Selfhosted

Tl;dr

Very new to home networking, but planning to get some hardware to run OPNsense bare metal to replace my ISP all-in-one.

Requirements: AES-NI support, Intel NICs, supports coreboot, can handle Wireguard both to connect out to my VPN provider and also to allow me to connect back to services at home

Nice to haves: 2.5+ Gbps NICs, resources to support an IPS like Snort or Suricata.

Questions:

• Are people still using cheap AliExpress hardware despite potential security risks?
• If so, do you reflash your firmware? Are you comfortable counting on a script like Flashli, or do you use something like SPI?
• Would you still reflash your firmware even from a more trusted vendor, like Protectli or Deciso?
• What is a reasonable amount to spend on reasonable router hardware?

Some Options I’ve Seen Recommended/Am Considering:

• Protectli Vault Pro VP2420-4 (but open to other Protectli suggestions)
• AliExpress N100/N305 machines (though of course with the aforementioned security concerns)
• Used Thinkcenter M720q (though not sure how the power efficiency compares)

Thanks so much to anyone who takes the time to post your thoughts, I’m extremely grateful!

Hi everyone,

Thanks so much again to those of you who left your thoughts on my thread a month or so ago. Progress on my NAS still continues at a glacial pace (mostly because I want ECC support and an iGPU that supports AV1 decoding on the same machine, but building around the W680 is a little pricey; in fact, might end up considering adding an A380 for AV1 support instead to open up some other options, but that’s a story for a different thread). But I am reaching out now because in the interim I’ve been trying to make progress on some more fundamental network infrastructure while I am figuring out plans for the bigger systems. Of course, even that turned into a bigger project than planned, which is why I am back to get some of your insights.

Just for folks who didn’t see my other thread, I am definitely a home networking noob generally, but am trying to build out my whole home network. In terms of the router hardware I am hoping to get, at minimum it would need AES-NI support and Intel NICs vs. Realtek, as well as support for coreboot for peace of mind (in an ideal world, even libreboot, but my understanding is basically no hardware released within a decade or more would allow that to run). At least 2.5 Gbps throughput would be nice, but not essential. Likely will be paired with a switch, so I’m also not overly concerned about port count (though maybe just for starting out 4 ports would be ideal and I can add in a PoE switch later).

In terms of planned use, I want to use Wireguard both to connect out to my VPN provider and also to allow me to connect back to services at home, as well as a few VLANs. Support for IPS like Snort or Suricata would be a plus, but it seems they can be resource intensive and I’m not currently thinking of them as a necessity.

A lot of resources I’ve seen suggested just grabbing a cheap machine off Amazon or AliExpress is the most cost-effective way to go, but it seems like there are some legitimate security concerns going that route. Are people still buying some of the cheaper AliExpress (e.g. Qotom, Topton, Cwwk) N100/N305 machines for their routers, even with concerns about backdoors (like Horse Shell in TP-Link firmware)? Are you reflashing firmware if you do so (and if you are, are you doing it through SPI vs. a script like Flashli)?

I’m the furthest thing from an expert, but just from a bit of poking around it seemed like if one wanted to reflash firmware in a 0 trust way, it looks like you’d need to either use SPI or JTAG vs. trying to do it through a script (and of course you’d need to take into account whether Boot Guard is enabled).

Would you reserve this treatment just for no-name router brands or would you reflash firmware the same way if you bought from a more trustworthy source like Protectli or even Deciso? Personally, my threat model (just trying to take back some privacy and control over my tech and not trying to stand single-handedly against the NSA) and current (low) skill level make me think I should just opt for a Protectli box that I know will work with coreboot (like the VP2420-4) and then move on with my life, but spending $300-$400 on a router seems like a lot (and perhaps I am robbing myself of the joy of having to figure out how SPI works).

Thanks so much for your thoughts! I remain extremely grateful to have the opportunity to tap into all of your collective wisdom (and hopefully at least save myself a few lessons learned the hard way). As long as its not obnoxious, I am also happy to share my progress and learning as I go in case it can save some time for other folks just starting out. Thanks again!