News for hackers. Stuff that matters.

A comment on Security Begins at the Home Router. Parent comment

Re:Security Begins at the Home Router by wtallis on Monday July 30, 2018 @05:33PM (#17648253)
> That's cheaper than most all-in-one routers,

It really isn't. There are plenty of consumer router+AP combos in the $75-90 range that offer equal or better performance to the ER-X + UAP-AC-Lite combination.

[ Parent | on HN ]
Re:Security Begins at the Home Router by ipython on Monday July 30, 2018 @09:05PM (#17649738)
I explicitly mentioned that you could beat single stream performance with high end all-in-one routers.

However, no router in that price point gives you the ability to easily expand past one AP, RADIUS VLAN support, the Unifi web interface and so forth.

My last setup was an ASUS N66 dedicated as the router with an Archer C7 as the WAP. Good performance but the configurability and stability (even with ddwrt on the asus) doesn’t compare to the ubiquiti combo I run now.

[ Parent | on HN ]
Re:Security Begins at the Home Router by wtallis on Monday July 30, 2018 @09:16PM (#17649778)
> However, no router in that price point gives you the ability to easily expand past one AP, RADIUS VLAN support, the Unifi web interface and so forth.

You must be assuming that the user insists on sticking with broken vendor software, instead of switching to OpenWRT. The only software benefit that you don't get just as easily from OpenWRT is centralized management of multiple APs. Adding and configuring APs one at a time is very easy and since home networks never require more than 2-3 APs the lack of centralized management is not a significant issue. RADIUS and VLANs are fully supported by OpenWRT, and the web interface is fine except for the aforementioned limitation that you're only managing one AP at a time.

I suspect your stability issues with the ASUS router were a consequence of you using DD-WRT hobbled by proprietary WiFi drivers, instead of an OpenWRT-supported router. The DD-WRT "project" is a mess compared to OpenWRT, which actually puts out stable releases and operates more like a proper Linux distribution. Third-party firmware distributions aren't all the same.

[ Parent | on HN ]
Re:Security Begins at the Home Router by ipython on Monday July 30, 2018 @09:31PM (#17649842)
As far as I can tell, you can’t do dynamically assigned VLANs on wireless via RADIUS on ddwrt, at least not when I looked a few years ago.

I used Merlin ddwrt which was supposed to be dedicated to ASUS hardware. At some point fiddling with wrt takes more time than the nonexistent price difference with the ubiquiti equipment :)

[ Parent | on HN ]
Re:Security Begins at the Home Router by wtallis on Monday July 30, 2018 @09:38PM (#17649873)
I still can't speak directly to your problems with the ASUS router, because I deliberately avoid devices that require Broadcom's proprietary drivers that often prevent you from using a recent kernel, and I don't use DD-WRT when I have the option of using OpenWRT instead. But from what I can tell, the feature you're looking for has been in OpenWRT for years, though I've never bothered to use it myself: https://wiki.openwrt.org/doc/howto/wireless.security.8021x#x...
[ Parent | on HN ]
Re:Security Begins at the Home Router by ipython on Monday July 30, 2018 @09:58PM (#17649957)
Ah you’re right. Thanks for the link.

I didn’t use the ASUS for WiFi, just routing. My instability had to do with ipv6 issues - it would stop broadcasting RAs if I remember correctly causing intermittent connectivity issues. I would have to cycle power every so often (month or so?)

No such issues with the edgerouter. I’m sure OpenWRT works great for folks, I just found it wasn’t the right fit for me.

[ Parent | on HN ]
Re:Security Begins at the Home Router by copperx on Monday July 30, 2018 @05:41PM (#17648334)
Such as ...?
[ Parent | on HN ]
Re:Security Begins at the Home Router by semi-extrinsic on Monday July 30, 2018 @06:17PM (#17648656)
Not OP, but I've been very happy with a $60 Buffalo N300, running since 2015 with no issues. I run DD-WRT on it, 200 Mbit symmetric fiber uplink, 3 devices connected via ethernet and the rest via wifi covering the whole (wooden) house, and I have port forwards for ssh and https to the server in the garage. Does everything I need and more.

I've been looking for an excuse to go down the Ubiquiti route, but I really can't find one.

[ Parent | on HN ]
Re:Security Begins at the Home Router by wtallis on Monday July 30, 2018 @06:43PM (#17648839)
The TP-Link Archer C7 has long been one of the best choices for an 802.11ac-capable wireless router, due to being well-supported by OpenWRT. It's currently $75. The only downside is that the CPU is a bit slower than the EdgeRouter X (though faster than the other EdgeRouters), so I looked on WikiDevi [1] for something with the same CPU as the ER-X. Out of the dozens of options, I picked a recent mid-range D-Link and found it listed for $89.99 on Amazon, though I didn't check for OpenWRT support.

I'm personally using a TP-Link Archer C2600 that was on sale for $70 from Newegg in January.

[1] https://wikidevi.com/wiki/MediaTek_MT7621

[ Parent | on HN ]
Re:Security Begins at the Home Router by ipython on Monday July 30, 2018 @09:51PM (#17649933)
I deliberately left the OEM firmware on my Archer C7 because OpenWRT cuts the WiFi performance by ~40%: https://wiki.openwrt.org/toh/tp-link/tl-wdr7500

In the end mucking with open source firmware, while interesting, just wasn’t worth it. I found the ubiquiti solution stable and the UniFi management software (especially their iOS app) are excellent for my needs. Plus mounting my AP in the ceiling means I can cover the entire house from one AP and at the same time keep the rest of my networking equipment stored away in the basement.

[ Parent | on HN ]