OpenWrt Project: a Linux operating system targeting embedded devices
openwrt.org
openwrt.org
If you really want something that runs a more recent version of OpenWRT (for security patches) and fast and stable wifi from the latest generation the best solution right now is to use OpenWRT for routing and get some prosumer Access Point. This combination has worked great for me. This is important if you want to deploy in a work environment where wifi needs to be stable and frequent reboots are not welcome.
for most people the newest wifi standard might not be that critical, any wifi standards after 802.11n worked well for me and they're fairly stable on openwrt.
This is a problem first in terms of security and secondly why ISPs have their own hardware cause people will upgrade their plan and complain they are not getting the speeds because they don't even have the hardware to support it. Firmware bugs in routers are becoming common for DDoS attacks.
As for DD-WRT, my favorite setting is the timer for turning wifi off for the night, and a scheduled restart each morning. I also set the signal strength to as low as I could. This way, the router has been running with no issues whatsoever, maintaining a very stable download rate -- so it sure does make sense to dig in the DD-WRT (or OpenWRT) documentation and wikis.
I admit being somewhat attached to old-but-excellent hardware in general, though, so there's that.
According to wikipedia they are now building prisons like that.
Obviously there's a tradeoff here, between the juicy target of a million homogenous ISP routers, and the ISP quickly patching them. But I bet there are also millions of routers running OpenWRT, albeit on a wider variety of hardware, with many disparate configurations and software versions. I'd expect some opportunistic hackers might see OpenWRT as a juicy target too.
Does OpenWRT have good support for automatic, unattended security updates?
I don't think this would work similarly to how it does on ISP hardware. ISPs have the ability to test their updates against known network conditions. OpenWRT developers do not have the same guarantee, and they don't even make or control all the software you would be using on the device.
no unattended support yet but you can preserve packages.
Here’s a link to past security advisories
Now there is Attended Sysupgrade https://openwrt.org/docs/guide-user/installation/attended.sy... which makes it really easy to upgrade the whole system, but the user has to launch the process.
I'd probably trust an open source team like OpenWRT's more than a shitbag company like my telco, or only-slightly-less-shitbaggy cableco, but as others have noted an open source effort likely won't ever have the resources to do it anyway.
I deeply dislike the cableco's ability to push firmware files to my DOCSIS modem, and I'm certainly not letting them any further into my network than that.
Sure, having your router get security updates is nice, but as a tradeoff for that, you're effectively giving your ISP a complete view into your home network. They could install firmware that gives them MAC addresses and then tags packet traffic by device, giving them a device-by-device, and hence person-by-person, packet-level (or at least connection-level, in the case of properly encrypted traffic) view of who is looking at what, all the time. With a more sophisticated beam-forming AP, they could physically track your devices (and thus people) around inside the house.
That data would be phenomenally valuable, especially as ad-tracking systems get shut down. And they've realistically got at least a few years of absolutely bald-faced shut-up-and-bend-over abusive behavior before Congress would get around to regulating it, and that's given both the worst-case for their behavior and the best-case for regulators. Very likely they could do shit like that indefinitely, especially if they own the router hardware. Who knows -- maybe they already are? It's not like they'd have to tell anyone in the US if they were.
I think I'd rather take my chances with random ransomware gangs than the guarantee of allowing a hostile actor -- my ISP -- into my private network. Those fuckers can stay where they belong, on the untrusted side of the firewall, pushing packets and nothing else.
Did you mean Wireguard?
FireWire [0] is a serial bus standard that used to compete with USB. :)
Unfortunately, the German router/modem market is monopolized by the FRITZ!Box devices made by AVM GmbH. IMO, it doesn't do a good job of being an ADSL modem as it provides very little technical information on what's wrong with the connection. But it does come with a ton of features that have nothing to do with being a modem or a router such as support for proprietary IoT devices by AVM. Basically, this whole thing is crap. I got FRITZ!Box at first but then sold it. It's quite hard to not use it because all major German ISPs "support" it and encourage you to get it; all those magazines that review devices and rate them promote it; every single electronics store has a big section dedicated to them.
I've settled on using Draytek Vigor 167 as a modem and Unielec U7621-06 as my router. I ordered this router directly from Unielec. I love how modular it is. The Wifi are a separate PCIe modules, and there's a SATA connection on the router for a disk. And Unielec is one of the few companies that support an actual unmodified OpenWRT. And the best part is that it cost about 100$. The downside is that they so far don't support the latest Wifi standards and most of their devices have only 1Gbit ports, which is okay for me.
Here in the Netherlands, most of the ADSL network was upgraded to VDSL some years ago (and more recently, FttH is widely being deployed).
But for more advanced users openwrt offers additional features. But worse wifi, no IoT, etc.
DIY is an option but also way more expensive.
See below for why I care so much about 6ghz.
This has recently become far cheaper over the past few years. You can now get quite powerful fanless computers that come with 4-6x 2.5GBe ports, and they typically have a slot on the board that you can put whatever Wifi card you want in.
Yes, they are still more expensive at around $200-300 for the computer (even without memory, storage, or wifi card), but considering a few years ago you'd need to spend nearly twice that for a similar system (and usually with only 1GBe), it's becoming a much more attractive offer to start a home-lab with.
Serve The Home has some excellent videos on these mini-computers that I highly recommend:
That DIY setup has a lot more compute for routing, but actually does worse in trying to be used as an actual (wireless) access point (and still costs more).
Many cards support multiple bands concurrently. Some of these devices have multiple slots as well, and if it doesn't you can get an NVMe to mPCIe adapter to enable a second slot. I personally use a Mediatek card for dual-band 2.4GHz + 6GHz and a USB adapter for the 5GHz band (mostly because I don't have an adapter for fitting more than 4 antennae).
> That DIY setup has a lot more compute for routing, but actually does worse in trying to be used as an actual (wireless) access point (and still costs more).
You don't need a lot of compute for routing packets, especially if you are able to set up flowtables and bypass most of that processing anyways. The extra compute is excellent for other services that you might set up on it though, which is why I explicitly mentioned it's a good starting point for a home lab.
All that aside, the real cost of DIY isn't the dollar amount. It's the time and effort required to set it up and maintain it. The only point I mentioned about cost is that it's significantly cheaper than it was a few years ago. If all you want is to reduce cost then it's unlikely you can beat recycling an old desktop computer with an additional 6E card thrown in.
Is 6E that much better (in applications where openwrt is typically used) than 6 to justify waiting for 6E?
Contrast that to the 5 GHz spectrum which only has 2 channels that are 80 MHz wide (excluding DFS). DFS is not an option in many places, and even the US only gets 1 channel that is 160 MHz wide (also DFS).
5 GHz spectrum is almost always congested and gets half the spectrum width.
See: https://www.duckware.com/tech/wifi-in-the-us.html#wifi6e
Perhaps I’m wrong, or it’s simply a very mature project - but can anyone comment on the security or community around DD-WRT relative to OpenWrt? Just a bit worried that I’m exposing some sensitive workloads through firmware that is vulnerable or not well scrutinized by the public.
But I cannot wait to get off such a special purpose system. I would much rather be running a regular & general purpose OS. I'd rather have systemd and regular builds of packages.
Ooenwrt exists mostly because good wifi is coupled to byzantine difficult hardware that requires absurd patches & guesswork to make that hardware useful. There's been no hope for most of these systems to ever get their support up-streamed. We are seeing some positive changes very recently, with for example Qualcomm & MediaTek both seemingly not far from being usable, which is lightyears better than where we have been. Conceivably we could run whatever on these devices at that point.
Also super sad is how hard it is to avoid these frustrating quirky devices in the first place. Trying to buy wifi add-ons is enormously challenging. M.2 (or often still mini-PCIe) cards are made by very very few folks, hard to find, and often around $200. Once you acquire one, now you're faced with it's awkward size that won't fit most places, and the often weird power demands like having some 12v lugs you have to hook up.
Ideally I'd love to scatter a couple rpi and some usb wifi cards around. It's been a while, but ~5 years ago I was buying & trying every Alfa (a good name that makes usb cards for a variety of chipsets) usb card I could, and usually hosting an AP started great but would quickly fall apart. Realtek only supported like 8 client devices, for example. Other chipsets would crash & even rmmod & re modprobing drivers wouldn't bring the device back up. Some just had terrible performance. It's such a pity USB gets such poor treatment, that there aren't some capable usb cards that can be a decent AP.
It was a great way to give users control over their devices and put them to uses their creators probably never thought of. Most ended up being used as Routers/APs in SOHO networks, I assume, but some were used for tasks that people approach with Beagle Boards and other SBCs these days. In the history of computing, it's a recurring theme that once a small enough, cheap enough machine becomes available (think of e.g. the PDP-8 back in the 60s), people find all kinds of uses for them that before (almost?) nobody would have considered using a computer for.
I'm not sure what plain OpenWRT is like these days but RutOS is a really nice balance between "just works" and "highly configurable"... and if you really can't find what you want to do through the UI it's completely open and hackable as far as I can tell.
But it is somewhat common for certain manufacturers to sell routers that claim to be OpenWrt-based/compatible, without actually being supported by vanilla OpenWrt. So you get a custom OWRT build, often with no further support, which is not that different from having a OEM firmware.
They are marketed towards industrial not consumer and come with the associated price tag, so maybe that has something to do with it. They also use the same OS across all their devices so it makes sense that it's in continuous development.
I was specifically looking for a 5GLTE modem/router when I came across teltonkia, at the time there was no other 5GLTE modem/router available that could run OpenWRT or similar, it was closed source unknowns all around except for them, so I was pretty happy to find them.
[0] https://wiki.teltonika-networks.com/view/RUTOS_Software_Deve...
Handles 300/300 with QoS w/o blinking. Load seldom touches 0.01.
In contrast, the original firmware of these devices is nearly useless.
Does anyone have a recommendation for a router that can handle 1Gbps internet and also has fairly fast output with clients connecting to it via WireGuard?
If you really want to have headroom, get something that claims 10Gpbs or 5Gps or similar.
Its CPU is easily fast enough to handle the advanced software flow control that allows really good QoS. My ping times don’t meaningfully change whether my connection is loaded or not.
Then you can upgrade the wireless without having to replace your router which does all sorts of non Wi-Fi functions.
It does require using an external USB3 gigabit Ethernet adapter.
[1] https://forum.openwrt.org/t/so-you-have-500mbps-1gbps-fiber-...
OpenWRT would be nice too if it is an all-in-one.
Prior I have had issues with IPv6 breaking the internet (due to poor or buggy adoption) and interestingly I've had no issues with CGNAT when I was expecting issues, so I'm not convinced how important IPv6 is right now, really.
(For those who haven't heard of CGNAT, it's basically a system where for residential grade connections multiple houses/connections are allocated to the same IPv4 address and the ISP hardware will manage some state internally to keep track of where each packet should go. The downsides of CGNAT are often exaggerated because 99% of P2P applications already use NAT hole punching instead of port forwarding anyway, which is fully compatible with CGNAT)