I do not mind tinkering at all, I actually like it. But on the other hand internet connection is something that should work even if I mess up a config, or something, or at least have “easy” way to safe defaults, that restore any working state… (meaning any working internet using either connection.)
Finding that MikroTik RB5009 is quite cheaper, than I expected (and I hope should work out of the box) I am considering that as being part of setup.
Expecting a base connection to work, plus the option to add the routing rules later?
I am already running a AdGuard Home (DNS+DHCP) on my home server with (unused) WiFi directly on the MB, so running an AP on that + few more APs around the house seems like a good option as well. Even after thinking about it for few more days I can not find a need for fast WiFi, everything important should use a cable.
I am still not sure about a need for more than 1Gb/s cables, but MikroTik RB5009 should have one such port, and main PC have one as well, and just checked, that networking cards for 2.5 Gb/s are really cheap, so I am not eliminating that option yet, and make sure the relevant cables are ready for it.
I couple of years ago, I needed a quick solution to my house’s WiFi issues. I didn’t really want to spend the kind of money required for a UniFi setup (but I would have been willing to setup the UniFi controller software). I also wanted to avoid adding yet another deivces or service to my LAN, that I would have to learn about and take care of, lest I get complains from the family.
The setup was quick and easy. They offer enough control for what I need. And in the almost two years I’ve had them, they’ve been no trouble. The signal has always been good enough for my family’s needs.
I’m sure there are downsides but to be honest, I haven’t had to think about them. So they don’t bother me all that much.
I was looking for a simple, stress free option, that was easy to administer, and that’s what I got. I would say though that they’re often on sale and we do have a Prime sale coming up. So it’d be worth waiting until then to buy them.
I prefer separation of devices for the purposes of failure points not taking down the entire network. Say router/modem/internet goes down, internal network is still up; PoE switch goes down, just loss of cameras; wifi goes down, hard line devices are still operational; etc…
I usually go this route when supporting other networks. Keep it simple mesh wifi/pihole/vpn for troubleshooting access. I’ve gone with Netgear Orbi in the past, since they were the only ones at the time using a dedicated backhaul for mesh communications. There are a host of others that have done it now, but if you’re looking for older mesh to save some $$$ with dedicated backhaul, Orbi is the only one.
I am not exactly looking at specific devices yet… Today I found none of the old routers I have is supported by OpenWRT.
I am also not yet sure about the wiring. Cameras need 100 Mb/s PoE (but will not use most of that link capacity).
Unless I will figure out some good use case for home server, I do not need to go over 1 Gb/s.
Not putting router (SW) to same box that will do a lot of other stuff is something that I consider reasonable enough.
I am still figuring which direction to take.
I got for a start cheap tp-link 8 port (4x PoE) switch 10/100Mb/s.
Vodafone GigaCube 5G, which is bad because it does not have enough ports, bad for DHCP, and I did not yet test it in AP mode only, so do not know about that, I will probably keep it, as 5G connection, and maybe an AP.
And last but not least an overkill server running proxmox (DNS, DHCP, frigate for camera recording, Home Assistant, Office, and other local services).
I will never not suggest a custom built OPNSense Router/Firewall. There are many small cheap mini-PC’s that can be used as the hardware to run it. I really like Hardkernel’s Odroid H5. it is quite overkill for this application, but considering how affordable and low power it is, there really is no reason not to use it.
With 8 cores you could even throw a hypervisor on it, and run OPNSense in a VM, and use other containers or VM’s to run other stuff (like a pihole instance, etc. etc.) and still have plenty of horsepower left over for serious WireGuard instances inside of OPNSense. (like - for instance, running VPN instances for laptops and phones to access your home network remotely, or routing all of your WAN traffic through a trusted VPN or something like that)
Just keep in mind that as delivered it is just a board, you’ll need to dress it up with a case, a power brick, a boot drive and RAM. And you’ll want to grab at least one of their optional m.2 ethernet adapters so you have two ethernet ports. (one for LAN, one for WAN)
I also find that Ruckus WAP’s by far outmatch Unifi’s units from a signal/range perspective. They cost a little more, but you get what you pay for. For home use you’ll want one that supports the “Unleashed” firmware (not all of them do) so you don’t need their full enterprise controller hardware.
If you go the Unifi route you will need to either run a local server instance to control it, or rely on their cloud management, neither of which are ideal for most people.
I used to run three Unifi AP’s, and replaced them with two Ruckus R650’s a couple of years ago. Little did I know just how good these Ruckus units are. I could have gotten away with just one.
Going from Unifi to Ruckus was as much of a leap as going from a consumer router to Unifi was 15 years ago when I did that, with the added bonus of no longer needing a server to run the Unifi software to manage the WAP’s.
Again, do I live in weird place? Hardkernel’s Odroid H5 is almost twice as expensive as MikroTik RB5009, without even accounting for it having only 1 port, and no box, no power, no disk, and no RAM.
My big box already have tailscale configured.
I have Vodafone’s GigaCube 5G and one WiFi extender, little did I know, how bad it is. I read from multiple sources, that the Cube should be actually quite good as WiFi… I am not sure if I would accept it, or bough something else, if I would know, that 5m away in any direction with single wall/floor the signal is already not great, and 10m is mostly too far.
That MikroTik unit is indeed a pretty cool and capable unit.
I don’t have any personal experience with it, but I do have lots of MikroTik gear in the house.
From my experience they are usually pretty under-dimensioned on the CPU side, so if you do any layer3 type stuff it may not keep up with interface speeds.
You’ll also likely be stuck with RouterOS which - while powerful - is a pain in the ass to configure right. It feels like it is in a constant alpha state with poor documentation, and turns things that are simple on other hardware into a real nightmare to set up.
I have been doing home lab type stuff for 15 years now, and am no stranger to enterprise networking hardware, and I have never struggled as much as I did when I tried to do routing (or even basic VLAN’s) on a MicroTik device with RouterOS. In fact, the last time I tried, I wound up just returning the units I bought because I could never get VLAN’s to work right.
The one benefit you’ll have from using that Mikrotik unit though, is that it has a Marvell Switch chip in it, which means you can actually use the ports on the back like a switch, which you can’t on many router-dedicated platforms, where an external dedicated switch is recommended.
All I can say is, I would never voluntarily take on Mikrotik’s RouterOS again. It just makes everything needlessly difficult.
In my experience, there is no such thing as a good consumer wifi device, especially if you are in a densely populated area with lots of competition for the airwaves.
Connectivity and performance usually just falls apart.
This is why I always recommend enterprise WAP’s for enthusiasts.
Years ago when I lived in a particularly dense area I tried consumer Wifi router after consumer Wifi router and all of them performed terribly. I could barely connect, and only got single digit Mbit performance even when standing right next to them.
Someone on another forum recommended I try a Unify WAP, and when I tried it it was like night and day. As soon as I connected it, it cut through the noise like it wasn’t even there. I got near full advertised bandwidth throughout the house. It felt like magic. I couldn’t understand how they did so much better in a noisy environment than the consumer models did.
Moving from Unifi to Ruckus a couple of years ago resulted in a similar leap in capability. The Ruckus units are a little bit more expensive, but you get what you pay for.
That said, if you live in a less dense area, (no close neighbors who use wifi/cordless phones/microwave ovens/etc.) you may have a decent experience with consumer gear, and not have the type of issues I have struggled with.
Ah, well in that case you have many more, more affordable options. That takes the interference problem out of the equation all together. The security issue is still in scope though.
Consumer wifi devices - regardless of the brand - have well deserved notoriously bad reputations for security. The manufacturers design poor security compromises into their software, and are terrible at keeping up with security patches.
This was a bit eye opening to me. I knew consumer routers were quite bad, but I had no idea they were this bad:
I am not including Unifi among my “consumer devices”. Unifi is much better than the consumer stuff. Not quite as good as the likes of Ruckus, but still an order of magnitude better than the consumer routers of the world.
Yes, there are cheaper options, but this is a very capable option. For the money you are spending you are getting quite an impressive piece of kit. if I didn’t already have more capable hardware in this role, this is the route I would take.
I’d probably configure it as follows:
1.) Odroid H5 board ($230)
2.) 1x 8GB DDR5 SO-DIMM ($120)
3.) Odroid H5 case ($10)
4.) 2x 16GB Optane M10 drives as cheap but low latency and indestructible mirrored boot drives ($8 each on ebay)
5.) 2x Intel i210 m.2 NIC’s (~$20 each on Amazon)
This won’t be the cheapest, but it will blow anything else you can get for this money out of the water, and OPNSense is both very powerful and very easy to live with.
I’d enable IBECC in the BIOS (a low level of ECC support on non-ECC DIMMS) to make it stable over long uptimes, and install it with the ZFS boot option, mirroring the two drives.
Once installed I’d use one of the two i210 devices as LAN and the other as WAN, skipping the on board Realtek 10gig device all together as i210 NIC’s are unbeatably reliable
Add a little bit more storage and possibly a little bit more RAM, and you could instead install Proxmox on it, run OPNSense in a VM passing through the two i210’s to the OPNSense VM, and add a couple of other LXC containers for other purposes (like pihole, SearXNG, etc. etc.)
It’s really quite amazing how much capability you can get, relatively inexpensively and in a small, low powered package these days.
I do not want to argue about prices, because they depend on region, but I can get:
2x Mercusys MA310E, 2,5 Gigabit PCIe
2x SSD disk Patriot P300 128GB
Endrofy Elementum E5 450W
ASUS PRIME B550-PLUS
AMD Ryzen 5 4500
”A box”
2x G.SKILL 8GB DDR4 3200MHz CL16 Gaming series Aegis
for way cheaper, than I can get the Odroid H5 and listed stuff, because I see it way more expensive (tax included).
And on paper this looks way more powerful. Or am I wrong?
I presume you are shopping used to get that kind of price on those desktop parts? Because at retail prices, I priced that out and it winds up being significantly more expensive.
Yes, those 6 Zen 2 cores in the Ryzen are going to be more powerful than the all E-core design of the Core i3 N300, at least on paper, but that extra raw compute power won’t make much difference in the functioning of a network appliance. They simply don’t need or benefit from that level of heavy lifting for standard routing and firewall tasks. The 8 core N300 is already quite overkill here as it is.
The real trade-off here is power consumption. The Odroid unit is designed as a low-power SBC; it will idle at very low wattage (the CPU itself is 7W TDP), whereas your proposed desktop build will likely idle in the 30–50W range and go much higher under load. That may not sound like much, but for a device that stays on 24/7 it adds up over time. Additionally, the Odroid can enable IBECC to provide many of the stability benefits of real ECC memory.
Also, those Mercusys MA310E NICs are Realtek. You generally want to avoid Realtek whenever possible in a network appliance build; they aren’t as reliable for long uptimes and tend to not play nice with FreeBSD (which is what both OPNSense and pfSense are based on).
You probably don’t need 2.5G anyway as your WAN speeds are much lower than that. (100Mbit from your initial post) I recommended Intel i210s simply because they are the “old faithful” of the enterprise gigabit networking world. They are validated to sit online almost indefinitely, offer low latency, and are extremely reliable.
If you find that you eventually need faster than gigabit performance on a router/firewall, it is generally best practice to skip the consumer “multi-gig” (2.5Gbit, 5Gbit) tier altogether. Realtek can be finicky in general when it comes to servers and routers/firewalls (the old pfSense mantra used to be that there are three important choices when it comes to your NIC: “intel, intel and intel”) But Intel’s i215 entry into multigig had some well-documented growing pains, and the follow-up supposedly fixed i216 leaves a lot to be desired. In those cases, it is much better to move to true enterprise units like the Intel X520, X540, or X710 and go full 10G.
No it was comparing all new. I used (first 2 results) Odroid H5 [130001] and ODROID-H5 – ODROID for the Odroid H5 and even cheaper one is over 300 (when converted back to ) just for the board, did not even checked if the shipping is free or not.
I picked Mercusys MA310E NICs, because the intel one is listed as no longer for sale, and price was almost same for 1 Gb/s and 2.5 Gb/s… Did not really think about it.
OPNsense looks like their HW is really expensive, but they too put Ryzen inside.
I am still thinking if it would be that bad to run it on the Ryzen 7950X that will be anyway running proxmox 24/7 It have 3x PCIe, and more than enough storage, RAM, ….
Please list all the reasons why it is bad idea. I will start, with why I do not care, so if there will be a flaw in my reasoning, please correct me.
(Single point of failure) If that box dies internet dies too. Well I can always just connect my PC directly if I would need help troubleshooting, and I do not really expect PC to die. Not much better argument, than what if the router device (whatever it will end up being) dies.
It might need a reboot from time to time. Yes, but routers too, so do not think this would be significantly worse.
Sharing system resources. There is plenty, with 3 test cameras running detection on the maximum resolution (to simulate closer to real load) I needed to look twice to say it is reporting system usage, because it was so low…
Power consumption. I think will be actually lower than a second box, because it already runs, and doing a bit of work probably uses less, than whole second box (no matter the spec).
After writing it out, I really wonder if that isn’t the best solution for a router. (Keeping APs out of this equation.) Now roast me for missing something obvious.
