Serious Discussion What Routers are the most secure?

[Azazel]

That have lowest attack surface (secure software implementation - memory safety - not many unneeded functionalities) and many years of security updates.

 

[Shadowra]

BitDefender and F-Secure used to offer a router with a kind of IDS, but I don't know if that's still the case...

Personally, I have an Asus router with security provided by Trend Micro.
I wanted a UDM before, but the prices.... :/

 

[blackice]

Any ASUS with Merlin firmware can be a good start.

 

[Jonny Quest]

Cool, interesting
About | Asuswrt-Merlin

Screenshots | Asuswrt-Merlin

www.asuswrt-merlin.net

 

[Templarware]

Any ASUS with Merlin firmware can be a good start.

The ASUS firmware with AiProtection isn't enough? Merlin releases will always lag behind Asus firmware, when there's a critical security bugs that need to be fixed.

 

[blackice]

If it’s a severe bug with a risk he generally implements it fairly quickly. Sometimes the fixes they implement are already in his code. I find Merlin helpful for the DNS Director. Otherwise I don’t notice much difference between the two. Some people say Merlin is more stable. If you aren’t using the advanced features he adds then stock is the way to go.

 

[I Walk MY Way]

I was all for ASUS with Merlin
Now I use Netgear
Had ASUS die on me so now it's Netgear NIGHTHAWK for its lifetime.

 

[jetman]

Routers which are marketed to businesses are probably the most secure because they tend to have more years of firmware updates. Draytek would be an example. They do tend to be more expensive however.

Alternatively, you could protect your router with a hardware firewall. Firewalla products are made for home users and seem to get positive reviews.

 

[HarborFront]

Routers which are marketed to businesses are probably the most secure because they tend to have more years of firmware updates. Draytek would be an example. They do tend to be more expensive however.

Alternatively, you could protect your router with a hardware firewall. Firewalla products are made for home users and seem to get positive reviews.

I believe these hardware firewalls (with malware and IoT protection) are connected using LAN cables. Do they have 10Gbps LAN ports? Otherwise they'll be bottleneck in my 10Gbps setup

 

[Sandbox Breaker]

This is a really hard question. I guess the one that is hardened the most, has pen tested firmware, updates frequently. Alot of factors here to consider.

 

[Bot]

That have lowest attack surface (secure software implementation - memory safety - not many unneeded functionalities) and many years of security updates.

When looking for the most secure routers, you want to consider those that have a strong reputation for security, a commitment to regular firmware updates, and a minimal attack surface. As of my last knowledge update in April 2023, here are some factors to consider and a few router manufacturers that are generally recognized for their security commitments:


Factors to Consider for a Secure Router:

1. Regular Firmware Updates: Manufacturers should provide regular updates to address vulnerabilities and improve security features.
2. Built-in Security Features: Look for routers with advanced security features such as automatic updates, firewall, intrusion prevention systems, and the ability to segment networks (guest networks).
3. Open Source Firmware Support: Some routers support open-source firmware like DD-WRT, OpenWrt, or Tomato, which often receive updates and patches from the community and can be more secure if properly managed.
4. Minimal Bloatware: Routers with fewer unnecessary features have a smaller attack surface.
5. Hardware Security: Consider routers with hardware-based security features like Trusted Platform Modules (TPMs).
6. Memory Safety: Routers built with attention to memory safety to prevent buffer overflows and similar vulnerabilities.

Router Manufacturers with a Good Track Record for Security:

1. Asus: Known for routers that support AiProtection (powered by Trend Micro), which offers built-in security features and regular updates. Asus also allows for third-party firmware installations for users who prefer that.
2. Netgear: Offers a line of routers with Netgear Armor, a security suite powered by Bitdefender. They also provide regular firmware updates.
3. Google Nest Wifi: Google provides security updates automatically to their router devices, and their system is designed with multiple layers of security.
4. Synology: While better known for their NAS products, Synology routers have a good reputation for security and receive regular software updates.
5. Cisco: Offers a range of routers that are generally aimed at enterprise customers but are known for their security features and robust firmware updates.
6. Ubiquiti Networks: Their UniFi series is designed with advanced security features and is suitable for both businesses and tech-savvy home users.

Open Source Router Firmware Options:

1. DD-WRT
2. OpenWrt
3. Tomato

It's worth mentioning that the security landscape is always evolving, and what may be considered secure today could be vulnerable tomorrow. Therefore, no matter which router you choose, it's crucial to stay informed about the latest security updates and best practices. Always register your product to receive the latest firmware updates and security advisories from the manufacturer.

 

[jetman]

I believe these hardware firewalls (with malware and IoT protection) are connected using LAN cables. Do they have 10Gbps LAN ports? Otherwise they'll be bottleneck in my 10Gbps setup

The top Firewalla product appears to be the Gold Plus model with 4 x 2.5GB ports. That may not suit your particular circumstances.
I don't know much about other vendors.

Firewalla Gold Plus: 2.5G Cyber Security Firewall & Router Protecting Your Family and Business (Ships Worldwide)

Powered by The Firewalla Security Stack Deep Insight helps you see the network at up to 5+ Gigabits per second with 4x 2.5Gbit Interfaces. Control your network with intrusion prevention (IPS) and network segmentation, adding virtual walls around your connected devices and lock them down. Active...

firewalla.com

 

[jetman]

And while I am here, the original poster could perhaps check out the Zyxel SCR 50AXE security router and the Draytek Vigor 2866ax

 

[simmerskool]

Router Manufacturers with a Good Track Record for Security:

1. Asus: Known for routers that support AiProtection (powered by Trend Micro), which offers built-in security features and regular updates. Asus also allows for third-party firmware installations for users who prefer that.
2. Netgear: Offers a line of routers with Netgear Armor, a security suite powered by Bitdefender. They also provide regular firmware updates.
3. Google Nest Wifi: Google provides security updates automatically to their router devices, and their system is designed with multiple layers of security.
4. Synology: While better known for their NAS products, Synology routers have a good reputation for security and receive regular software updates.
5. Cisco: Offers a range of routers that are generally aimed at enterprise customers but are known for their security features and robust firmware updates.
6. Ubiquiti Networks: Their UniFi series is designed with advanced security features and is suitable for both businesses and tech-savvy home users.

@Bot got it right including Ubiquity (& Unifi is about half the cost of Cisco).

 

[Nevi]

Next week I get my new router. I'm tired of wi-fi, but although I used wi-fi would it be very different speeds this one have. I get 1000/1000mb. And to the half price of what my old Yousee router, that give me around 600 down. I have just started Express VPN, and it keep surpricing me. It's got totally same speeds as without VPN. So I think the expensive price is worth it.

Icotera i4882 WiFi 6-router​

It's not just the design that impresses. For our new WiFi 6 router has won Best in tests measured in both streaming, gaming and online meetings. The test shows that with our WiFi 6 router you can expect significantly increased speeds and that the router has the best range on the market. With Telenor's WiFi 6 router, you get the best experience with streaming, gaming and online meetings. It supports speeds of up to 2500 mbit, so there is no doubt that our router is the hotspot of the future in the home.

 

[Brahman]

I purchased a Mikrotik hAp ac router in the year 2019 or so and I got a software update almost every month in the past 5 years. So you can add mikrotik routers to the list of safe devices when it comes to security updates.

 

[Zero Knowledge]

It's less about attack surface for routers because all hardware has bugs. it's more about how long it takes for vendors to patch bugs/exploits. ASUS, Neatgear, Mikrotik are all good choices for consumer devices with frequent security patches/updates. Ubiquiti is good value too but has had a few hum dinger bugs lately like all enterprise gear.

If you choose enterprise level gear like Cisco, Palo Alto, Juniper or Fortinet you probably have too much money because subscriptions every year will drain you bank account. Enterprise doesn't guarantee you security, they have just as many bugs/exploits/attacks like consumer devices.

Enterprise is nice too fool around with in your home lab but from experience consumer devices protect the home network just as good as the Cisco's etc for much less money.

 

[jetman]

I believe these hardware firewalls (with malware and IoT protection) are connected using LAN cables. Do they have 10Gbps LAN ports? Otherwise they'll be bottleneck in my 10Gbps setup

Firewalla is releasing a 10Gbps version..

Firewalla Gold Pro: 10G Cyber Security Firewall & Router Protecting Your Family and Business (Pre-Sale)

Powered by The Firewalla Security Stack Deep Insight helps you see the network at up to 10+ Gigabits per second with 2x 10Gbit Interfaces and 2x 2.5Gbit interfaces. Control your network with intrusion prevention (IPS) and network segmentation, adding virtual walls around your connected devices...

firewalla.com

 

[Practical Response]

It's less about attack surface for routers because all hardware has bugs. it's more about how long it takes for vendors to patch bugs/exploits.

The former is confusing as it's exactly what it's about as the latter which is more on point, is exactly what negates that.

 

[HarborFront]

Firewalla is releasing a 10Gbps version..

Firewalla Gold Pro: 10G Cyber Security Firewall & Router Protecting Your Family and Business (Pre-Sale)

Powered by The Firewalla Security Stack Deep Insight helps you see the network at up to 10+ Gigabits per second with 2x 10Gbit Interfaces and 2x 2.5Gbit interfaces. Control your network with intrusion prevention (IPS) and network segmentation, adding virtual walls around your connected devices...

firewalla.com

But it has no malware protection. To do that means it'll need to tie up with a large AV/AM company and likely to provide a subscription service

No Wifi support. Can overcome with a travel router like the Beryl AX (GL-MT3000) from below. Speed is a bit low so might not suitable for whole house use unless you have a couple of them

GL-MT3000 / Beryl AX

Beryl AX (GL-MT3000) is an OpenWrt multi-gigabit Wi-Fi 6 wireless router for frequent travelers and remote workforces to protect their digital assets and footprints online.

www.gl-inet.com

It can protect IoT devices through creating VLAN and setting up a network segment for the IoT devices

2Gb WireGuard.....would this be a bottleneck for VPN? 10Gb would be better.

Its supports 3rd-party VPN service. That's great for now one can ride upon those 3rd-party VPN 10Gb servers

From its website OOKLA Speedtest