Hacker News Reader

Comment by lmilcin | Hacker News Reader

> Folks - these routers are secure. There is nothing to see here, move along.

If experience is any guide, they are not.

Consumer routers have horrible track of embarrassing, easily exploitable vulnerabilities. That are not patched for a long time or ever.

And exposing your router to public like that suggests the owner knows very little about security. This typically goes in hand with other neglect. Tell me, how many home users that are not security conscious keep their routers regularly patched and will replace the router when the manufacturer stops supporting them?

View on HN

What router does HN recommend for consumers?

I personally run Ubiquiti Unifi gear, but they're not exactly consumer friendly (more geared to power users).

I personally run Ubiquiti Unifi myself, but after some news here on HN I have serious doubts and am in search of a better alternative myself.

https://news.ycombinator.com/item?id=26638145

So are we all, but there isn't one really. Unifi fills their prosumer niche perfectly, no matter how much of an ass and mismanager the current CEO is.

All of the competition either requires intimate knowledge of networking internals, is twice as expensive or both.

Whatever I can keep an updated OpenWRT on.

Buy something well supported by OpenWRT; that typically correlates to at least OK hardware that is known to work well enough. Ideally you'd also install OpenWRT on it, or another choice of OSS rather than factory firmware.

Funny enough, I recently purchased one of the latest TP-Link Archer 5400x (AX73) routers. Ended up not needing it, so I opened it up and connected via UART.

Once you log in it appears to be running a version of OpenWRT, although they don't specify that on their website.

Yeah, I love the older Ubiquiti stuff (Edgerouter) and the Unifi access points, but all their new routers (like the UNMS ones) seem to require cloud hook-in which I really don't want.

When the EdgeRouter-4 I have dies, I suspect I'm going to need to find a new hardware brand, this time preferably running OpenWRT. Potentially it could get to the point where I'll have to look for an ARM based server with low enough power usage and a few independent network interfaces and just run pfSense or VyOS or something...

Haven't done it myself yet but did pick up an rpi cm4 based board to do this: https://www.jeffgeerling.com/blog/2021/two-tiny-dual-gigabit...

They still sell the ER series, but Microtik sounds like what you want.

However, it's likely that your ER-4 will far outlast the majority of devices you can find running OpenWRT. They're very well built units.

Yeah, I’ve used Microtik gear, and I never liked their software. I hear the performance has improved a lot though (that was a big selling point of the Ubiquiti gear when I got into it with their hardware acceleration).

I expect I will eventually move to embedded server hardware (even maybe Xeon-D) on a machine running vSphere or something with a router VM and other VMs for stuff I want to run. Just have a few separate NICs and pair it with a separate managed switch (which I already have anyway).

I use Synology but admittedly have don't have a deep understanding of networking or security. It works for me and is very user friendly.

What Synology products do you use? I was not aware they offered routers.

They do offer a router. It's basically just a Synology NAS with no drives and a few extra routery bits.

https://www.synology.com/en-global/products/RT2600ac

Ubiquity AmpliFi. That’s their consumer line of routers with WiFi.

Mikrotik

https://news.ycombinator.com/item?id=18200119

https://news.ycombinator.com/item?id=17908028

Oh well, "Let s/he who has not sinned cast the first stone". One can very well install OpenWrt on any Mikrotik.

Grab an old office computer stick and Intel NIC and run OPNsense [0] on it. I've got an old Lenovo ThinkStation and it works brilliantly.

[0] https://opnsense.org/

That is, assuming you have plenty of time.

I don't.

Is it too much to ask to have competently built hardware with competent software for a reasonable price enabled by mass production?

I mean, just don't make stupid things like open access to it from a single point of failure where a single engineer can loose their AWS key and enable attackers to access million networks?

Or build devices that overheat placed on an open shelf in home office in truly unreasonably hot Polish climate?

It depends on your experience. For me it didn't require much time at all. You might also consider it a valuable learning experience so worth making the time. I would highly recommend being on top of your own home network as you really never know when networking skills will come in handy.

I have some ops experience but that was 20 years ago. Nowadays if I need to do something like that I have to do a bunch of research and spend a lot of time on it. Which I would prefer spending, for example, with my son teaching him programming.

I can sympathize with people that don't have technical background -- these are practically defenseless.

My question is security updates.

I'm willing to invest time once to get something better working. I'm not willing to invest time on an on-going basis to keep my router secure. My normal router is a !@#$%, but the company does push out security updates.

Most of the DIY projects I've seen require me to do it manually.

opnsense has auto updates, and they are pretty painless. highly recommend it.

I've had good experience as a basic home user with Fritzboxes. I can't vouch for them in terms of security or unusual and fun uses that people here may have for their home network though.

has anyone had good experiences with the Turris Omnia?

> This typically goes in hand with other neglect.

UPnP is on by default, yeah

Reply on news.ycombinator.com