My Linksys router died this morning - fortunately, I had a spare Netgear one laying around, but manually replacing all DHCP reservations (security cameras, user devices, network devices, specific IoT devices) and port forwarding options was a tedious pain. I needed a quick solution; my job is remote, so I factory reset the Netgear (I wasn’t sure what settings were already on it) and applied the most important settings to get the job done.
I’m looking for recommendations for either a more mature setup, backup solution, or another solution. Currently, my internet is provided from an AT&T ONT, which has almost everything disabled (DHCP included), and was passing through to my Linksys router. This acted as the router and DHCP server, and provided a direct connection to an 8-port switch, which split off into devices, 2 more routers acting as access points (one for the other side of the house, one for the separated garage, DHCP disabled on both).
If going the route of a backup solution, is it feasible to install OpenWRT on all of my devices, with the expectation that I can do some sort of automated backups of all settings and configurations, and restore in case of a router dying?
If going the route of a smarter solution, I’m not sure what to consider, so I’d love to hear some input. I think having so many devices using DHCP reservations might not be the way to go, but it’s the best way I’ve been able to provide organization and structure to my growing collection of network devices.
If going with a more mature setup, I’m not sure what to consider for a fair ballpark budget / group of devices for a home network. I’ve been eyeing the Ubiquiti Cloud Gateway + 3 APs for a while (to replace my current 1 router / 2 routers-in-AP-mode setup), but am wondering if the selfhosted community has any better recommendations.
I’m happy to provide more information - I understand that selfhosting / home network setup is not a one-size-fits-all.
Edit: Forgot to mention! Another minor gripe I have is that my current 1 router / 2 routers-as-AP solution isn’t meshed, so my devices have to be aware of all 3 networks as I walk across my property. It’s a pain that I know can be solved with buying dedicated access points (…right?), but I’d like to know other’s experiences with this, either with OpenWRT, or other network solutions!
Edit 2: Thanks for the suggestions and discussion everybody, I appreciate hearing everybody’s recommendations and different approaches. I think I’m leaning towards the Ubiquiti UCG Ultra and a few Ubiquiti APs, they seem to cover my needs well. If in a few years that bites me in the ass, I think my next choices will be Mikrotik, OPNsense, or OpenWRT.
You must log in or # to comment.
$150 fanless N100 pc with 4x2.5gbps from aliexpress and install OPNsense on it.
This is the correct answer for the selfhosted crowd
How much power can these things draw?
STH measured 23w on theirs, but it can vary based on which one you buy. Tons of compute power with those 4 E cores.
https://www.servethehome.com/fanless-intel-n100-firewall-and-virtualization-appliance-review/4/
I would not recommend unifi for a mature solution. It sure works nice as a glass panel, but it will get limiting if you will have a desire to hack around your network. Their APs are solid, though, it’s just the USG/Dream machine that I wouldn’t recommend.
Mikrotik software is very capable and hackable and you can run it in a vm if you feel like bringing your own hardware.
Another vote for Mikrotik, but only if you’re technical-minded and want to learn how routers work. One of the things I like the most about it is the ability to import/export the router config as plain text. That makes it very easy to do things like bulk-editing (I have a lot of IOT devices I need to configure), storing your config in version control for safe-keeping etc.
Yup, I have a Mikrotik and love it. I haven’t fully explored the possibilities, but so far I have:
- DNS server - traffic to my NAS uses my domain name, but everything stays on my network (so I get TLS, without hitting the internet)
- VLANs - haven’t fully configured yet, but I’m working on segmenting my network based on access needs; I currently have two SSIDs I’m playing with
- Ubiquiti AP - absolutely solid, though running the server is really annoying, especially since the machine it’s on is only connected via WiFi (so I have to drag the AP down every time I need to re-pair it if I break my wifi)
If you want a professional setup but don’t want to pay a ton, Mikrotik w/ Ubiquiti AP is affordable and very capable. All in, I think I spent $70 on the router and $100 on the AP, so $170 for an “enterprise grade” network. I’m planning to upgrade the AP soon, and it’s nice to not have to reconfigure the router, I’ll just add the AP, configure in the software, then remove the old AP.
I have a pretty decent background in networking - I spent a few years in a network technician position and finished up my CCNA training while I was doing that work. I’ll have to look into Mikrotik, I’ve never actually heard of that brand, thanks for the recommendation
I run Opnsense on a Proxmox VM (I followed this guide). I’m quite pleased with it. Opnsense is probably going to be more secure than any consumer router firmware, but you’re going to have to make a bigger upfront investment in hardware. I had never used Opnsense prior to using this system, and the fact that I’m running it on Proxmox is a huge benefit. If I’m ever about to do anything I’m unsure of, I can snapshot the VM in Proxmox. If my router config breaks as a result of my tinkering, I can easily restore from the snapshot.
Thanks for the link, I’ll have to look into running OPNsense on my Proxmox cluster. I’ve been holding off on buying a new server, having a server just for my networking VMs might be a good solution, thanks!
If you’re looking for a more mature networking setup, I would definitely recommend splitting up your router, switch and AP duties into separate devices. It gives you the most flexibility for when you want to tinker or change things.
For a main router setup, I would recommend OpnSense. It’s has a cloud backup feature which allows you to automatically backup the configuration to a Google Drive xml file whenever it is changed.
The XML config file stores all your leases so you don’t have to worry about reassigning DHCP reservations. If you load the config onto a new system, like for an upgrade or if the router hardware fails, usually you just have to change the interface mappings and you’re good to go.
As far as APs/switches, I would recommend Unifi or Mikrotik. Unifi has a fancy dashboard you can use to adopt new equipment and restore/change configs from, but I find Mikrotik easier and simpler to backup and I like that i dont have to host a controller to make config changes.
I’ll have to look into Mikrotik APs. I have a Mikrotik router and a Ubiquiti AP, and the Unifi SW is annoying (I’ve had to set it up twice now). I’ll need to upgrade my AP soon, so if Mikrotik makes a good AP, I might just go that route (and now’s a good time because I’m running cable and am annoyed at my AP being passive PoE).
Yeah, I definitely agree with splitting it up. Until lately, I haven’t been able to justify the cost of replacing my whole setup. But at the rate that my routers/routers-as-APs seem to die (maybe one every 18 months), it’s enough of a nuisance that I’ll just spend some money and do it the “right” way
If going the route of a backup solution, is it feasible to install OpenWRT on all of my devices, with the expectation that I can do some sort of automated backups of all settings and configurations, and restore in case of a router dying?
That’s what I do. Every device runs OpenWRT except my ONT. Backing up is just a cron script that calls each one and pulls the config.
For my router, I ended up buying an old Barracuda LoadBalancer 340 and installing OpenWRT (it’s an x86 device so it was super easy). It’s a little over-powered for a router, but the price was right. It’s got more than enough spare resources to run some extra stuff, including Docker, so I’m probably going to throw my PiHole container on there since I haven’t been impressed with AdGuard Home (which is available in the repos).
And if you go for an old Barracuda unit like I did, the default BIOS password is
bcndk1I’m not very experienced with OpenWRT - how sensitive is it to device changes? If your Barracuda dies tomorrow, do you have to purchase the same brand / model, or could you slap your saved config onto a similar device? Is there some sort of device compatibility to consider?
The barracuda I have is
basicallyan x64 board in a 1U half-depth case with two extra network adapters (3 total including the onboard one). I have two of them: one’s running OpenWRT (my router) and the other vanilla Debian.So if my router one dies, I can just either pull the drive from it or restore a config backup to another suitable PC that has two NICs (or promote the second unit I have).
The config in openwrt is abstracted. So if the hardware and NICs are totally different, you might need to reconfigure the device names in the config so they’re referencing the right NICs, but everything else should “just work” (e.g. WAN and LAN are just arbitrary labels).
Oh, that’s really nice. The more I hear about OpenWRT and OPNsense being so well supported, the more I lean towards those as my solution
I almost went with OPNsense (having previously used pfSense), but everything else was already on OpenWRT so I decided to keep things consistent. OPNsense is a solid choice, too.
It is somewhat sensitive, at least wireless device names, network/switch setup, MAC addresses and LED/ GPIO settings are going to be different - almost always (and this list is far from complete).
Usually what I do is I take the config and merge it manually (Beyond Compare), to the default config of a new unit, that way I can adjust the interfaces and other details.
To be fair I only do this because I tend to deploy OpenWRT on customers quite a lot and something I don’t have a config for some specific hardware already done. A router is basically a fridge, it should last a long time and even if you’ve to manually configure everything it won’t be much of an issue 5 or 10 years later.
Unifi gear is super great value-wise. Their support is lacking, but their equipment is pretty easy to deal with.
UCG is great and cheap.
UDM Pro is more flexible / future proof but also more expensive. (you get POE, and access to the rest of their suite, but that access also comes with some hardware lockin)
They don’t do custom DNS, so a couple of PIE holes or a DNS service are prudent.
Agreed. After 4 years on PFSense, and that becoming basically a second job, I pulled the trigger and got a Unifi USG-Ultra, and my life is now all rainbows and unicorns.
That’s seems to be what I keep coming back to over the past few days. The UCG Ultra looks perfect for what I need - I don’t want a router and AP in one device, nor do I need any of the security software that other Unifi devices seem to have - I run those separately. I think the UI and dashboards are what are really pushing me towards Ubiquiti, they look really great for displaying the info I want to see
It is pretty intuitive and just works. I do have an issue where I can’t access my services on ProxMox and UnRaid via URL (only via IP) when I have the work profile enabled in that network from the local network (works via internet from outside or through a VPN though), but it does work is the profile is disabled. Other than that, everything just works and is super easy to setup and configure.
This is what I did after running consumer Linksys and ASUS routers, including with OpenWRT.
I moved to a Unifi setup and haven’t had any issues. I can manage it remotely if I need to, like another household member needs something changed or fixed. I’ve never had to restart it to fix an issue, it just works.
Easy upgrades without having to replace the entire setup and move settings over manually. Especially easy wireless upgrades, almost just plug and play replacing the old access point antenna.
And if you need just a small setup and you run a home server you can run the management software on there instead of something like their dedicated Cloud Key device.
hell it’s almost worth it just for the Suricata IDS/Blocking :)
BTW you CAN do DNS in a unifi gateway. It just requires making dnsmasq entries through shell. Perfect solution? No. But it gets you there with no additional hardware.
If going the route of a backup solution, is it feasible to install OpenWRT on all of my devices, with the expectation that I can do some sort of automated backups of all settings and configurations, and restore in case of a router dying?
My two cents: use a “full” computer as your router (with either something like OPNsense or any “regular” linux distro if you don’t need the GUI) and OpenWRT on your access points.
Unless you use the GUI and backup/restore the configuration (as you would with proprietary firmwares), OpenWRT is frankly a pain to configure and deploy. At the moment I’m building custom images for all my devices, but (next time™) I’m gonna ditch all that, get an x86 router and just manually manage OpenWRT on my wifi APs (I only have two and they both have the same relatively straightforward config).
It’s a pain that I know can be solved with buying dedicated access points (…right?)
Routers and access points are just computers with network interfaces (there may be level-2-only APs, but honestly I’ve never heard of any)… most probably your issue is that the firmware of your “routers as access points” doesn’t want to be configured as a dumb AP.
Good points. It’s strange to me to think of routers and APs as just computers, or things that can be run off of a mini-PC or some kind of raspberry pi, but it seems like it’s entirely feasible to build up your network with those.
I have a closet full of old routers (including Linksys), extenders, and switches to be able to handle dead spots. They all sucked. Then I heard about mesh routers when they first came out. Tried two, saw that they worked well, and got a third one. A few months later, a new ISP showed up in our neighborhood with unmetered Gig fiber and I happily drop-kicked Comcast to the curb. It was gratifying that the fiber connection came with a single mesh device of the same brand I already had. Since then, I’ve upgraded to the next-gen routers, and gotten a few smaller ‘wall-wart’ units for extending the range outdoors.
I don’t really have to fuss with configurations like I had to before. It’s amazing how much of a time drain it was to go screw around with settings when a new device came in that didn’t work, or to replace a router when one died. I haven’t had to do anything in years. Every once in a while, I go set up a DHCP reservation but that’s it. The firmware updates auto-install while everyone’s asleep and I get pretty decent bandwidth in places I had constant dropoffs. When I switched out the actual routers to the new gen, the whole thing took 10m and the whole network was down for maybe 2m while the new ones booted up. No end devices had to be modified or restarted.
Where the fiber comes in, there’s a single router node, with two Ethernet ports. One goes to the fiber ONT, the other to a 10-port gig switch where it feeds the rest of wired setups. Elsewhere, the farthest mesh unit has no incoming physical connection, but a small wired switch connected to other wired devices near there. I didn’t have to make any router configuration settings to make this work. Just plugged it all in. Common devices go on the main network, and janky IOT devices (and visitors) go on the guest network.
For external access for self-hosting, you can take a domain name and set up a free Cloudflare tunnel to access your in-home services remotely. Pay Cloudflare a fee and you get extra rules-based access control. The router also has a premium service where it comes with a family bundle of security software. One other thing I like is that the mobile app sends a notification whenever a new device joins the network, so if I see one I don’t recognize, I can block them. Hasn’t happened yet, but if it does, I’ll know to go rotate the wifi passwords.
Anyway, highly recommend mesh routers. I happened to get Eeros (before they were acquired) but there are a few other brands around. Some people don’t like that Amazon bought eero, but they appear to be left to run as an independent outfit. It has been pretty solid so far.
P.S. A friend with a more complicated setup than mine got Ubiquitis. It’s anecdotal, but he recently asked about switching away and I told him pretty much what I’ve written here. YMMV.Edit: checked back with friend. He said he was very happy with his Ubiquiti gear. I mixed up his review from years ago with another friend’s networking setup.
But Ubiquiti can absolutely work in mesh mode, what exactly is your friend looking to solve?
I personally have a Mikrotik router (just router, no wifi) and one Ubiquiti AP, which gives really good coverage in my house. I’m going to be getting faster speeds soon (city is rolling out muni fiber), so I’ll want something better than my current AC AP since the 5MHz band doesn’t cover my whole area and technically can’t saturate gigabit (I might try out 10 gbit, but I’d need a new router). So I’m thinking of running a bunch of cable and getting two U6 Lite APs and then switching to wired for our desktops. I could probably even keep using my AC AP, and just put the U6 where people will more likely get closer to the max (probably downstairs where we play games).
My main concern with a mesh setup is that, while it’s easy to set up, there would be added latency from going through repeaters and whatnot vs two APs with a direct line to the router working off the same SSID. Running cable kinda sucks, but the total cost seems about the same between a mesh setup and a dedicated AP setup.
Thanks. After your note I went back and re-checked with my friend. I mixed up his comments with those from another friend with a different setup. Updated my original comment.
Sounds like we have similar experiences, I’m definitely looking at mesh. I’m tired of having multiple networks across the house! I’m definitely looking at separating IoT and guests to their own VLAN, which I understand Ubiquiti devices are really good at facilitating. Having notifications for new devices is a really nice feature that I never really thought about. Would definitely be nice to have tracking for that
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters AP WiFi Access Point DHCP Dynamic Host Configuration Protocol, automates assignment of IPs when connecting to a network DNS Domain Name Service/System IP Internet Protocol IoT Internet of Things for device controllers NAS Network-Attached Storage PiHole Network-wide ad-blocker (DNS sinkhole) PoE Power over Ethernet SBC Single-Board Computer SSH Secure Shell for remote terminal access SSL Secure Sockets Layer, for transparent encryption TLS Transport Layer Security, supersedes SSL Unifi Ubiquiti WiFi hardware brand VPN Virtual Private Network
13 acronyms in this thread; the most compressed thread commented on today has 6 acronyms.
[Thread #921 for this sub, first seen 14th Aug 2024, 19:05] [FAQ] [Full list] [Contact] [Source code]
I used to use OpenWRT on various devices, but two years ago I got a UDM-Pro, a USW-16-POE, and a few Unifi APs and cameras. I run pi-hole on the UDM-Pro. I have no complaints. It is more expensive than piecing it all together using OpenWRT and some Raspberry PIs, but way easier.
No issues or anything so far with the Unifi devices? That’s good to hear. Do you have any third-party integrations with your Unifi devices, or is it as locked of an ecosystem as I’ve read others say? I don’t think I’d mind taking the plunge, as long as it has good customer service and support.
Be prepared to be hostage of their cloud services… Unifi was all cool until they introduced the Cloud Key and a few other things.
Can’t you just not use their cloud services? It makes you create an account for setup, but once setup was done I never touched it.
They’re devices usually require a ui.com account and linking the device. As some people already said it you’ll still require cloud connection to setup the device even if standalone by using their mobile or desktop app. Doesn’t seem like a good choice for someone who’s into privacy and self hosting.
For someone who’s into privacy I wouldn’t recommend ubiquity at all. A few years ago there was a scandal about them doing telemetry, first in secret without even a setting to turn it off, and when people to to know about it they have made a default-on setting for it. They know you’ll most probably use their gear for the outmost routers too, and you won’t discover it.
I do not know what you mean by third-party integrations. I do not use any cloud stuff, Ubiquiti’s or otherwise.
As for backup, you can also buy a e.g. Lenovo M920q minipc, buy a pci-e riser, buy a dual port ethernet card, set up Proxmox, set up an pfSense (or OpenWRT, or OPNsense) VM inside, pass-through the ethernet card directly to the VM. The VM is very backupable, since you just copy the VM state and save it somewhere. This would only work for the router though, since the AP’s that’d be running OpenWRT wouldn’t be VMs. This is at the cost of having to deal with an additional layer for the VMs.
I guess the problem you’re asking about in regards in regards to cross-device portability of a backed up config is valid. If you had a four ETH port router, backed up the config, and then uploaded it on a two ETH port router, you’d run into trouble, but I have no experience here.
You can also install OpenWrt on some switches these days (PoE also reportedly works with realtek-poe module):
- https://forum.openwrt.org/t/support-for-rtl838x-based-managed-switches/57875/
- https://openwrt.org/toh/views/toh_standard_all?dataflt[Device+Type*~]=Switch
That way you’d have a fully open OpenWRT-only network lab, so you’d always be working with the same system.
deleted by creator
My setup is smaller, but when my venerable old router died about a year ago, I acquired an Asus TUF-AX3000_V2 where I installed FreshTomato. One can login via SSH and dump all settings for backup. Likewise, individual or all settings can be done on the command line instead of the GUI. I have a script on my computer that reads CSV files with MAC addresses and more to apply changes in an automated way.
As a fellow ONT haver, you should find out if you have XGS or G-PON fiber and just stand up an opnsense box/VM as your router.
Can also check out the 8311 discord!
Currently I have a WAS-110 connected via SFP NIC to a Proxmox VM running opnsense. That has SR-IOV for my physical ports and other VMs and then a nice WAP for wifi6e.
That way you don’t get vendor locked into anything on the Ubiquiti/Ruckus side of things
Oh, very interesting. Yeah, I hate this AT&T ONT - I hate the idea of my ISP owning or providing any equipment. I was under the assumption that there weren’t good alternatives for the ONT, and that I was stuck with the AT&T-provided one, since fiber is relatively newer. Seems much easier for them to lock you into using their device. Thanks for the link!
My pleasure! If you have GPON (1Gbps and less), it is easy to just masquerade as the BGW320 without the hardware from what I know. Again, would check out the discord to find out what you need.
OpenWRT is really powerful. You can go into the Luci and select “take backup archive.” This will back up the current config. When ever you screw up or get a new device you can restore the backup. Keep in mind if you change hardware it might mess up the configuration as the physical ports change.
What’s even cooler is you can build custom images online and then deploy them. https://firmware-selector.openwrt.org/
I’m a big fan of Mikrotik with Unifi WiFi.
Mikrotik I have a RB5009 which is powerful enough for all of my needs.
