Edit: Thanks for all the answers, from me and anyone else who was looking! I have some good ideas from the below comments and hopefully this thread helps some others as well.
The major benefit of this setup is that you don't depend on some manufacturer for updates. Given Ubiquiti's and Netgate's recently hostile actions towards users and open source, this provides a great peace of mind. The other benefit is that you're free to upgrade your hardware as needed, which particularly for WiFi cards is great to have. Right now I'm sticking with WiFi 5 because of the costs, but in the future upgrading to 6E would just be a matter of changing the cards (assuming they're supported by the OS).
Speaking of cards, I went with Compex WLE1216V5-20, which have an Atheros chip and are thus much better supported on Linux than Broadcom, etc.
With pfSense, the issue was primarily two-fold. First was the fact that all the firewall rules and such did not support dynamic prefixes. Major PITA right there.
Second was the DNS server, that is, when using pfSense as a DNS server I couldn't figure out how to prevent it from sending the public IPv6 address to clients. Thus when the (public) prefix changed, DNS stopped working on the clients.
Some of this might have improved since I last used it, but I switched to OpenWRT and haven't looked back for a second.
I've had intermittent LAN dropouts on the SG3100 that I couldn't explain from the logs. That in addition to Netgate's hostility towards open source with how they're handling pfSense, and the whole pfSense+ product, just puts a bad taste in my mouth when it comes to supporting the company. For the hardware and software stack they provide, the devices are very overpriced IMO. Same with Ubiquiti, though at least with Ubiquiti you're paying for a set-it-and-forget-it network, as long as you're willing to fully invest in their ecosystem. They're the Apple of network prosumer equipment.
But my main interest in abandoning both is investing in devices that I can upgrade and maintain independently and at my own pace. It will also be cheaper in the long run, though it does require some tinkering to setup.
I guess it will depend on how much I like OpenWrt :) I don't have any experience with it.
In tunables you need:
hw.ibrs_disable="1"
hw.mds_disable="0"
vm.pmap.pti="0"
It's sad that everyone only wants to accept huge amounts of cash these days. Take VyOS as an example. The smallest licensing option they have is $6k per year for unlimited installs. That makes it completely unobtainable for a person that I build firewalls for, so we don't even evaluate it.
In terms of percentages, we could probably add about 15% to every firewall sold and that could be passed along to a software vendor. If we had a self serve portal where we could download LTS releases and generate lifetime licenses we'd send them 15% of our firewall (sales) revenue and they'd basically never hear from us.
In real numbers that would be about $1-1.5k a year as long as we could pay per device as we sell/install them. Using pfSense as an example it'd be in the range of $10k since we started using pfSense and, in the last 5 years, I think I've only had 1 issue I couldn't figure out on my own where I had to go ask on their forum.
https://danosproject.atlassian.net/wiki/spaces/DAN/pages/819...
Eventually I picked the Asus ZenWifi system, and honestly it works great (I have no affiliation with Asus). There's no cloud account to create when you install it. The app is acceptable. There are various security things you can turn on which seem to require cloud assistance, but the core product seems to work very nicely. Any time you try to turn on something which might cause the system to share extra data, a popup appears to explain that to you.
It's so powerful, Wifi-wise, that I bought three nodes and only deployed two. I use it with Ethernet backhaul but it has a dedicated radio for wireless backhaul. It has ethernet LAN ports on each node, and each node is identical to every other node (i.e. there is no "base" and "satellite"). I went from spotty Wifi throughout my 2,000 sq ft house to very strong Wifi throughout. I wrung my hands for a long time because I gave up VLANs and some other things I wanted, and then said the heck with it.
The last time they had a pay per device per month service it started at $1/device/month and then they bumped it to $10/device/month. Somehow they thought the one time cost of a device should become an annual cost and that people would adopt it. Obviously that flopped.
Now think of the same scenario, but everyone's gotten complacent and are getting dependent on their devices that are linked back to ui.com. They might not blatantly flip the switch, but now that they have a hook for licensing checks they can start shifting development so new features are licensed for a monthly fee rather than getting them free forever when you buy a device.
IMO as soon as the all-in-one devices that perform management (ex: UDM Pro) while being linked to a ui.com account get enough adoption they'll shift to some kind of feature licensing or simply release new devices / revisions that require "cloud licensing" or something similar.
They're also very flippant when it comes to breaking devices in a way that prevents a connection to the controller. They think SSHing into broken devices to fix them is reasonable and it's not if you have to deal with many sites / devices.
Not exactly what I want to see in the device that can literally compromise all of my other devices. Am I missing something -- did this turn out to be nothing, or did folks decide that Ubiquiti has bounced back? This seemed really really serious at the time and turned me completely off from ever purchasing one of their products.
https://krebsonsecurity.com/2021/12/ubiquiti-developer-charg...
Not great - but more classic insider attack, then security breach.
Any links or reference. Cant find anything with a quick Google Search.
Some instructions here: https://boratory.net/pfsense-firewall-futro-s900/ https://forums.servethehome.com/index.php?resources/introduc...
I'd suggest using old consumer routers as access points.
There are two choices, the way I see it:
1. Invest in a decent router (probably $150-200 at least) and throw openwrt on it. You'll need something with serious CPU beef because openwrt relies more on software than hardware, and most routers use hardware for QoS etc., hence the price tag. You'll also need to actually understand the multitude of settings offered by openwrt if you care at all about security or performance -- this is nontrivial if you aren't already a network engineer.
2. Buy a used Apple Airport router. The last generation support AC wifi, which is... basically as fast as the best things out there right now, barring wifi 6E. On the plus side: this comes with mostly sane defaults and good performance, I easily get 600+ mbps up/down on my gigabit internet. On the downside... I think you can only configure airport routers through macOS (and a mostly-dead iOS app), and they don't let you configure all the settings you might want. A fair tradeoff for good, non-footgun defaults IMO, but YMMV.
There's also the third option of creating some bespoke raspberry pi + wifi hardware solution for yourself, but that's likely to get you punched by your flatmates when it inevitably reboots incorrectly during a power outage or overheats or whatever and suddenly you need to spend 2 hours debugging problems without a working wireless connection and everyone else is pissed they can't use the internet. Unless, of course, you're a brilliant network engineer who would never make a silly mistake or have a bug in their custom router solution.
Which I guess is why most people use Google or Amazon spyware for internet in their homes.
The biggest reason I don't use a Google router or something of that ilk is exactly what you mentioned in this comment: I don't want basic functionality like port forwarding locked behind some cloud account that I might have to pay for monthly eventually (or might get shut down). At least my current hardware will likely work perfectly until the hardware fails.
The way it was written your statement sounded like a Apple shill really.
Why not OPNsense on an old x86 box?
> but that's likely to get you punched by your flatmates when it inevitably reboots incorrectly during a power outage or overheats or whatever and suddenly you need to spend 2 hours debugging problems without a working wireless connection and everyone else is pissed they can't use the internet.
I thought for a couple of years that my OPNsense setup would pass the Family Acceptance Factor, but one day (a few months back!) it spontaneously wiped itself of its settings — requiring me to plug in a monitor, reconfigure it to boot, and restore my settings from a backup.
My (very annoyed) family had to ask why we had to jump through hoops, and not use a simple consumer router like everyone else.
I'd imagine that OpenWrt would be the same, or worse.
In the worst case, stock firmware would require a hard reset (power cycle) every few weeks. I've had OpenWRT firmware running without interruption (on UPS) for years at a time.
Given that I'd likely keep my next router for 5+ years, I'm hoping for 2.5gbit (if not 10gbit), 4 ports, IPv6 aware (I get a /60 from my ISP), VLANs (so I can keep the random consumer crap segregated off), etc. I had settled on the hardkernel with 6x2.5 Gbit ports, but it's discontinued.
My Ubiquiti 6xp does a great job, I can keep the config file in git, I can assign a IPv6 /64 per port, run custom firewall rules to redirect all DNS to my DNS server (allowing blocking youtube, web games, etc), etc. I block all remote access to my router and from the consumer crap VLAN with watches, TVs, AV receivers, game consoles, etc.
Here's hoping someone ships similar, have my eye on the Mirotek RB5009UG+S+IN, has 1 10G, 1 2.5G, and a bunch of 1G. I'd need a second vlan capable switch with a 10G uplink for my uses, but it's workable. Hoping for similar with a few more faster ports. Even just 2x10G would make a big difference.
They also are introducing full VLAN support in DSM 1.3 which should be out soon if you're a power user. Honestly if they supported PoE for their extenders I probably would have switched out to it. The extenders will mesh wired or wireless which is nice.
https://kb.synology.com/en-global/SRM/help/SRM/NetworkCenter...
I personally like that because I can safely remotely access the routers I've deployed for others if I ever have a reason to. They just need to check a box to turn it on or off in the GUI.
They also have an "experience improvement" program that sends home telemetry that can also be disabled. As far as I know there's no "phone home" that you can't turn off if you don't want it.
Maybe for routers it’s different, but this service is not secure for NAS.
Also note that in unpatched hostapd channel bonding (40MHz and more channels) does not really work. There is a check whether neighboring channel is crowded (which always is due to overcrowded spectrum) that disables channel bonding. AFAIK Openwrt has patch that allows to override this check, but Debian does not.
As a result, i get consistently higher wifi speeds from commercial wifi APs than from my Alix router.
I have on order a mikrotik rb5009UG+S+, which has nine gigabit ethernet ports, one 2.5 gigabit ethernet port, and a 10g sfp+ cage. It has zero fans and benchmarks show it capable of 10 gigabit routing. It costs less than $200.
I love vyos, and I would definitely prefer an open source router. But people I talk to love their mikrotik products. It doesn't seem like the old ones are being abandoned.
Was going to go all in on Ubiquiti but was put off when reading about the reliability issues, plus was way more expensive.
Pleased with my router + access point + PoE switch + hardware controller :)
It says it supports a gateway mode, but as a power user I want a bit more control than what I would expect a WAP to offer. I use an EdgeRouter-4 running whatever the latest official release is. Having separate boxes grants me freedom to do things like mess with Wi-Fi settings while my SO watches a show on Apple TV connected via Ethernet. It's the little things.
I often think of a pfSense build, but then I remember how happy I am with the performance and efficiency of a dedicated box.
A dumber switch would be just fine, but I wanted something with 802.1at POE and good VLAN support because I like to break things up a bit.
OPNsense is darned handy, and I like that it does more than an EdgeRouter would, like terminate a Wireguard VPN. The R610 works wonderfully, and the switch... well... it's a switch. Once configured it's kinda transparent.
Moving houses soon, so I got a second R610 to fill in signal on what I perceive will be dead spots due to plaster+lathe construction, and in testing thus far it all seems to Just Work. And like you appreciate, since it's all modular it's a lot easier to maintain than the UniFi stuff when things go sideways.
Very, very happy with this setup.
Interesting, thanks. Looks similar to one I'm considering to purchase when I'm moving next year. I'd be using OpnSense too.
I think that any slim/passive box will work well. So long as it has enough NICs and they have quality drivers for hardware offload and whatnot it'll work great.
I use mine with a Mikrotik RB4011. A very stable and reliable combination.
Nope, don't trust them to do that after https://community.ui.com/questions/Ubiquiti-ignoring-auto-up...
They have dozens of products which they update constantly, picking one bug at one time as malice and blacklisting a company is not correct. If you go that route you won't have any company left to buy from.
I also just find the UDMs interface an absolute shit show to navigate and find things.
RouterOS is a bit clunky for a Linux user. They kind of mimick Cisco UX, which is a big mess for everyone except professional network engineers.
And before anyone else jumps in with old information,as of the latest firmware, it does not require cloud access. And the PPoE performance problem has been fixed.
It was a bumpy transition for a bit because they moved off of Vyatta to generic Linux for the routers.
This is no longer the case. Some devices (albeit not too many) now have working 802.11ax [0].
I know most about the Linksys E8450, which does require a newer snapshot of OpenWRT (it's not yet in a stable release).
[0] https://openwrt.org/toh/views/toh_available_16128_ax-wifi
Would like to hear ideas about Apple's airports running custom NetBSD ... are you guys still running those as edge/internet routers with wifi or have you pushed them to the inside of the network and promoted some other box to the firewall role? I'm kinda stuck in the conundrum "it's unix with PF, it can handle itself" and "it's does not get updates anymore".