Router + AP for 1Gbit/s WAN

Before proceeding, are you familiar with compiling etc because that will more or less be a requirement and I would recommend you to look at something that doesn't rely on USB for networking.

What you're looking at in general would be router/firewall/gateway (x86/RK3399-based, no idea how well RK3399 runs on in particular OpenWrt in general however), a switch (Zyxel GS19XX are decent ones for the money and doesn't break the bank), I'd say that IPQ4018/19 are probably your best bet as far as performance/price for AP/WiFi however from what I can tell there are still issues with VLAN support if you want to run OpenWrt.

Thanks for your quick reply!

I'm working as MS365/Azure admin, so I wouldn't consider myself a noob regarding IT. On the other hand compiling and/or programming isn't really my domain, it would at least take me some time to get started.

What would be your recommendation for an x86 device? Maybe one of these chinese mini-pcs or an Odroid H2+? But the Odroid isn't widely available in Germany and expensive..

I would recommend you an X86 Machine (any "chinese" fanless PC with 2 or more NIC's) + Some mini PoE switch + some AP PoE working with OpenWRT.

At home I'm handling a 600 MB symmetric fiber with no problems running:

x86 J1900 Celeron Machine as main router + TP Link 8 port switch PoE + DAP-2610 AP PoE

I'm not using SQM because, with 600 MB I have no bandwitch/bottleneck problems.
Of course, x86 Celeron and DAP-2610 running with OpenWRT.

1 Like

The majority of x86 hardware suffers from various vulnerabilities see 1 and depending how paranoid you are that might be a showstopper (ARM does suffer a bit too but it's not as bad at least to date of writing). While I honestly believe that you'll most likely never encounter such an attack on your specific device/connection it's worth taking into account and I would highly suggest that you look into Intel's 4000 series or newer when it comes to hardware simply because it's much newer [2] than the old dated J18/1900-series that are by now 7 years old! (and no AES-NI etc) [3].

[2]: -->

x86 will most likely be the most flexible platform but if you want something reasonable recent it'll drive up the cost. The downside with cheap x86 platforms is that many uses Realtek PCie/USB nics (including the Odroid board) and while they may work decent on desktops they're not really "server/network" grade at least in my book and by looking at servers etc in general it's something you don't find and they're usually not recommended if you look at network oriented distros (do note that there's a difference between supported and recommended). With that being said, they may work perfectly well for your use case.

I can't really say a SoC/platform that will give you zero issues because pretty much all have their quirks and issues, adding gigabit line speed on top of that gives you even a more limited selection. x86 will however most likely give the least of issues however there "might be"/are distros that will "utilize" the hardware to it's full xtent more than OpenWrt as are usually targeted against devices not fitted with sub 1Gb of ram and 16-128Mbyte of storage. I've personally looked for something cheap to use as firewall without spending too much time and for now RK3399 + dual ethernet Intel NIC (these can usually be found pulled/used in .de cheaply) which in my case has worked really well running FreeBSD 13-CURRENT but it's not a fully plug and play solution and it's a full OS so no fancy web ui although I don't find pf's syntax hard to read so it's an issue in my case. This board is supported in Openwrt however I think that it's in a pretty rough state (ie buggy etc) until ~5.10 or newer kernel is imported but I haven't verified.

It's also very easy to overengineer, but some kind of router + Zyxel GS1900-8 (use idealo) + an AP or a router flash an AP (VLAN functionality and other features may be limied using OpenWrt depending on platform) would be the way I'd go for but it might be a bit hard to hide everything physically.

Edit: Might as well provide a link for the RK3399 in .de

What components would you use based on the linked motherboard?

Nothing special really,

  • 12V 3-5A PSU (Mean Well / Delta) such as Mean Well GS60A12-P1J (EOL)
    I've also been using a 3A one but I don't have it available right now so I don't know what model it is.
    I haven't measured voltage usage but 3A+ seems to run fine.
  • Fujitsu D3035-A11 (Intel I350-T2 variant, I350-AM2 controller)
    I found these really cheap pulled
  • Various variants of memory cards
    Toshiba EXCERIA M302 32/64Gb
    Transcend 32GB Premium microSDHC Class 10 UHS-I (TS32GUSDU1)
    Samsung Pro microSD (MB-MG32EA/AM) 32Gb
  • EDIT ...and of course the heatsink:
    To mention a few, you should at least get a A1 rated one these days though :slight_smile:
    I've also attached an external HDD to one of the boards for use as a buildbot (using FreeBSD) as I/O on SD cards are dreadfully slow and writes are limited.

This has worked really well for me (tm) running FreeBSD 13-CURRENT (recent builds)

I do have a few APs (IPQ4) running OpenWrt though =)

1 Like

Since I find the discussion interesting, I tried to cap my router/server by disabling CPU threads, to simulate a less powerful CPU.

I don't run OpenWRT on my device, but Fedora, so the system's doing a lot of stuff in the background, that OpenWRT wouldn't, so read the numbers with a grain of salt.

The Xeon I use is roughly 2x the power of the J4105, per thread - . One Xeon core (2 threads) has ~50% more power than the whole J4105 (there seem to be a huge overhead).

I used echo 0 > /sys/devices/system/cpu/cpuX/online to "disable" the threads.

With 1 core/2 threads active, I was able achieve a DL rate of approx 900 Mbps.
Outgoing traffic seems to require more CPU power, and that core only
gave an UL rate of roughly 200 Mbps.

But 've noticed my UL rates have been low lately, and it might affect the
UL total - I'm on 1/1 gbit fiber.

Network adapter's a HPE Ethernet 10Gb 2-port 562T with Intel chipset providing CPU offloading.

I used the speedtest.nets' cmd version tool to run the benchmarks, not the browser.

What case would you use to fit a low profile pcie card?

2U cases usually use low profile cards, assuming the cards are standing up, and don't use a riser.

But I wouldn't get a LP card in the 1st place :wink:


For an all in one option the R7800 is popular. You can get full line rate with the hardware offload enabled builds ("NSS CPU cores") + it has a switch & AP built in.

1 Like

Sorry, my question was vauge. What case would you fit a pcie (low profile) in a board like ROCKPro64?

To be fair, it's in progress. You can use the NAS case but its kinda expensive, I've been using a very primitive temporary solution but I've seen people simply modifying the acryllic enclosure. I think a simple solution would be to raise and simply drill a hole for the bracket mounting screw in the top layer. There are some 3D printer variants in the making but nothing finalized to my knowledge.

I edited my last previous post and added the heatsink that I forgot about :wink:

Overkill size wise, because of the additional space for storage, but at least it'll fit the PCIe.

But I agree with diizzy, 3D printed.

It's more pronounced on photo than in real life and spent zero minutes cleaning things up (as long as it holds together I'm fine with it) it's not going to be on display or anything (there's also a top part I haven't attached it). :slight_smile:
It doesn't help that my printer likes to wrap using this PETG filament

...but it runs great =)


PCEngines APU2 (Simple wan) as edge device with openwrt 21.02.1 stable (APU1 as backup), Netgear GS310TP POE switch(factory firmware, for power control), two TP-Link EAP-225v3 access points(factory firmware, without using hardware or software controllers). Works fine, low cost, highly upgradeable.

1 Like

The apu2's pretty hard to get hold of, currently, at a decent price.

There are other options out there, cheaper, but just as capable.

1 Like

Everything (from the x86_64 range) starting with baytrail-d or ivy-bridge should have the capacity to cope with 1 GBit/s linespeed plus sqm/ cake (I've successfully tested an ivy-bridge celeron 1037u locally via 1 GBit/s and sqm/ cake; only the idle power consumption could/ should be better (it would be, starting with haswell). The pcengines APU range (AMD T40E or GX-412TC based) is a bit marginal though, allowing just 1 GBit/s but not SQM at the same time; depending on your requirements -and for the right price- these can still be a good option for the intermediate future.

1 Like

Hey Diizzy! Would you be able to share the file to print that case?

Without controller you loose fast roaming features, aren't you?

Yes. I haven't reviewed real world differences with / without central management of roaming decisions.

Roaming behavior is very much impacted by the client.