Looking for Router/Gateway with Greater Security than traditional consumer equipment

[loveleeyoungae]

Yes, I've used gear from: Dlink, Netgear, Nexland (Brought by Sonicwall I think many, many years ago), Cisco, ASUS, TPLinks, Norton Core, ...
The main reasons I dropped the last player before ASUS were reliability, reliability, reliability then security (as in patching vulnerabilities promptly with frequent updates), costs, simplicity to setup (KISS), learning curve is not too steep and time-to-maintain is not crazy.. and in general feeling of an active, engaged community around the platform. I've toyed with going hard core like Mikrotik or Sophos XG or UTM... but as I got into that research, one or more of the above reasons always got in the way. Some of the more commercial players are offering "home" licenses with limits on either the number of devices or a limit on the CPU/RAM of the products - Sophos is an example. Untangle offers an attractive $50/yr home-only license as well.

BTW, I just invested a few hours examining OPNSense. Sadly, it does not come with an out-of-box easy-to-configure/use ad-blocking setup - so game over there. I did locate posts where people have "added" it to the platform but I'm not ready to spend hours digging into yet another router with something not supported by the community at-large. My bottom line is I'm not considering anything that does not offer ad-blocking out-of-box now. Hence, back to the original posting. Later.

After some reading, I think I see some reasons you chose Untangle - they're considered one of the most two generous providers regarding free versions of commercial products. The other is Sophos. These things obviously will take a lot of time. Just for the setup, I would have to consider between a direct installation on a low-end mini PC or a VM installation on some high-end mini PC running some other OS. So, many thanks for your input, I think I'd stick to my Asus routers for some more time and get back to these high-tech things later

 

[Rainmaker]

...or pfSense, OPNsense, etc. BTW I have not set up a BARE Linux box as a router/firewall since...oh...probably 2000! Unless you are (or want to be) a wizard with raw iptables, best to find a distribution that has simple router/firewall front end (anyone remember Mandrake Single Network Firewall?).

Sorry to reply to this slightly old thread, but this caught my interest. You don't need to learn or use raw iptables at all. Shorewall is the tool here, and I love it. After years of using pfSense, I got sick of it corrupting itself and chewing up my config; and while OPNsense is nice enough it can't implement WireGuard properly due to an upstream bug (and it'd only be in user space anyway).

My solution this month? A refurb SFF Dell Optiplex 7010 from eBay (Core i7 3770, 8GB RAM, 128GB SSD, Intel Pro 1000PT server NIC) and a headless Arch Linux install with the linux-hardened kernel. I took 30 mins to add the Arch base, with dnscrypt-proxy for (encrypted) DNS, dhcpd for DHCP, and Shorewall for the stateful firewall. Oh, and the WireGuard kernel module of course.

Shorewall has simple config files that live in /etc/shorewall, and you edit them to reflect your network. No iptables stuff, no weird code or syntax. Just a few easy to follow tables that you fill in as needed with normal English language. Shorewall then reads those files on boot and uses them to configure Netfilter directly, and then exits. Simple. For my uses I just set ./interfaces with the five NICs I had available, then ./zones to list WAN, LAN, DMZ and VPN, ./policy to allow firewall to all, LAN via VPN tunnel only, DMZ to WAN, and to drop traffic from DMZ to LAN. The ./rules file allows easy DNAT and other rules, again in a human readable pro forma table format ('ACCEPT WAN DMZ 80 tcp'), then just two lines in the ./snat file to masquerade LAN and DMZ. Literally five minutes' work (mostly typing out my DNAT rules) and it's been solid ever since.

I have a 380/20 cable connection and get that 24/7 over WAN, and the i7 gives me a comfortable ~370 over the WireGuard VPN with all 8 threads simmering away barely in double figures under full network load. My uptime shows that overall system load averages are in the order of 0.01 to 0.1, and we don't have a quiet network!

Not that I disagree with your points in general, but I did want to add for future readers that not only is a Linux router possible, but could be preferable - and it's practically easy these days even with multiple subnets and VPNs. Shorewall is a beautiful thing. <3 Because it's only a base Arch install it doesn't need much updating, and is very stable. Arch being close to upstream means fast bug and security fixes too.

Here's a rough (slightly outdated) network topology of my home.
Here's my GitHub with my Shorewall configs and my custom WireGuard scripts and systemd service.
Finally here's a speed test from a LAN client connected via WireGuard:

Sorry... As you were.

 

[sfx2000]

Not that I disagree with your points in general, but I did want to add for future readers that not only is a Linux router possible, but could be preferable - and it's practically easy these days even with multiple subnets and VPNs. Shorewall is a beautiful thing. <3 Because it's only a base Arch install it doesn't need much updating, and is very stable. Arch being close to upstream means fast bug and security fixes too.

Nice update...

You know that Shorewall does handle traffic shaping...

https://blog.tjll.net/building-my-perfect-router/#traffic-shaping

 

[Rainmaker]

Nice update...

You know that Shorewall does handle traffic shaping...

https://blog.tjll.net/building-my-perfect-router/#traffic-shaping

Yes indeed, and a lot more besides. It's a great piece of software. Thanks for the blog link, it was very interesting. I have vnstat running for bandwidth monitoring atm, but I'd love to get netflow working with a pretty dashboard like that one. Something to pick at over the new year, perhaps! Merry Christmas to you all.

 

[rnatalli]

As some others have pointed out, an x86 box running pfSense, Untangle, OpnSense, or Sophos are your best bets. I've personally used pfSense as I'm familiar with it, but have been testing Untangle and it's definitely easier overall. For hardware, I would look at boxes that have both an AES-NI enabled processor and Intel-branded NICs; something like the Qotom Q330G4. If you want something sold locally, Protectli offers some boxes which are basically tweaked MiniSys units.

 

[coxhaus]

Current IDS is NOT set and forget. It requires constant management which turns off home users. I think Ubiquiti Unified Security Gateway (USG) has a chance at making this work for home users. It is a very young product right now. I hope it works out.

Untangle is the best I have seen and tried. When I ran it for years, the home addition had limitations back then.