Hacker News Reader

Comment by arminiusreturns | Hacker News Reader

Ubiquiti EdgeOS based edgerouters are what I prefer as a greybeard sysadmin type who has dealt with everything under the sun. It's VyOS (Vyatta) based, they are now complying with gpl afaik, and their hardware is really good for the price/performance ratio. The edgerouter-x or lite can be found for ~$99 and is a great piece of gear.

Another option would be your own hardware with pfsense (bsd) or ipfire(linux).

Even further would be your own hardware with linux and write your own nftables or bpf.

View on HN

The ERL family is pretty bad as a router, in my experience. There is a longstanding firmware issue that introduces packet loss for routed packets (it doesn't multiplex across the dual cores correctly, which leads to out of order packets). If you really want to use Ubiquiti, I would suggest using an ER-X which is cheaper, doesn't have this problem, and is quadcore.

The best option in my opinion is something Intel based running a well known Linux distro with automated security updates that is fully in your control. Shorewall can do everything needed for a home router. This option is a lot more expensive though.

Interesting that the more expensive router has this problem. I've been really happy with my ER-X, it works great with my internet service (500Mbs up/500Mbs down). I had some speed issues at first but this was solved by upgrading to the latest firmware and making sure hardware offloading was enabled.

I was a bit annoyed that hardware routing is not automatically enabled for setups that can use it. It is not hard, but you have to stumble upon the fact that that setting exists (only on the command line).

My recollection is that it's not enabled by default because there were (are?) some features that don't work once you enable it. I assume it's the Deep Packet Inspection and advanced routing type stuff.

(Sadly my home internet connection is too slow to make hardware offloading on the edge router matter...)

> There is a longstanding firmware issue that introduces packet loss for routed packets

Interesting, do you have any more about this?

Got an ER-PoE that intermittently loses packets and have never got to the bottom of why (I gave up and bought a non-Ubnt router, just haven’t got around to configuring it yet).

https://community.ubnt.com/t5/EdgeRouter/UDP-packet-loss-on-...

I was one of the people involved in some of the measurements on there.

I avoid ubnt networking gear in general after that experience (although ER-X seems good and I use one at home as a smart switch). Their specialty is in APs, which work really great.

The last update of the first post says that this was fixed in v1.10.0, and the release notes concur: https://community.ubnt.com/t5/EdgeMAX-Updates-Blog/EdgeMAX-E...

I knew I should have checked the release notes before commenting. No idea if it works but that would be a great improvement.

Open to the idea I’ve got a different issue, but I’m still seeing an issue with 1.10.5.

Thanks, and agreed. It was my first Ubnt gear, and I suspect it will be my last. It was so much cheaper than some of the alternatives though (that should probably have been a red flag…) but firmware that’s at best in continuous beta really isn’t good enough.

I think this is batch based. Ubiquiti has had prod line issues intermittently, especially in the earlier batches. I would suggest trying to contact them for a replacement if you are getting packet loss.

I am a big fan of PFSense. Not a huge fan of Netgate as a company and the direction they are taking the product.

In any case, you can load it onto some fairly low cost hardware for your typical home user. It's fantastic.

I am not a huge fan of the Ubiquiti routers. They required loading a config onto them just to get DHCP enabled and NAT setup for a typical 1 WAN and 1 LAN environment. Why on earth they would ship without that config on them when 99.9999% of environments are like that is bewildering to me.

Don't know if it's changed since then but I haven't gone back to mess with them since.

I couldn't recommend PFSense more. Setting up my home firewall years ago using it on a pcengines.ch board was really easy and fun. I used a (now long discontinued) WRAP board back in the day, then when broadband became faster I had to remove it because the slow processor would bottleneck my connection, but I'm looking forward to get faster hardware to have it working again. One day, well over 10 years ago, while I was moving from the old ISP to a new one, they screwed up something and I spent some weeks cut off from the Internet. The WRAP board had a mini-pci connector I already had fitted with a powerful WiFi card, so I connected a high gain directional antenna in place of the low gain one and started monitoring the channels. Back in the day there still were weak WEP encrypted connections, but I was even more lucky because a local ISP which delivered their routers with no default encryption had no less than 3 customers in my neighborhood, one of which, probably an office with no traffic at least since the evening, allowed me to surf a lot faster than my previous connection. PFSense was a godsend because all I had to do was set the rules so that the WLAN interface became a slave seen as the WAN, so I got back online all my cabled home network in a matter of minutes.

As a Linux guy I have to admit PFSense and similar products (NAS4Free etc) interface is the best I have ever seen around wrt functionality and ease of use, sadly OpenWRT web interface simply doesn't stand a chance, and I'm not referring to aesthetics as I'm aware OpenWRT is aimed at hardware with orders of magnitude less resources, but pure functionality - in fact I have never been able to configure a small tp-link mr3020 router to use it as a WiFi bridge for my networked but not wireless printer. Yes it can be done and there is a HOWTO on that task, but it doesn't work and low level iptables scripts aren't exactly my strong point. It would be trivial doing that with PFSense, but sadly it cannot fit into that device. /Rant

They come with a wizard for setting up basics like that now.

Sorry for the spam, I seem to post this regularly but the Ubiquiti EdgeRouter Lite will happily run OpenBSD. It supports the onboard packet accelerator with some extra configuration.

I didn't know that, wow. I found some resources on this [1] [2] [3] but it seems like everything is working? Have you tried WireGuard on OpenBSD/octeon?

[1] https://www.openbsd.org/octeon.html

[2] https://news.ycombinator.com/item?id=10079210

[3] https://an.undulating.space/post/180411-erl-openbsd-upgrade/

Not yet... I bought a brand new one just for testing with OpenBSD vs Vyatta because I'd like to benchmark performance of each.

Are you planning to post your benchmarks? Also, any helpful info on getting OpenBSD running on one of these is welcome!

Yes I will post benchmarks and rulesets. I plan to make equal rulesets for each OS if possible.

Do you have any documentation on using the onboard packet accelerator with OpenBSD? I thought it was just binary linux blobs.

Just saw this, so sorry for the late reply: https://undeadly.org/cgi?action=article;sid=20180418073437

Unfortunately I was wrong and the post is just for cryptography acceleration. Will have to check the commits to see if any other work has been done.

Ahh, that’s unfortunate. Thanks for looking it up anyway.

I wonder if the EdgeRouter Lite is similar enough to the Unifi Security Gateway to port that...

Yes. http://www.codeghar.com/blog/openbsd-on-ubiquiti-usg.html

They're basically the same hardware.

I like the software but for some reason my SFP port intermittently went out for exactly 2 minutes. I tested it with a couple of different SFP modules to be sure that wasn't the problem and contacted Ubiquiti support, assuming I could get an RMA.

For whatever braindead reason, they told me that they wouldn't give me an RMA because they don't "support" 3rd party SFP modules. They wouldn't loan me one to fix the problem, they wouldn't agree to reimburse me if it didn't fix the problem, nothing. Buy their module or deal with broken equipment.

I bought one of their SFP modules and to nobody's surprise the problem persisted. At the same time I bought a Mikrotik hAP and again to nobody's surprise, all the SFP modules that "failed" worked with zero problems.

At that point Ubiquiti finally granted me an RMA but at that point I went and got a refund instead.

After that support experience, I'll never buy Ubiquiti or recommend it again.

I'd much rather recommend PC-Engines: https://www.pcengines.ch/. They're x86 based so you can run whatever on them, cheap and have really good performance.

Reply on news.ycombinator.com