How much wifi and open-source do you really want?

If you are willing to go with commercial hardware + open source firmware (OpenWRT) you might want to check the table of hardware of OpenWrt at https://openwrt.org/toh/views/toh_available_16128_ax-wifi and https://openwrt.org/toh/views/toh_available_864_ac-wifi. One solid pick for the future might be the Netgear WAX2* line. One of those models is now fully supported the others are on the way. If you don’t mind having older wifi a Netgear R7800 is solid.

If you want full open-source hardware and software you need a more exotic brand like this https://www.banana-pi.org/en/bananapi-router/.

Both solutions will lead to OpenWRT when it comes to software, it is better than any commercial firmware but there’s a catch about open-source wifi. The best performing wifi chips are Broadcom and those don’t usually see open-source software support**. MediaTek is the open-source alternative and while they work fine they can’t, unfortunately, beat Broadcom. As most hardware is Broadcom they have hacks that go behind the published wifi standards and get it go a few megabytes/second faster and/or improve the range a bit.

** DD-WRT is another “open-source” firmware that has a specific agreement with Broadcom to allow them to use their proprietary drivers and distribute them as blob with their firmware. While it works don’t expect compatibility with newer hardware nor a bug free solution like OpenWRT is.

I use unifi access points for wifi, and have an OpnSense router/firewall running on my server (proxmox).

That works really well, only negative ting is that if I reboot my server the internet is down while doing that. But that doesn’t happen very often.

I can vouch for MikroTik also. I have no access to fiber, so my choice was to get crappy Huawei or ZTE with limited customisation option or get MikroTik. I have bought Chateau 5G AX. I was able to bypass mobile CGNAT with Wireguard tunnel to a virtual MikroTik on cheap VPS, as my mobile provider does not offer static IP for non business customers. I am also running reverse proxy on my server to access my network directly thanks to Wireguard tunnel. You can edit nearly everything on MikroTik router (including MAC address on any interface and even spoof IMEI number when it has LTE like mine).

I’m using a thinclient (Fujitsu S920), slapped an Intel Pro/1000 NIC in there and installed opnsense. Hardware cost for both used was around €80. Wifi is handled by a TP-Link access point.

It’s a big boy router/firewall, and it’s been quite a learning experience but very fun.

Depending on how in depth you want your firewall, packet inspection, etc to be and your internet access speed, you may want a commercial grade router. You can also probably use an old PC and add a dual gigabit NIC to it and load up opnsense or pfsense or some other router/firewall distribution. From there, add a stand alone switch and a standalone wifi AP (or router in AP mode). The reason I bring up using a commercial device or an older desktop is because packet inspection, filtering, etc at line speed on a gigabit connection won’t be possible with a lot of low powered devices.

I used to do this (was using an old Intel core i5 second gen with added RAM and a dual port gigabit NIC) but it was a lot to keep up with. I have since moved on to an Asus router (RT-AX86U) with the AsusWRT-Merlin software package. The only functionality I really lost was suricata for IDS. The AsusWRT distro comes with some proprietary stuff (that I think you can turn off) but it’s also very “open” in terms of just running Linux underneath. This means you can set up things like VLANS, use iptables, etc.

AsusWRT-Merlin adds some niceties (including a nice add on system that will expand into web based interfaces for certain things you might usually do from command line, better/expanded firewalling, and even adguardhome installer for DNS-based malware/spyware/ad blocking… kinda like pihole but lots of people like it better). The maintainer of that package corresponds frequently with Asus (to the point that some of his stuff is merged back into the official AsusWRT at some points).

I can confirm that the model I mentioned above is able to do all the firewalling, QoS, adguard DNS filtering, etc at gigabit speeds. It also has some sort of IDS and a few other protections, but they are part of the proprietary bits (Asus licensed via TrendMicro I believe).

I use an N5105 generic mini pc running proxmox and opnsense. You can get them fairly cheaply from Aliexpress. They’re particularly low power and come with 4-6 gigabit network ports. I have two containers, the second of which hosts my Home Assistant instance. As an added bonus they often don’t have a fan.

For wifi I use Ubiquity wifi 6 Lite APs with the controller running under home assistant.