How to build your own router and mesh solution using powerful hardware

Consumer-grade routers are convenient when it comes to user-friendliness in how they operate. They offer an all-in-one solution for routing both wired and wireless traffic into one network with terminology you can generally understand (unless you’re completely new to the game). But they take on a lot of responsibility for one device, wearing multiple hats, and can only manage so many devices. It becomes a little more balanced when you have a nicer mesh solution, but that gets expensive.

Networks are getting larger and larger, with so many devices capable of connecting to the internet or each other. If you have a network with 100 to 200 (or even more) devices spread around, it could be too much for some consumer routers to handle. Many models still claim they are best for households with 20-40 devices. This number seems a little low when you consider how popular IoT has become, mixed in with everything else. Just count how many switches and outlets you have on your walls throughout your home, and consider how that would affect your numbers if you replaced them with IoT alternatives.

Even if you expand to an expensive mesh solution, it still lacks a lot of things, like tighter security in a world riddled with vulnerabilities. This is because you can only pack so much into these little devices with the processing power they include. That, and the company will only dedicate so much of its time to a device before it has already moved on to focus on the next new model, leaving the old ones behind with a few firmware updates and fixes that may last a year or two at most.

So, what if you could do more? What if you could build a more powerful network that can handle more devices, more configurability, and denser security? What if you could take control of some of these focus points so that the network can continue to remain secure against the latest threats, because you make use of an open-source software solution that is actively maintained and is supported by a large community of users?

You could do that by moving away from consumer routers and toward building your own. Using a mini PC solution that is designed for this kind of scenario and some wireless access points, you could introduce a new level of powerful resources and security to your network that makes these other consumer models look like they came from a toy store.

This also separates the wireless capabilities of your network away from the “router”, so that it can focus on the processing of security, IPs, rules, other settings, and overall throughput. Thus, you are delegating responsibilities between devices, which only expands on the overall processing power of the network.

Finally, by doing this, you are turning your network into a modular setup that doesn’t need full replacement when something stops working. With consumer routers, if you start to experience degradation in your wireless capabilities, the whole router needs replacing. By building your own solution, you only have to replace the individual parts that fail over time. You also have the ability to upgrade certain resources as needed since you are using a mini PC and separate access points. So, if you need a little more RAM? Add a little more RAM! If you need more storage space, upgrade the hard drive (and so forth). If you want the latest generation of Wi-Fi, upgrade an AP or two (or all if you are feeling frisky).

This can get a little expensive since it does require multiple parts to get everything working. But in the end, it doesn’t end up being much more than a “nice” consumer mesh system. Kind of like the nicer Netgear Orbi models like this one. Where the solution we recommend today would be much less than that and more powerful. So in the end, it balances out (especially if you shop wisely using sales).

What is needed

When you consider what is needed, it doesn’t take much to imagine. You need a mini PC that acts as the “router” (or in this sample case, it is a firewall/router), hardware for the PC (SSD + RAM), 1-3 access points (depending on the size of your home or environment), Ethernet, the open-source software for the mini PC, and your brain!

It really isn’t much different from running out a mesh network with 2-3 repeaters (or more). It’s just that you take the “router” out of the mesh network and let it fly solo. That, and you need a monitor and keyboard during the initial configuration, before it can live on its own within the network (accessed via browser, like you would a normal router).

The mini PC handles (as mentioned) all of the routing, rules, policies, etc. It acts as the central hub for wired connectivity and manages the overall throughput of your networks between devices and the internet. You’ll want one with a minimum of two Ethernet ports, and you can go with something that has additional ports if you are comfortable with configuring multiple LAN/VLAN scenarios. If you aren’t familiar with that, this is fine, and you can stick to a two-port scenario.

You’ll also want to make sure those ports are future-proofed enough to handle modern-day devices and internet connections. Fiber is growing quickly among multiple ISPs, and many modern devices within your network may be capable of 2.5Gbps or faster. So limiting yourself to 1Gbps ports may be a deal breaker soon if not already.

Some mini PCs can be customized at purchase, while others come barebone, and you can add the RAM and hard drive yourself.

• In our scenario, we are using a Protectli Vault VP2420 mini PC(also on Amazon). It is a powerful and solid solution, with four 2.5Gbps ports, that is designed specially for use case scenarios like this (firewall/router setups). This model has an Intel Celeron J6412 Quad Core Processor inside, giving it a huge step ahead of consumer routers when it comes to processing. It features a strong aluminum build and doesn’t feature any fans, thus it runs whisper-quiet. And it automatically powers on with power restore, which is something you want. Protectli even has the option to include a set of stickers (labels) for the ports on the PC when you order one from their website. That way, you never forget which port is what (ie, WAN, LAN, OPT1, etc) based on whatever configuration you choose.The company was nice enough to send one out for this demonstration, and we have had a lot of success with it so far.

The APs (access points) handle connectivity for all wireless devices. Broadcasting (however) many SSIDs the specific models you buy support (ie, 2.4GHz, 5GHz, 6GHz, guest network(s), etc). The mini PC still routes everything globally, but it’s the APs that feature the hardware that is used to broadcast and connect to all of those devices. Taking that load off of the mini PC and spreading your resources around since the APs have their own (embedded) processors, memory, etc.

• In our scenario, we are using two Zyxel BE11000 WiFi 7 Triple-Radio NebulaFlex Access Points. These are a little more powerful than what the average consumer may be looking for, but we really wanted to press things when it comes to the number of devices we are connecting to the network and the overall throughput between devices. You can absolutely find cheaper AP solutions out there that are  Wi-Fi 6 compatible if you are looking to save a little money. Some require being plugged into the wall for power, some require PoE (power over Ethernet), and some offer both (one or the other).

The open-source software that you choose to install on the mini PC is completely up to you. You can go the whole nine yards with something like pfSense or OPNsense for a full-fledged firewall solution that acts as your router. This is if you want to focus even harder on security than your typical home router scenario, and provides utilities and functionality that is on par with something you’d get from companies like Fortinet.

Of course, with this comes the need for a much deeper understanding in order to make your way through the settings. So if you aren’t that fluent, make sure you have a friend with you that is, as it is very easy to get lost within the rules/policies that can be required at times. Thankfully, these open-source options do a great job of handling a lot of the heavy lifting automatically during install if you follow a tutorial (there are plenty out there).

Alternatively, you can go with an open-source option that is a lot closer to what you’d find on a router. Popular examples include OpenWrt and DD-WRT. They still offer plenty of options that go much deeper than your typical consumer router and offer communities of active users that can be very helpful to chat with when you are trying to get started.

• In our scenario, we made use of OPNsense as we really wanted to put our setup to the test and lean towards having a very strict sense of security that far surpasses that of a consumer router. In this case, we chose OPNsense over pfSense since we felt the community would be a much better match for beginners than pfSense. That being said, both are still very powerful and solid solutions.

Signal Flow

So basically, you have a configuration that is quite similar to a mesh network, only the router and wireless parts of the network are separate. Looking at it from the point of the internet coming into your network, it would look something like this:

Internet > Modem > Mini PC (router) > APs (and any switches you may be using)

When it comes to the hardware, it really is quite simple. The APs are simply devices on your network, like anything else. It’s just that those devices bring other devices into the mix, acting, in a sense, as wireless switches. All actual switches you may be using to spread Ethernet around with are also connected to the mini PC.

Software

Honestly, it’s the software that has the biggest learning curve, as it will require educating yourself on how it works. So if you aren’t willing to nerd out, you may want to stick with the latter two solutions we provided as an example that act closer to what you’d find on a consumer router. If you ever get frisky, you can always back your settings up (in case you revert back to them) and try installing one of the firewall options for a nice challenge.

As I mentioned, we wanted to throw everything we had at the mini PC we have been testing with to make sure it could handle an extreme scenario that would bring many consumer routers to a grinding halt over a series of weeks or even days in some cases. Usually forcing you to have to reboot them continuously or eventually fold and just upgrade.

Protectli actually has its own tutorial on how to get OPNsense on its Vault PCs (there is also a tutorial for pfSense as well). Ultimately, the instructions are pretty straightforward as long as you know which port is what on your mini PC. So if you have another model/brand that you are using, things are roughly the same.

It didn’t take much time at all to get OPNsense installed on the Vault 2420. And although it does help that we’ve done this before, you can see above that it doesn’t take much time at all, even if you were to follow along with the video for the first time.

Our Scenario – Overall Performance 

This brings us into the nitty-gritty that determines if this is worth all of the effort. After all, the purpose of this is to build something that doesn’t need to continuously be replaced. Something that is capable of handling extreme network loads and can go on doing so for a number of years.

So we took this to an environment that is littered with smart devices. This is a home where nearly every switch and outlet is smart/connected, along with thermostats, cameras (2K-4K), ceiling fans, tower fans, TVs, gaming consoles, computers, speakers, digital assistants, mobile devices, alarm, power strips (a small handful),  appliances, and more. There are even some coming from two of the neighbors who have buddied their way into the network over the years.

Many routers have taken on this home over the years, and all have eventually crumbled due to the number of devices and sheer amount of traffic between everything. As time moves on, the device count either moves higher or some devices swap out with even more network-hungry solutions. The latest router in use was a flagship 10Gbps Netgear Nighthawk router, which still couldn’t hold things together without having to be rebooted every week or so.

So, enter the new Protectli Vault 2420 mini PC. It isn’t the first time some of us have toyed with an option like this for managing a network. But it is the first time one has been used inside this home in place of a normal router. Making for the perfect comparison to see how well something like this holds up.

The Vault 2420 is an all-inclusive solution for a project like this. It comes with a mounting bracket, SATA adapters, USB cable, power adapter, and the aforementioned stickers/labels (which you can choose to add when checking out via the company’s website).

We added a stick of 16GB DDR4 memory (Kingston) and a 128GB M.2 SATA. Both of which are complete and total overkill for a project like this. At least, assuming you don’t find yourself logging a ton of analytic data, in which case the drive is perfect. But for the price, it’s one of those “why not” situations. As for the RAM, we have a handful of spare Kingston sticks to pick from, so it was convenient (and why not…).

Between what we added and the resources and features the mini PC already comes with, it should be capable of running just about anything on a firewall/router setup. Including plugins that help store and display various analytics surrounding your network and its security. So this is what we did, since it is always useful to have an understanding of what devices are doing and how much data/bandwidth they are consuming. Analytics like that can be powerful when it comes to tracking down data-use leaks (finding out what is using the most data across your network).

We slowly started rolling devices into the Vault from the router they were previously on. Making sure to keep within the same IP range so that configurations between all of the devices didn’t need adjustment within themselves. We also added any static IPs and port forwarding instructions for any device that needs it. That last part is one of the many learning curves you might find yourself googling, as it is quite a bit different than a normal consumer-friendly router. Thankfully, OPNsense has a large community of users that are usually more than happy to answer questions and discuss things (including on Reddit).

At first, we made our way to around 40 devices, focusing on the hungriest devices we could think of (analytic and media servers, computers, high-res security cameras, gaming consoles, TVs, and other streaming devices). This didn’t seem to affect the Vault at all. It tapped into the resources a little, but we were still barely touching the RAM.

So then came the volume test of adding everything else in groups. Working our way to 100, and then to over 200 devices (it all adds up quickly). This was an easy task as we simply moved each SSID from the router over to the APs one at a time. Taking whatever devices were on each, with them. Each of these moves resulted in a noticeable burst of devices trying to connect to the APs wirelessly and the rest of the network.

Each SSID that was moved to the new setup was followed by a nice pause so that we could monitor activity and resources. Looking for any anomalies such as noticeable latencies, connectivity issues, or anything else out of the norm. Thankfully, we didn’t really detect any outside of a few caused by user errors on our end, configuration-wise.

In the end, we reached 237 total devices, including 48 that were light switches alone (I never knew a home could have so many switches). Then, when you consider outlets and everything else, things really stack up. There are some raspberry pis, and a number of other odd devices as well. As I mentioned earlier, networks are getting larger and larger with so many devices capable of connecting to the internet or each other. You don’t even realize it until you start sorting through the list or walking around the home counting/considering how many devices connect (or have the ability to connect) to the internet, or each other.

We then gave it a good reboot to see how it handles all of that mess, trying to regain connectivity, and it did quite well, bringing everything back together. The initial load on the processor was a little interesting, but it collapsed soon after.

Then we started going around lighting everything up, streaming video content to as many devices as we could, either via the internet or the local media server, loading games, downloading games, etc. Clearly, creating an unlikely situation unless you have 5-6 kids and work from home with your partner (and are possibly entertaining a few guests in the mix). The internet bottlenecked before anything since that location is limited to 1Gbps (they are waiting for fiber to become available in their area). While the Ethernet running everywhere is capable of up to 5Gbps, leaving plenty of overhead to put this little PC through its paces.

Ultimately, it did a fantastic job. It was able to do a lot where the Netgear Nighthawk would have experienced various points of choke. Including the need to be rebooted (the Nighthawk) after all of that throughput we created. Where the Vault didn’t need a single reboot. Even with this many devices, we were barely touching the RAM and SSD. Processor has its ups and downs, but nothing concerning to call out of the normal. We are able to make full use of the internet connection without any drops in speed, outside of the data we were already consuming at the same time through other devices.

I’d love to see any of the mesh systems take this on. At least, within the same price range. Mesh systems are getting quite impressive. But to get to that level, it comes with quite the price. Some of these systems reach $1,500 or higher. When you can build this system out for $500-$800, depending on how many APs you need/want.

It can still be costly when you consider that range, and could even cost a little more if you use the APs we did, since Wi-Fi 7 is expensive. But you don’t need the APs we used, as there are plenty of consumer-friendly Wi-Fi 6 or 6E models for $100 or less (each) that would yield similar results (it’s not like any of the devices on the network we have been testing even support Wi-Fi 7 yet). In fact, around 90% of the devices on the network don’t even support Wi-Fi 6 (the majority of the network is 2.4GHz or 5GHz).

So I would say that this test has been a complete success. And we picked the perfect mini PC model since the majority of those reading this will likely have fewer devices, or at least less overall stress on the network, compared to what we created. We just wanted to throw as many punches as we could. It also proves that it doesn’t take much to outperform many of the routers out there, since it doesn’t take much to handle all of this routing. It’s nothing like the processing requirements of normal PC use in the office, at home, playing video games, etc. Especially, since it doesn’t have to provide a visual image unless you are logged into it over the network. Even then, it is serving a webpage and not a monitor.

Additional Resources

Links:

• Protectli Vault 2420 can be found via Protectli or Amazon

Additional Images – Protectli Vault VP2420 Mini PC: