, and in a silly way, so you have to write ugly patches for both the Linux and FreeBSD kernels.
And there are many other things I could mention in this list, but I won't.
The point here is that these are all things that were not known when they advertised their router, things that have been discovered over time

So... it seems the right approach here is to look for hw that has at least 2-3 years of history behind it.
Possibly with feedbacks from those who developed it.

[coppice]

Like Ubiquiti with the RSP (RouterStation/Pro).

Ubiquiti has a really patchy history. One generation of products makes everyone happy, and the next pisses them off. Rinse and repeat since the company began. Only buy a product from them that has been thoroughly recommended by a source you trust. When they make a good product people do really praise them.