Looking for Router/Gateway with Greater Security than traditional consumer equipment
T Testscript Occasional Visitor M mtganzer Occasional Visitor L loveleeyoungae Regular Contributor G gattaca Senior Member abailey Very Senior Member joegreat Very Senior Member
I have tried the rest now the best? A few other people had various recommendations and nothing hit home. I currently utilize an off the shelf Netgear router...
/styles/default/images/apple-touch-icon-57x57.png
SNBForums
you can set up a linux OS and turn it into a router and security gateway, thats the most flexible and performance option in the cheapest way, otherwise you're looking at more complicated options.

...or pfSense, OPNsense, etc. BTW I have not set up a BARE Linux box as a router/firewall since...oh...probably 2000! Unless you are (or want to be) a wizard with raw iptables, best to find a distribution that has simple router/firewall front end (anyone remember Mandrake Single Network Firewall?).

pfSense with pfBlockerNG and Snort plugins checks off the items you mentioned. I am really not all that enthralled with other "Unified Threat Management" options anymore now that most traffic runs over SSL/TLS. You can install a "man in the middle" break/inspecton on the UTM boxes, but it is not trivially easy to do (have to create trusted certificates and push them out to all systems on your network). Easier for me at home just to make sure to keep the antivirus and ant-malware updated on the end hosts.

Re: "subscriptions" for updating signatures - pfBlockerNG updates from an extensive number of mostly-free published lists to set up DNS Block Lists and IP Block lists, and also does your GeoIP blocking. The Snort plugin uses standard Snort signature sets. The paid "Emerging Threats" lists is ~$30 year for personal use, or free of you are ok with the VDL list (basically a delayed release of the paid list).

Be advised that if you really want to do IDP and IPS (or VPN) you will need MUCH more CPU power, especially as speeds get up to gigabit range. You said you had set up a Ubiquiti USG - I had an Edgerourer Lite, which was the unmanaged version of that device. For basically NAT firewall, it works quite well (I tested it to 900+ Mbps when I recently installed ATT Gigabit Fiber). And there are add-in scripts in the community to set up DNSBL (DNS Black List). But no GeoIP blocking, and none of the Ubiquiti hardware to date has the CPU horsepower to do IDPS. I am currently running pfSense in a VM on my Xeon Ubuntu server, but $1000 would easily get one of Netgate's pfSense appliances - the SG-5100 at $800 would more than handle what you are likely to throw at it. Nice thing is if you want to "kick the tires", you can easily set up pfSense in a spare PC - just throw in an extra NIC (Intel chipset preferred).

...or pfSense, OPNsense, etc. BTW I have not set up a BARE Linux box as a router/firewall since...oh...probably 2000! Unless you are (or want to be) a wizard with raw iptables, best to find a distribution that has simple router/firewall front end (anyone remember Mandrake Single Network Firewall?).

pfSense with pfBlockerNG and Snort plugins checks off the items you mentioned. I am really not all that enthralled with other "Unified Threat Management" options anymore now that most traffic runs over SSL/TLS. You can install a "man in the middle" break/inspecton on the UTM boxes, but it is not trivially easy to do (have to create trusted certificates and push them out to all systems on your network). Easier for me at home just to make sure to keep the antivirus and ant-malware updated on the end hosts.

Re: "subscriptions" for updating signatures - pfBlockerNG updates from an extensive number of mostly-free published lists to set up DNS Block Lists and IP Block lists, and also does your GeoIP blocking. The Snort plugin uses standard Snort signature sets. The paid "Emerging Threats" lists is ~$30 year for personal use, or free of you are ok with the VDL list (basically a delayed release of the paid list).

Be advised that if you really want to do IDP and IPS (or VPN) you will need MUCH more CPU power, especially as speeds get up to gigabit range. You said you had set up a Ubiquiti USG - I had an Edgerourer Lite, which was the unmanaged version of that device. For basically NAT firewall, it works quite well (I tested it to 900+ Mbps when I recently installed ATT Gigabit Fiber). And there are add-in scripts in the community to set up DNSBL (DNS Black List). But no GeoIP blocking, and none of the Ubiquiti hardware to date has the CPU horsepower to do IDPS. I am currently running pfSense in a VM on my Xeon Ubuntu server, but $1000 would easily get one of Netgate's pfSense appliances - the SG-5100 at $800 would more than handle what you are likely to throw at it. Nice thing is if you want to "kick the tires", you can easily set up pfSense in a spare PC - just throw in an extra NIC (Intel chipset preferred).

pfsense and other such distributions have limitations. They are simpler to set up (not simple), but they limit what you can do too to some extent as its not a full blown OS that lets you install and use every feature you want. A normal linux OS like debian, BSD, SUSE can become an all in one router which is something pfsense cant (you cant use pfsense as a file server, on the network side, you cant create an applications cache (see steam and OS update cache as example) with pfsense as that requires installing software that these distributions wont allow or work with). Not even pro cisco can do it, and it really depends on what you're looking from a router. The most flexible router is still done by using a regular linux server OS rather than specialised, but if your needs arent as big than going specialised would be the way otherwise if you want everything for cheaper then the only way is to use a linux/unix server OS (not ubuntu) and spending all the effort and having the knowledge. You gotta pay somehow, if its not with money, its with skill.

If you use RMerlin's firmware for asus routers you will be dealing with raw iptables, and you are outdated, in opensuse i can set up iptables and plenty of things via their GUI based networking utility which can even work over TTYL in such a pretty and intuitive way. However if you have the skill to properly configure a configurable router, you will find terminals and editing text files to be just as intuitive if not less restrictive in feel over GUI.

My recommendation:

If you use "VPN" and/or want an "IDPS" (i.e Snort or Suricatta): Buy a "Mini PC" for install "pfSense or Untangle or Sophos'' (Any Mini PC from the previous post)​

........../

Router

..........\

If you will not use any feature above: EdgeRouter 4 or USG Pro 4 (In a few months Ubiquiti will release a new USG router and will use the same or better hardware than the EdgeRouter 4)​

Switch: UniFi PoE+ Switch 150W or higher (Need UniFi SDN Controller)

AP: UniFi nanoHD or UniFi In-Wall HD (Need UniFi SDN Controller)

Cameras: UniFi Video Camera G3 Micro or UniFi Video Camera G3 Dome or UniFi Video Camera G3 or UniFi Video Camera G3 PRO (Need UniFi Video or UniFi Protect)

Other: Raspberry Pi 3 Model B+ (Only if you buy the EdgeRouter 4 or USG Pro 4 to install Pi-hole)

Remote Management and Access:

UniFi SDN Controller: UniFi Cloud Key Gen2 or Gen2 Plus

UniFi Protect: UniFi Cloud Key Gen2 Plus (Link with information)

UniFi Protect is an evolution of UniFi Video. We built UniFi Protect from the ground-up for the best video viewing and reviewing experience possible.

The UniFi Protect product line is designed for users who don't need or want to maintain their own servers. We've had overwhelmingly positive response to the UCK-G2-PLUS already for this reason: It's plug-and-play, self-contained, pre-loaded with Protect and SDN software, and most importantly: You don't need to do any system administration work to make the most of it.

UniFi Protect is designed to be the most robust, plug-and-play surveillance platfrom on the market. The UCK-G2-PLUS allows anyone to quickly set up and use a Ubiquiti camera system. No Linux server administration knowledge is required.

The UCK-G2-PLUS is a performance value at $199, with an 8-core 2.0GHz CPU, 3GB of RAM, a front-panel display for system status, PoE power, user-upgradeable hard drive with a tool-free tray, and built-in battery backup so you don't even need an extra UPS system. For users looking to get started with plug-and-play video surveillance with 1-20 cameras and no monthly fees, you can't beat the UCK-G2-PLUS and UniFi Protect.

The all-new UniFi Protect mobile apps include easy Bluetooth setup so everyone can get up and running straight from their mobile phone without even opening a laptop. Our goal was to make video surveillance accesible to everyone, and the UCK-G2-PLUS is the perfect platform for delivering on that promise. That said, the UCK-G2-PLUS is just the start and we will continue to grow the platform to meet more and more use cases.

At this point, the UCK-G2-PLUS is the hardware to buy. UVC-NVR sales will be discontinued in the coming months and we will only retain UVC-NVR inventory for warranty replacements for existing customers.

Something like this:

Off-topic

- Stories - Ubiquiti Networks Community

Beautiful Cable Management

I've considered Ubiquiti gear ever since Hunt did his write up. At that time, I studied their web site, other write ups and other forums. I almost pulled the trigger but at the last minute I asked some harder questions in these areas:

what I already had in hand, and what is available today

Merlin's and this forums excellent support for ASUS,

Platform stability, integration, reliability, ease of use, market penetration,

Platform/unit resale-ability,

Platform operations, updates, firmware revs (how frequent), complexity, maintenance,

My families use patterns,

costs, scale, platform security (layering) as well as the company's attention to patching,

"sure it would have been a cool project" factor

KISS

and probably more things I cannot remember now.

FWIW, here's what I've done which works well for us. I'm in the KISS boat along with trying to follow the repeated conclusions by not only the SNB staff and reports but many of the SMEs in these forums. Always, YMMV.

Have multiple ASUS in a combo of AP and Router mode for 5+ years for full coverage in my home. What I learned from several SNB articles is those big routers simply could not keep up between the kids stuff, work stuff and Apple this and that. They also were a SPOF for the wireless workloads.

Signals do not penetrate far outside or inside b/c of the wall construction. (That was what was attractive about Ubiquiti's (in wall) APs.

My approach is to only buy new ASUS units when the SNB community agrees it's time to do so.

I typically install the new unit to the "hottest" point and then waterfall the other ASUS units from there.

Today I have 2 x APs - an RT-AC88U (newest) and an RT-AC1900P at opposite ends of the home.

The main routers are an RT-AC1900P + N56U in the basement mostly in just router mode. I usually turn the wireless off or do not broadcast so as not to confuse the family.

This approach also subdivides the primary wireless workload and provides a backup AP if I'm upgrading the firmware or one of the main AP decides to flake out. I've taught the family to just simply switch to the other AP.

The AP/SSID are NOT the same names (see above)

I set/lock the units channels, trying not to overlap after seeing the wifi-map I share with the neighbors. I know some of that single vs multiple SSID is controversial but I always want to know what AP I'm actually connecting to.. so I know if there is a problem.

My "main" routers (RT-AC1900P/RT-N56U) live the basement as the internet facing units. I use 2 routers b/c I need to layer some of the "IOT" traffic closer to the internet and prefer to keep it off the more "inner" core.

I also have Untangle sitting on a old laptop right behind the modem so it takes the brunt of the scans, probes and also has ad-blocking active. Via that laptop, I also get a quick view of the modem's stats b/c I can just open another browser page, hit the modem's IP and see what each channel signals look like. Sometimes they are hot, sometimes they are not so I can adjust the in-line attenuators to keep the signal in the optimal range for the modem to operate. (You would not believe the variances in signals, especially when it rains.) I can also use this to perform the DLS Reports performance tests as there's nothing between this point but the modem..

I use Merlin's production code base exclusively and perform firmware updates about ever 1-2 months, rolling thru the ASUS units. I used to have a Netgear in the mix but then decided I did not want to deal with yet another set of firmware updates.

I rarely hear complaints from the natives! The setup is screaming fast as as secure as I can make from that POV.

At some point, the 1900P units will waterfall out and then I'll sell them on eBay. I've concluded from reading SNB, the next unit I'll buy with the awesome RT-86U but not sure when. Yesterday there were tempting deals but my 1900Ps are barely breaking a sweat and it's rock solid stable.. (very important for family tranquility).

I also have a couple of well reviewed (VLANable) Dell commercial switches I got off ebay for like $25 each. These are just acting as normal switches handling all the in-room physical connections. I decided to just use separate switches instead of trying to complicate the setup with multiple VLANs. (KISS again). This also works well with my layering.

This seems to be the most cost effective approach I've found to date. It's been 3+ years now since I brought the 88U and I do not remember how old the 1900P's are at this point what 5+? All have been rock solid.

BTW, I've tried MANY other router brands and after my last round of crappy failures 5+ years ago, when I spent days trying to decipher and fix, I threw all that crap in a box and decided I'm sticking with ASUS + Merlin....at least until they give me a reason not to!

YMMV

Later.