Configuring a router for security can only take you so far. You also need to chose the right router initially.

Many people use the device given them by their Internet Service Provider (ISP), which I think is the least secure option for a number of reasons. Understandably, many non-techies prefer this because they can call their ISP when things go wrong.

Slightly more secure, would be a consumer router, but that is not the best option either. To bolster this opinion, see the page on router bugs. It is not an exhaustive list of bugs, but it illustrates the poor state of software on consumer routers.

As for high end routers, such as Fortinet, Sonicwall, Cisco and Aruba, they have had more than their fair share of critical security flaws.

CUT TO THE CHASE: I recommend Peplink routers. In the 12 years I have followed Peplink and routers in general, Peplink has not had one critical security flaw. No headline grabbing bugs. Their software has bugs, of course, but never the critical security flaws that everyone else has. Peplink routers are business/enterprise class, yet still reasonably easy to configure. My only relationship with Peplink is that of a customer.

I used to recommend the $200 US Pepwave Surf SOHO router, which was their cheapest Wi-Fi router, but production of it stopped in October 2022. During 2023, the cheapest Peplink router (with Wi-Fi) was the Balance 20x for $450 US. As of February 2024, the cheapest Peplink model (with Wi-Fi) is the newly introduced B One for $300. That's what I would suggest. Like the Surf SOHO, it is the cheapest Peplink router.

The Peplink user interface is, in my opinion, simpler than that of other techie oriented routers. You can see for yourself, by kicking the tires of a much higher end Peplink router here. This site also offers a peek at their user interface, see the page on initial configuration of the Surf SOHO.

Quick takes:

• Peplink is my first choice
• A low end secure option is pcWRT. More below.
• pfSense should be secure, but the user interface may be a bit too techie for many people. Also, it is not available in a box with Wi-Fi, so you have to add your own Access Points and that means two user interfaces to deal with. Lots of techies use pfSense but this March 2021 article by Jim Salter for Ars Technica has to make anyone wonder if the company behind it (Netgate) is really trustworthy. I have not used pfSense.
• If you want something free and open source, I have heard good things about OPNsense from a trusted source. I have not used it. It is said to be easier to use than pfSense, but still, the target audience is techies. For example, you can download it and install it on many computers, but just to download it requires a bit of techie know-how as there are many different editions. I am not aware of an on-line demo of the User Interface, so it is impossible to judge if the user interface is too "techie" for you. In May 2021,Lawrence Systems did a video comparing pfSense and OPNSense.
  The cheapest way to get a box with OPNsense pre-installed is to buy a small fan-less Protectli computer. Their marketing could not be worse, as their website hides the fact that they will pre-install OPNsense. They don't say it anywhere. And, when you start to order one of their computers, OPNsense is not shown as an option. But, after you configure a computer with sufficient RAM and hard drive space to run OPNsense, then, magically, the option to have it pre-installed appears. Their cheapest usable model is about $200 (as of March 2024) but that is with a single LAN port and no Wi-Fi. Gotcha: Protectli computers do not support on-board Wi-Fi when OPNsense is installed on them. So, like pfSense, you would need to add your own Access Point(s).
• Ubiquiti is not recommended. More on why below.
• My distaste for consumer routers means avoiding TP-Link, Netgear, D-Link, Belkin, Buffalo, Linksys and the like. That said, the best of the lot is probably Asus running Merlin firmware. Which Asus model? Eric/Merlin himself likes the RT-AX86U (new) and the RT-AC68U (old). See 2021 State of the router.
• Many people rave about Eero for its great Wi-Fi performance. However, Eero is owned by Amazon, and as far as I am concerned, that is a reason to avoid them. I would also avoid any router from Google for the same basic reason - the company wants to know (and does know) so much about us. Worse, I have used Google Wi-Fi and it stinks as a router, having nothing to do with security. Keep in mind that the router sees the unique MAC address of your devices which enables assorted tracking.
• Synology also has many great reviews, but I both hated it and found it not secure at all.
• There is every reason to expect the Turris Omnia to be very secure. However, I hated the user interface and found it very hard to use. It seemed like it was from a prior century.
• F-Secure used to sell a router called SENSE, that stressed security, but as of October 2020 it has been discontinued. Symantec also used to sell a secure router (called Core) but no more.
• Scalys in The Netherlands has a web page devoted to their Trustbox home router which is focused on security. It is not clear if the router is actually for sale. If the routers exist, there is a chance they are not made in China, but its just not clear from the lone web page. The firmware is based on OpenWRT.
• The Wire Cutter reviews everything. Do not take their advice on routers. They focus on speed, speed and speed; completely ignoring security. And, if the router is not sold at Best Buy, they never heard of it, which means they have not reviewed anything on my short list.

NOTE: Any router can only be made as secure as its included features allow. For a list of router security features see my Security Checklist.

NOTE: Buying a used router from a stranger (think eBay) can be dangerous, as the firmware may have been maliciously modified. To protect against that, download new firmware using a different router. If possible, switch the firmware entirely, that is, if it came with stock firmware, try switching to DD-WRT, OpenWRT or anything else. Asus owners can switch from Asus firmware to that offered by Merlin.

NOTE: Jim Salter is a trusted techie expert and in the September 12, 2024 episode of his 2.5 Admins podcast he recommended some routers. However, his focus IS NOT ON SECURITY. That said, he likes the Netgear Nighthawk line of routers and the professional level TP-Link Omada devices (which sort of requires a controller). He suggested avoiding the consumer level TP-Link Archer and Deco mesh devices.

What makes a router secure?

1. The lack of software bugs or, more importantly, the lack of big huge security flaws
2. The prompt fixing of bugs
3. Secure defaults
4. Securely configured (as seen on the home page of this site)
5. Can the router be used without an account from the hardware vendor? Without the cloud service from the hardware vendor? Privacy is one reason for this, but you also do not want to be dependent on a cloud service that might fail or get hacked.
6. Privacy - does the router spy on you? Does it send data to the hardware manufacturer?
7. Tech support that is competent and provided for a long time
8. Outbound firewall support

By "privacy" I am referring to a router not spying on you. In the old days, no routers spied on the network they governed. Now, this is getting harder and harder to find. It is now the rule, rather than the exception, that customers must have an account with the router manufacturer. If the router is in contact with a cloud service from the manufacturer, there is always the chance the someone from the manufacturer can get into the router. Plume is perhaps the ultimate example of monitoring your network and they are forming partnerships with ISPs.

Then too there is passive spying; many routers phone home with data about the activity on the LAN they control. The last router that I took a serious look at, the Synology RT2600ac was disgraceful in this respect. It phoned home to Synology all the time, there is no way to stop it and Synology can not be bothered documenting what data is being transferred or why. For details, in my Synology review see the section Spying On The Router. In March 2020, I confirmed my earlier tests that Peplink routers do not spy on you at all. You also do not need to have an account with Peplink to use their routers.

Cisco is perhaps the poster boy for Point 1, it seems as if new critical security flaws are found in Cisco router software every month. So many that I have given up even including them in the News page. And these are huge flaws, the type that let remote attackers take full control over vulnerable devices.

Initially, I did not include outbound firewall rules in this list. However, with the January 2020 release of the Cable Haunt vulnerability in Broadcom cable modems, it has become much more important. For my take on Cable Haunt see the Bugs page. In short, if a device on your LAN can access a vulnerable cable modem, then it can attack the modem. If the modem is part of a gateway (combination router/modem) that makes the danger even worse. In the US, we can not update the firmware on our cable modems, our ISP must do this. Since most ISPs are virtual monopolies, they have no motivation to bother with something that will cost them time and money and that few customers are aware of. So, this vulnerability is likely to remain with us for decades.

The only defense is blocking LAN side access to the modem (it is usually available at IP address 192.168.100.1). There are two ways to do this. The hard way is defining a custom route in the router, something many routers do not support. The easier way is to block IP address 192.168.100.1 with an outbound firewall rule. Again, many routers do not offer outbound firewall rules. The Pepwave Surf SOHO, that I recommend, does support outbound firewall rules and configuring it to block modem access looks like this. I blogged about this back in 2015: Talk to your modem and Using a router to block a modem.

The need for outbound firewall rules was again illustrated in November 2022 when cameras made by Eufy were found to be phoning home, despite assurances that all data was kept local. See Eufy caught lying about local-only security cameras with footage sent to cloud, accessible in unencrypted streams by Ben Schoon (Nov. 29, 2022). A router with outbound firewall rules can both detect and block devices that try to phone home. Peplink can even schedule firewall rules. My NAS is controlled by a scheduled firewall rule. It can only make outbound connections to the Internet during the half hour that it runs a scheduled task to make off-site backups. The rest of the time, a firewall rule blocks it from the Internet.

Then too, consider the many stories about how apps are spying on us by sending data to huge number of third party marketing companies. Here is one such report from January 2020. The report lists some of the common tracker domains used by the apps they examined: ads.mopub.com, sdk-android.ad.smaato.net, googleads.g.doubleclick.net, api.pubnative.net, my.mobfox.com and more. The only way to block apps from spying on you, at least at home, is to have a router than can block domains like this. The Pepwave Surf SOHO can block all access to one sub-domain, by setting DNS to an invalid IP address, or, block web access to an entire domain (all sub-domains) with its Content Blocking feature. Or, both.

Some people only trust Open Source router firmware. For example, at PrivacyTools.io, they recommend OpenWrt, pfSense and LibreCMC. However, they offer no explanation for why these three systems are more secure than anything else. I do not think that all open source is good and all closed source is bad.

Secure defaults are needed because most routers are owned by people with no understanding of networking and these people should be secure by default. UPnP is an excellent example, it is insecure and enabled by default on every consumer router. WPS should be disabled by default, or better yet, not even available. Wi-Fi encryption should default to WPA2-AES. Etc. etc.

On a related point, if you need to open a port, perhaps to allow for remote control, a router than can limit access to said port by source IP address is almost a necessity.

Three Governments Rate Security

In April 2023, I was made aware of the Cyber Security Agency of Singapore and their Cybersecurity Labelling Scheme (CLS). CLS rates assorted smart devices according to their levels of cybersecurity provisions. This lets consumers identify products with better cybersecurity. It is also a way that manufacturers stand out from their competitors and be incentivised to develop more secure products.

You can research the products they have rated here: Cybersecurity Labelling Scheme Product List. As of April 2023, they have rated 143 Wi-Fi routers, with Level 1 being the worst, and Level 4 being the best. They also show when tech support for the device ends. The only routers that scored the highest were a few from Asus. They have not reviewed any device from Peplink or Pepwave. They have only reviewed three mesh systems (all rated poorly).

Singapore has agreed with the Transport and Communications Agency of Finland (Traficom) to honor a similar system in Finland called the innish Cybersecurity Label.

And, Singapore has also agreed with the Federal Office for Information Security of Germany (BSI) to likewise honor Germany’s IT Security Label.

FYI: pcWRT

NOTE: I wrote the below not having used a pcWRT router. As of January 2022, I have started to test pcWRT router. Far from finished.

The pcWRT router was initially sold for its Parental Controls rather than security (the "pc" in the name is for Parental Control). That said, it has had many security features added since it was first released back in 2015. The system is based on OpenWRT and there is an online demo of the router interface.

Right off the bat, I like the fact that you do not need to have an account with pcWRT to use the router. You also do not need a mobile app, the router is configured with a web interface.

There is currently (January 2022) a single model that sells for $129. An older model with less horsepower has been discontinued. It has dual band Wifi AC (aka Wi-Fi 5) with 4 GB Ethernet LAN ports. The software is also supported on a handful of other routers such as the TP-Link Archer C7 (v2) and the Linksys WRT1900ACS. A LITE version of the firmware for use on other routers is free, the full featured firmware, (referred to as pcWRT Premium) for use on other routers, sells for $49 with a 90 day money back guarantee. Download their firmware at pcwrt.com/downloads.

Privacy is great, no account is needed with the vendor and they say the router does not phone home at all. Support for VPNs is excellent. As per this blog post, A router that talks three VPN protocols, pcWRT supports OpenVPN, IKEv2 and WireGuard, both as a server and a client.

pcWRT comes with 5 pre-configured VLANs. Each VLAN can be assigned to one or more LAN ports and one or two wireless networks. If you assign every VLAN to an SSID that transmits on both radio frequency bands, then it can create 5 SSIDs. If, you assign each VLAN to two SSIDs, one on each frequency band, then it can create 10 SSIDs. It can also send different VLANs through different VPN connections (or no VPN). Wow.

There is an option to "Enable WiFi client isolation" which prevents wireless devices on an SSID from communicating with each other. The availability of WiFi networks can be scheduled.

It also does ad blocking using the same technology as Pi-hole. To enable ad-blocking network-wide, just check "Enable Ad Block". You can enable it for some or all profiles. There is a white listing feature for the inevitable over-rides, such as when a website will not load without ads being displayed.

A number of DNS providers are pre-set, you can easily chose amongst them or specify anything of your choice. You have a lot of flexibility in controlling traffic: you can allow or block a URL, a subdomain, a domain, a certain port on a domain, a port, or a port for a specific protocol. More here: How to allow or block web sites on the router. Devices using the router can be assigned to profiles and each profile can use different DNS servers and have a custom black or white list of domains. It seems that you could define a profile for a child with a white list that only allows them access to a small number of approved domains. It can even block just a section of one website. They example they give is
http://www.yahoo.com/block/this/path
It logs the blocked domains and also has a summary report of blockage.

The router lets you create a backup of the current configuration to a file. You can be emailed when new firmware is available. Interesting blog from the company, How to use your router to block smart TV snooping talks about the VLAN feature and watching the domains a smart TV talks to and then limiting the domains it is allowed to communicate with. The routers offer their own, free DDNS service that provides you with a hostname on the pcwrt.net domain.

Like many other routers, it can block Pings from the WAN side. It also has a stealth mode and I am not clear what that is/does.

The website says nothing about who created the router, and there is no Contact Us page either. All communication is via a Forum. Documentation is mostly in the blog on the website. There is also a 5 page pcWRT Parental Control Router User's Guide. One Parental Control feature is the ability to block YouTube videos that are not child-safe. They have good release notes and a history of firmware releases.

Maybe GL.iNet

Another company to consider is GL.iNet. I have not used their products, but they are cheap and the company has a focus on security.

Their routers run OpenWRT and include an OpenVPN client, a WireGuard client, Tor and encrypted DNS from either Cloudflare or NextDNS. The Slate (GL-AR750S-Ext) was released in 2019 and sells for about $55 (as of Feb. 2021). The Beryl (GL-MT1300) is newer and sells for about $70. They have many other models too.

GL.iNet routers, on Android, are configured with the GL.iNet app. The app was analyzed by Exodus on Feb 13, 2020 (app version 1.0.17) and found to contain no trackers. Also, it only requested 3 Android permissions. As of March 2021, the latest version of the app is 1.0.23, released January 2021.

At these prices, we can't expect great speeds or for the routers to handle too many attached devices. As for VPN speeds, when running the OpenVPN client, the company says to expect about 20Mbps with each model. When running the WireGuard client, expect roughly 70Mbps with the Slate and 90Mbps with the Beryl. Rather than your main router, they may be a better fit for a secondary router.

Maybe Turris Shield? Maybe?

In September 2020, Turris released a new device, the Turris Shield. As I write this, very little is known about it, there are no reviews of the Shield and even the documentation page on the Turris website is skimpy. It is sold as a firewall rather than a router and is meant to sit between the modem and the router. People who have a single Internet device (a combination modem and router), can place the Shield behind it, rather than in front. This, however, will only protect Ethernet devices as the Shield does not do Wi-Fi. If nothing else, the Shield deserves a look because it is made in the Czech Republic rather than China.

On the upside, the software (TurrisOS based on OpenWRT) is open source and Turris says it self-updates, both the OS itself and updates to defend against new attacks. I am confused about the term "attack". Any router purchased at retail should have a firewall with no open WAN side ports and thus defend the LAN behind it. So the purpose of the Shield firewall is unclear to me. The Shield is described as a "unique firewall" and a "unique security system" but there is no explanation of what makes it unique. Turris says it respond to threats within seconds, but it is not clear to me what types of threats it is responding to or how it is responding.

Turris says that it can be used by non-technical of people, that all you need to do is pick a password and the device does everything else on its own. Too good to be true? Time will tell. It is administered via a web interface.

The Shield can be both an OpenVPN server and client. VPN servers in routers serve two purposes. One allows you to login to the device when you are traveling and use it as a free VPN to avoid paying for a commercial service such as ProtonVPN, Mullvad or TunnelBear. The available documentation does not say it can do this. The other purpose is to provide access to files and devices on the LAN when you are traveling. I would expect this to be blocked by any router as the router firewall would see this as an unsolicited incoming connection. Using the Shield as a VPN client puts all your eggs in one basket and gives you no flexibility. Individual devices can not be excluded from the VPN tunnel and if there is a problem with the VPN connection, all your devices are knocked off-line. If the VPN is slow, all your devices are slow. My personal preference is for a VPN box that connects to the LAN side of a router rather than the WAN side.

Some missing information: what is its maximum throughput with and without a VPN? Does it support inbound or outbound firewall rules? If it does support rules then not mentioning this is negligent documentation. If it does not support firewall rules, then, again, just what does it do?

As of early September 2020, the Shield was available for purchase in Germany, Great Britain, Spain, France, Italy and the Czech Republic. Alza was selling it for 104 British pounds, which was roughly equal to $138 US dollars.

FYI: Firewalla

As a company, Firewalla seems very much focused on security. However, Wi-Fi is not their thing. Most of their routers do not do Wi-Fi. This page, of theirs, How to Choose between Different Firewalla Products does not even list Wi-Fi as an attribute of any of their current (as of Aug. 2023) devices. The page points out that there is no subscription fee for their routers, but also that the web interface is secondary, their devices are meant to be managed with a mobile app. As of Aug. 2023, the last update about a web interface was July 2020 and it was in beta back then.

The Firewalla Gold router first shipped to customers in November 2020. It costs $485 (as of Aug. 2023) and does not do Wi-Fi. It is listed here as an FYI, I have no experience with it. The first two generations of Firewalla (Gold is their third) were add-on devices that plugged into a LAN port of your router. The Gold model can function that way too, but it is included here because it can also be a stand-alone router. There is more information on their other devices on the Resources page.

Quoting the company: "Unlike a traditional router, Firewalla's focus is ... on the greater ability to control network traffic. This include controlling device access, blocking categories of traffic, and managing what your digital things can do. Rules applied to your system can get complex. " The target audience are techies, I get the impression that Firewalla is a bit much for a non technical audience.

Firewalla Gold is based on Ubuntu Linux and offers full access to the operating system via SSH. If it ships with an open port for SSH, that is a security issue. You can install your own "packages" including Pi Hole for ad/tracker blocking.

Features: It supports VLANs for network segmentation. It can be both a VPN server and client for both OpenVPN and WireGuard. It supports site-to-site VPN connections (as does the Pepwave Surf SOHO). It supports multiple Ethernet WAN connections, though I am not sure if it load balances or only offers fail-over. It supports GEO-IP filtering which lets you block entire countries. It does ad blocking and can notify you of a spike in bandwidth usage. It does encrypted DNS using DNS over HTTPS (DoH). It runs vulnerability scans and automatically blocks malicious web sites. It does Intrusion Prevention and when that fails, it does Intrusion Detection. It is not clear if it offers outbound firewall rules. It does offer Parental Controls. There are no ongoing subscription fees.

My concerns: It is not clear what, if any data, the device sends to the company. Also, you have to have an account with Firewalla to use the thing, which is a privacy risk. And, it is not clear if you are at all dependent on a cloud service of theirs. The device has a console port. Why? They don't say. The speed is a concern. They promote it as having 3Gbps speed which I am sure is not true. I suspect they are adding up the speed from three gigabit Ethernet ports. Fudging the numbers like this does not promote trust. Still, it is likely to support Internet speeds around 900Mbps.

Without Wi-Fi from a router, any Access Point that you add to it, has its own user interface. This means that owners of the Firewalla Gold have to learn to deal with both its UI and that of the Acess Point. Then too, there is the chance that devices connected to the AP may not be individually governable by Firewalla. The user manual is a mish-mash of all three Firewall devices. They do not offer a manual dedicated to the Gold model. There is also a FAQ.

In September 2020, Kevin C. Tofel liked the Gold model. He points out that it can run Docker containers, can block devices from the network at the touch of a button and can block social networking apps. It also notifies you when a new device joins the network. He says it can show minute details of network traffic but does not explain this in detail.

Dong Ngo reviewed the Gold in Jan. 2021 and said " ... it's best used as a souped-up version of the Firewalla Blue Plus ... you should consider it an add-on firewall / online-protection device of an existing network, rather than a router that hosts a network of its own, where it makes things a bit too complicated for home users.". Full review: Firewalla Gold Review: An Expensive but Totally-a-Keeper Add-on Firewall.

FIREWALLA PURPLE: Firewalla Purple was released in January 2022 for $320. In Aug. 2023 it was $340. In July 2024, it was $360. While it can function as a router, be aware that it has but one LAN port. It can also be installed between a modem and a router, but in that mode, there is nothing it can do about VPN or Tor connections. Finally, it can be plugged into the LAN port of an existing router, but in that mode, it does not work with all routers. As a router, the Wi-Fi is short-range, there are no external Wi-Fi antennas. Many will need to add an Access Point or a normal router for the Wi-Fi. But, this would occupy the lone LAN port, so you would also need a switch. And, while it brags about VLAN support, that requires an external smart switch, one that supports VLANs. So, things get complicated fast. And, while it is marketed as being easy, some users will need to deal with three different devices with three different user interfaces. Not so easy.

FIREWALLA PURPLE SE: Perhaps realizing that the Purple was somewhat expensive for a device with only one LAN port and poor Wi-Fi, Firewalla released the cheaper Purple SE for $230 (as of July 2024). It does not have Wi-Fi and the maximum wired speed is 500mbps.

By way of comparison, a pcWRT router does VLANs all by itself, no external switch needed. pcWRT also does normal Wi-Fi with four external antennas. And it costs $129 and can be used without sending any data to the company. Firewalla requires a mobile app for configuration, so there is no way to know what data is sent to the company. Both do parental controls and ad blocking. Both support a maximum of 5 VLANs. Firewalla can be an OpenVPN client, pcWRT also includes IKEv2 and WireGuard client software. Both can make a site-to-site connection with themselves. However, Firewalla only supports the much slower OpenVPN for site-to-site connections.

Some articles said the Firewalla Purple can be a travel router because it can connect to the Wi-Fi network in a hotel or coffee shop. However, it is not battery powered.

Note: There is more about Firewalla on the Resources page in the section for Add-on Security Devices.

DrayTek

I have no hands-on experience using routers from DrayTek. Their products are business class, not intended for consumer use.

As of October 2024, I am tempted to remove them from this page. A research report from Forescout Research, Vedere Labs (Dray:Break Breaking into DrayTek routers before the threat actors do it again) found 14 new bugs in their routers. Yes, all software has bugs but 14 found by a single company seems extreme. And, these bugs came on the heel of many others. In fairness, DrayTek fixed all the bugs, even those in EoL models, but how many bugs is too many? Anyone considering DrayTek should read the report. Here are some quotes from it:

• In 2024, routers are a primary target for cybercriminals and state-sponsored attackers - and are the riskiest device category on networks. With this knowledge, we investigated one vendor with a history of security flaws to help it address its issues and prevent new attacks...
• On Sept. 18, 2024, the Federal Bureau of Investigation announced it had taken down a botnet exploiting three CVEs on DrayTek assets (CVE-2023-242290, CVE-2020-15415 and CVE-2020-8515). Note: the bugs exploited by the botnet, are not related to the bugs found by Vedere Labs.
• According to the National Vulnerability Database (NVD) the first reported vulnerability for DrayTek routers appeared in 2013 ... there has been a significant increase in critical vulnerabilities affecting these products over the past four years, with at least 18 issues allowing for remote code or command execution. These vulnerabilities were discovered by different researchers suggesting the vendor did not perform variant analysis after receiving individual vulnerability reports and producing patches. Additionally, the presence of similar issues in different parts of the functionality indicates a lack of "post-mortem" analysis by developers.

On the one hand, DrayTek published a 24-page router security best practices paper. On the other hand, it has not been revised since 2017 (last checked October 2024).

See a list of the features on their routers. Not only do they support WPA2 Enterprise, but most DrayTek routers have a built-in RADIUS server which greatly simplifies the implementation of Enterprise level security.

You can judge the user interface for yourself, they have online emulators for all their routers. DrayTek makes many different router models: single WAN, dual WAN and multi-WAN. There are very few installed in the US, they seem to be popular in the UK.

I do not know how long DrayTek supports the software in their routers or what the deal is with tech support (free or not and for how long).