Hi, I got a new router from my ISP, but it doesn’t even have an option to change the address of the DNS server…
So I’m gonna switch (if necessary also the ISP).
I have never used a custom router, so I would appreciate a push in the right direction. What can you recommend? Synology? FritzBox? Asus? Bridge Mode on the ISP router + RasPi?
The following I am running on a separate device, but if possible it would be nice to have it directly on the router device:
When I reached your situation, I started rackmounting which has saved me a lot of time.
I got a 1u dell poweredge r210 and slapped in a 10Gb network card. Loaded up OPNsense onto it. OPN sense was not easy to learn how to use, for me at least. Struggled to get everything running smoothly. But I am very happy I went with rack mounting instead of adding to the rat’s nest.
You haven’t mentioned what sort of access link or speed you have, that seems very relevant here.
For my 1Gbit/s fiber connection the Edgerouter 6P has been pretty good. It has an SFP port and can route 1 Gbit/s of traffic without issue and my dual-stack setup works well too.
The only significant downside is that its switching is slow, it has no hw support. So I put my NAS on a separate subnet instead so that the traffic to it can be routed instead.
Hi-end Xiaomi router, they have WiFi ax and enough ram and support open wrt so you can host your things on it, better yet, do DIY router on orange pi board, there’s tutorials you can follow
One more for mikrotik (I run the VM version on a small linux box).
I tested a ton of those (pf/opn-senses, VyOS, even Cisco), and noone of the free ones can handle IPv6 in a reasonable way in 2024, which is slightly bizzare. Mikrotik has some annoyances, but it’s rock solid as a router.
I don’t use its container features and instead run podman in a vm next to it. Works great.
OpnSense is incapable of proper DHCPv6-PD, that’s when your route receives a prefix from upstream and delegates parts of it downstream. More specifically, it does the delegation, but it doesn’t add the relevant routes, effectively blackholing the allocated prefixes.
VyOS fixed this specific bug since I reported it. RouterOS and IOS never had it.
I can kind of recommend Firewalla. They run all open source software under the hood, but their UI is their own. I’m not super impressed with some of the decisions they’ve made, but it works and has almost every feature a firewall/router device needs.
Things I like
VPN client support with selective VPN routing. Beats having to manually maintain a routing table for a VPN interface.
SSH access with sudo to root
comes with an Ad blocker, but can run pihole in a docker container. I find the onboard ad blocker paired with NextDNS via TLS is good enough.
Things I don’t like:
UI is a phone app. WebUI is neutered. You will require all three (SSH included) to set up any advanced configs
SSH access is a pain to use.
Firewall rule creation is kind of a nightmare. I can see what they were going for, but they missed.
You can’t easily configure the onboard IDS or Adblocker. You can dive into the filesystem if you want, but I don’t wanna.
I have a mesh system made up of Asus Zenwifi ET8s, and I have been very happy with them. They have a lot of cool features, such as having a VPN server and VPN client, with the VPN client allowing me to apply the VPN to only selected devices. It has tons of customization options for those that are knowledgeable about that sort of thing. For example, I can tweak at what signal strength AP steering happens. It has WiFi 6E and 2.5 Gbps wired backhaul.
When I first got it, it was very buggy, and some features straight up didn’t work. But they eventually got all the bugs that I found fixed. It’s in a really good state right now.
To address your desired features, it does have wireguard. I don’t know about DDNS, but it does not have pihole built in. It has adguard built in, but it doesn’t really seem to do much, tbh. Then again, pihole didn’t really do anything for me either. I ended up shutting off my pihole because I didn’t even notice a difference.
If you want to start small, I’d go with one supported by Asuswrt-Merlin, “a third party alternative firmware for Asus routers, with a special emphasis on tweaks and fixes rather than radical changes or collecting as many features as possible.” Keeps it close to stock with minor upgrades, and a faster release cycle for fixes. The RT-AX88U_PRO is one of the higher end routers that is supported by Merlin.
A raspberry pi with pihole running as dhcp server. In the ISP router turn off DHCP, DNS problem solved as pi will advertise its DNS to all connected devices on the network.
I guess maybe too mainline for everyone here but I use an Asus router flashed with the Merlin OS (a painless easy process) and it works excellently. No issues setting up all the things you mentioned.
I have had basically no issues with my setup:
Edgerouter 4 (overkill, had a lower end Edgerouter earlier with no issues except the power adapter died, other hardware was fine).
Some pretty basic unifi AP.
As well as some cheap dumb gigabit switches.
Can basically fire and forget them. Relatively easy to do most things I need on it.
Never needed a reboot outside of upgrades. No stability issues, unlike basically all other home grade all in one stuff I have experienced in the past.
For a full open-source hardware and software experience you need a more exotic brand like this https://www.banana-pi.org/en/bananapi-router/. The BananaPi BPi R3 and here is a very good option with a 4 core CPU, 2GB of RAM Wifi6 and two 2.5G SFP ports besides the 4 ethernet ports. There’s also an upcoming board the BPI-R4 with optional Wifi 7 and 10G SPF.
Both solutions will lead to OpenWRT when it comes to software, it is better than any commercial firmware but be aware that it only support wifi hardware with open-source drives such as MediaTek. While MediaTek is good and performs very well we can’t forget that the best performing wifi chips are Broadcom and they use hacks that go behind the published wifi standards and get it go a few megabytes/second faster and/or improve the range a bit.
DD-WRT is another “open-source” firmware that has a specific agreement with Broadcom to allow them to use their proprietary drivers and distribute them as blob with their firmware. While it works don’t expect compatibility with newer hardware nor a bug free solution like OpenWRT is.
There are also alternatives like OPNsense and pfSense that may make sense in some cases you most likely don’t require that. You’ve a small network and OpenWRT will provide you with a much cleaner open-source experience and also allow for all the customization you would like. Another great advantage of OpenWRT is that you’ve the ability to install 3rd party stuff in your router, you may even use qemu to virtualize stuff like your Pi-Hole on it or simply run docker containers.
How much bandwidth and flexibility do you want? OpenWRT is what I use on consumer hardware but many people here also swear by custom hardware with opnsense
Think about it… with OpenWrt you can spend even more time tweaking around and doing things that may be more automation under OPNsense. :P But yes, fair point.
I have a Unifi router, switch and four access points. My setup works fine. Stable.
I see other people from work say they get dropouts over the work VPN but I have no issues at all. I’m not saying the hardware is their cause but ISP provided all in one boxes are just that. An all in one solution.
Jack of all trades, master of none. Forcing a router reboot to get the home Internet working again has become a thing of the past since I set up a unifi router and APs.
I’d had router/WiFi combos before running either dd-wrt, open-wrt, or tomato. None of them were stable. But I suspect that was because the hardware just couldn’t keep up, not because the open source software was faulty.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !selfhosted@lemmy.world
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.
Rules:
Be civil: we’re here to support and learn from one another. Insults won’t be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it’s not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don’t duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
When I reached your situation, I started rackmounting which has saved me a lot of time.
I got a 1u dell poweredge r210 and slapped in a 10Gb network card. Loaded up OPNsense onto it. OPN sense was not easy to learn how to use, for me at least. Struggled to get everything running smoothly. But I am very happy I went with rack mounting instead of adding to the rat’s nest.
You haven’t mentioned what sort of access link or speed you have, that seems very relevant here.
For my 1Gbit/s fiber connection the Edgerouter 6P has been pretty good. It has an SFP port and can route 1 Gbit/s of traffic without issue and my dual-stack setup works well too.
The only significant downside is that its switching is slow, it has no hw support. So I put my NAS on a separate subnet instead so that the traffic to it can be routed instead.
Hi-end Xiaomi router, they have WiFi ax and enough ram and support open wrt so you can host your things on it, better yet, do DIY router on orange pi board, there’s tutorials you can follow
One more for mikrotik (I run the VM version on a small linux box).
I tested a ton of those (pf/opn-senses, VyOS, even Cisco), and noone of the free ones can handle IPv6 in a reasonable way in 2024, which is slightly bizzare. Mikrotik has some annoyances, but it’s rock solid as a router.
I don’t use its container features and instead run podman in a vm next to it. Works great.
How do you mean? IPv6 in OPNsense is working fine.
OpnSense is incapable of proper DHCPv6-PD, that’s when your route receives a prefix from upstream and delegates parts of it downstream. More specifically, it does the delegation, but it doesn’t add the relevant routes, effectively blackholing the allocated prefixes.
VyOS fixed this specific bug since I reported it. RouterOS and IOS never had it.
I’m isolated from this I suppose as I still use a separate line for upload. PD delegates and opens ports. What CIDR ranges do you use?
PD delegates the whole prefixes, i.e. it allows the subrouters to ask for a subnet of the size they need.
pfSense on an old PC with two NICs should do well. You could buy dedicated hw like a protectoli. Ive had one for 6 years now no issues.
I can kind of recommend Firewalla. They run all open source software under the hood, but their UI is their own. I’m not super impressed with some of the decisions they’ve made, but it works and has almost every feature a firewall/router device needs.
Things I like
VPN client support with selective VPN routing. Beats having to manually maintain a routing table for a VPN interface.
SSH access with sudo to root
comes with an Ad blocker, but can run pihole in a docker container. I find the onboard ad blocker paired with NextDNS via TLS is good enough.
Things I don’t like:
UI is a phone app. WebUI is neutered. You will require all three (SSH included) to set up any advanced configs
SSH access is a pain to use.
Firewall rule creation is kind of a nightmare. I can see what they were going for, but they missed.
You can’t easily configure the onboard IDS or Adblocker. You can dive into the filesystem if you want, but I don’t wanna.
I have a mesh system made up of Asus Zenwifi ET8s, and I have been very happy with them. They have a lot of cool features, such as having a VPN server and VPN client, with the VPN client allowing me to apply the VPN to only selected devices. It has tons of customization options for those that are knowledgeable about that sort of thing. For example, I can tweak at what signal strength AP steering happens. It has WiFi 6E and 2.5 Gbps wired backhaul.
When I first got it, it was very buggy, and some features straight up didn’t work. But they eventually got all the bugs that I found fixed. It’s in a really good state right now.
To address your desired features, it does have wireguard. I don’t know about DDNS, but it does not have pihole built in. It has adguard built in, but it doesn’t really seem to do much, tbh. Then again, pihole didn’t really do anything for me either. I ended up shutting off my pihole because I didn’t even notice a difference.
If you want to start small, I’d go with one supported by Asuswrt-Merlin, “a third party alternative firmware for Asus routers, with a special emphasis on tweaks and fixes rather than radical changes or collecting as many features as possible.” Keeps it close to stock with minor upgrades, and a faster release cycle for fixes. The RT-AX88U_PRO is one of the higher end routers that is supported by Merlin.
A raspberry pi with pihole running as dhcp server. In the ISP router turn off DHCP, DNS problem solved as pi will advertise its DNS to all connected devices on the network.
I guess maybe too mainline for everyone here but I use an Asus router flashed with the Merlin OS (a painless easy process) and it works excellently. No issues setting up all the things you mentioned.
I have had basically no issues with my setup: Edgerouter 4 (overkill, had a lower end Edgerouter earlier with no issues except the power adapter died, other hardware was fine). Some pretty basic unifi AP. As well as some cheap dumb gigabit switches. Can basically fire and forget them. Relatively easy to do most things I need on it. Never needed a reboot outside of upgrades. No stability issues, unlike basically all other home grade all in one stuff I have experienced in the past.
How much wifi and open-source do you really want?
If you are willing to go with commercial hardware + open source firmware (OpenWrt) you might want to check the table of hardware of OpenWrt at https://openwrt.org/toh/views/toh_available_16128_ax-wifi and https://openwrt.org/toh/views/toh_available_864_ac-wifi. One solid pick for the future might be the Netgear WAX2* line or the GL.iNet GL-MT6000. One of those models is now fully supported the others are on the way. If you don’t mind having older wifi a Netgear R7800 is solid.
For a full open-source hardware and software experience you need a more exotic brand like this https://www.banana-pi.org/en/bananapi-router/. The BananaPi BPi R3 and here is a very good option with a 4 core CPU, 2GB of RAM Wifi6 and two 2.5G SFP ports besides the 4 ethernet ports. There’s also an upcoming board the BPI-R4 with optional Wifi 7 and 10G SPF.
Both solutions will lead to OpenWRT when it comes to software, it is better than any commercial firmware but be aware that it only support wifi hardware with open-source drives such as MediaTek. While MediaTek is good and performs very well we can’t forget that the best performing wifi chips are Broadcom and they use hacks that go behind the published wifi standards and get it go a few megabytes/second faster and/or improve the range a bit.
DD-WRT is another “open-source” firmware that has a specific agreement with Broadcom to allow them to use their proprietary drivers and distribute them as blob with their firmware. While it works don’t expect compatibility with newer hardware nor a bug free solution like OpenWRT is.
There are also alternatives like OPNsense and pfSense that may make sense in some cases you most likely don’t require that. You’ve a small network and OpenWRT will provide you with a much cleaner open-source experience and also allow for all the customization you would like. Another great advantage of OpenWRT is that you’ve the ability to install 3rd party stuff in your router, you may even use qemu to virtualize stuff like your Pi-Hole on it or simply run docker containers.
How much bandwidth and flexibility do you want? OpenWRT is what I use on consumer hardware but many people here also swear by custom hardware with opnsense
…which is completely unnecessary and overkill for most people, even those with home labs, since OpenWrt can do it all.
I won’t disagree but not everyone is the same
Homelab is a hobby, and like other hobbies, people actually loves doing the “unnecessary and overkill” stuff.
I thought “unnecessary and overkill” is our actual name, and selfhosting is just a nickname
Think about it… with OpenWrt you can spend even more time tweaking around and doing things that may be more automation under OPNsense. :P But yes, fair point.
I have a Unifi router, switch and four access points. My setup works fine. Stable.
I see other people from work say they get dropouts over the work VPN but I have no issues at all. I’m not saying the hardware is their cause but ISP provided all in one boxes are just that. An all in one solution.
Jack of all trades, master of none. Forcing a router reboot to get the home Internet working again has become a thing of the past since I set up a unifi router and APs.
I’d had router/WiFi combos before running either dd-wrt, open-wrt, or tomato. None of them were stable. But I suspect that was because the hardware just couldn’t keep up, not because the open source software was faulty.
you can convert really any computer into a little router using the help of an ethernet card. I’m planning to do exactly that for my homeserver