Ask HN: Which wireless router do you use at home?
I've been using an Airport Extreme for many years, but recently I started having trouble with wi-fi quality. I'd been thinking about getting a new router anyway, because I'd like one that can run a DNS server I can use to add a few records only visible to my local network. Which hardware do you use? If its software is customizable, what do you run on it (e.g. OpenWrt)?
82 comments
[ 3.1 ms ] story [ 147 ms ] threadAs for the hardware - If you want to use OpenWRT/LEDE you have to be selective about supported WiFi chips. ath9k is battle tested but no ac wifi. ath10k should work reasonable well if you only want to have an access point. Broadcom / Mediatek and others can have issues - stability or signal strength depending on the driver.
Check out kmod-sched-cake and sqm-scripts for the latest in research regarding bufferbloat - https://www.bufferbloat.net/projects/codel/wiki/Cake/ together with airtime fairness - https://linuxplumbersconf.org/2016/ocw/system/presentations/... you can archive some crazy results in good wifi (only on ath9k / mt76 partly on ath10k).
If you want something off the shelf - Mikrotik and Ubiquity and to a degree TP-Link and Asus models get good reviews. In terms of hardware and antennas Mikrotik and Ubiquity are usally better.
You probably want 802.11ac and 5GHz - at the moment 802.11ac Wave2 is probably not worth the money because you need support on the client side and that is rare.
TP-Link Archer C50 would be my budget pick (30€) and runs LEDE - no Gigabit through. Archer C7 for Gigabit.
If you don't mind soldering a serial console and flashing LEDE using the bootloader get a used Cisco Meraki MR18 / MR24 without licence and wall mount kit for a few $ from ebay - top notch hardware and antennas (but ath9k not ath10k) and lot's of CPU / memory.
I would probably be more happy with ubiquiti unifi
https://support.t-mobile.com/docs/DOC-10864
Which was easy to upgrade the firmware and then override so I could install Tomato.
[1] https://www.amazon.com/dp/B01AJEJG1A/
[1] http://thewirecutter.com/reviews/best-wi-fi-router/
It has USB 3, GigE, wireless speed has been fine etc... certainly one of the best home tech purchases I've made in the last couple years.
[1] http://www.netgear.com.au/home/products/networking/wifi-rout... [2] https://advancedtomato.com
[1] http://uk.tp-link.com/products/details/cat-9_TL-WR802N.html
Unlike newer models it allows created your own WiFi access point that is routed to the Internet via another WiFI network. Very useful when travelling with multiple iPads and such - no need to connect them all one by one to a hotel WiFi (no need to configure them at all as a matter of fact) and you get your own isolated subnet with working broadcast and multicast.
Is the hardware worth 330€? Probably not. But IIRC everything is open source, including the hardware design, which you'd never get from a commercial router.
Is it worth 330€ as a router? CZ.NIC has put a lot of effort into the OS and updates. The router has 8GB of NAND and they are using btrfs to handle updates (snapshot, update, rollback if there are issues).
This kind of update feature doesn't exist in OpenWrt and LEDE, though mainly because most routers ship with 16MB of NOR flash and there simply isn't room to take a snapshot while upgrading. Some routers like the Xiaomi Mi 3 have 128MB of NAND and it would be possible if there was upstream support in LEDE (although that router has other issues with MediaTek WiFi).
So if you're looking for a reasonably secure router that auto-updates, I think it's worth it. Set it and forget it mentality.
If you have the technical skills and time to manage the router yourself, then just buy a low power PC (e.g. PCEngines APU, Solidrun ClearFrog, Marvell MACCHIATTObin) and install Linux/PfSense/OPNSense.
I don't own the Turis myself, I just saw some conference presentations of theirs about how they implemented the Turis.
I'd rather have my wifi be a black box that just works and my router be a little more just raw hardware with openbsd or linux or pfsense.
It is better to get two cheap routers and use one as an AP only. The AP only can be placed where ever you want so it'll have better coverage than a multi-antenna router any day.
https://advancedtomato.com
1. Persistent DNS cache using pdnsd (even after reboot because it is on-disk) with a long minimum global TTL. You would imagine this would be a problem, but surprisingly I haven't had any. I've only had to get in once to correct something. You can manually purge a specific domain, and all of them if you think something is wrong.
2. Powerful enough for good OpenVPN settings. Automatically routes through a VPN, and can be disabled for a specific client if needed. The AES instructions (which are on any Intel chip after 2008) help out immensely compared to using just a generic router.
3. Smoother LAN transfers. A cheap gigabit PCIe card (Intel EXPI9402PT - on ebay for about $20) which takes away local transfer rate problems, especially if you have an NAS.
4. Use it as an NAS. It isn't a good idea to mix devices which need good security with non-critical systems, like NAS so be sure about your settings and know what you are doing.
Another cool thing is port forwarding to the remote VPN instance so you can login remotely and check out your network or access any files/media you have on your NAS.
There are more things people can do which give more control and/or better experience, like setting up rate limiting on clients, custom settings for clients with unknown MAC addresses, etc. Traffic shaping is a good one (prioritize specific type of connections over another - example VoIP > Netflix > torrent).
The extra power really opens up the possibilities of what a router can do.
If anyone has any questions, I'd be glad to help out.
What problem does this solve? Is it a bid to improve privacy?
This is especially useful when you have an application which doesn't cache DNS requests and issues a new one for every connection. Torrenting gets a big boost for example.
Privacy is just a side effect.
EDIT: Also, "Torrenting gets a big boost for example." sounds strange, don't trackers give out IP addresses? Why would BitTorrent be DNS bound?
I have it set up to be 1 day. Most websites have been setting up low TTLs like 1 hour or less because they don't want to take a chance in case of a problem, and DNS is cheap or free these days.
About your statement - 'don't trackers give out IP addresses?', what do you mean?
Often trackers are addressed by their domain (I've never actually seen a tracker without one). So each torrent has its own specific set of trackers. So all those trackers are frequently resolved and contacted for peer exchange.
So then the DNS curb would be looking up the hostnames of the trackers, which I'd guess would be under a dozen or so hosts (I don't know, I'm just guessing) per torrent. That seems unlikely to be a hot-spot to the degree that enforcing a long cache would provide a "big boost" to overall performance.
OpenDNS look up for Google just now took me 500ms, even without the VPN. I use tunnel mode for DNS on the NAS, which can easily double it.
I usually build the software from source so I don't know if every thing will work fine for you. Nevertheless here are the package names I remember from when I first set it up.
pdnsd - for DNS caching read the manual so you can write a good config, and don't forget to change the bind IP to an interface so that it is accessible to the local network
openvpn, easy-rsa - Initial setup[2] there is a bug which for which there is a temporary fix[3]. Might be fixed by now.
Port forwarding: I currently use iptables, but I've been trying to move to nftables, which I recommend. Here's how I do it for now (this must be done on the OpenVPN server):
tun0 is the openvpn interface
eno1 is the public ethernet interface of your VPN
Say the IP addr of openvpn CLIENT (router in this case) is 10.8.0.2 - eno1 port you want to forward to is 1234
say the client port (the router port to be forwarded) is 6789
#iptables -t nat -A PREROUTING -p tcp -i eno1 --dport 1234 -j DNAT --to-destination 10.8.0.2:6789
#iptables -A FORWARD -p tcp -d 10.8.0.2 --dport 6789 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
The above commands are not persistent so save them to /etc/iptables.conf
I always choose very conservative settings for firewall. Only a single port is forwarded to the VPN. Rest are closed, spoof open ports, and have a honeypot if you want.
There are many guides on iptables, but I would again recommend nftables. You're going to have to dig deep sometimes since it is still new.
If you have questions about anything, just google. Chances are, it has already been covered several times.
[1]: https://arstechnica.com/gadgets/2016/04/the-ars-guide-to-bui...
[2]: https://www.digitalocean.com/community/tutorials/how-to-set-...
[3]: https://bugs.launchpad.net/serverguide/+bug/1504676
Be careful, this isn't true... most low end Intel chips (Celeron, Pentium, i3) don't support AES-NI. Starting with Skylake chips (2015/2016-era), the whole processor line supports AES-NI. See https://en.wikipedia.org/wiki/AES_instruction_set
>you're much better off with something like an ER-X I pretty much recommend a plain jane router which can run DD-WRT for anyone. All this is clearly overkill, and more importantly useless for most people.
Another choice is getting a cheap NUC like x86 device and get AP-only devices for good coverage.
For some odd reason, after moving to a new house, the Powerline networking in my office degraded from the consistent 300-400Mbps in the old house to < 10Mbps in my new office.
The new house is old, with thick walls, and I wasn't getting good throughput with the old pair of OnHubs I was using, but I figured that enough mesh points would overcome that, and as one of the mesh points is in my office, I've found plugging the desktop ethernet output directly into the ethernet input on the Mesh unit to be extremely performant.
Current router: ASUS AC3100
[1] https://asuswrt.lostrealm.ca/
Apart from the Unifi centric hardware, I have an Asus router that currently handles all the routing (also DHCP), and a cable modem.
https://en.wikipedia.org/wiki/Ubiquiti_Networks#Open-source_...
"In 2015, Ubiquiti revealed that it lost $46.7 million when its finance department was tricked into sending money to someone posing as an employee."
How does that even happen?
The first time I heard someone is using a pre PHP 3 version. Must be perl/cgi based and really old stuff. Why do they even ship with an inbuilt web server with cgi enabled - it's so outdated and screams 1995 tech. (even back in 2002 cgi, and Perl and PHP3 were considered outdated, and we had already PHP 4)