If you are using one of the routers that has true VLAN support like the AX86U Pro, there are anecdotal reports of people getting it to work but it's hacks and workarounds.
https://www.snbforums.com/threads/ax86u-pro-vlan.83996/
VLAN support in the AX86U (not Pro) would be a win. But it looks very hacky.
https://www.reddit.com/r/HomeNetworking/comments/l47ocn/secu...
seeing weird IP addesses pinging my router from the outside is normal, but when i see something _inside_ my network trying to get _out_, that's when I know it's time to start reformatting
So far, no issues, and it has the ability to let me ssh in, and install third party untilites via n opkg-style interface.
My error was a complaint about a lack of disk space in the logs, fwiw. RT-AX92U.
I have had an Asus for years and use the vendor firmware, and update it semi-regularly when I remember to, and have never had an issue.
I bought an Asus because they have decent capabilities out-of-box, but also because there is the option of using third-party firmware (which I've never bothered to do).
Even with this event I'll probably stick with the OEM firmware.
You're looking at your phone on a day to day basis. Using your desktop. The router/switch/lightbulb/etc? All stuff that sits in the background and gets forgotten. Those things should do self maintenance - especially with zero days and issues that require updates to not be pwned the instant you connect to the www.
But realistically, it's definitely better for the "masses" to have stuff that just takes care of itself. Grandma don't know how to update router firmware and people like that are why stuff like Apple's "appliance" model is better than Androids more hands on approach.
I do prefer Android for streaming devices, there’s just too much value added from using Android there. But I use an iPhone because I just want my phone to work. And I limit my desktop computer count to exactly one. For networking, I use Asus Merlin. I don’t use it for its flexibility or features, just for the stability which this recent news confirmed was a good idea. The only special features I even use are an OpenVPN server, and secure DNS over TLS to cover my devices that don’t support DNS over HTTPS.
(add.: and I don't mean "different kinds of people" in a condescending way, but that we value different aspects and have different methods for going about these things)
Depends a lot on the use case, though.
Yes, because I can plan for it. I can do it on a weekend or a local holiday. I can do it in the evening after work, or in the morning so that I have the whole day to go out and buy a replacement. If it's not critical, it can wait until my vacation.
And even without any risk of bricking, it should still be done on my schedule. I don't want the connection to glitch while I'm in the middle of a live stream, or an online multiplayer game, or a call with a distant relative.
Normal case: You lose some features / quality of life / stability improvements for a day / week / month (whenever you get around to updating it).
Best case is that you aren't in general population of bricked routers like everyone else today.
Worst case scenario is that you're late to a zero-day exploit. Although, the tech news cycle tends to report those stories pretty well, so you'd be aware of it.
The pros definitely outweight the cons in my opinion, especially on something critical like my internet access.
So against the one time you win by manually updating, you are weighing hundreds of times you had to research before clicking ‘update’ to see if there were any reports of this update bricking routers?
Because if you don’t do that, you just click the update button whenever you get round to it, you are running your router in a ‘vulnerable to zero days’ configuration, AND you’re going to brick your router the one time they ship an update that goes bad.
That's great for people who are into opsec as a hobby. But with the proverbial Aunt Millie I want auto-updates so they're patched.
Asus allows the option of having auto-updates enabled or disabled (forget which is the default).
Hardware and software companies have a story of implementing anti-user features in very shady ways (ie silent update to T&C allowing the org to track and share data with third parties and/or brokers).
I don't care if my smart Philips light bulb shares all its data with god knows who. My router? that's the device that manages all connections including critical ones. I want it to be impeccable and transparent. That's why I refuse to buy from manufactures that require a could account like Eeroo or that require weird connections to work properly like Tenda (a friend had a Tenda mesh and it wouldn't work if we blocked connections to Baidu, Weibo and others)
I have auto-updates disabled.
What in Earthly existence does not break eventually?
It's about dealing with the odds and rates of breakage.
Years ago I bought a $100 gigabit Linksys router, immediately flashed it with openwrt, and set it up. I assumed my isp was the reason my download speeds were struggling to hit 100mbps (new house and network all at once), and later when I bought my first NAS I assumed hdds are just inherently slow.
I had abysmal network performance for over a year before I figured out my gigabit router was the performance bottleneck, my isp was giving me 3x what the router could handle. The reason for the terrible performance was that openwrt doesn't have the closed source binary blobs to run hardware accelerated routing, instead everything gets squeezed through the cpu, and my router couldn't do it.
So basically, many routers lose performance, in my case I got a 10x performance drop, and openwrts website is all but useless for telling you which routers to buy.
All I can say is be careful blindly installing openwrt unless your router has a CPU that's complete overkill for what you want to do...and none of the mid range consumer combined routers/access points meet that criteria.
/edit I might be getting mixed up with netgear!
I have d-link mesh satellites, and needed 4 around the house just so I didn't have any blindspots. To show how bad they are, when my laptop is within a metre of the d-link main satellite, I get the full 150Mbs of my upstream, but 2 metres away but with line of sight, it drops to ~130Mbs. Leave the room, and it's about 90Mbs :(
I was hoping something like Ubiquiti would be something like the full upstream speed without the horrible dropout-per-metre I'm getting right now. Happy to get a few of them in mesh (if that's how they work) if I can get full speed from my office which is curretly 4 hops away.
https://store.ui.com/products/u6-lr-us this single long range one should cover most of your home (depending on walls etc). and if it's not enough, just get another one from this list: https://www.ui.com/wi-fi#compare
of course, if you can't/won't use ethernet cables for your APs, you can try this mesh: https://store.ui.com/products/access-point-wifi-6-mesh
as a reference, a single long range AP covered a 7 bedroom house (wood), with just a couple of minor blind spots. but for a double wall brick house we needed 3x U6 lite.
Oh. I actually didn't know this. Damn.
> power-over-ethernet
I used to use PoE and was getting great speeds everywhere in the house, but then I got solar panels and an inverter. Turns out, that a lot of people ended up having the same issues as me on whirlpool.net.au :(
But yeah, I've also considered getting an electrician in and wiring some rooms with CAT-6 and go wireless AP in that room. But sounds like it's still going to be the same as mesh doing this and halving my speed?
Awesome! Thank you for the links. I'll check them out!
as long as there is an ethernet cable from your switch/router to the AP, then speed will not halve. speed halves only when using mesh.
> Awesome! Thank you for the links. I'll check them out!
no problem. i started out my career in networking, and have always kept a soft spot for it even thou i'm doing software these days.
the minimum you need is:
- 1x Dream Machine (Pro or SE doesn't matter)
- 1x Access Point (could be long range, could be lite, depends on your needs)
you plug in the internet and the AP into the Dream Machine and that's about it.
from this barebones setup you can add further hardware depending your needs. for example I've added a PoE switch and another smaller non-poe switch (that funnily enough is powered by the other PoE switch).
Edit: to be honest, I'm actually excited to try this out now. I've been on bad wireless for at least 4 years
Mesh networks can use Ethernet as backhaul and they can also use dedicated radios on 6GHz for backhaul. I’m using a mix of both (still have a couple I need to run Ethernet to) and it’s fantastic.
I wouldn’t recommend wireless backhaul to people who have bad experience with WiFi. Some people have bad WiFi because their (older?) buildings have problems with wireless in general: I am not saying they live in a faraday cage but still their if their WiFi isn’t great, wireless backhaul won’t be either. Go wired if you have a choice.
Thus, in older houses, WiFi signal may not be great, and brick walls will make wiring the house an absolute pain.
I have seen some people dropping wire outside of the house, which is not great either (surges can and will happen).
For sure, that's why I mentioned that I'm still in the process of switching over to pure ethernet for backhaul.
That said, if you have enough nodes, 6GHz for backhaul works pretty nice right now. My home has concrete block exterior walls with some interior concrete and plaster walls and the nodes that use dedicated 6GHz for backhaul are doing just fine as is.
I would never consider 5GHz for backhaul, though.
It can be used on the same coax as is used for your cable modem, though if you can isolate the coax you want to use as an ethernet link, you might have better results.
I've used the competing standard DECA in the past, as it was significantly cheaper than MOCA about 5-8yrs ago ($25/unit vs $150/unit) but MOCA is now the much better option with it supporting GB speeds and pricing being down around ~$50/unit. I think the max speeds I saw over DECA was about 100Mbps, maybe 200Mbps on shorter runs.
Mesh dropping bandwidth is less of an issue these days as we have much more bandwidth and you are unlikely to run the largest channel width anyway, then newer solutions support mu-mimo with separate backhaul.
This is only true for single band networks. You can use one band as backhaul, another for AP, and still get ~300Mbps.
> of course, if you can't/won't use ethernet cables for your APs, you can try this mesh
All of the latest UniFi APs support meshing. Ubiquiti is not great at naming their products, apparently.
Also, I would advise against the LR. It does output more power and has a larger antenna than the lite, but there is little to it for indoors use, compared to the Pro, which I believe is cheaper and definitely is speedier.
good one, this is true, i was mistaken.
Agreed it's best to connect the access points with Ethernet.
802.11r accelerates the multi step handshake that you have to perform with WPA enterprise when you roam from one access point to another. There is a much shorter handshake for WPA personal so there is no advantage to enabling 802.11r if you’re not using Enterprise auth.
For WPA3-SAE and WPA3-OWE it is required as each client has a different (session) key.
I see you got recommended Ubiquity. That is good. Better than consumer grade shit.
*Downvoted for telling the truth about how shit WiFi is, classic HN. You are mostly programmers lol. "WiFi works lule" For some Netflix sure.
I think this plus laying cable should last me another 10-20 years
It supports poe, wifi ax (but only on 5 GHz), wpa 3 and can broadcast 4 separate networks, each on its own vlan (but it doesn't do any routing). It's been great for random iot junk that I don't want on my main network.
Routing is handled by an old HP elitedesk I've saved from the bin at work.
This programmer's task for the weekend is to buy a couple of cheap second-hand Ethernet switches, by the way, as part of an on-going effort to switch to networking infrastructure that doesn't compete with at least 13 of my neighbours. (-:
… which is about the most bandwidth intensive application most households ever use.
If you can’t get CAT6 where you need it, I have found MOCA to Ethernet adapters work well. Something like this. https://a.co/d/6FYGrga
If COAX is not available, I have also had a good experience with Powerline to Ethernet adapters. https://a.co/d/ddGHPOG
Take the face plate off your phone jack and if you see a wire with four pairs of wires inside, only two connected to the jack, you may be in luck. I had rented a few townhomes which were like that, enabling me to build out a simple wired network without modifying or drilling at all.
Below are the complete contents of the file:
DISTRIB_ID='LEDE'
DISTRIB_RELEASE='17.01.6'
DISTRIB_REVISION='r3979-2252731af4'
DISTRIB_CODENAME='reboot'
DISTRIB_TARGET='ar71xx/ubnt'
DISTRIB_ARCH='mips_24kc'
DISTRIB_DESCRIPTION='LEDE Reboot 17.01.6 r3979-2252731af4'
DISTRIB_TAINTS='no-all mklibs busybox'
Edited: Added newlines for file content. I originally posted this from mobile in a hurry. Copy/pasting from the ssh session on my phone resulted in newlines being lost.
By separating the router from the Wi-Fi access point, even if you only use one AP, you’re able to put the AP in the best place for full coverage. I hired an electrician to run the cable for me when I bought a house about 10 years ago- he charged a reasonable price, cut a minimum number of holes in the wall, and I was left with a cable in the center ceiling of the house which gave me excellent service throughout with a ceiling mounted AP.
Since then I’ve added on to the house and run additional wires to more ceiling mounted APs to get consistent 5ghz only access throughout the house. Rock solid and never have to think about it (although it is always tempting to tweak)
Now I'm running a Turris Omnia with the bundled OpenWRT fork for router tasks and that seems to work fine.
GPON does.
It’s pretty stable but frustrations remain. Their Edge series are more powerful but the UI is painful and much must be done via the CLI. The Unifi line doesn’t support such things. For example, on an edge router it was fairly easy to make a rule saying “any port 53 traffic that isn’t coming from the Pihole, redirect back to the Pihole”.
The Dream Machine Pro isn’t 100% stable and occasionally requires the config to be reloaded. It’s support for more modern VPN types has been slow to materialise.
The UDMP has been vastly superior to my crappy IDP supplier routers.
- Traffic prioritization (real-time, prioritized, background), and access profiles (per-device data budget, filters, max online time).
- Per device statistics on max data rate, current throughput, Wi-Fi standard, encryption, signal properties (e.g. MU-MIMO or not), etc.
- Special LAN port for guests, without access to the rest of the network (good for that ad filled smart TV).
- Extra LED with customizable function (can light up if there's anybody in the guest network, or a device plugged in the USB, or data cap is exceeded, etc).
- Energy consumption graphs for each major component (CPU, Wi-Fi, USB devices, etc).
- More information about my DSL cable than I know what to do, including spectrum graphs, line attenuation, latency, and even approximate line length.
- Security diagnostics with provider info, firmware status, login credentials type, open ports, egress filters, Wi-Fi security, etc.
- Also has features for smarthome, telephony, NAS, and media center, but I've never tried those.
I've read about routers disabling 5GHz when they detect RADAR, because 5GHz can interfere with that use, and RADAR has higher priority. Here's an article on this, official from the manufacturer and for your specific model (another point for them in my book):
https://avm.de/service/wissensdatenbank/dok/FRITZ-Box-7530-A...
I wanted to say there used to be Freetz which was neat but they ensured this wouldn't work anymore. But I learned it is continued in form of Freetz-NG!
My ISP (Freedom Internet) allows me to rent a modem for 2 EUR per month. A steal.
it kept adjusting the settings I had configured after some period of time
e.g. set up a hole for SSH. I then tested it to ensure that it worked
then a few days later, trying to use it for real... finding out the device had decided to change the DNAT target ip
I replaced it with a mikrotik box that cost 1/6th as much and has functioned perfectly ever since
> APU router is the most open-source network device you can buy. It comes with open-source BIOS, open-source operating system of your choice and open hardware schematics. It's not locked down in any way.
I bought mine with opnsense pre-installed and it has been absolutely rock solid. For wi-fi, I've just used an old router with wifi in "ap-mode" connected to my APU router -- interestingly it turns out that the throughput bandwidth for wi-fi increased by orders of magnitude as soon as the poor Asus box didn't have to perform any logic on the packets passing through.
[1]: https://teklager.se/en/products/routers/apu4d4-open-source-r... -- I have no affiliation with the company, just a happy customer.
OpenWRT is fine but I've found that if you're shopping around for devices it's hard to find ones that will do 1gbps with traffic shaping enabled for an affordable price.
Modern routing appliances are like a vcr/tv combo. You will have a better time if you split the functionality apart. It allows you to change/upgrade pieces of your network infrastructure more easily.
1. Use the ext4 image and extend the main partition to the full size of the disk. This requires a lot of "fiddling" later in case of upgrade (as parent wrote).
2. Use the combined squashfs image and don't touch the image layout (no resizing, keep the ~100 MB free default / partition). Easy upgrade experience like other embedded devices (get image, open ui or ssh, upload, flash, reboot, done). Oddly, this isn't made clear by the official Wiki at all and the simplest option.
IMO, the best configuration is running your x86 box with Proxmox and run the squashfs OpenWrt in a VM. There is no need for more than 100 MB of space and if you need to install so many packages or apps, better create another VM and use a standard Linux distro. It will also be more standard for many apps to be installed on a full fledged OS instead of the custom OpenWrt layout.
You only need 2vcpu and 256 MB of ram to run standard OpenWrt at 1 Gbps (SQM included if you have a recent CPU). The rest of your box ressource can be used for anything you want.
Can you elaborate? I wasn't a fan, but it's an option compared to pfSense CE.
I basically don't care about "features," but I wanted the latest WIFI standards because of reception issues in my house, and at least 4 wired ethernet ports. (I don't want to have to buy dongles / extenders for wired ethernet ports.)
It was surprisingly hard to find an OpenWRT router that supports the latest WIFI features, so I just went with a proprietary router.
In the presence of a collision, the Intel cards are able to successfully receive the stronger signal of the two as long as there's enough of a difference in signal strength.
The cards with Realtek chipsets on the other hand, are only able to receive the stronger of the two frames if the stronger frame started being transmitted first.
It's as if Intel's receiver is always looking for frame preambles even when a valid preamble has been heard and the radio is in the middle of receiving a frame. The other receivers stop looking for preambles while in the middle of receiving a frame.
If you live in an urban environment and have wifi problems, you'll likely have an observable improvement if you upgrade.
I don't know how well Qualcomm and Broadcom chipsets perform, but I wouldn't be surprised if at least Qualcomm works as well as Intel.
We have Rukus unleashed (AP) + PfSense at one of my hotel
But I prefer Aruba Instant on APs. Most easist and simple.
However, it was kind of a bear to get all setup. In terms of setup difficulty it goes Mikrotik -> EdgeRouter - any consumer focused router. I've been putting off setting up VLANs for about a year and a half because I just know I'm going to break everything.
It is certainly a step up from "plug in and it works" consumer routers/APs but the setup has gotten much easier since the early days.
Recommended. And if you check you can even find some of their hardware can run OpenWRT so you have that as a backup.