Hacker News Reader

Comment by PaulKeeble | Hacker News Reader

A lot of these routers have DD-WRT, OpenWRT, FreshTomato or maybe pfsense support. Since the manufacturers long ago abandoned security updates and feature upgrades an open source firmware will vastly improve the security and the devices functionality.

Not all routers can run one of these firmwares but many can and I wouldn't choose a device that didn't in the future. Its relatively easy to setup a basic secure home router using a Raspberry pi 4 and USB Ethernet and then attach one to a hub and the other to the modem and you have a 1 gbit/s capable routing device that can do SQM and remove bufferbloat and not a lot of consumer routers can remotely achieve that level of performance.

It is more hassle than the manufacturers firmware, but its also a surprisingly good way to extend a routers usable life and functionality as well. VPNs, Virtual LAN, File and web servers or just better QoS you can do just about anything you might want.

View on HN

The lack of ongoing support from device manufacturers is really awful. There were some major UPnP vulnerabilities (last year, as well as some previous ones iirc) and a parade of attacks against WPA of various levels and very few devices ever get patched for them - including high-spec devices.

Running open-source firmware is basically necessary to have any chance against all these attacks, because manufacturers simply won't do the work.

There really really needs to be some regulation on this, internet of things devices as well. Give a defined minimum software update lifespan on the box at time of purchase and require that it be at least 3 years from the date of sale, for example.

Without auto updates, a whole load of good that'll do. 99.9% of people are (justifiably) scared to even log in to their router, let alone update it or flash open source FW.

There's frankly a lot to be said about Comcast's current proprietary router model that's basically a completely managed box. You don't even log into the router directly, you manage it on xfinity.com.

> You don't even log into the router directly, you manage it on xfinity.com.

Lol, no thanks.

The very last thing I need is an ISP controlling my LAN.

Then get your own router and use their one as a glorified modem (some ISP routers will actually have a modem mode where they act purely as a modem)

Xfinity will allow you to bring both a modem and a router. AT&T will not because their gateway/router does authentication into their network. Some people on the UniFi forums were able to pass authentication back to the gateway but it reduced speed.

I'm not with xfinity but that is what I do.

> You don't even log into the router directly, you manage it on xfinity.com.

That's absolutely the worst thing I can imagine.

My current ISP (Telia) tried to replace their at-home FTTH box with one which can only be managed through their company portal (https://telia.no/minside).

I threatened with immediate service-termination unless they returned the old box which could be managed locally.

I mean... There's lines I'm not willing to cross and a router which I'm not allowed to manage locally is simply not allowed in my house.

Are you in Norway and formerly on Get? If so, I'd recommend getting your own router anyway - you just need one that allows you to specify the VLAN for the WAN, at least in my area they hide internet on VLAN 10. You still need their ONT as far as I know, but I can live with that.

Yeah. Get Fiber to the home package.

I’m not sure if simply jumping on the right VLAN is enough though.

So I’m pedantic and in true HN spirit I’ve bought a secondary Get box (second-hand, with original Get firmware).

It arrived today, and I’m in the process of completely tearing it apart and reverse-engineering the entire setup for usage with OpenWRT.

So far I’ve extracted the PCB, figured out the serial interface and pinout, found out there’s no “free” root from there and are now in the process of extracting the full firmware via the built in bootloader for further analysis.

If I find anything else interesting I’ll let you know :D

I agree it's the worst thing ever for me and you. But it's awfully nice that I don't need to setup a VPN at my grandma's house 2000 miles away to help her troubleshoot some things.

> The lack of ongoing support from device manufacturers is really awful.

One of the reasons why I specifically when with Asus: they've got pretty good long-term support. There's also third-party firmware that uses the open source nature of most/all of the code (e.g., Asuswrt-Merlin).

Maybe I just had bad luck but my two most recent Asus Wi-Fi routers are dead, unsupported, and no Linux/OpenWRT.

OpenWRT does not work well with Broadcom devices in general. Some are supported (you can port it yourself actually) but most won't work.

Fortunately, it does work with Atheros, Qualcomm, MediaTek/Ralink and I think some other chips.

The model I have:

* https://openwrt.org/toh/asus/rt-ac68u

Also:

* https://www.asuswrt-merlin.net

I avoid Asus due to how often they use Broadcom chips and lack OpenWrt support.

Please contact me via email - dave dot taht at gmail dot com. Working on a successor to this:

http://www.taht.net/~d/fcc_saner_software_practices.pdf

Alas I just don't know what role and impact this document will have.

But "VintCerf, Co-Inventor of the Internet" really made me smile!

site is down for me. In New York

Broadcom wifi chips on these SBCs work sort of fine in ac mode (you can maybe get ~150mbit/s in practice), but it could be much better.

Anyway, it so nice to have a router with 8GiB ram or 32GiB storage, instead of these ram/storage starved devices that are sold as wifi routers usually that can barely support openwrt. Being able to use Arch Linux or Debian, and the latest mainline kernel and have replaceable storage is just so much more flexible in what you can do.

I'll be trying Quartz64-A with some well supported 3x3 or 2x2 mimo PCIe wifi cards, soon. (Router use excludes Intel Wifi cards, sadly) I hope that will be an amazing wifi router for me. I already run one as a non-wifi router: https://megous.com/dl/tmp/599ba099a6893863.png (well there's a USB wifi card visible there, but that's just a secondary wifi network for untrusted devices, I'd like something much better for my primary wifi)

I've been using one of the miniPC type OpenWRT supported devices as my core router. Though rather than adding wifi to the base I dangled my old wifi with OpenWRT off of it since my theory of instability on routers is that wifi makes everything suck.

https://pcengines.ch/apu3c2.htm

Yes, I have similar setup. I used microtik wifi router previously, and it's still a primary wifi ap for me, but all ports are bridged together including a wan port, and it now just serves as a 5xGLAN switch + wifi ap. All the DHCP, DNS and other services are on Quartz64.

> Router use excludes Intel Wifi cards, sadly

Why? Do you have any other manufacturer you could recommend for a reasonable price? What are you using for your Quartz?

Why would you buy an expensive card that doesn't allow AP mode on anything ac or ax?

"Hello IAmMrZ

Thank you for your patience in this matter.

After checking this further, we would like to inform you that the engineering team confirmed that Intel® wireless products follow regulatory compliance and it is expected that AP mode cannot be enabled in non-2.4 GHz channels. We hope this clarifies your concerns.

Best regards,

Andrew G.

Intel Customer Support Technician"

https://community.intel.com/t5/Wireless/Intel-AX210-Gentoo-L...

I'll be trying realtek 8822ce and 8852ae based pcie cards, using mainline Linux rtw88/89 drivers.

Qualcomm based cards are also quite common in high end wifi routers. But they are pricey.

> Being able to use Arch Linux or Debian, and the latest mainline kernel and have replaceable storage is just so much more flexible in what you can do.

To be fair, my current OpenWRT devices are running more up to date kernels (5.4) than my Debian-based (4.x) devices at home.

And for a router I really don't need/want more code than strictly necessary. What use is 8GBs for the system, if it all it can do is load extra services, which will starve the RAM of the device and make runtime performance less predictable?

What can you do with your 8GB+ router compared to mine 32MB?

OpenWrt is a nightmare to update due to the space constraints. A more traditional distro can just be updated via the usual package manager commands. I believe OpenWrt expects you to back up configs and reimage the whole thing.

What are you talking about?

There’s literally a sysupgrade-image you can use to update in place without losing your config.

Has it been a while since you used OpenWRT last time?

Since I used it? No. Running it on many things. Upgraded it? Yeah. I've done a lot of fresh installs but don't usually upgrade the system because it doesn't seem trivial compared to running one command occasionally on the rolling release distros I'm used to. What you're describing is unknown to me. It sounds a bit OpenBSD-like, maybe. I also consider OpenBSD to be unreasonably annoying to upgrade (although it's been a while since I tried with that either, I heard it got better).

You can always just “opkg upgrade” if that’s your cup of tea.

That won’t necessarily update the kernel-image though which is often stored directly on some MTD-partitions, so flashing the sysupgrade image is the recommended approach if you want to make sure everything is up to date.

And it’s literally just uploading one firmware file to one web-ui. It’s not like it’s hard to do it particularly involved or time-consuming.

If you’ve been using OpenWRT at all I’m kinda surprised you’ve actually been able to miss them.

They’re pretty much front and center in the firmware download pages and referenced in every single release note, more or less.

My router runs Linux 5.15. I can cache more stuff in RAM, instead of wearing out the flash storage, or having to throw useful data away (http cache, larger DNS cache). I can use all the new stuff that's added to the Linux kernel's networking stack. I can use any scripting labguages, to automate things like updating my DNS servers easily. I compile my own kernel for the router, so I can disable anything I don't like, all the barely used and less tested protocols I don't need, etc.

Minimal Arch Linux is quite small. But I have option to to install anything, and the board will support it, without me having to figure out workarounds.

The board has 4 cores, you can dedicate 1 to the routing, and use the rest for whatever without starving the core functions of the router of the resources.

I mean, it's just a lot more flexible, while being cheaper and easier to replace than dedicated routers, when the HW breaks. Just copy the root filesystem to other uSD card, and swap the kernel, and it will run the same on a different ARM SBC, which I have quite a lot laying around in my home.

> Being able to use Arch Linux or Debian, and the latest mainline kernel and have replaceable storage is just so much more flexible in what you can do.

Why not use dedicated router/firewall software like pfsense, OPNSense, or Untangle (all BSD-based, Untangle is a paid product though)?

I bought a little NUC with an Intel CPU and NICs to run pfSense a few months ago and it's been fantastically stable.

I replaced microtik router with this, because it was annoying to have to run an odd duck that I always have to keep figuring how to manage differently, or how to workaround its defficiencies, because it doesn't run a reguar OS, but some dedicated thing for routing. It's much easier to me to do more complicated things, the manufacturer didn't add UI for on a general distro, than on some special purpose OS.

+ now I run the same OS on the router I run on 12 other server machines at home. This is just easier to manage and backup, and replace with any other SBC that I have at home, regardless of the model as long as it has an ethernet port.

Most VDSL routers don't have any decent support on DD-WRT or OpenWRT due to the proprietary firmware blobs required for all the DSP algorithms inside the modem.

Sadly, that means a massive chunk of the world connected by ADSL/VDSL can't use this advice.

You can but you need your own device that supports an open source firmware. The ISP provided modem you can potentially put in modem mode at which point its just the interface to the wire and you can then run your own router in PPPoE mode to interface to it and out to the internet. If the ISP provided device can't do that then turn off its NAT, firewall and wifi and just configure it to connect to the internet and plug into anetwork port just your router from the routers WAN port and then use DHCP WAN configuration. Then all your devices only go into your device. The only device exposed by the poor security of the manufacturer is the modem itself and your network is defended by your personal device.

There are a bunch of other ways to do it but you can absolutely have your network defended by your own device running open source firmware and still use the device the ISP has provided mostly as a modem. I use a DHCP WAN on my router which outputs to the ISPs provided router which is just a modem at this point and not a lot else. It still runs DHCP and DNS and all that other junk but my home network doesn't use any of it. I use Virtual LANs internally for some development services I use so the default ISP routers are useless to me and after issues with various routers with VDSL modems I gave up and have used openWRT ever since. I also use separate access points for wifi since its another area openWRT is a little behind just due to how long drivers take to come out.

And then you have fun with the fact the ISP resets all the devices back to defaults once a week... And if you have to live with it in its default config you have double-NAT and games and web conferencing stuff doesn't work properly.

It's just a bad compromise.

https://github.com/genewitch/opensource/blob/master/wireguar...

I wrote this up the other day. Mine is still super flaky, but I am going to be trying closer servers. I think, ideally, you want your game console on the DMZ of the router with wireguard.

Just don't NAT again, but simply firewall. That's what I do. Luckily the days of routers crashing when there are more than 15 TCP sessions are over, even with the cheap ISP routers. But Wifi usually still sucks with those, plus security concerns, so I like to isolate it from the rest of my network with OpenWRT.

You could do what I do and run your own router on PC hardware and get a separate DSL modem. There aren't a lot to choose from, but you should be able to find one at least.

I generally don’t buy a home wifi router unless it runs one of the open source router distros for this very same reason.

Does anyone maintain a list like this one for vulnerabilities in open source router firmware ?

Given they are all continuously updating its unlikely such a list would exist. The way this usually works for open source software is that the vulnerability isn't made public until the software patch has already been issued and its very rare to get anything other than "security issue fixed" in the changelogs anyway. The answer should be on the latest version of the firmware no outstanding known vulnerabilities or very few.

The entire problem is that most of these routers haven't received updates in years from the manufacturers, they are abandoned. The open source firmware's are not abandoned and are continuously getting updates for their underlying packages from Linux/NetBSD even if they aren't doing substantial development themselves. What vulnerabilities that do exist and are not getting fixed will be in the hardware binaries for wifi for the FreshTomato supported routers and those usually listed as poor or no wifi support in openWRT, that is about it.

The last release of Gargoyle was last year, and Shibby Tomato went silent several years ago, probably taking a lot of older routers out of 3rd-party ROM updates.

Many router ROMS don't come out as often as is necessary to address exploits in a timely manner.

Most router ROMs are developed in the same haphazard fashion as phone ROMs on xda-developers. Only a few like OpenWRT are actually run like a desktop Linux distro, with a well-defined and managed release process and stable branches.

Gargoyle is based on OpenWRT, but has extensive options for bandwidth control of individual devices/MACs, plus the ability to force everything to use Tor.

I don't know how UDP would work over that routing, and if QUIC would work (at all).

I imagine that this can be done with OpenWRT, but many plugins and custom configuration would be required to achieve equivalent functionality.

Last time I checked, Gargoyle's QoS system consisted almost entirely of obsolete 1990s-style manual classification and prioritization. The only interesting capability it offered was a feature to try to estimate the actual bandwidth you were getting from your ISP in realtime, to tune the overall bandwidth limits of the QoS system.

Unless it's been overhauled to incorporate the lessons of CoDel, fq_codel, CAKE and modern active queue management in general, the QoS portions of Gargoyle can be ignored as a time-wasting anachronism. You'll be better off with vanilla OpenWRT and its SQM package.

Thanks for the sage advice. I have some homework to do.

Reply on news.ycombinator.com