eero WiFi System

The WiFi quality is very good, and I am able to get 100+ Mbps in most places in my four story house. (We have a Gigabit internet connection, so I'm definitely limited by the WiFi, not by the WAN.) In addition, the setup is extremely easy; they've done a beautiful job with that. There are some major caveats, however. First, despite their misleading claims, the Beacons themselves (the small units that plug in to a wall socket) only have two-bands of WiFi, and thus pretty much require your devices to connect on 5 GHz in order for you to get high performance (so that the 2.4 GHz can be saved for backhaul). So to be clear: you only get a "tri-band mesh" if you buy the expensive package which has three full-size eero units. If you buy either of the other two packages, you're getting a "dual-band mesh". Second, despite the high quality WiFi this provides, I'm only giving three stars because the security of the Eero is lacking in several areas, despite that being a highly touted benefit. To be specific: - The router returns pings and responds to all incoming connection attempts to ports. This is pretty bad practice, and most routers will either default to, or let you select, a "steathy" mode where no incoming packets are responded to. Why is this important? One of the first things hackers do when scanning for vulnerabilities on random IP addresses is see if a machine is there responding to requests. Despite eero's claims otherwise, I have verified that if your system isn't responding, you get far fewer hacking attempts. People take a shot and move on. However, if your system acknowledges its existence, the hackers then stick around and try all manner of automated intrusion attempts. - There is no way to tell if a device is on the sandboxed "Guest" network or not. Everybody appears to be on the same network. - There is no way to prevent a device from connecting to the internet but still allow it to see the LAN. This is exactly what you would want to do to things like local baby monitors to prevent them from phoning home or being hijacked from the internet, but this is the first router I've had which doesn't let you do that. In fact, there's no outgoing firewall option on the Eero whatsoever. - Similarly, there is no option to allow a device to be on internet but not connect to anything else on the LAN. This would probably the most important thing Eero could do to prevent attacks from "internet of things" devices. For example, if you have an IP camera that operated by connecting to a cloud server, there's absolutely no reason you want that thing to be able to see anything on the LAN. That way, even if somebody does hack into it, they can't use that as a base to attack other devices on your network. Other, more sophisticated routers offer this option. - The subscription malware filtering only works properly on unencrypted connections. In my testing it allowed me to visit test malware sites via https that it wouldn't let me visit on http. Pretty dumb, as all it's doing is checking host names. Not sure why that can't work on https just as well as http. - All the malware filtering is doing is checking host names by running their own DNS server on your router. This is NOT a robust way to block malware. Most malware uses hard-coded IP addresses to "phone home" and the eero will do absolutely nothing about that. At this point you should realize that this "security" the eero touts is more about selling a subscription than offering real security. Because of the above two limitations, you should absolutely NOT purchase their "Plus" subscription. It's a sham and a waste of money. The ad-blocking it comes with is useless, too, and lets the majority of ads through. This router is great for providing reliable WiFi easily, but they are clearly on the Apple model: "treat users like fools and give them no options because we know better. Unfortunately, the defaults chosen by Eero are often poor from a security point of view, so they violate the corollary to the Apple model: be smarter than your users. I'm confident the security issues above could be fixed without adding undue complexity to the product, so I'm very disappointed these haven't been implemented. If these guys REALLY wanted to achieve their stated mission, they'd find a way to make *real* security accessible, instead of the half-way effort they've implemented. In summary, buy this for the great WiFi, but absolutely positively do NOT purchase their $10 a month "Plus" package. UPDATE: I've recently had problems with connectivity I've traced to the eero's security subscription, further convincing me it's a terrible add-on. I've recently had difficulty connecting to my personal server, and only fixed it by disabling the protection features of the router. My server wasn't being blocked, but it was somehow making the connection intermittent. I suspected the eero when I found out I could connect fine with the IP address but not with the host name (i.e. when DNS was being used). I turned off all the security features of the eero (which, as I mentioned above, simply uses DNS filtering) and everything began working again.