Which router/AP

Hardware Hub Networking
, , ,
1

Right now I have ISP provided GigaCube 5G, because I needed something at the time of connection, and they claimed the supported device list is low.

After full setup I will have DSL line (100 Mb/s download, 20 Mb/s upload), plus 600 GB mobile data (~93 Mb/s download, ~31 Mb/s upload) more of an backup connection.
Home server and main PC will be connected using 1Gb/s Ethernet (at least, considering 2.5 Gb/s).
Phones will need an WiFi, and that is hear of this question.

That GigaCube from Vodafone if placed more or less in the middle (top floor) of the house have WiFi signal in most of the house. House is ~15x15m, and including garden I would like to cover ~30x30m with house almost in the middle.
I bought cheap AX1500 Wi-Fi 6 Range Extender from Mercusys, just to realize it is not using cable to extend the WiFi connection, but it is connecting to WiFi, and creates another network with different SSID.

The result I imagine house is fully covered and the garden is covered by WiFi signal with single SSID, so phone switches seamlessly from one beacon to the next.

I need recommendations on what HW to use, and maybe even SW (OpenWRT?).

2

Iā€™m thinking 2 things.

If you want a easy setup and management, a small Ubiquity gateway plus switch and 1 or 2 acces points got you covered for everything.

If you want to have more freedom and tweak-ability, you got some choice at the router side.
Flash a old router with OpenWRT or look in to Pf-sense in a mini pc with 2 nics.
For APā€™s Ruckes real good and a bit pricey.
And the rest needs to wait a bit, Iā€™m being called away.

5 Likes
3

There will be completely new wiring in the walls network cables included, so I was thinking POE AP, but I never did setup multi AP network, and using extender helped now, but switching between 2 SSIDs is not the solution I had in mind.

Flashing an old router is not a good option for me, it would mean dropping speedā€¦ :thinking: After I wrote it, I am thinking that 2.4 GHz might not matter that much for phones, and main PC will use cable in the future, but are these old routers fast enough to do proper encryption? In my case it would be way over a decade old. So that is a good question, should I even consider using that old router, or is it simply past itā€™s useful life as an primary home AP?

4

I separate out mine, Netgear APs and a custom router; old Intel Atom I bought off eBay forever ago (had to figure out how to install Linux on it using only a serial port interface).

Any modern mini-pc should work if youā€™re comfortable setting up all your iptables rules manually. Iā€™ve used the following for ~2 decades and they still work perfectly (rules are half way down the page):

IPv6 took some work, but it was still doable, and itā€™s neat understanding at a low level how routers and firewalls actually work:

5

Letā€™s see, POE for APā€™s is a real nice to have.
No hassle with extra holes and power supplies.
You also donā€™t need a special switch immediately btw, for only 2 devices 2 matching injectors is way more cost effective.

Getting 2 AP to work together is not complex, how depends on your AP model.

OpenWRT in general: itā€™s usually faster with 10 time the capability s vs original firmware.
What makes OpenWRT faster require itā€™s own wiki unfortunately start here, and here
And I need to go to sleep unfortunately.

1 Like
6

Doesnt sound like you want to go crazy with a big homelab setup running many servers and setting up all kinds of VLANs, it sounds more like you just want a quality and easy to use/set up 1gb network that covers your whole place. So I would just go with either UniFi or Firewalla.

A Cloud Gateway Ultra (router), Switch Ultra 60w, and two or three U7 Lite access points sound perfect for you.

Or if using Firewalla, a Gold SE router along with their Switch SE if you can find one in stock or just some sort of Netgear or TP Link poe switch if you cannot, and then two or three AP7 access points.

The firewalla setup is significantly more costly, but it also has some very nice home-centric features and ease of use. UniFi is still very easy to use IMO though and does have a larger support base for asking questions.

Both of these options allow for easy setup and use of the network and give you significant number of options while presenting them in an easy to use manner. Both can set up VLANs and various firewall rules and security settings without getting too technical, and both can run 1 SSID across all the access points perfectly well.

7

Well previously I was in a flat with limited space and options. Now I am planning to dedicate at least one whole room for a home server (camera recording, home asistent, cryptpad, ā€¦ all running on top of proxmox sharing ano 7950X.

So I never before did VLANs, but few weeks ago I would even say, that they do not look too useful for me. But I have an LG dishvasher, so an separation for it is something I will try for sure.

Cable part of the network seems easy. But the Wi-Fi is something I need more learning for. I never touched OpenWRT, and I am not sure if I have an supported device. (Two routers I checked does not seem to offer firmware update in admin UI. (I did not start reading the linked docs when writing this)

Internet will be less than 1Gb/s, so WiFi devices will not care, and PCs will be wired, so not yet sure if going faster on LAN would significantly help, or just cause issues. Cameras will be 100Mb/s POE, so at least 2 switches.

8

I can recommend Zyxel NWA50AX Pro as AP(s) with OpenWrt 25.12
Edit: you can also use this guide to get hardware acceleration configured.

If you are also looking for a switch:
I run two if these behind a Zyxel XMG1915-10EP which already got OpenWRT snapshot support and will get stable support (including PoE) in the next release. My switch is still running stock firmware since Iā€™m waiting for the stable version to come out.

I use the SFP+ Ports for my Proxmox server running a OPNsense VM and my NAS runs great thus far.

1 Like
9

this. Unifi is nice.

1 Like
10

worth keeping in mind that switches supported by OpenWrt truly support only VLANs and maybe PoE (some do some donā€™t, must check to see if itā€™s supported for that device).

Other features like LAGG/802.3ad bonding are not really supported yet. You can set them up but will be run ā€œin softwareā€ on the switchā€™s very weak CPU, and will run poorly.
And probably most other features supported by the stock firmware are also not supported so make sure you donā€™t need any of them either.

VLAN support is usually enough for most people, but Iā€™m one of the few that needed LAGG bonding and canā€™t make the switch (pun intended) until someone reworks the drivers to actually offload that to the switch chip like itā€™s doing in stock firmware.

11

My plan is to setup a Protectli ā€˜vaultā€™ running OPNsense and Iā€™m going to try running Suricata on it too. Replaces a PiHole too if you have that. So thereā€™s another option for you to think about.

Iā€™m not always the biggest fan of this guy for everything but this dude talks about it here, forgive the AI slop thumbnail. :roll_eyes:

He has some hardware recommendations also.

Edit - Careful with the AP/WIFI part though, not all devices have that. I couldnā€™t care less about that, but once you have this as the primary you could do a secondary AP wherever you need it, if the primary hardware doesnā€™t do that.

12

Depending on your needs, I would consider just building a custom box instead of using a preconfigured micro box. The preconfigured micro box may save on power but has limitations such as choice of NICā€™s, speed of NICs, hardware limitations, etcā€¦ I custom built my box just for the purpose of future proofing it with 10Gb.

1 Like
13

But yes, Opnsense and pfsense are great options for home router replacements. They are extremely powerful tools compared to off the shelf routers. If you need wireless, you can just bridge your old or new wireless router off the custom firewall and isolated it for extra security.

1 Like
14

Some good things to know you wrote.
The thread is also got some extra suggestions.

All good stuff to consider, but before starting any comparisons.
I would like to ask you about some preferences as it helps to get any not mentioned requirement clear.

Could you humor me for a bit? Itā€™s not going to be as the Dahua post I swear.

Did you intend on to install all network cabling yourself and end connectors?

When the DSL finally is done and keeping the 5g, do you want the router to have a form or automatic fail over to 5g, when a DSL outage is detected?

Oh back to network cable, do you know which category youā€™ll get as only going 2.5gbs can be done easy on cat5e.
Getting more expensive cable might not seem to make sense, But even cost does make sense to get better cable to install. If you install better cable now you donā€™t have to reinstall it down the line. When you could wat 10gbe.

I think cat6a will be my advice but not if you need a shielded version.

Wifi with multiple APs can be setup in passive and active ways, passive is sharing a ssid just getting of range until the connection drops and connect to a new one.
Active modes come in 2 wifi optional standards. 802.11r fast roaming is the oldest, and is just the passive mode but the APs communicant signal strength and when a client passes a threshold the client has a chance to switch itself and otherwise the APs for a handover.
Newest standard is called 802.11s mesh, and allows for zero connection loss at handover because check the wiki.

So I recommend going for mesh, fast roam is still used sometimes but mesh wins.

Last one: having a OpenWRT or Opensens router will give the most freedom and customization, but getting started with any off them will require a dive in the deep and a investment in time to learn it.
The other way around Ubiquiti has a less ā€œfreeā€ experience but uses the bit of control to offer a more guided and user friendly setup.

Would one or the other have your preference or disqualification?
Maybe nether.

I recently checked the differences in features between ubiquiti and pfsense.
It was almost on pair, PFsense had more in depth setting and add-ons you can setup you own IDS/IPS, Ubiquity has the some feature same application I happen to know.
But you can set full custom filters on PFsense, ubiquiti has saved you the trouble of finding them and made is list with selecte subject and option.

15

10 Gb/s networking is so expensive, and I do not really see the advantage of it, I do not yet have an use case, that would benefit from it, even the 2.5Gb/s might be useless for me.

I am considering 2.5Gb/s only because my desktop already have such port, and I might dedicate the routing functionality to a server, that will be in the basement, so it would cost me only single NIC to connect, and if I will not do that I can always make it an pass trough, or connect the cable to a switch. Even 1Gb/s pass trough does not seem like it should make things (noticeably) worse for internet connection over phone wire, or cell tower.

16

:rofl: sure, and again, it was useful, and not that longā€¦

Yes the failover is an requirement, bandwidth splitting would be even better, but should not send latency sensitive stuff over 5gā€¦ so it is only a dream for now, and I will work towards it.

Main PC to server room is the only cable I was considering to do in cat6, everything else seems like waste to go better cable. I did not even consider unshielded as an optionā€¦ :smiley:

I hope for that :slight_smile: but I want to learn on a path that will actually lead to success (eventually), not on a path, oh I bought things that will not work together, and I need to scrap most of it, and buy a new stuff (like the extender I picked). For now I can always connect the extender to the power outlet, and get most of the house covered, before I learn how to do it more reasonably.

That is a choice I did not even know I had few minutes ago, so I do not know which one. I only knew OpenWRT by name and in last few days I clicked trough few of their pages.

My current setup includes AMD Ryzen 7950X, 32 GB RAM, 1 Gb/s Ethernet, and unused WiFI doing proxmox (Frigate, Home Assistant, AdGuard DNS+DHCP, Cryptpad, and Budget Board, soon probably GitLab). So that PC should have easily enough compute to be also a router, and AP. I will later (once phone line without an data cap is used) connect it to off site backup, and maybe add a second local server as well depending on how many use cases I will come up with.

17

You can get 10Gb pretty reasonable if you know where to look and thatā€™s subjective depending on your budget.

OpenWRT makes use of your existing router if it is supported where Opnsense replaces the router and expands on capabilities.

pfSense & Opnsense are essentially the same with different concepts of management. Opnsense forked from the original pfSense project with goals to increase frequency of updates/patches/ui, while pfSense stays more in tune with how things are done from an enterprise environment.

Reason I recommend going with a physical box is to allow your home built router to grown with you. If you only need 1Gb, it stays that way. If you need 10Gb, replace or add a NIC of your choice. You could virtualized pfSense/Opnsense, but I would recommend passing through the NIC to the VM. Physical box is preferred imo, since it makes management of subnets, vlans, network segregation/management much easier.

10Gb/40Gb is really for my internal networks since I run a host of services directly off my NAS that include iSCSI and NVMe-oF.

1 Like
18

I love my ubiquiti gear as well.

1 Like
19

For a dual-WAN setup with failover between DSL and 5G, your best long-term route is separating your router/firewall from your wireless access point.

Here are the two cleanest setups depending on how much time you want to spend tinkering:

  1. OPNsense on an x86 N100 / N305 Mini PC + Standalone AP (Most Flexible)

    • Hardware: Grab a cheap Topton/CWWK fanless mini PC with 4x Intel i226-V (2.5GbE) NICs.
    • Why: OPNsense handles Multi-WAN gateway groups with automated health monitoring (pinging Cloudflare/Quad9) effortlessly. When your DSL drops packet loss or latency spikes, it switches default routes to your 5G GigaCube in under 2 seconds.
    • AP Pair: Pair it with a UniFi U6-Pro or TP-Link Omada EAP670 running off a standard PoE injector.

  2. UniFi Cloud Gateway Ultra (UCG-Ultra) + UniFi AP (Turnkey & Clean UI)

    • Hardware: The UCG-Ultra is ~$129, has dual-WAN failover/load-balancing built in, and runs the Network controller onboard.
    • Why: Zero configuration overhead for VLAN tagging and automatic WAN failover, plus a single pane of glass for your AP and wired clients.

  3. MikroTik RB5009 or hEX S (Rock-solid & Low Power)

    • If you want ultra-low power consumption (~5W-15W) and enterprise-grade routing tables, RouterOS handles multi-WAN policy routing easily, though the learning curve is steeper.

If you already run a homelab server 24/7, you could also virtualize OPNsense in Proxmox with dedicated PCIe NIC passthrough, but a dedicated low-power N100 box keeps your internet alive even when restarting the server.

1 Like
20

:thinking: Would it sound crazy, that option 1 in local stores is about twice as expensive as option 3? (Just for the box, not even counting additional switch needs for option 1)