$150 fanless N100 pc with 4x2.5gbps from aliexpress and install OPNsense on it.

I would not recommend unifi for a mature solution. It sure works nice as a glass panel, but it will get limiting if you will have a desire to hack around your network. Their APs are solid, though, it's just the USG/Dream machine that I wouldn’t recommend.

Mikrotik software is very capable and hackable and you can run it in a vm if you feel like bringing your own hardware.

I run Opnsense on a Proxmox VM (I followed this guide). I’m quite pleased with it. Opnsense is probably going to be more secure than any consumer router firmware, but you’re going to have to make a bigger upfront investment in hardware. I had never used Opnsense prior to using this system, and the fact that I’m running it on Proxmox is a huge benefit. If I’m ever about to do anything I’m unsure of, I can snapshot the VM in Proxmox. If my router config breaks as a result of my tinkering, I can easily restore from the snapshot.

If you're looking for a more mature networking setup, I would definitely recommend splitting up your router, switch and AP duties into separate devices. It gives you the most flexibility for when you want to tinker or change things.

For a main router setup, I would recommend OpnSense. It's has a cloud backup feature which allows you to automatically backup the configuration to a Google Drive xml file whenever it is changed.

The XML config file stores all your leases so you don't have to worry about reassigning DHCP reservations. If you load the config onto a new system, like for an upgrade or if the router hardware fails, usually you just have to change the interface mappings and you're good to go.

As far as APs/switches, I would recommend Unifi or Mikrotik. Unifi has a fancy dashboard you can use to adopt new equipment and restore/change configs from, but I find Mikrotik easier and simpler to backup and I like that i dont have to host a controller to make config changes.

Unifi gear is super great value-wise. Their support is lacking, but their equipment is pretty easy to deal with.

UCG is great and cheap.

UDM Pro is more flexible / future proof but also more expensive. (you get POE, and access to the rest of their suite, but that access also comes with some hardware lockin)

They don't do custom DNS, so a couple of PIE holes or a DNS service are prudent.

If going the route of a backup solution, is it feasible to install OpenWRT on all of my devices, with the expectation that I can do some sort of automated backups of all settings and configurations, and restore in case of a router dying?

That's what I do. Every device runs OpenWRT except my ONT. Backing up is just a cron script that calls each one and pulls the config.

For my router, I ended up buying an old Barracuda LoadBalancer 340 and installing OpenWRT (it's an x86 device so it was super easy). It's a little over-powered for a router, but the price was right. It's got more than enough spare resources to run some extra stuff, including Docker, so I'm probably going to throw my PiHole container on there since I haven't been impressed with AdGuard Home (which is available in the repos).

And if you go for an old Barracuda unit like I did, the default BIOS password is bcndk1

If going the route of a backup solution, is it feasible to install OpenWRT on all of my devices, with the expectation that I can do some sort of automated backups of all settings and configurations, and restore in case of a router dying?

My two cents: use a "full" computer as your router (with either something like OPNsense or any "regular" linux distro if you don't need the GUI) and OpenWRT on your access points.

Unless you use the GUI and backup/restore the configuration (as you would with proprietary firmwares), OpenWRT is frankly a pain to configure and deploy. At the moment I'm building custom images for all my devices, but (next time™) I'm gonna ditch all that, get an x86 router and just manually manage OpenWRT on my wifi APs (I only have two and they both have the same relatively straightforward config).

It’s a pain that I know can be solved with buying dedicated access points (…right?)

Routers and access points are just computers with network interfaces (there may be level-2-only APs, but honestly I've never heard of any)... most probably your issue is that the firmware of your "routers as access points" doesn't want to be configured as a dumb AP.

I have a closet full of old routers (including Linksys), extenders, and switches to be able to handle dead spots. They all sucked. Then I heard about mesh routers when they first came out. Tried two, saw that they worked well, and got a third one. A few months later, a new ISP showed up in our neighborhood with unmetered Gig fiber and I happily drop-kicked Comcast to the curb. It was gratifying that the fiber connection came with a single mesh device of the same brand I already had. Since then, I've upgraded to the next-gen routers, and gotten a few smaller 'wall-wart' units for extending the range outdoors.

I don't really have to fuss with configurations like I had to before. It's amazing how much of a time drain it was to go screw around with settings when a new device came in that didn't work, or to replace a router when one died. I haven't had to do anything in years. Every once in a while, I go set up a DHCP reservation but that's it. The firmware updates auto-install while everyone's asleep and I get pretty decent bandwidth in places I had constant dropoffs. When I switched out the actual routers to the new gen, the whole thing took 10m and the whole network was down for maybe 2m while the new ones booted up. No end devices had to be modified or restarted.

Where the fiber comes in, there's a single router node, with two Ethernet ports. One goes to the fiber ONT, the other to a 10-port gig switch where it feeds the rest of wired setups. Elsewhere, the farthest mesh unit has no incoming physical connection, but a small wired switch connected to other wired devices near there. I didn't have to make any router configuration settings to make this work. Just plugged it all in. Common devices go on the main network, and janky IOT devices (and visitors) go on the guest network.

For external access for self-hosting, you can take a domain name and set up a free Cloudflare tunnel to access your in-home services remotely. Pay Cloudflare a fee and you get extra rules-based access control. The router also has a premium service where it comes with a family bundle of security software. One other thing I like is that the mobile app sends a notification whenever a new device joins the network, so if I see one I don't recognize, I can block them. Hasn't happened yet, but if it does, I'll know to go rotate the wifi passwords.

Anyway, highly recommend mesh routers. I happened to get Eeros (before they were acquired) but there are a few other brands around. Some people don't like that Amazon bought eero, but they appear to be left to run as an independent outfit. It has been pretty solid so far.

~~P.S. A friend with a more complicated setup than mine got Ubiquitis. It's anecdotal, but he recently asked about switching away and I told him pretty much what I've written here. YMMV.~~

Edit: checked back with friend. He said he was very happy with his Ubiquiti gear. I mixed up his review from years ago with another friend's networking setup.

As for backup, you can also buy a e.g. Lenovo M920q minipc, buy a pci-e riser, buy a dual port ethernet card, set up Proxmox, set up an pfSense (or OpenWRT, or OPNsense) VM inside, pass-through the ethernet card directly to the VM. The VM is very backupable, since you just copy the VM state and save it somewhere. This would only work for the router though, since the AP's that'd be running OpenWRT wouldn't be VMs. This is at the cost of having to deal with an additional layer for the VMs.

I guess the problem you're asking about in regards in regards to cross-device portability of a backed up config is valid. If you had a four ETH port router, backed up the config, and then uploaded it on a two ETH port router, you'd run into trouble, but I have no experience here.

You can also install OpenWrt on some switches these days (PoE also reportedly works with realtek-poe module):

• https://forum.openwrt.org/t/support-for-rtl838x-based-managed-switches/57875/
• https://openwrt.org/toh/views/toh_standard_all?dataflt[Device+Type*~]=Switch

That way you'd have a fully open OpenWRT-only network lab, so you'd always be working with the same system.

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

13 acronyms in this thread; the most compressed thread commented on today has 6 acronyms.

[Thread #921 for this sub, first seen 14th Aug 2024, 19:05] [FAQ] [Full list] [Contact] [Source code]

I used to use OpenWRT on various devices, but two years ago I got a UDM-Pro, a USW-16-POE, and a few Unifi APs and cameras. I run pi-hole on the UDM-Pro. I have no complaints. It is more expensive than piecing it all together using OpenWRT and some Raspberry PIs, but way easier.

My setup is smaller, but when my venerable old router died about a year ago, I acquired an Asus TUF-AX3000_V2 where I installed FreshTomato. One can login via SSH and dump all settings for backup. Likewise, individual or all settings can be done on the command line instead of the GUI. I have a script on my computer that reads CSV files with MAC addresses and more to apply changes in an automated way.

I have the att bgw-320 as well. Very excited for when the hardware for the bypass comes around.

I tried using the IP passthrough setup on it, but it ended up causing all sorts of slowdowns that I had troubles diagnosing. I was using the nanopi r4s with a WiFi AP when I had this issue. Make sure to look into compatibility with ATTs IP passthrough is not total passthrough so you might have to dig into the details to make sure it all works together.

As a fellow ONT haver, you should find out if you have XGS or G-PON fiber and just stand up an opnsense box/VM as your router.

https://pon.wiki/guides/masquerade-as-the-att-inc-bgw320-500-505-on-xgs-pon-with-the-bfw-solutions-was-110/

Can also check out the 8311 discord!

Currently I have a WAS-110 connected via SFP NIC to a Proxmox VM running opnsense. That has SR-IOV for my physical ports and other VMs and then a nice WAP for wifi6e.

That way you don’t get vendor locked into anything on the Ubiquiti/Ruckus side of things

OpenWRT is really powerful. You can go into the Luci and select "take backup archive." This will back up the current config. When ever you screw up or get a new device you can restore the backup. Keep in mind if you change hardware it might mess up the configuration as the physical ports change.

What's even cooler is you can build custom images online and then deploy them. https://firmware-selector.openwrt.org/

I'm a big fan of Mikrotik with Unifi WiFi.

Mikrotik I have a RB5009 which is powerful enough for all of my needs.

I'm going to suggest something that I don't see anyone else talking about here. Synology, the company mostly known for the NAS devices, makes some surprisingly good routers as well. I've got 2 of their RT2600ac and 3 of their MR220AC mesh units. Their configuration software is unlike anything I've used by any other brand. It a web based interface that looks like a variant of desktop linux. Configuring it feels like configuring an actual computer.

I had originally purchased these for my business, an esports center, but after the business closed a few years ago I kept the hardware and used them in my home. They are so much better than any other consumer networking hardware I've tried from DLink, Linksys, and Asus.

They have newer models out that support AX wifi. But I haven't felt the need to upgrade yet. A few notes though. Their hardware does not necessarily support every cutting edge feature. No wifi 7 as far as I know for instance. They seem to sit about 2-3 years behind the absolute latest, but the trade off seems to be stability and reliability.

In my home, I have every unit physically hardwired back to my server rack in my basement. So while it does support mesh over wifi, I've opted to run ethernet to every room in my house. My general rule is anything that can be wired, should be wired. We even have a disconnected shed/workshop which I trenched and buried a cable out to so that I'd have a wired access point out there.

I rarely see anyone mention Synology's routers, but I think they are worth consideration.

Mikrotik all the way. But prepare yourself for a nice steep learning curve, but now that om past that i sware by it. Super fast and infinity configurable. The entire router configuration can be exported as a txt file and imported in seconds so if it breaks just get a new one and load up your config and you are good to go. Also the forums are a gold mine of information. What i love the most is just how fast it is. Setting take effect instantly. Also means it is extremely fast to lock yourself out of not careful. Again, steep learning curve but really good after that.

I haven't seen it mentioned it yet, Firewalla. I I've been running the Gold version myself for a couple of years now and it's been great.

I believe it was founded by ex-cisco engineers.

This is paired with Unifi switches/AP's.

I took a quick read of the comments and I apologize in advance if this has been suggested already.

I use a self hosted DNS server (AdGuardHome) I was using TechnitiumDNS for a long while, but moved over to the other recently so I could do some more blocking as needed (adult special needs house dweller sometimes needs limited internet). It also acts as a DHCP Server so it takes the role of both the DHCP assignments away from the router. As it so happens, this week, I got to experience the benefit of having this setup live when my main router also went down, I was able to switch to a spare router (My ISP provided one) and all I had to do was turn the DHCP off and optionally point the DNS To my AdGuardHome address, set the SSID's up and I was in business. All of my devices happily reconnected and grabbed their assigned IP's.

In short, if you have a spare computer, SBC such as a raspberry PI or whatnot, you can easily host something like that and not have to worry about setting those again.

Edit: Forgot to mention! Another minor gripe I have is that my current 1 router / 2 routers-as-AP solution isn’t meshed, so my devices have to be aware of all 3 networks as I walk across my property. It’s a pain that I know can be solved with buying dedicated access points (…right?), but I’d like to know other’s experiences with this, either with OpenWRT, or other network solutions!

This works very well with OpenWRT on each AP and/or router device by using the same ESSID and password combo on each of them, enabling WLAN roaming and also 802.11r Fast Transition to allow your mobile devices to hand-off quickly from one AP to another as signal strength levels demand. With this enabled you keep the same IP address, and even SSH sessions don't drop when you move from one AP to another, it all happens in the background. As far as the end-user is concerned it is all just one big happy wifi network.

802.11r is not mesh, that's a separate thing but and you can do it with OpenWRT too. I don't need to because I have ethernet to all my APs, so all the RF bandwidth is available for the last leg from AP to device(s), and not being used by back-haul from AP to AP through to the router as well.

In your use case I would consider grouping devices into categories and having a different wifi network for each category with the dhcp and firewall rules set accordingly.

VLANs on the ethernet-side might also be useful, but it sounds like most of your devices are on WiFi, so it might well be possible to get a "mature" setup without needing that extra complexity.

As others have said, backing these settings up and restoring them to a new device in the case of hardware failure is generally straightforward. Care is needed when replacing the broken device with a new one because of naming conventions varying from device to device, but the network logic, and things like dhcp reservations can be carried over.

I like the Turris Omnia and (highly configurable) Turris Mox. They come with OpenWrt installed.