Curious Well the thing is would be nice if it is one box really for simlicity/space and as mentioned, just strong security, updates, privacy, Wifi, nothing fancy like NAS etc. all risky accesses disabled like ssh etc.
Strong security will almost always lead to enterprise (grade) gear. The only thing that comes close is maybe some Unifi router combos, but I really have a love-hate relationship with Ubiquiti because of their inconsistency and their general hit or miss approach with hardware.
Curious pfSense is nice I saw it but... right now there is no posibility to make dedicated setup.
Btw... question about those consumer grades routers that were released like late 2025, they should be up to date atleast a 2-3 years no?
For point one: that's a shame, but I hope you'll get there someday. I will never ever go back to consumer grade crap. It's one of the downsides once you've tasted the possibilities of a serious setup.
For point two: as mentioned, the consumer grade routers do the bare minimum for security. Nobody really gives a damn about consumers, since they are forced to use these crappy overpriced and underspecced devices due to their lack of knowledge. 2-3 years of updates for a friggin router is criminal IMHO.
Curious btw about OpenWrt is there any good guide to check how to make basic but strong "lock" down setup, if we not speak about obvious stuff like remote access, yady yady yada, firewall, are there any extra stuff like IDS/IPS etc.?
Am I missing something that I am not really aware of other than standard lock down setup procedure?
OpenWRT is a hobbyist project, first and foremost. The goal is to give a better software experience for already existing hardware or to prolong the lifespan of EOL devices (remember the 2-3 years of updates?). Its goal is not to harden anything and I am not aware of any attempts to do such things, since it's not the primary focus of OpenWRT. If you want good security for your networking gear, you really need to look at enterprise grade products and that's for the most part a split setup with hardware firewalls, managed switches and APs with VLAN and RADIUS support.