@Vaughanza ?
Hear me out, this best in class approach is NOT expensive, and you can have your whole network up and running while you improve it over time piece by piece. This**** that I mention below at you will think is really pretty slick - and you can solve your whole problem with only steps #1 and 2 below and then stop if you want.
You are in luck, I only have the time to type this now because I am sitting in the waiting room of a shop to get my car fixed!
This is NOT expensive at all (even though it sounds like it is) - so read on…
The paradigm you want to go is AWAY from an all-in-one unit. Believe it or not, this is MUCH LESS EXPENSIVE and works better -
Some manufacturers now have the paradigm of you being able to update the firmware of, and manage the settings for, all of your WiFi equipment in one interface. This makes everything MUUUCH easier AND allows the devices to actually work with reach other in a seamless fashion! (In this situation, they need to be from the same manufacturer of course.) All my firmware is updated with one click - so it is kept up to date - otherwise, what % of people go check the firmware individually for every piece of their equipment on a weekly or regular basis?
I went with the TP-Link Omada paradigm, and I bought it one piece at a time even though each piece of hardware is not expensive at all!
-
Don’t even throw away your old router, still use it! Get a router that is NOT wireless, just wired that is in a class of devices that work together as mentioned above (I have the TP-Link TL-ER7206, the working together part is their “Omada” class of devices). TP-Link has another router that is about $50 less that does the same thing, called the ER605 I believe. The problem I saw with the 605 is that it has a MUCH lower throughout for processing VPN traffic - and the ER7206 has the ability to share its processing load with other hardware (more about this later). The idea behind the non-wireless router is that it offers much better hardware, dedicated to using all of its processing power for routing and decoding/encoding VPN encryption when and if you decide to implement that. The one I have even had the option (turned on of course) to share the workload across CPUs in two hardware devices (the router and controller, see below).
-
Then use your current router only as an access point, plugged into the new router, so you can still get value out of your old investment! Almost all routers have this capability.
Boom. Your problem is solved, you can now connect hundreds of devices if you like. But, why go half- baked? Spend $30 every 6 months to slowly grow it into the below! And the TP-Link TL-ER7206 is only about $150: https://a.co/d/awQ4D5B
-
Then, put Cat6 cables at strategic locations throughout your home, from the router or to a location where you can put a switch (which is then connected to your router (switches are very cheap). Cables are cheap and it is a one-time hassle and maximizes the speed of your whole network.
-
Then, for very little $ you can then buy a couple access points, one at a time as budget allows (less than $ each (that work with the all-in one paradigm mentioned above, mine are labeled “Omada”, only and always each one plugged directly into the Cat6 cables)). They are POE (Power Over Ethernet) but come with a power injector adapter so you don’t have to have POE in the CAT6 cables you are running in your home. I went with their lowest class Omada access points, the EAP225 ($59: https://a.co/d/a9WCmwc). They have indoor and outdoor models too! The main difference between the EAP225’s and their fancier models is the the EAP225 does not offer WiFi6 - but when I looked at the specs, WiFi 6 is much more speed than most of my devices now or in the future would ever need by a long shot!
-
At this point to then get everything visible in one place (which TP-Link calls the “Controller”, for the TP-Link “Omada” paradigm, they have a few inexpensive options). They have a “software” controller which you can just run on a PC in your home (and the software is free) - not sure but I don’t think that needs to be running all the time. Then they have a couple of hardware controllers, the OC200 and OC300. These use very little power and give the all-in-one web interface that allows you to control all the Omada equipment in one place. I went with hardware so I could leave it running all the time. Someone tried to steal my identity and as you will see later this is why I started this journey (strong VPN handling). A VPN provider is only something like $30 per year so that’s not an issue.
I decided to go with the OC300 because it is able to share the processing load with the TL-ER7206 and because of its much faster throughput than the OC200 - for only $50 more!
I had an old switch laying around that I used for a long time (did not have to be Omada) to split the CAT6 cables so there was a dedicated cable to each wireless access point. Later I did buy an Omada class switch (which then allows more sophisticated networking with the access points, such as having multiple vlans (like I use for my iot devices) but not required at all.
Here is the cool part -
When the attempt on stealing my identity took place (I actually did this right after buying the router), I decided to use a VPN service provider to connect some devices in my home to the Internet only through VPN tunnels, managed by my router, for safety so my ISP and others cannot spy on my traffic. I wanted it handled by my router so no software would have to be installed on the end user devices to utilize the VPN tunnel for internet access - it would just “work,” However, I found that any one vpn tunnel offered by the VPN service provider would occasionally stop working - because there was a hiccup on the server at the VPN service provider side. So, I signed up for a second VPN provider and would switch from one to the other (or from one city to another within the same provider).
Then I figured out how to on the 7206, allow access for devices to more than one tunnel at once! So I actually for fun have 10 VPN tunnels running, (5 from each VPN service provider), all grouped together!
Not all devices are on the vpn’s (such as for example my printer is not).
**** So the end result is, the devices in my home that are on the VPNs - every time they access the internet, that access is randomly through one of 10 VPN tunnels that are all up and running at the same time. So it doesn’t matter which VPN tunnel or even provider is down! For instance if I launch a browser on my PC at home, and go to whoer.net or whatismyip.com (or both) - these website show where you are coming from and what your external IP address is. Every time I refresh the browser the IP address is different and the city where I am located in randomly changes to Belarus, Zurich, Riga, Romania, Spain, etc. etc. anywhere of the 10 locations I had set up! How diggity bomb is that!!!
You can on the single web interface turn on or off routing or anything you can think of for any individual or group of devices in your home.
Key to VPN service provider selection is:
-
Avoid them if their headquarters are in a 14-eyes alliance country - or has a government associated with one - (meaning their government forces them to share data) and
-
What kind of VPN tunnels they provide. I use L2TP/IPSEC (for the reason below). Not all VPN service providers offer this option, OpenVPN and Wireguard I believe are common, faster and more secure, but Wireguard due to its design cannot be controlled by specific individual routing policies (those are controlled on the other end of the tunnel, not by you for example).
Ok so here are the drawbacks I see with Omada:
-
The TL-ER7206 can only group together and control routing for - as the most secure option - L2TP/IPSEC tunnels, and there is some functionality for OpenVPN and Wireguard on the TL-ER7206 but it is not as client, but as server (for you to connect into your network from the outside).
-
The TP-Link Omada paradigm does let you controll all of these setting remotely as well! But, I turned off this capability (and deleted that account) because all that information then is on the TP-Link servers. And, TP-Link headquarters are in Shanghai, CHINA… So I am using a different way of accessing my router remotely in a secure fashion.
So I believe you may be thinking how did someone try to steal my identity? The reason is not obvious from the below statement unless you sit and think about what that means when I make this statement:
One day my boss at work called me up and asked me why the HR department contacted him to ask him why I had applied for unemployment benefits…
YIKES!
Good luck, let us know what you go with