Best Routers for Greenlight: Top Picks & Buying Guide

Two Deco S4 units work together to form seamless mesh coverage up to 3,800 sq ft, running AC1900 speeds across 3x3 6-stream radios built to handle up to 75 connected devices.

• Up to 3,800 sq ft coverage (2-pack)
• AC1900 dual-band, 3x3 6-stream Wi-Fi
• Supports up to 75 connected devices
• Single SSID with seamless roaming between units

Wireless connections and optional Ethernet backhaul work together to link the two Deco units, and additional Deco units can be added later to extend coverage further if the 2-pack alone doesn't reach every corner of a larger home.

Setup runs through the Deco app on Android or iOS, walking through connecting each unit and choosing between router or access point mode depending on the network's needs.

• Guided setup via the Deco app
• Router or access point mode, selectable per unit
• Alexa voice command support for guest Wi-Fi on/off
• Parental controls with per-profile online time limits

Because both units share one network name and password, connected devices switch automatically to whichever Deco has the strongest signal as they move through the home, without needing to manually reconnect to a different network name in each room.

Each Deco S4 includes 2 Gigabit Ethernet ports (4 total across the 2-pack), and the system supports wired Ethernet backhaul between units for a more stable connection than relying on wireless mesh links alone.

• 2 Gigabit Ethernet ports per unit, 4 total in the 2-pack
• Wired Ethernet backhaul support between Deco units
• Any unit can function as the primary Wi-Fi router

Running a wired backhaul cable between the two Decos, where the home's layout allows it, typically delivers steadier throughput than a purely wireless mesh link, worth considering for larger homes or rooms with multiple simultaneous 4K streams or downloads.

The AC1200 label splits into 300 Mbps on 2.4 GHz and 867 Mbps on 5 GHz, so no single device ever sees 1200 Mbps at once. In daily use the 5 GHz band carries 4K video and game traffic while 2.4 GHz handles smart plugs, printers and anything sitting far from the unit behind masonry.

• Four fixed external antennas with beamforming steer signal toward active clients rather than spraying it evenly
• MU-MIMO on the 5 GHz band serves several compatible clients in parallel instead of one after another
• A two-bedroom apartment or a compact two-storey house sits within comfortable reach; long single-level layouts do better with a OneMesh extender added

Wired traffic is the quiet strength here. Four Gigabit LAN ports let heavy devices bypass Wi-Fi completely and leave the airtime free for phones and tablets.

Setup runs through the free Tether app on Android or iOS, or through a browser if you prefer a desktop. The order is short: run the supplied Ethernet cable from your modem into the WAN port, power the unit, then follow the prompts to name the network and set a password.

• WPA3 sits in the wireless security menu, a step above the WPA2-only firmware found on many older dual-band units
• Access Point mode converts it into a wireless extension of an existing gateway, which sidesteps double NAT headaches with port forwarding
• Guest network, parental controls and firmware updates all live in the same app rather than a separate web console

Allow around ten minutes start to finish. The antennas are fixed rather than detachable, so there is no assembly beyond angling them upright.

This is a router on its own, not a modem-router combination. It expects an existing cable, DSL or fibre modem to feed the WAN port, which is how most home services are wired. Providers such as Xfinity, Spectrum, Cox, Verizon, CenturyLink and Frontier all work, because the unit simply accepts an Ethernet handoff from their equipment.

• If your provider supplies a gateway that already routes traffic, either bridge that gateway or run this unit in Access Point mode
• Fibre customers keep the existing ONT in place and connect it to the WAN port
• With no USB port on board, network storage and printer sharing need a separate device on the LAN

Adding a OneMesh-compatible extender later keeps one network name across the whole house, instead of forcing phones to hop manually onto a second SSID.

The ER707-M2 combines 1 dedicated 2.5 Gigabit WAN port, 1 flexible 2.5 Gigabit WAN/LAN port, 4 Gigabit WAN/LAN ports, and 1 Gigabit SFP WAN/LAN port, giving several ways to mix wired uplinks and local connections. A USB 2.0 port adds support for attached storage or an LTE dongle used as backup internet.

• Maximum concurrent sessions rated at 500,000, aimed at offices running many simultaneous connections rather than a single household
• Supports more than 1,000 connected clients across the network
• Flexible port roles let WAN and LAN assignments be reconfigured to match different ISP setups
• SPI firewall and lightning protection are built in for basic perimeter security

VPN support covers up to 100 site-to-site IPsec tunnels, 66 OpenVPN connections, and 60 each of L2TP and PPTP, giving multiple ways to connect remote sites or individual remote workers securely. Remote cloud access and the Omada app centralize management of the router alongside other Omada devices from one interface.

• Load balancing spreads traffic across available WAN connections for more consistent throughput
• Centralized management works across multiple sites from a single login rather than logging into each router separately
• 5-year warranty is paired with technical support available 6am to 6pm PST, Monday through Friday
• Designed to integrate with other Omada SDN hardware for unified network policy control

As a router-only device, the ER707-M2 needs a separate access point or mesh system for Wi-Fi, since it focuses purely on wired routing, VPN, and firewall duties. It is built to sit at the edge of a small office network, handling multi-gig WAN uplinks before traffic is passed to switches and access points.

• Works with standard 2.5 Gbps or Gigabit ISP connections through its flexible WAN port options
• Best suited to setups already using or planning to use Omada-managed switches and access points
• Configuration through the Omada app or controller software has more depth than a typical consumer router interface
• USB port allows LTE backup so internet connectivity is not fully dependent on the primary WAN link

Bandwidth splits into up to 1200 Mbps on 5 GHz and up to 574 Mbps on 2.4 GHz, which is where the AX1800 label comes from. Those are link speeds shared across connected devices, not a guaranteed per-device figure.

• 5 GHz carries the fast traffic - 4K streaming, gaming, large downloads - over shorter distances.
• 2.4 GHz travels further through walls and is where most smart plugs, cameras and sensors live.
• Four high-gain antennas plus beamforming aim signal at devices rather than radiating evenly.

OFDMA lets the router talk to several devices within the same transmission slot, which is the practical Wi-Fi 6 gain in a busy household: fewer stalls when a dozen devices all want airtime at once.

Initial setup runs through a phone app that walks through connection type, network name and password, so no browser configuration page is needed to get online.

• Parental controls allow per-profile time limits and content filtering.
• Guest networks can be raised on both bands to keep visitors off the main network.
• Quality-of-service settings prioritise a chosen device, useful when one machine handles video calls.

The router can also act as an OpenVPN or PPTP server, letting a laptop away from home reach the home network. It joins an EasyMesh setup with compatible units, so coverage can be extended later without replacing it. Note that the more advanced security and parental control features move to a paid tier once the included trial ends.

Wiring is conventional: a gigabit WAN port for the modem and four gigabit LAN ports for wired devices such as a desktop, console, NAS or television.

• Every port is gigabit, so a plan above 1 Gbps cannot be delivered in full through this router.
• Plans up to about 940 Mbps are matched comfortably.
• A modem or ONT from the internet service is still needed - this is a router, not a combined unit.

It works with the major cable, fibre and DSL services in the same way any standalone router does, since the connection type is set in software during setup. If the existing service supplies a combined modem-router, that unit usually has to be switched to bridge mode before this one takes over routing.

Combined figures are 1201 Mbps on 5 GHz using 802.11ax plus 300 Mbps on 2.4 GHz using 802.11n, an AX1500 class device. Four external high-gain antennas with beamforming steer signal toward connected clients rather than radiating evenly in all directions.

• OFDMA lets several devices share one transmission slot, where Wi-Fi 6 helps most in a busy house
• MU-MIMO serves multiple clients at once instead of taking turns
• 1024-QAM raises the data carried per symbol for newer clients
• Dual-core 900 MHz processor keeps routing steady with many sessions open
• OneMesh support extends coverage under a single network name

Read those numbers as ceilings under ideal conditions. A phone two internal walls away will see a fraction of them, which is normal at this class and why spending ten minutes on antenna aiming pays off.

Setup runs through the Tether app or a browser page and takes a few minutes end to end.

• Connect the ISP modem to the Gigabit WAN port
• Join the default network printed on the label, then follow the wizard to set a name and passphrase
• Plug wired devices into any of the four Gigabit LAN ports
• Position it high, central and clear of metal, with the four antennas at a mix of vertical and 45 degrees

Parental controls, guest networks and Alexa voice commands are configured in the same app afterwards. Firmware updates are prompted rather than silent, so check for one shortly after setup. Placement changes results more than any setting here, since a router in a cupboard or behind a TV loses more signal than any feature can recover.

This is a router, not a modem. On most connections the provider box stays in place and this plugs into it.

• Works with Verizon, Xfinity, Spectrum, Cox, CenturyLink, Frontier, RCN and other major providers
• A separate modem is required for cable, DSL and fibre services that do not hand off Ethernet directly
• Backward compatible with 802.11a, b, g, n and ac clients, so older laptops and smart plugs still join
• WAN throughput tops out at 1 Gbps, matching the port speed

There is no USB socket, so network storage and printer sharing are off the table. Wi-Fi 6 gains apply on the 5 GHz band alone, since the 2.4 GHz radio runs 802.11n. Older smart home devices that insist on 2.4 GHz will connect happily but see no benefit from the newer standard.

Five gigabit Ethernet ports are split as one fixed WAN, two that can be configured as either WAN or LAN, and two fixed LAN. Running two or three WAN connections at once allows load balancing across separate lines, or automatic failover when the primary line drops.

• A USB port accepts a 4G or 3G modem as a further backup uplink.
• Bandwidth control and session limits stop one machine flooding the connection.
• Input accepts 100 to 240 V, so it works on either mains standard.

There is no wireless radio in this box at all. It is a gateway, and Wi-Fi has to come from separate access points cabled to the LAN side. Five ports also means a switch is needed for anything beyond a handful of wired devices at the site.

Tunnel capacity is what separates this from a home router: up to 20 LAN-to-LAN IPsec tunnels, plus 16 each of OpenVPN, L2TP and PPTP connections. That is enough to link several branch sites and still leave headroom for remote workers dialling in.

• An SPI firewall with DoS defence handles the standard flood and malformed packet attacks.
• Filtering by IP, MAC and URL, together with access control lists, sets who can reach what.
• Application layer gateway support covers FTP, H.323, PPTP, SIP and IPsec pass-through for VoIP and legacy software.

One caveat to plan around: OpenVPN configuration requires an Omada SDN controller rather than being available from the standalone interface. IPsec, L2TP and PPTP can be set up without one, so pick the tunnel type according to how you intend to manage the device.

The gateway can run standalone through its own web interface, or be adopted into the Omada software-defined networking platform alongside access points and switches. Adoption gives one dashboard for the whole site instead of logging into each device separately.

• Three controller choices: a hardware controller appliance, software running on a PC or server, or a cloud-based controller.
• Cloud access allows configuration and monitoring from outside the site.
• One-click automatic IPsec setup between Omada sites removes most of the manual tunnel configuration.

For a single-site installation the standalone interface is enough on its own. For anyone managing several locations, or handing a network over to someone else to support, the controller model is the main reason to choose this gateway over a consumer router, since configuration and firmware can be pushed centrally.

This is a 2x2 dual-band 802.11ax unit: roughly 1201 Mbps on 5 GHz and 574 Mbps on 2.4 GHz, radiated from four external antennas.

• 1024-QAM packs more data into each transmission than 256-QAM Wi-Fi 5 gear
• OFDMA splits one channel between several small transmissions instead of queueing them
• MU-MIMO serves two streams at once to capable clients
• Target Wake Time lets phones and sensors sleep between check-ins

The practical gain over an older AC1750 unit is not headline speed to a single laptop, it is behaviour when fifteen devices are awake. OFDMA cuts the airtime each small packet consumes, so a video call holds steady while a console downloads. Coverage depends heavily on wall construction: plasterboard and timber are kind, dense masonry is not.

The router app walks through the first boot: plug the WAN port into your modem, scan the label, name the network and set an admin password.

• Trend Micro powered filtering blocks known malicious sites with no ongoing fee
• Parental controls schedule access per device
• Built-in VPN server covering WireGuard and OpenVPN protocols
• Instant Guard builds an encrypted tunnel home from a laptop abroad

Change two settings straight away. Turn on automatic firmware updates, since router security depends on them, and give the 2.4 GHz and 5 GHz bands the same network name so devices roam between them without manual selection. If you later add a second compatible unit, AiMesh pairing is handled from the same app in a few taps.

The unit is a router, not a modem, so it connects to whatever your provider supplies.

• Works behind cable, fibre ONT, DSL and satellite terminals with an Ethernet handoff
• One gigabit WAN plus four gigabit LAN ports
• Power input 110 to 240 V, output 12 V at 1.5 A maximum
• PPPoE, dynamic and static WAN modes all supported

If your provider supplies a combined modem-router, put that box into bridge or modem mode first, because leaving two routers in series creates double NAT and breaks console networking and port forwarding. There is no USB socket, so shared storage needs its own network connection. For lines up to about 900 Mbps the gigabit WAN is the correct match; anything faster wants multi-gig hardware.

This dual-band Wi-Fi 7 router combines a 5764 Mbps 5GHz band with a 688 Mbps 2.4GHz band for 6.5 Gbps of combined bandwidth across 6 spatial streams.

• Rated coverage of up to 2,400 sq ft with 6 external antennas and beamforming
• Supports up to 90 simultaneously connected devices
• Multi-Link Operation combines both bands for lower latency on supported clients

Because this is a dual-band design rather than tri-band, there is no dedicated 6GHz lane; devices without Wi-Fi 7 support fall back to standard 5GHz or 2.4GHz speeds rather than the peak combined figure. For a typical single-floor or small two-floor home, the antenna layout and beamforming keep signal consistent across rooms, though a very large multi-floor house may still benefit from a mesh add-on at the edges of the stated coverage area.

Setup runs through the Tether app, which walks through connecting the WAN port to a modem and configuring the wireless network name and password in a few steps.

• 1x 2.5 Gbps WAN/LAN port, 1x 2.5 Gbps LAN port, and 3x 1 Gbps LAN ports
• 1x USB 3.0 port for a shared drive or printer
• Powered by an included 12V 2.5A adapter

The unit measures 10.6 x 6 x 1.9 inches and stands vertically, so placement needs a bit of clearance around the antennas rather than lying flat under other equipment. Guest networks, port forwarding, and a separate IoT network are all configurable from the same app, and firmware updates are pushed automatically once cloud services are enabled during setup.

The 2.5 Gbps WAN port supports multi-gig internet plans when paired with a compatible modem, while standard gigabit or slower ISP connections still work through the same port without any adapter needed.

• Supports IPv4 and IPv6, PPPoE, and dynamic or static IP connection types common across ISPs
• WPA3 encryption plus a separate network for IoT devices through HomeShield
• Compatible with Alexa and Google Assistant for voice-based network commands

Because the 2.5 Gbps WAN port only reaches its full speed with a matching multi-gig plan, anyone on a standard gigabit or lower connection will see their own connection's ceiling rather than the port's ceiling. HomeShield's deeper security scanning and parental controls are managed through the cloud-connected Tether app rather than a fully local dashboard.

Three radios rather than two: 2402 Mbps on 6GHz, 2402 Mbps on 5GHz and 574 Mbps on 2.4GHz, making up the 5400 Mbps combined headline. The 6GHz band is the reason to buy a 6E unit at all, because it carries no legacy traffic from older devices and has room for 160MHz channels without overlapping the neighbours.

Six high-gain antennas with beamforming shape signal toward connected devices, and OFDMA plus true tri-band working raises capacity roughly fourfold against a comparable dual-band unit when many devices are active at the same time.

Behind the radios sit a 1.0 GHz dual-core CPU and 512 MB of memory, which is what stops throughput collapsing when dozens of clients, QoS rules and a VPN tunnel are all live at once. The housing is shaped for heat dissipation rather than stacking.

The standout wired feature is the 2.5 Gbps port, which can face either direction. Used as WAN it lets a multi-gig cable or fibre service exceed the old Gigabit ceiling; used as LAN it gives one machine, typically a NAS or a workstation, a 2.5 Gbps link to the rest of the network.

Setup runs through the Tether app, which handles connection type, network naming and firmware. Do the firmware update first, before anything else gets configured.

VPN support is unusually complete for a home unit. It runs as both a server and a client, covering OpenVPN, PPTP and L2TP, so you can either reach your home network from outside or push household traffic out through a provider. Security is WPA3, and the unit carries a 2-year warranty.

It works with any provider that hands off an Ethernet connection, including AT&T, Verizon, Xfinity, Spectrum, RCN, Cox, CenturyLink and Frontier. As with any standalone router, a separate modem is still needed for most cable and DSL services, so this replaces the router half of an existing gateway rather than the whole box.

On the client side, only Wi-Fi 6E devices can use the 6GHz band. Recent flagship phones, current laptops and newer 6E adapters qualify; anything older sits on 5GHz or 2.4GHz and sees no benefit from the third radio at all. Worth knowing too: 6GHz attenuates faster through walls than 5GHz, so the fastest band is also the shortest ranged.

OneMesh support lets a compatible extender join as a single roaming network name rather than appearing as a second SSID.

This is a dual-band AC1200 router: up to 867 Mbps on 5 GHz and 300 Mbps on 2.4 GHz, quoted as 1,200 Mbps combined because the two bands are simply added together.

• Four fixed external antennas with beamforming aim signal at connected devices rather than radiating evenly in all directions
• Coverage is quoted at around 1,000 sq ft, which suits an apartment or a compact single-floor home
• MU-MIMO with two spatial streams lets it serve several devices at once instead of in turn
• 5 GHz handles streaming and gaming, while 2.4 GHz reaches further through walls for doorbells and sensors

For a larger home or thick internal walls, pair it with an EasyMesh extender to form one roaming network rather than a second, separate network name.

Setup runs through the maker's mobile app on Android or iOS, or through a browser page if you prefer a keyboard.

• Connect the WAN port to your existing modem, power up, and follow the prompts
• Set the wireless names and passwords, then let the app check for a firmware update - keeping firmware current is the main ongoing security task
• Guest Wi-Fi is a single toggle and keeps visitors off the main network
• Parental controls block sites by keyword and limit access times per device
• Access Point mode turns it into a wireless bridge behind an existing router, while range extender mode rebroadcasts a network you already have

The unit accepts 100-240 V input, so it travels internationally with nothing more than a plug adapter.

This is a router, not a modem. Cable, DSL and fibre lines each need their own modem or ONT in front of it, which most providers supply as part of the service.

• It speaks standard DHCP, PPPoE and static IP connection types, covering the major providers
• IPv6 is supported, which several providers now hand out by default
• IPTV set-top boxes are handled through IGMP Proxy and Snooping, bridge mode and tagged VLANs where the provider requires them
• WPA3 is available for devices that support it, with WPA2 fallback for older equipment

The limitation to plan around is the wired side: every Ethernet port is 10/100 Mbps. If your line delivers more than roughly 100 Mbps, wired devices will never see it.