By provenance, I mean where it's designed, where it's manufactured, who has brand oversight of it, who controls the firmware, who runs the IoT phoning-home servers, etc.
(I don't have high security requirements for home, but I pay attention to such things out of curiosity.)
The only thing is they're definitely not designed for regular consumers, you at least need familiarity with Linux networking.
Mikrotik has had quickset (a single page configuration for home use) for 8+ years, Android Home app for 3+ years
port forwarding? ofcourse how else can the kid have a minecraft server with friends
dynamic dns? then the friends don't need to search "what's my ip" every time
parental controls? to schedule how much time they can play minecraft...
I like Mikrotik but for anyone trying to go beyond the barebones default firewall/router/ap on the quickset page you need to be prepared to learn. i.e. To make a DHCP reservation, you go through the menus until you click IP, then you realise you don't click on DHCP client to set up a DHCP client you go into DHCP server and try to give a device a reservation which requires the step of making it static first then seperately setting it's IP.
The complaint basically boils down to: they have all the options there and available and the least common task is just as easy to do as the 2nd most common (after initial basic setup), and if a task touches multiple parts of the config you need to touch each of those parts. Great for someone who knows what they're doing but for a home user it would be great to have more quickset pages for the 2nd to 10th most common tasks (as intagible as that list is).
Ubiquity gear is structured the same way: It, too, absolutely runs Linux, and it uses a custom userland.
One of these userlands is friendlier than the other, but they're both still Linux.
It's a tale as old as the hills, or at least as old as the OG Linksys WRT54G -- which was my own first foray into owning dedicated routing hardware ~20 years ago (which was -- guess what -- Linux with a custom userland). (Previous to that, I used Linux with the userland of my choosing on my desktop PC.)
From that point I found the CLI to be relatively discoverable as a way to configure the devices.
I like RouterOS well enough, though.
I tell people to jump into Ubiquiti's (ui.com) ecosystem which is much more accessible for power users who occasionally wrestle with concepts like wireless, VLANs, subnets, and traffic rules.
So I installed openwrt. They're actually pretty well supported by openwrt (except for the newer 10g switches)
You mean an RFC1918 for etherboot? I have a "few" of these devices and this simply doesn't make any sense in any context.
I've since wiped the firmware/license keys so no idea.
It's still Chinese hardware, but it's warrantied by Protectcli and you have control over the bits you can change.
My first move out of the consumer "junk" was Ubiquiti EdgeRouters but their software quality declined a few years back, and my models got no more updates, then my main router died. My overkill i3 6-port Protectcli box has been running great ever since; first with pfSense now OPNSense; I'll only replace it when it dies or I want 10GbE routing.
They've mostly been solid, and aren't too expensive. I did replace the one in the hall (on the ceiling) outside my living room recently though, upgrading it from an AP-AC-Pro to an U6-Pro and the range is significantly worse on the same WiFi spec, making the living room TV basically unusable for streaming, despite being flawless on the older AP.
I'm going to try the newer U7 Pros and if that doesn't work out, I'll start looking at alternatives, but I suspect anything acceptable will be more expensive. I run ethernet almost everywhere so WiFi is just for our mobiles/laptops/tablets/IoT, but the TV in the living room currently has no easy way to get cables to so that AP is critical.
I'm coming to the realization that mixed 2.4 ghz/5ghz access points aren't a great idea. If I wanted consistent 5 ghz coverage, I'd need a lot more access points, but I'd want to turn the 2.4ghz radios off on most of them because 2.4ghz goes too far.
The hardware is relatively inexpensive and seems to be rather stable, the company is based in Latvia, and the manufacturing (or at least the board-stuffing and injection-molding) seems to primarily be done in Europe. Some of their stuff is pretty flexible about what kinds of PoE is can work with.
All of the Mikrotik stuff I'm aware of runs their Linux-based RouterOS. This means they all get the same user interface -- the same for a "switch," for an "access point," and for a "router."
I like that this blurs the lines between different device classes. For instance, my access points have two Ethernet ports on them, and two radios. I can use them as simple access points, or as routers, or as switches... or all of this at the same time. Whatever I want to do with them is fine: It's just a highly-configurable device with n hardware interfaces available on it.
I could replace the separate switch and OpenWRT router that I have on a shelf in the basement with a singular Mikrotik switch that did both jobs if I wanted to. (I probably would not, and it probably would never make sense to do so, but their software allows me to do as many nonsensical things as I choose. That's a good thing.)
For me, wanting as much open source in the stack as possible, it gives me peace of mind, but it really depends on the individual.
All I can really suggest, is to take a look at the Coreboot site[0] and see if it sounds like something you'd want.
Arguably the most important area of "provenance" is who controls the software ("firmware"). (Perhaps the hardware owner should control the software, e.g., compile and install OpenWRT.) The report on which this submission appears to be based mentions "command injection" as the vulnerability being exploited.
https://www.cyfirma.com/research/comprehensive-analysis-of-c...
https://www.microsoft.com/en-us/security/blog/2024/10/31/chi...
If you're concerned about provenance (or even if you're not), I suggest using a general purpose device and rolling your own ala pfSense[0]/OPNSense[1], etc, or just use one of the BSDs or Linux and use native tools or one of the many router/firewall distros[2]
[2] https://en.wikipedia.org/wiki/List_of_router_and_firewall_di...
Regarding pfSense and OPNsense, I recently built and used a nice OPNsense box, including IPS, but decided to go back to OpenWrt for home use, because OpenWrt actually worked a bit better for the things I needed.
I might use pfSense (or maybe OPNsense) router for a startup office of more than several people, though (until we can cost-justify a dedicated IT infra&support specialist). With OpenWrt on the WiFi APs.
Assuming you mean NUCs[0] and not NICs, I'm sure you're correct. That said, there are many other fanless miniPCs which are both less expensive and, as such, much less likely to be counterfeited.
>Regarding pfSense and OPNsense, I recently built and used a nice OPNsense box, including IPS, but decided to go back to OpenWrt for home use, because OpenWrt actually worked a bit better for the things I needed.
A fair point. The device I use as a router/firewall came pre-installed with OPNSense, which I immediately wiped and replaced with a vanilla Linux install and customised it to my own taste.
I mentioned OPN/pfSense not because I use them, but because they offer a fairly complete solution without having strong networking knowledge. Rolling your own is, IMNSHO, definitely superior to those, as well as to OpenWRT.
As for WiFi, I restrict my APs to just bridging to my wired network and have implemented strong egress filtering to control outbound access.
>I might use pfSense (or maybe OPNsense) router for a startup office of more than several people, though (until we can cost-justify a dedicated IT infra&support specialist). With OpenWrt on the WiFi APs.
That's not a bad idea at all. Although you might also consider one or more of the other distros/packages in the Wikipedia link[1] I included in my previous comment. Good luck!
[0] https://en.wikipedia.org/wiki/Next_Unit_of_Computing
[1] https://en.wikipedia.org/wiki/List_of_router_and_firewall_di...
(I used industrial NUC PCs as part of factory stations for a startup a few years ago, and they were nice. I looked into NUCs for home routers/firewalls, but I didn't like their NIC options.)
My misunderstanding. Apologies.
I use something similar to this[0] device, which has 4X2.5Gb ethernet ports and no WiFi (which was my preference) interface.
As such, no additional NICs were required, even with a dual ISP configuration.
[0] https://www.amazon.com/gp/product/B09J4H9ZXY?ie=UTF8&th=1
Many of their NUC-sized computers have dual physical LAN ports.
https://www.servethehome.com/identifying-risky-counterfeit-i...
(I’m looking at my stack right now and looking to upgrade)
I still don't understand why because it's not fully installed.
I thought this was just a DC generator plugged into a DC-to-AC converter (an "inverter") and nature did its thing to autobalance the flow of electricity. I'm excited to find out what the app does and why these panels need a WiFi password.
Since APU2 schematics are open, rebooting PC Engines as a US company could be initiated by US leadership requesting AMD to restart production of the AMD GX-412TC SoC, until AMD can ship a Ryzen Embedded alternative with comparable power efficiency. The lack of a replacement SoC forced the end of APU2 and PC Engines.
National policy tools are not limited to banning negative examples, they can also encourage scaling of positive existence proofs.