US bans foreign routers - reason enough for a new Airport?

[bapegg]

Remember that Cisco networking equipment is made overseas.

I've been saying from the beginning that the router ban makes no sense from a security standpoint. Consumers are going to get stick with older routers that are currently on the market right now or they are going to be limited to just a few options for new routers. Hackers will have more time to concentrate on hacks with fewer new routers available or people stuck with soon to be outdated routers.

 

[drrich2]

Accidentally stumbled across something new (to me) today. In this thread, the issue of whether router is updated, whether users bother to do this, whether it is automated and for which brands/models, and how the router ban will impact this going forward have all been made issues.

Then in a comment under a PC Magazine article (link to article), someone (Joe Smart) claimed TP-Link stops providing software updates after 2-years, which makes them vulnerable when new exploits are discovered. I was appalled and went digging online to see if that is true.

XDA-Developers.com has an article: Your router is about to stop getting security updates - here's what to do posted 3-31-26, and it says this: "Even with the ban aside, most companies have an EOL support policy that only spans a few years. TP-Link's support will lapse usually after 3 years, with other manufacturers following a similar timeline."

3 Is better than 2, but that still looks a little...sparse. But it claims other manufacturers follow a similar timeline. A Reddit thread started 5-days ago discusses the issue: Moving on from TP-Link due to lack of a patching programmecus User DeltaTux wrote that Unifi AC LRs he recently replaced still got updates 10-years after product launch (though the original poster had heard allegations of bad support from Ubiquiti, though evidently that's disputed).

Netgear has a page discussing updates: End of Service Products and states:

"The end of NETGEAR's product lifecycle is called End of Service or EOS. Products that reach EOS no longer receive firmware updates, including important security updates.

In general, EOS for NETGEAR products occurs three years after the last sale date – the last date that NETGEAR reasonably anticipates that a NETGEAR product will be available to purchase by end customers through authorized distributors, resellers, or other authorized outlets (“Authorized Partners”) and the date we have removed the product for sale from our NETGEAR.com webstore (if we sell the product through our website). Note the last sale date may be limited to a particular SKU in an identified country or region. For more information, please read our full End of Service Policy."

So, depending on how long a product remains on sale, you might get over 3-years of updates.

TP-Link has this page: TP-Link End-of-Life Policy - 2 snippets from that:

"

• The End of Sales (EOS) date is when TP-Link discontinues a product. After this date, TP-Link will no longer accept new orders for the product.
• TP-Link will provide a notification (the “End of Sales Notification”) around 3 months before the EOS date.

"
"

• The End of Maintenance (EOM) date is when TP-Link will no longer provide support or maintenance for a product. After the EOM date, the product’s functionality may be limited (e.g., it may only connect to a local network or cease to work entirely).
• Unless otherwise required by law, the EOM date is usually 3 years after the EOS date. TP-Link may decide at its discretion to continue offering maintenance for a longer period to address significant vulnerabilities and bugs.

"

So, they might put out an update later if something really bad comes along?

Amazon's Eero has this page: eero Software Security Updates that states "Your eero receives guaranteed software security updates until at least five years after the device is last available for purchase on our websites. After that time, we strive to provide software security updates for as long as we can (subject to technical and other limitations)."

Woo-hoo! That sounds like a winner. And they've got a nice list of their products with 'at least till' support dates in column form.

A little digging regarding ASUS suggests they aren't known to have a specific time commitment but may in practice offer updates quite awhile. Wish I had a specific time frame; anybody else have one?

I can't track down a hard & fast committed timeframe for Ubiquiti, either, but again, it looks like they have a rep. for extended support.

---

Okay, so that brings up a few talking points/questions:

1.) Does a brand's anticipated firmware update support duration impact your choice of router?

2.) How many of us are using routers that are no longer eligible for firmware updates and don't even know it?

3.) If yours isn't update-eligible, would that alone motivate you to upgrade to a newer model?

4.) Does the option to switch to open source router firmware on a given brand and model product matter to you? That might be an avenue to extended updates, though I don't know how far that goes in practice.

5.) The OP asked if the router ban is reason enough for a new Apple Airport router; I still say 'no,' but does anyone recall how long Apple provided firmware updates for the old Airport Extreme? A little online searching suggests Macs get security updates for around 7-10 years and iPhones get security updates at least 5 years (maybe longer). Would they likely support a router so long?

This has been an interesting topic. If I were in the market for a new router today, an Amazon Eero would now be high on my list to consider.

 

[mdcmdcmdc]

@drrich2 thanks for continuing to post these summaries. This last one is interesting because TP-Link is being bashed in a lot of places for not providing updates, while Netgear gets the exemption. Unless I'm missing something, both written policies look the same, three years after end of sale.

 

[bapegg]

Three years after EOS is pretty much an industry wide standard.

I haven't used a Netgear router if a few years. But they didn't have an auto update feature. I know in the past that Netgear would end all support at the three year mark.

New TP-Link routers come with auto update turned on by default.

One problem I see for those that want at least 4 ethernet ports that are at least 2.5 GB or faster is that you are limited to expensive routers or cheap no name routers.

I feel that security will go down hill in 2-3 years as more routers stop getting updates and fewer brands are available for purchase with this ban.

 

[IvyKing]

I stumbled on to ASUS routers after trying to get a Linksys router running on an internet connection where the DHCP server was refusing to accept new MAC addresses. The Linksys refused any attempt to set up until it could get an internet connection. The ASUS said that the connection was live but not responding to the DHCP requests - called the ISP about that issue and they reset the DHCP.

When updating the router to handle the upgrade to 2.5G service, it was an imediate buy when coming across an ASUS router with 2.5G Ethernet ports. It was nice to hear that ASUS seems to have a longer support lifetime.

 

[mdcmdcmdc]

I have a Netgear router from 2020 for which they just emailed me an end of service notification. I'm not sure how urgently I should consider replacing it. I've sworn by Netgear since I set up my first home WiFi in 2002, but I wasn't happy that this last router required me to create an account on Netgear's web site to use the router in my home. Makes me wonder how much personal info they're collecting from the router about my devices and network usage, speaking of security.

 

[minik]

PC Magazine appears to be on a roll...

Facing Router Ban, TP-Link Tells FCC It's Investing Hundreds of Millions in the US That investment, however, hinges on TP-Link receiving 'conditional approval' from the FCC to exempt it from the foreign-made Wi-Fi router ban.

Gee, I wonder where TP-Link is going to get those 'hundreds of millions?' Out of the pockets of us, the customers, in inflated product prices? And even if they do that, chronically high U.S.-based manufacturing costs will add to the bill.

It also raises the question of whether TP-Link is basically having to bribe the U.S. federal government for authorization to do business here, and whether other companies (e.g.: Amazon) had to do that. The ban demanding plans to move manufacturing to the U.S. makes that a dubious claim of mine in terms of semantics (i.e.: it's not a bribe, it's a requirement under the law, don't'cha know?), but in a practical sense...if it looks like a duck and quacks like a duck...

Did MacRumors do a main site page article on the router ban and these related issues covered in this thread? I suspect every member of and/or visitor to this forum does so via a router at some point. Seems like this is a very important story. Many of us get news from other sites (hence my posting links), so it's easy to assume everybody is aware, but maybe not?

In 2020, I bought a Velop (Linksys) mesh system at Costco and it's only WiFi 6. Now at Costco, they're only selling TP-Link as I'm looking for an upgrade.

 

[drrich2]

I have a Netgear router from 2020 for which they just emailed me an end of service notification. I'm not sure how urgently I should consider replacing it.

I'd like to know, too. Does anyone viewing this thread replace a router that's working fine, for no other reason than that it will no longer qualify for firmware updates? Do any of you know anyone or any business that does this?

It's like the recommendation to replace surge protectors every 3 to 5 years; I ran across that (how many people even know that?) and wondered what % of consumers do so. Any of you guys?

 

[bapegg]

I generally replace routers when they stop getting firmware updates. By the time a router stops getting updates, the hardware and WIFI protocols are also outdated. I also have a background in network admin so I am not like the average home user.

The average person is not going to upgrade routers unless they stop working or there is a major upgrade in WIFI speeds. They also are not likely to regularly check for firmware updates either.

 

[IvyKing]

Firmware updates on ASUS routers are fairly painless, though it does require logging into the router on a somewhat regular basis. Seeing reports of new attacks on routers have been the usual prompts for logging in and updating.

I'm on my fourth router, the first two were replaced when they died, the third was replaced to upgrade from 1G Ethernet to 2.5G Ethernet and the 1G router was reconfigured to an WiFi access point to replace an access point with 100M Ethernet.

 

[mdcmdcmdc]

I'm not concerned about my Netgear router now being "EOS" in the near term. I asked the question to see if maybe I should be, because there are a lot of very knowledgeable people in this thread.

Maybe next year I'll see what's available. I just got a new MacBook Pro that has WiFi 7, but most of the time at home it's on wired Ethernet, so I don't feel compelled to run out and buy something new just for that.

 

[IvyKing]

The point where I would be concerned is when updates are no longer available. Vulnerabilities can take years to show up and be exploited.

 

[polyphenol]

The point where I would be concerned is when updates are no longer available. Vulnerabilities can take years to show up and be exploited.

But how do you know when that is?

A company might terminate their support at any time. This has sometimes been done because the company could not see a way of overcoming limitations of the device itself. (Or are unwilling to do so.)

But there might be no warning. Indeed, they might not even state it anywhere. Just no new updates become available. And no realisation that this is not because none are needed.

 

[bapegg]

But there might be no warning. Indeed, they might not even state it anywhere. Just no new updates become available.

Netgear will generally have an End of Service notice when you go to their website to look for updates.

I can't speak for D-Link or Linksys since it's been so long since I have used their routers. And I haven't owned my TP-Link router long enough for it to reach end of service.

 

[mdcmdcmdc]

I got two emails from Netgear, about 6 months apart, telling me it was at EOS. Of course, they were accompanied by suggestions for new Netgear equipment that I could buy, but, to be fair, they offered a 20% discount if purchased from netgear.com.

Looking around a bit, the Netgear requirement to create a login at their web site to use the router in my home seems all too commonplace. I only looked at TP-Link and Eero, and they both have similar requirements. Not surprisingly, Eero can also use an Amazon account.

 

[IvyKing]

Asus routers can be set up without logging into their website.

 

[drrich2]

Today PC Magazine put out another article:

Tech Group Urges FCC to Scrap Wi-Fi Router Ban's Software Update Cutoff

This bit near the end is interesting:

"The CTA also says the Defense Department, which issues exemptions to the ban, should “provide clear public guidance on the process for seeking a conditional approval; (ii) publish examples of conditions sufficient to achieve a conditional approval; and (iii) adopt a fast-track for products produced in defense treaty allied countries.”"

Yeah, that would help preclude the government playing favorites with the conditional approvals...somehow I'm not holding my breath for that one.

So...just what countries are 'defense treaty allied?' Do any of them offer cheap foreign labor and advanced technology manufacturing? A little Googling suggests NATO and a number of other agreements; a lot of countries, but do any do what we need?

 

[drrich2]

From PC Magazine today: Got an ISP Warning About Your TP-Link Router? Consider Replacing It

Some high points:

1.) Spectrum is e-mailing customers thought to have exploitation-vulnerable 23 models of older TP-Link routers, which Russian hackers have targeted.

2.) It's noted per Spectrum's e-mail they recommend if your router's over 5-years old, consider replacing it. I'm guessing they are just referring to those 23 older models? That isn't clear from what I see.

3.) All affected products are in End-Of-Life status.

There's more to the article, but those points stood out to me. I have a TP-Link router and I'm a Spectrum customer, but I bought my 6E router July 2023 and believe they're still sold; I did not get an e-mail from Spectrum so far, and mine shouldn't be affected anyway.

 

[drrich2]

I was inspired by this latest article to start a poll here on MacRumors in Networking asking when you bought your router (as a gauge of roughly how old it is). There are multiple parameters one could ask about - brand, model, year released, year considered to no longer be sold, year when designated end-of-service, WiFi version, etc., but for now I figured hey, keep things simple. I bought mine in July of 2023, a TP-Link Axe75, which PC Magazine's The Best Wi-Fi Routers for 2026 article (updated April 9th) shows as the best WiFi router for most people (roughly $100 at Amazon right now, so evidently still sold).

I suspect the people who vote in this poll will skew toward later models than the general public (many of whom use ISP-provided routers, and I don't know how old those tend to be).

 

[bapegg]

It's funny that I received that email from Spectrum when I just replaced my TP-Link AX21 router that I bought in 2024 with a new TP-Link BE-600 in March 2026.

I was running a Netgear router before that and it was close to its EOS when I bought the TP-Link AX21. The main reason for getting the TP-Link BE-600 was for the 2.5 GB and better WIFI. The AX-21 was WIFI 5 while the BE-600 is WIFI 6.

I always checked the Netgear router for updates and do the same with the TP-Link routers even with having auto update turned on.

 

[drrich2]

Yesterday YouTube channel Gamers Nexus put out an interesting video:

You'll Subscribe to Your Router, Too | The First Router Bribes Are Here

Some highlights:

1.) The presenter suspects more ISPs will use this situation as leverage to require customers to rent routers from them.

2.) Netgear poured a lot of money into government lobbying.

3.) Despite alleged concerns about 'national security,' the federal government has cut and/or tried to cut the resources (e.g.: manpower, budget) for federal cyber security.

4.) This will likely raise router prices and may lead to decreased innovation (e.g.: I imagine if the U.S. router market constricts via exclusion of competitors), and may discourage old routers owners from upgrading, IIRC.

5.) These 'conditional approvals' are for 18-months. Even when (if!) companies get them, there's still uncertainty in the market since it's time-limited.

6.) The definition of a router isn't universally agreed upon. Depending on what's used and how interpreted, devices we don't think of as routers could be so labeled.

7.) He's skeptical a lot of people will update old routers just because the ban prevents them from getting updates after 3-1-27.

8.) He's concerned 'political contributions' and approvals might somehow come to correlate.

9.) He talks about Netgear lobbying Congress over 'strategic competition with China.' It lobbied for the Routers Act, requiring the government to study 'national security risks posed by consumer routers and modems.' It's not yet law.

10.) The government has considered banning TP-Link routers, and it turns out Netgear and TP-Link have been in conflict - TP-Link sued Netgear alleging an unlawful smear campaign to falsely cast TP-Link and its' products as infiltrated by the Chinese government.

11.) He pointed out the analogous situation with the DJI drone ban - with potential for conflicts of interest.

12.) There's an interesting bit about data allegedly collected if you have the White House ap. on your phone.

You really ought to watch this guy; he's entertaining.

 

[IvyKing]

6.) The definition of a router isn't universally agreed upon. Depending on what's used and how interpreted, devices we don't think of as routers could be so labeled.

I've had experience with a Sun workstation back in the dialup days, where the machine would detect the presence of the PPP daemon and the Ethernet port during the init sequence and announce this machine configured as a router.

More to the point, a router can be built with any machine having multiple network interfaces and some means of running user supplied software. Trying to regulate that could run into some first amendment issues.

 

[drrich2]

YouTube influencer channel CalebRated video from May 4th: The FCC “Ban” Everyone’s Talking About — What’s Actually Happening

Apparently there's concern the push for governmental restrictions may grow beyond routers to other tech. (and today PCmag.com put out The Government Doesn’t Just Want to Ban Ghost Guns. It Wants to Control Your 3D Printer, so maybe he has a point), but he brought up some things that are relevant to a router discussion.

Smaller companies (I suspect with narrower margins and lower cash reserves?) such as Anker and TP-Link are more vulnerable that big companies like Apple and Samsung if regulations puts a financial hurt on the market.

Some electronics gear manufactured overseas requires testing and currently testing facilities are often local to manufacturing, so there's an economy-of-scale already in place that could be disrupted with mandated relocation of manufacturing to the U.S.

We already knew a move to U.S. manufacturing would be more expensive given higher wages and regulatory burden (if I understand correctly), but I didn't realize testing is another factor that can add cost. And if a limited supply of testing facilities gets too many requests, who are they going to prioritize...big players or little guys?

Concern about 'ban creep' is legitimate. It's my understanding there's the ban against Huawei and ZTE 5G infrastructure gear and their mobile devices, newer DJI drones (don't recall the details on that), the federal government was going to TP-Link at one point, we saw the TikTok ban drama unfold, the PCMag article about the threat of restricting 3-D printer use is there... I've also seen content indicating there's been pressure on the Linux community to support age verification (I don't use Linux so that's outside my lane).

He also discussed the time frame in which electronics companies tend to plan future product rollouts, and the uncertainly and risk to greater expense a ban inflicts on the market can result in planned product delays and even hesitancy to introduce into a given market.

 

[drrich2]

From PC Magazine posted today: FCC Extends Update Deadline for Foreign-Made Routers, Drones Until 2029 Previously, foreign-made routers and drones were only allowed to receive software updates until early 2027, potentially leaving them vulnerable to hacking.

From the article: "On Friday, the FCC’s Office of Engineering and Technology (OET) issued an extension that permits previously authorized foreign-made drones and Wi-Fi routers to “continue to receive software and firmware updates that mitigate harm to US consumers” at least until Jan. 1, 2029."

Also "TP-Link plans to apply for an exemption and has told the commission that it's investing "hundreds of millions of dollars" in US manufacturing."

Huh. Wonder where those 'hundreds of millions' will come from? Did I just hear a slurping sound from my bank account?

 

[drrich2]

Posted by PC Magazine today: FCC's Foreign-Made Router Ban Collides With Memory, Chip Shortage

In a nutshell, I'd thought this router ban wouldn't become problematic for awhile (unless you're worried about buying a router that might not get conditional approval and be cut-off from future updates, but as it turns out there's also an immediate concern per AT&T - from the article "AT&T says the ban prohibits hardware changes to existing Wi-Fi routers, which is a problem because manufacturers need to source new components amid the RAM crunch."