GADNET vs a traditional router
Encryption, admin login, segmentation, telemetry, updates and ownership compared across an ISP box, a cloud-managed mesh router and GADNET.
GADNET vs a traditional router
Five categories — security, sign-in and privacy, network, monitoring, updates and ownership
| Feature | Consumer ISP router | Consumer mesh / cloud-managed router | GADNET Zero Trust |
|---|---|---|---|
| Security | |||
| How the router encrypts and protects its own connections and passwords. The right-hand column is GADNET. | |||
| TLS encryption | TLS 1.2 with RSA-2048 (legacy) | TLS 1.3 classical | Hybrid TLS 1.3 with X25519MLKEM768 (post-quantum today) |
| Certificate authority | Vendor pre-loaded, often expired | Vendor cloud certificates | Internal CA + parallel ML-DSA-65 PKI |
| Password storage | Often plaintext, MD5 or SHA-1 in legacy units; default credentials the bigger issue | Handled by the vendor cloud account | Argon2id (memory-hard, tuned for RPi5; exceeds OWASP baseline) |
| WAN attack surface | WAN admin often reachable on legacy units; TR-069 remote management on others | Closed by default | Default deny on every WAN port |
| Sign-in & privacy | |||
| Who can log in, how, and what happens to your data. | |||
| Admin login | Password printed on a label (banned for new UK devices under PSTI Act 2024) | Vendor app with a cloud account + optional 2FA | Two-factor, no cloud account: device certificate + PIN on phones, passkey or FIDO2 key (WebAuthn AAL2) on computers |
| Recovery flow | Factory reset only | Cloud account password reset | Recovery phrase + backup restore |
| Telemetry | Vendor cloud, often opaque or with limited opt-out | Usage data to the vendor cloud; opt-out varies | Zero outgoing telemetry by default |
| GDPR data requests | Email vendor support (slow) | Request it from the vendor | One-click export + Article 17 erasure |
| Network | |||
| How devices on your network see each other — or don't — so that one compromised gadget can't reach the rest. | |||
| Network segmentation | Single flat LAN | Main network + guest network, sometimes a separate IoT network | 5 built-in Zero Trust zones + unlimited custom |
| IoT device isolation | Same network as personal devices | Separate IoT network on some models | Dedicated IoT zone: internet access, cannot reach other zones |
| Smart-home discovery across zones | Same flat LAN — everything talks to everything (insecure) | Casting usually breaks across networks; some models bridge it | Per-device mDNS bridging, off by default — you choose which devices may be discovered (TV, speaker, printer) and which may discover them; a compromised smart bulb still cannot scan your laptop |
| New device default | Instant full network access | Full access after Wi-Fi join | Quarantine in the Isolation zone until you approve |
| First-time setup | Web address printed on a label | Vendor's phone app | Setup page opens by itself on any phone or laptop (RFC 8908 + Apple / Android / Windows probes) |
| Monitoring | |||
| Whether you can actually see what is happening on your network — and prove it later if something goes wrong. | |||
| Network map | Static device list | Device list in the app | Real-time topology + zone membership + traffic volume. Per-device accounting on by default, switchable to aggregate or off |
| Threat detection | None | Optional IDS / IPS subscription | Rule-based port scan + ML network-flow anomaly detection. Detection runs by default; critical anomalies are blocked immediately, everything below the critical threshold starts in dry-run so you see what it would cut before it cuts it |
| Audit logs | Reset on reboot or weekly | Event history in the app | Structured JSONL, 90d auth + extended security retention |
| Updates & ownership | |||
| Who controls the device after you buy it — and how long it keeps getting security fixes. | |||
| Update lifecycle | Typically 2-5 years; EoL often quiet | For as long as the vendor supports the model | Signed updates from the project; once the source is published (Apache 2.0), anyone can keep building it |
| Backup | None or single config file | Settings kept in the vendor cloud | LBU apkovl + local snapshot on by default; off-device SSH and S3 once you supply a destination. All signed (SLH-DSA) |
| Supply chain transparency | Closed firmware | Release notes only | CycloneDX 1.6 (ECMA-424) SBOM per artifact; audit reports to be published with the source |
| Hardware ownership | Vendor-locked, no root | No root access; managed through the vendor's app | Full root on standard Raspberry Pi 5 |
| Cost model | One-off purchase, or a recurring rental fee if the ISP supplies it | Hardware purchase; security features often behind a subscription | You buy the hardware once; no license fee |
Open-source firewalls such as OPNsense and pfSense are a different class from both columns: free IDS/IPS and updates, full root access, an mDNS reflector. What GADNET adds there is Zero Trust zones and first-connection isolation that work out of the box, with a setup page instead of a firewall rule editor.