Wow, the timing of this question is eerie. Just last week, I got tired of talking about segmenting my network but never doing it. So I did some research, asked some friends, and settled on the following:
* An Opnsense firewall (purchased from Deciso; ie: "official" hardware)
* An OpenWRT One (ie: "official" hardware) to be used as an access point
* A Microtik switch (SW OS, not Router OS)
My plan is to create multiple SSIDs, have each one on a different vlan, and then control services provided to that vlan. For example, I'll dump all IOT crap onto a vlan that doesn't have internet access.
I'm still not 100% sure it will work (the hardware still hasn't arrived). But finally, to answer your question: "Yes!"
Holy crap, give me official hardware. I installed DD-WRT on my linsys router. It's been so long that I don't remember exact details, but the process was INTIMIDATING. I felt like I had to download a blob from a website that wasn't the official website (ie: I seem to recall different people building DD-WRT for different hardware). I also recall some features not being available on some hardware.
Give me the hardware that is sold by the people that work on the project!
I want some reassurance that I have the "most supported hardware", so I don't have to go through huge feature matrices to see if my hardware supports feature X.
I want headroom to install new packages. I don't want to have so little space that I need to remove one package to install another.
And finally, I want the people writing the software to GET PAID, because I want it to still be around... and being actively developed 10 years from now.
PS:
I initially wanted to get a consumer grade switch, but my network operator friends told me that was a terrible idea... and that I should get a use Cisco switch on Ebay. Cisco is probably great and network operators love it... but holy crap... trying to figure out what switch to buy is an enormous pain in the a$$. I pushed my friends, they relented and said: "Mikrotik is also great". I went to their website. 1000 times better than Cisco's; their switches were cheaper. I didn't have to "call for a quote" or scour Ebay. I haven't turned it on yet, but the buying experience was so much better.
My idea is one step further: selling the device with various ad-blocking and user-selectable tiers of security configuration included. Stop your devices spying on you, detect/notify if you have any infected devices on your network. That kind of thing.
Similarly though, there's limited appeal to those who aren't already capable of setting it up themselves.
I'm still slowly pursuing this because I believe in it, whether it's profitable or not.
ISPs would have been able to do this kind of thing since forever but, strangely, I don't see it advertised as a potential value-add at all. Had ISP's commonly taken up such a mantle, players like NextDNS probably would be less necessary.
I want it, in the same way I want a laptop with Linux. I can install it myself, and I already have done, but I wish the option was viable for most others, so that more of the market is open source.
For routers, the only realistic way that can happen is by getting some big vendor to adopt ddwrt or openwrt to offload (some of) the job of writing the firmware. And even then, most people use their ISP provided router. A niche vendor supplying preflashed routers isn't going to make a dent.
The OpenWrt One is really not a great piece of hardware. No 6GHz, and only two Ethernet ports, one of which is only 1Gbit. The latest GL.iNet products are apparently better, but also apparently don't run stock OpenWrt, only a fork of it. In other words, there's still plenty of room in the market for good routers with open-source firmware.
I used to use dd-wrt, but I later settled on ASUS routers, and installing "ASUS Merlin" firmware on them.
I find ASUS hardware high quality in general. And using an open-source project like ASUS Merlin means the pain-points and limitations that I would face with stock firmware have been resolved to (at least to satisfactory extent) when I need reach for the hacker type configurations.
Same journey for me. Merlin does everything I need, and it's actively developed. They drop support for older devices too quickly, but everyone in the software industry seems to drop older devices as soon as new ones hit the market so they're no worse.
Wouldn’t trust it at this point … but what I would trust is a blank router that has a GitHub repo with a containerized build that I could run on my own machine and something ai ish that lets me flash it :)
Would be legit to be able to have an Llm do a source audit before installing …. Not perfect but damn sure better than nothing
I don't think it will work as a business. The people who want dd-wrt will just install it themselves, not pay additional for it to already be installed. However, I do think you may be able to sell an ad-blocking router with ad-blocking already installed. I think people may consider that enough of a feature to pay for.
Agree - the firmware is never really a selling point.
But a shop built around routers could have a few angles:
1) Privacy/ ad-protection native (as you say)
2) High security and performance (fully tuned DD-WRT). Even solving bufferbloat for end users would be amazing - the world is barely catching up on that.
3) Good software add-ons that aren't proprietary junk. Asset management/upgrade, sign-in/landing pages, monitoring and trafffic shaping that holds up, etc.
Bunlding FOSS to solve these problems well, even on some else's hardware, does seem like work, and work can be charged for.
Back in the day I probably modded over 100 consoles for people, Xbox, Wii, DS, Switch, PS3.... I can't say that even once the person cared about hearing what XBMC was and all the things it could theoretically do. They just cared about being able to play/watch things with the press of the button without having to know any of the tech aspects.
Anyone I knew that could mod consoles just did it themselves.
There are some Chinese companies making more open router dev boards like Banana Pi R4. You can install openwrt out of the box. But generally, the SoCs that power the current generation of routers are locked down / highly proprietary (and always have been). It's the chips, not the boards, which matter most.
I just bought a used Extreme Networks AP that shipped with OpenWRT installed. I appreciated the convenience of something that was partly done before I got it.
It's currently serving as a wireless bridge client for a network of 10 IP cameras.
You need to remind yourself that the overwhelming majority of populace are not HN users. Most just want a cheap "internet box" that gives them WiFi. If any had interest in going deeper into networking, they would build a router themselves. But if you had some extra unique features on top of DD-WRT, that might turn a few heads. I do recall Tomaz Zaman on Youtube building their own router completely from scratch - not saying it's 100% what you plan on doing, just a reference point for you to look at.
I'd be happy to be proven wrong, but I think that routers are a pretty geeky thing that most people don't want to hear about. I had offered to buy and set up a pfsense router for my parents for a few years ago and they were decidedly not interested, even after I tried explaining the merits of it. Pretty much anyone who is going to be interested in DD-WRT is going to be someone who can set it up themselves.
pfsense can sell for a relatively high price, I think, because they market themselves more towards businesses and big corporations.
Interesting related question -- I recently inherited several WiFI AP/Routers that are openwrt or DDWRT compatible. Are there any packages that folks are working on, or know of that can centrally manage a fleet of them?
If there wasn't, I was going to use this as a project to explore vibecoding...
Alternately, what's the problem you're trying to solve? Who are your potential customers? Why do existing options in the market not address their needs?
I used to use pfsense and openwrt and stuff but now with Claude I just use a custom Linux distribution running on a dell 2u. That being said I have 25 gbps of internet across 5 internet providers (puerto Rico) and that plugs into my internal home network running at 2x 25 gbps . So for savings it’s like two quad 10 gbps cards. I’ve found substantial speed advantages via consumer hardware considering the cross sectional bandwidth is like 70 gbps
Thinkpenguin used to sell Rosewill routers that came with a particular Linux installed, but their value add was no proprietary blobs, everything open source and FSF certified IIRC.
As the other commenter said - but if you loved IOS before it was iOS you’ll find routeros comfortable if different, if you like rc.d you’ll like DD-WRT.
they're entirely different beasts. dd-wrt is more or less a normal linux distro that targets embedded devices. it has a "unified config" that abstracts away configs for many packages, but those abstractions are leaky. when you log in by ssh, you're using a shell and editor to edit config files.
compared with RouterOS where the Linux bits are almost completely hidden behind the proprietary config engine (and the proprietary cli and webuis that power that config engine). for the most part with routeros, you'd be hard pressed to know that you're even on a unix let alone linux.
I used to use DD-WRT, and Tomato, and Shibby's mod of Tomato, and Advanced Tomato, and other stuff. Somewhere, I'm sure I still have a WRT54GS that I hacked ~20 years ago to accept SD cards. It was a fun time in using inexpensive hardware in unintended ways.
At one point, and I don't remember exactly when, I just started using OpenWRT instead. It wasn't always the case, but it presents a very usable GUI straight away these days and it has a ton of flexibility for getting creative later.
At home I run it on a Pi4 that I bought for the purpose. It keeps up with my 500/20Mbps DOCSIS internet very well indeed. I've used it with a USB NIC to get dedicated ports, and also with VLANs and a managed switch instead. I just download and flash the card, plug stuff in, and configure it. No real issues -- for years, now. (Wireless is provided by Mikrotik access points.)
When something faster happens in my neighborhood (which may be very soon; I had a very brief chat with a dude whose fiber splicing trailer was parked across the street just yesterday), I'll probably want to move to something more capable.
That could be in the form of faster Pi, or an old PC running OPNsense -- or even stick with OpenWRT. No big deal.
If I really wanted a tidier package for light-weight travel or something, then I guess I'd pick something appropriate from glinet and put an official OpenWRT image on it.
For heavier-travel, I've got a kit with a Pi4, a managed PoE switch, and a backup Mikrotik box (that can be a switch or a router; it runs OpenWRT as well and the normal config is that it just provides more switch ports), and all this stuff is mounted onto a 1U rack shelf that is in-turn inside of a road case. It's meant to be physically durable and to include enough gear that if any part of it dies then I can replace that functionality Right Now without spending time finding parts in the middle of nowhere.
So, no: I would not buy one that was prefabulated. It wouldn't scratch my itch.
---
For everyone else? Honestly, the regular folks I know who ask me questions about networking aren't into that stuff at all or they wouldn't be asking. They don't care about ultimate speeds, or latency under load, or any of those things. They don't care about running Internet services from their network, or services on their local network, and probably don't even have a printer to abuse if something goes awry. They're also not interested in exploring the bowels of their home to install cabling for PoE access points.
They just want decent-enough wifi coverage that they don't have to think about it, and then: They want to succeed at not thinking about it.
So for those folks, I've come to recommend proprietary multi-node mesh systems. It doesn't really matter to me which one it is, or how terrible some aspect or other is: They all tend to check the right boxes, they update themselves, and then: Nobody thinks about them.
IMHO, those who want a router with open-source firmware are going to have the technical knowledge to do the finding and flashing themselves, by virtue of being embedded in tech deeply enough to recognize the value of an open-source firmware in the first place.
Those who look at you blankly when you mention open-source router firmware aren’t likely going to become customers.
You would be surprised at how many people that know enough to be curious but are not ready to jump straight into flashing custom firmware yet. I've seen people sell pre-flashed wired and wireless routers like this for years on platforms like EBay. I think there's already a niche there, even if it's small.
I'm not sure how approachable tools like Claude Code have made this for people though. If I was just getting started, I would probably just have the tool do it for me.
I know how to flash firmware, but I'd still rather buy routers that have open-source firmware pre-flashed and tested by the vendor. This is simply because I've often run into issues with OpenWrt. I once bought a bunch of Archer C7s because it was described as a good router for OpenWrt, only to discover dmesg full of crashes from the proprietary wireless firmware running on the 5Ghz chip. In another case, I learned long after installing OpenWrt that the performance was much worse than stock firmware because OpenWrt didn't support hardware routing offload.
Wow, the timing of this question is eerie. Just last week, I got tired of talking about segmenting my network but never doing it. So I did some research, asked some friends, and settled on the following:
* An Opnsense firewall (purchased from Deciso; ie: "official" hardware)
* An OpenWRT One (ie: "official" hardware) to be used as an access point
* A Microtik switch (SW OS, not Router OS)
My plan is to create multiple SSIDs, have each one on a different vlan, and then control services provided to that vlan. For example, I'll dump all IOT crap onto a vlan that doesn't have internet access.
I'm still not 100% sure it will work (the hardware still hasn't arrived). But finally, to answer your question: "Yes!"
Holy crap, give me official hardware. I installed DD-WRT on my linsys router. It's been so long that I don't remember exact details, but the process was INTIMIDATING. I felt like I had to download a blob from a website that wasn't the official website (ie: I seem to recall different people building DD-WRT for different hardware). I also recall some features not being available on some hardware.
Give me the hardware that is sold by the people that work on the project!
I want some reassurance that I have the "most supported hardware", so I don't have to go through huge feature matrices to see if my hardware supports feature X.
I want headroom to install new packages. I don't want to have so little space that I need to remove one package to install another.
And finally, I want the people writing the software to GET PAID, because I want it to still be around... and being actively developed 10 years from now.
PS:
I initially wanted to get a consumer grade switch, but my network operator friends told me that was a terrible idea... and that I should get a use Cisco switch on Ebay. Cisco is probably great and network operators love it... but holy crap... trying to figure out what switch to buy is an enormous pain in the a$$. I pushed my friends, they relented and said: "Mikrotik is also great". I went to their website. 1000 times better than Cisco's; their switches were cheaper. I didn't have to "call for a quote" or scour Ebay. I haven't turned it on yet, but the buying experience was so much better.
My idea is one step further: selling the device with various ad-blocking and user-selectable tiers of security configuration included. Stop your devices spying on you, detect/notify if you have any infected devices on your network. That kind of thing.
Similarly though, there's limited appeal to those who aren't already capable of setting it up themselves.
I'm still slowly pursuing this because I believe in it, whether it's profitable or not.
Edited to add: Part of what I'm setting up: https://lists.uninvitedactivity.com/DNS/, a vague explainer here: https://news.ycombinator.com/item?id=49990394
nextdns is in a perfect position to do this...
They can do part of it, yes.
ISPs would have been able to do this kind of thing since forever but, strangely, I don't see it advertised as a potential value-add at all. Had ISP's commonly taken up such a mantle, players like NextDNS probably would be less necessary.
I want it, in the same way I want a laptop with Linux. I can install it myself, and I already have done, but I wish the option was viable for most others, so that more of the market is open source.
For routers, the only realistic way that can happen is by getting some big vendor to adopt ddwrt or openwrt to offload (some of) the job of writing the firmware. And even then, most people use their ISP provided router. A niche vendor supplying preflashed routers isn't going to make a dent.
The OpenWrt One is really not a great piece of hardware. No 6GHz, and only two Ethernet ports, one of which is only 1Gbit. The latest GL.iNet products are apparently better, but also apparently don't run stock OpenWrt, only a fork of it. In other words, there's still plenty of room in the market for good routers with open-source firmware.
No, I want a router with OpenWrt pre-installed.
So I buy GL.iNet routers, which come with OpenWrt pre-installed.
Janky version though? My comment a month ago: https://news.ycombinator.com/item?id=49494259
I used to use dd-wrt, but I later settled on ASUS routers, and installing "ASUS Merlin" firmware on them.
I find ASUS hardware high quality in general. And using an open-source project like ASUS Merlin means the pain-points and limitations that I would face with stock firmware have been resolved to (at least to satisfactory extent) when I need reach for the hacker type configurations.
Same journey for me. Merlin does everything I need, and it's actively developed. They drop support for older devices too quickly, but everyone in the software industry seems to drop older devices as soon as new ones hit the market so they're no worse.
Wouldn’t trust it at this point … but what I would trust is a blank router that has a GitHub repo with a containerized build that I could run on my own machine and something ai ish that lets me flash it :)
Would be legit to be able to have an Llm do a source audit before installing …. Not perfect but damn sure better than nothing
I don't think it will work as a business. The people who want dd-wrt will just install it themselves, not pay additional for it to already be installed. However, I do think you may be able to sell an ad-blocking router with ad-blocking already installed. I think people may consider that enough of a feature to pay for.
Agree - the firmware is never really a selling point. But a shop built around routers could have a few angles:
1) Privacy/ ad-protection native (as you say)
2) High security and performance (fully tuned DD-WRT). Even solving bufferbloat for end users would be amazing - the world is barely catching up on that.
3) Good software add-ons that aren't proprietary junk. Asset management/upgrade, sign-in/landing pages, monitoring and trafffic shaping that holds up, etc.
Bunlding FOSS to solve these problems well, even on some else's hardware, does seem like work, and work can be charged for.
I think the comment above is the winner here.
Back in the day I probably modded over 100 consoles for people, Xbox, Wii, DS, Switch, PS3.... I can't say that even once the person cared about hearing what XBMC was and all the things it could theoretically do. They just cared about being able to play/watch things with the press of the button without having to know any of the tech aspects.
Anyone I knew that could mod consoles just did it themselves.
Many stock Firmware is just OpenWRT with fancy interface. I remember Asus being one.
Well, I just bought a:
https://www.gl-inet.com/en-de/products/gl-be14000
so.. yes? I haven't gotten around to flashing stock openwrt on it - but I probably will at some point - seems to be supported now?
https://forum.gl-inet.com/t/flint-4-openwrt-vanilla/71383/10
I think it would be difficult to compete with existing offerings - even though they are quite few.
There are some Chinese companies making more open router dev boards like Banana Pi R4. You can install openwrt out of the box. But generally, the SoCs that power the current generation of routers are locked down / highly proprietary (and always have been). It's the chips, not the boards, which matter most.
I just bought a used Extreme Networks AP that shipped with OpenWRT installed. I appreciated the convenience of something that was partly done before I got it.
It's currently serving as a wireless bridge client for a network of 10 IP cameras.
maybe preinstalled but easily able to overwrite with a downloaded version from dd-wrt as no one should trust preinstalled firmware on these devices.
You need to remind yourself that the overwhelming majority of populace are not HN users. Most just want a cheap "internet box" that gives them WiFi. If any had interest in going deeper into networking, they would build a router themselves. But if you had some extra unique features on top of DD-WRT, that might turn a few heads. I do recall Tomaz Zaman on Youtube building their own router completely from scratch - not saying it's 100% what you plan on doing, just a reference point for you to look at.
> So, do you actually want a router that you can buy with DD-WRT pre-installed?
No, I'd rather flash it myself and use OpenWrt instead of DD-WRT.
Availability of an OpenWrt port is the first thing I check when looking for network hardware :)
I'd be happy to be proven wrong, but I think that routers are a pretty geeky thing that most people don't want to hear about. I had offered to buy and set up a pfsense router for my parents for a few years ago and they were decidedly not interested, even after I tried explaining the merits of it. Pretty much anyone who is going to be interested in DD-WRT is going to be someone who can set it up themselves.
pfsense can sell for a relatively high price, I think, because they market themselves more towards businesses and big corporations.
Normies would rather just use the router that their ISP provides, or get a Google / Apple mesh network.
Honestly you often don’t even have a choice they don’t even give you a modem that does ppoe pass through or bridge mode.
DD-WRT isn't open-source though. OpenWRT is.
What part of it isn't open source?
DD-WRT specifically includes drivers/firmware blobs that OpenWRT can't/doesn't. Mostly broadcom stuff afaik.
Interesting related question -- I recently inherited several WiFI AP/Routers that are openwrt or DDWRT compatible. Are there any packages that folks are working on, or know of that can centrally manage a fleet of them?
If there wasn't, I was going to use this as a project to explore vibecoding...
Yes, or open Wrt
Glinet routers are already this.
Buy https://www.gl-inet.com/en-us/products/gl-mt3600be and move on with your life.
Alternately, what's the problem you're trying to solve? Who are your potential customers? Why do existing options in the market not address their needs?
I used to use pfsense and openwrt and stuff but now with Claude I just use a custom Linux distribution running on a dell 2u. That being said I have 25 gbps of internet across 5 internet providers (puerto Rico) and that plugs into my internal home network running at 2x 25 gbps . So for savings it’s like two quad 10 gbps cards. I’ve found substantial speed advantages via consumer hardware considering the cross sectional bandwidth is like 70 gbps
I got this idea too. To sell the openwrt preinstalled routers.
Thinkpenguin used to sell Rosewill routers that came with a particular Linux installed, but their value add was no proprietary blobs, everything open source and FSF certified IIRC.
How does DD-WRT compare to RouterOS?
As the other commenter said - but if you loved IOS before it was iOS you’ll find routeros comfortable if different, if you like rc.d you’ll like DD-WRT.
they're entirely different beasts. dd-wrt is more or less a normal linux distro that targets embedded devices. it has a "unified config" that abstracts away configs for many packages, but those abstractions are leaky. when you log in by ssh, you're using a shell and editor to edit config files.
compared with RouterOS where the Linux bits are almost completely hidden behind the proprietary config engine (and the proprietary cli and webuis that power that config engine). for the most part with routeros, you'd be hard pressed to know that you're even on a unix let alone linux.
I used to use DD-WRT, and Tomato, and Shibby's mod of Tomato, and Advanced Tomato, and other stuff. Somewhere, I'm sure I still have a WRT54GS that I hacked ~20 years ago to accept SD cards. It was a fun time in using inexpensive hardware in unintended ways.
At one point, and I don't remember exactly when, I just started using OpenWRT instead. It wasn't always the case, but it presents a very usable GUI straight away these days and it has a ton of flexibility for getting creative later.
At home I run it on a Pi4 that I bought for the purpose. It keeps up with my 500/20Mbps DOCSIS internet very well indeed. I've used it with a USB NIC to get dedicated ports, and also with VLANs and a managed switch instead. I just download and flash the card, plug stuff in, and configure it. No real issues -- for years, now. (Wireless is provided by Mikrotik access points.)
When something faster happens in my neighborhood (which may be very soon; I had a very brief chat with a dude whose fiber splicing trailer was parked across the street just yesterday), I'll probably want to move to something more capable.
That could be in the form of faster Pi, or an old PC running OPNsense -- or even stick with OpenWRT. No big deal.
If I really wanted a tidier package for light-weight travel or something, then I guess I'd pick something appropriate from glinet and put an official OpenWRT image on it.
For heavier-travel, I've got a kit with a Pi4, a managed PoE switch, and a backup Mikrotik box (that can be a switch or a router; it runs OpenWRT as well and the normal config is that it just provides more switch ports), and all this stuff is mounted onto a 1U rack shelf that is in-turn inside of a road case. It's meant to be physically durable and to include enough gear that if any part of it dies then I can replace that functionality Right Now without spending time finding parts in the middle of nowhere.
So, no: I would not buy one that was prefabulated. It wouldn't scratch my itch.
---
For everyone else? Honestly, the regular folks I know who ask me questions about networking aren't into that stuff at all or they wouldn't be asking. They don't care about ultimate speeds, or latency under load, or any of those things. They don't care about running Internet services from their network, or services on their local network, and probably don't even have a printer to abuse if something goes awry. They're also not interested in exploring the bowels of their home to install cabling for PoE access points.
They just want decent-enough wifi coverage that they don't have to think about it, and then: They want to succeed at not thinking about it.
So for those folks, I've come to recommend proprietary multi-node mesh systems. It doesn't really matter to me which one it is, or how terrible some aspect or other is: They all tend to check the right boxes, they update themselves, and then: Nobody thinks about them.
IMHO, those who want a router with open-source firmware are going to have the technical knowledge to do the finding and flashing themselves, by virtue of being embedded in tech deeply enough to recognize the value of an open-source firmware in the first place.
Those who look at you blankly when you mention open-source router firmware aren’t likely going to become customers.
You would be surprised at how many people that know enough to be curious but are not ready to jump straight into flashing custom firmware yet. I've seen people sell pre-flashed wired and wireless routers like this for years on platforms like EBay. I think there's already a niche there, even if it's small.
I'm not sure how approachable tools like Claude Code have made this for people though. If I was just getting started, I would probably just have the tool do it for me.
I know how to flash firmware, but I'd still rather buy routers that have open-source firmware pre-flashed and tested by the vendor. This is simply because I've often run into issues with OpenWrt. I once bought a bunch of Archer C7s because it was described as a good router for OpenWrt, only to discover dmesg full of crashes from the proprietary wireless firmware running on the 5Ghz chip. In another case, I learned long after installing OpenWrt that the performance was much worse than stock firmware because OpenWrt didn't support hardware routing offload.
Ddwrt is a joke today. I would pay to have it go away forever or finally become mature and not be forever in beta.