A raspberry pi with pihole running as dhcp server. In the ISP router turn off DHCP, DNS problem solved as pi will advertise its DNS to all connected devices on the network.

I guess maybe too mainline for everyone here but I use an Asus router flashed with the Merlin OS (a painless easy process) and it works excellently. No issues setting up all the things you mentioned.

I went tplink omada router, switches, and aps, very happy.

I have been using opnsense on a very cheap celeron nuc for a few years, very happy with it

If you’re new, something like Uniquiti UniFi stack is very beginner friendly and well polished.

If you’re planning to run your own hardware, the usual recommendation seems to be pfsense or opnsense on a modern lower end system (Intel N100 box for example).

Bearing in mind that a router is only responsible for routing (think directing the packets where to go). You’d also want to have access points to provide WiFi for your wireless devices. This is where UniFi stack makes it easier because you can just choose their access point hardware and control through single controller. Whereas rolling your own you’d be looking at getting something else to fill that role.

I’m very happy with my FritzBox (7590), it handles de ADSL connection to the ISP, supports various DDNS providers, Wireguard VPN, 4 port gigabit switch (5 of you don’t need the WAN port), guest WiFi with client isolation.

It also has basic media server and NAS functionality (with USB3 external hard drives).

Of course you can change the DNS server and other network controls like QOS, wake on LAN, port forwarding, different profiles with parental controls, filters, connection times, etc.

They also seem to take security seriously.

I personally would flick through the OpenWRT supported devices and pick the best supported device with 802.11ax.

I’ve been super happy with mikrotik, currently running mikrotik hex s, and ubiquity u6-lr for wifi, have had 0 issues, no need to reboot etc. Plenty of customizing if desired. A learning curve tho if you do want to start messing around

You haven’t mentioned what sort of access link or speed you have, that seems very relevant here.

For my 1Gbit/s fiber connection the Edgerouter 6P has been pretty good. It has an SFP port and can route 1 Gbit/s of traffic without issue and my dual-stack setup works well too.

The only significant downside is that its switching is slow, it has no hw support. So I put my NAS on a separate subnet instead so that the traffic to it can be routed instead.

Adding another Mikrotik recommendation with the standard warnings – a bit of a learning curve, although it has a default configuration that “just works”. If you mess something up you can just apply the default config to get back online.

Don’t buy from Amazon. For whatever reason people have problems with those units. Fakes maybe? Who knows. If you’re in the US buy from streakwave, roc-noc, ISP supplies, Double Radius, or Getic (international shipping).

The RB5009 series is very good if you want something beefier with more ports.

pfSense on an old PC with two NICs should do well. You could buy dedicated hw like a protectoli. Ive had one for 6 years now no issues.

Hi-end Xiaomi router, they have WiFi ax and enough ram and support open wrt so you can host your things on it, better yet, do DIY router on orange pi board, there’s tutorials you can follow

I can kind of recommend Firewalla. They run all open source software under the hood, but their UI is their own. I’m not super impressed with some of the decisions they’ve made, but it works and has almost every feature a firewall/router device needs.

Things I like

• VPN client support with selective VPN routing. Beats having to manually maintain a routing table for a VPN interface.

• SSH access with sudo to root

• comes with an Ad blocker, but can run pihole in a docker container. I find the onboard ad blocker paired with NextDNS via TLS is good enough.

Things I don’t like:

• UI is a phone app. WebUI is neutered. You will require all three (SSH included) to set up any advanced configs

• SSH access is a pain to use.

• Firewall rule creation is kind of a nightmare. I can see what they were going for, but they missed.

• You can’t easily configure the onboard IDS or Adblocker. You can dive into the filesystem if you want, but I don’t wanna.

I have a mesh system made up of Asus Zenwifi ET8s, and I have been very happy with them. They have a lot of cool features, such as having a VPN server and VPN client, with the VPN client allowing me to apply the VPN to only selected devices. It has tons of customization options for those that are knowledgeable about that sort of thing. For example, I can tweak at what signal strength AP steering happens. It has WiFi 6E and 2.5 Gbps wired backhaul.

When I first got it, it was very buggy, and some features straight up didn’t work. But they eventually got all the bugs that I found fixed. It’s in a really good state right now.

To address your desired features, it does have wireguard. I don’t know about DDNS, but it does not have pihole built in. It has adguard built in, but it doesn’t really seem to do much, tbh. Then again, pihole didn’t really do anything for me either. I ended up shutting off my pihole because I didn’t even notice a difference.

If you want to start small, I’d go with one supported by Asuswrt-Merlin, “a third party alternative firmware for Asus routers, with a special emphasis on tweaks and fixes rather than radical changes or collecting as many features as possible.” Keeps it close to stock with minor upgrades, and a faster release cycle for fixes. The RT-AX88U_PRO is one of the higher end routers that is supported by Merlin.