TR Forums

Redocbew wrote:

Losergamer04 wrote:

PFSense as a VM on an old server running ESXi.  Wireless is done through a Ubiquity AC Pro.

I had that setup at first(using KVM instead of ESXi), but I moved pfSense into a dedicated device since I didn't want to take the network down when I messed with the machine hosting it.  I got one of those NUC-like pre-made pfSense boxes since I didn't have enough spare parts to build another machine, and I didn't want a tower sized router anyway.  I kept the RT-AC66U as an AP for wireless.

What NUC did you get? I'd be interested in doing it that way. Something powerful enough for packet inspection?

Usacomp2k3 wrote:

Redocbew wrote:

Losergamer04 wrote:

PFSense as a VM on an old server running ESXi.  Wireless is done through a Ubiquity AC Pro.

I had that setup at first(using KVM instead of ESXi), but I moved pfSense into a dedicated device since I didn't want to take the network down when I messed with the machine hosting it.  I got one of those NUC-like pre-made pfSense boxes since I didn't have enough spare parts to build another machine, and I didn't want a tower sized router anyway.  I kept the RT-AC66U as an AP for wireless.

What NUC did you get? I'd be interested in doing it that way. Something powerful enough for packet inspection?

It wasn't an actual NUC, just a small form factor system like you can get from the pfsense store. It uses a Celeron J1900 if memory serves. If you want to build your own you might have an easier time checking out the ZBox from Zotac. The last time I looked they made more dual-nic models than the NUC did.

Running a D-Link DIR-655. It's been running for eight years, still rock stable and I reboot the thing so rarely I couldn't even guess, it just works.

Wifi range is poor but it averages 220Mbps out of the 300 possible for my cell. Changing settings requires the device to restart and the interface could've been better done, but as I modify settings so rarely it doesn't bug me anymore. 

churin wrote:

Asus RT-AC68U

I have been using it for two years with no issues.

seconding, I have two of them and am highly satisfied with results. I think I'll probably put a pfsense box in front of them soon or an ubiquiti firewall before I go IOT, but that's mostly because I don't want to mess with VPN's on the thing too much. Merlin firmware on it works well, too.

Kougar wrote:

Running a D-Link DIR-655. It's been running for eight years, still rock stable and I reboot the thing so rarely I couldn't even guess, it just works.

Wifi range is poor but it averages 220Mbps out of the 300 possible for my cell. Changing settings requires the device to restart and the interface could've been better done, but as I modify settings so rarely it doesn't bug me anymore. 

I can't imagine that's still getting any updates at all. You might consider upgrading for your own security, Kougar.

DancinJack wrote:

I can't imagine that's still getting any updates at all.  You might consider upgrading for your own security, Kougar.

Aye, last firmware update was three years ago to fix an exploit. But I'm not entirely convinced a modern router is any more secure unless I pay for some serious something or other. Also I don't want to chance updating to a device that is less stable, so unless I know it is vulnerable or already hacked I'll keep it.

The latest is Netgear basically left all its devices open to exploit from a malicious site. Last Month it was Zyxel and Speedport routers. Then practically everyone has remote administration exploits still, ASUS, Dlink, Linksys... I turned all that off a long time ago.

I've never understood why consumer routers have that feature at all.  In an enterprise setting it makes perfect sense since you may have to mess with a router that's far from your physical location, but not for a home network. How many people not running 3rd party firmware are going to want to mess with a network they're probably not using when they're not at home?

Exactly. The very people that might wish to remotely admin their routers are the same people buying commercial grade gear or rolling their own routers anyway. 

Kougar wrote:

Exactly. The very people that might wish to remotely admin their routers are the same people buying commercial grade gear or rolling their own routers anyway. 

Yep. Although after I configured mine, I set it up so you'd have to remote into an internal server before being able to admin anything. Something about having remote administration directly from the internet gave me the heebie-jeebies.

I run a http://www.newegg.com/Product/Product.a ... 6856205007

running https://pfsense.org/

If I needed to do it over again, I'd simply grab one of these: https://www.amazon.com/Intel-Server-Ada ... 78KVWC96QE

And toss it into my ESX machine, which would run pfsense in a wee VM. Having a hard disk and 8GB of DDR3 in my router has been overkill.

TP-Link TL-WR841N/ND v9 running on Openwrt. Don't use any of the cool features of Openwrt due to lack of onboard storage though I suppose I could get a USB flash stick to use for storage if I cared, mainly flashed it to Open WRT because I could. The 100mb speed of it is just fast enough for my download speed (about 85-90mb down), so If Comcast does another system upgrade raising my speed for free I'd need to get a gigabit router.
Reliability wise using wired it works exactly as it should, no issues.
The Wireless speed on it is okay, 85-ish in the same room using my Droid Turbo 2 as the test bed, haven't really done range testing but I'd guess it wouldn't be that great given it's very low cast, reliability on the other hand gets a 7/10 as I occasionally have to turn the wifi on and off because it drops out, however it could be my phone, I haven't bothered getting another wireless adapter for my pc after I lost or threw away my old one.

2x Linksys WRT-610Nv2 w/ DD-WRT firmware on them. Generally been happy with them for a number of years, running them in multiple configurations such as wireless bridging. However they appear to be reaching the end of their lives. Range and stability issues have been cropping up. Looking to likely replace them with a couple of Ubiquiti UAP-AC-PRO's and run pfSense as gateway/firewall.

My Ubiquiti Power APN finally passed on recently. So now I'm running a Mikrotik rb951g-2hnd. I'm still learning the ins and outs of the interface. I find it a bit...let than intuitive. But the range and feature set are impressive.

I was thinking of going with an Ubiquiti Amplifi, because our company has a close tie to Ubiquiti, and they look like they might be fun to tinker with, but I couldn't really justify the purchase to myself.

Forge wrote:

If I needed to do it over again, I'd simply grab one of these: https://www.amazon.com/Intel-Server-Ada ... 78KVWC96QE

That model is more than several years old.  While it does support VMDq, it doesn't support SR-IOV. Probably not a huge deal, but it does let the hypervisor pass control directly to the hardware (keeping in mind that the host system also has to support SR-IOV). Even if you don't care about SR-IOV support, I would still look at something i340, i350, or i350v2 based.

Don't get me wrong, the PRO/1000 VT is tried and true, but there have definitely been advancements in the controllers in the decade or so since the VT was released. If I had one already I'd use it depending on the situation, but if I'm buying new it wouldn't be my first choice.

When I was running pfSense in a VM I was passing through the NICs it was using directly to the VM.  The reading I did at the time was all leaning towards the overhead of the VM not really making much of an impact until you got past gigabit speeds, so I did it mostly just because I was curious how it would work.

I use a Mikrotik pretty cool and can be driven by the command line or Winbox which is a GUI type app.

Ubiquiti EdgeRouter X (~$50). Great little router for home use.

We also use a pair of Ubiquiti UniFi AC Lite AP (~$80 ea) access points.

Ubiquiti has a good track record continuing to enhance existing products via (no-charge) SW updates. For example, the latest EdgeOS release enables IPsec crypto offload on the EdgeRouter X.

curtisb wrote:

Forge wrote:

If I needed to do it over again, I'd simply grab one of these: https://www.amazon.com/Intel-Server-Ada ... 78KVWC96QE

That model is more than several years old. While it does support VMDq, it doesn't support SR-IOV. Probably not a huge deal, but it does let the hypervisor pass control directly to the hardware (keeping in mind that the host system also has to support SR-IOV). Even if you don't care about SR-IOV support, I would still look at something i340, i350, or i350v2 based.

Don't get me wrong, the PRO/1000 VT is tried and true, but there have definitely been advancements in the controllers in the decade or so since the VT was released. If I had one already I'd use it depending on the situation, but if I'm buying new it wouldn't be my first choice.

I actually chose that one because gigabit, four ports, <50$ on Amazon.

SR-IOV doesn't matter if you pass the whole device through. I want one leg to go to the ONT, and two to the switch. I have my servers and most of the heavy lifting machines using dual gig links and LAGG for easier throughput.

If you've got the hardware spare, why not overengineer?

All the Ubiquiti fans: How's your throughput? When I bought two AP AC Pros, I couldn't get more than ~500Mbps from any client. Ended up arguing with a few different techs at Ubiquiti that told me I don't actually want what I want, then took them back and picked up an AC87R instead. Dropped dd-wrt onto that and called it a day.

TM-AC1900, aka Asus RT-AC68U (like everyone else, as was said )

I got one in 2014 when T-Mo first offered them, and had 2 years with zero downtime. Best performance I have ever gotten out of a router. I wanted to buy it from T-Mobile when we switched cellular providers but thanks to the power of red tape I had no choice but to send it back or pay a ridiculous fee.

So, I turned right around and bought one off ebay for 75 bucks. Don't fix what ain't broken.