Before you pick a Wi-Fi 7 router, the real question is what you will do with it after the first speed test. A router that wins a benchmark at six feet can still lock you out of VLANs, ship without a WireGuard server, or sit on firmware no one outside the vendor can touch. For a homelab or a technical household, those limits decide the best Wi-Fi 7 router far more than the headline number on the box.
We picked eight routers for different jobs, from an $80 starter to a quad-band flagship, and we checked every price, firmware status and US regulatory filing below in October 2026. None of these went through our own RF testing, so the throughput figures come from the named reviewers we link to. If your homelab needs a real firewall in front of the Wi-Fi, the gateway section after the OpenWrt notes sends you to the right box.
The short list
| Role | Router | Price | 6 GHz |
|---|---|---|---|
| Best overall for most homes | ASUS RT-BE92U (no LAN VLANs) | About $265 | Yes, 320 MHz |
| Budget | TP-Link Archer BE230 | About $80 | No |
| OpenWrt-based home router | GL.iNet Flint 3 | About $210 | Yes, 320 MHz |
| UniFi ecosystem | Ubiquiti UniFi Dream Router 7 | About $279 direct | Yes, 320 MHz |
| Flagship | ASUS ROG Rapture GT-BE98 Pro | About $685 | Yes, two 6 GHz radios |
| Wired homelab, 10G and SFP+ | ASUS RT-BE88U | About $340 | No |
| Travel, mainline OpenWrt | GL.iNet Beryl 7 | About $130 | No |
| Mesh | TP-Link Deco 7 Pro BE63 (2-pack) | About $300 | Yes, 320 MHz |
What changed for US router buyers in 2026
In March 2026 the FCC added foreign-made consumer routers to its Covered List, which means a new model cannot get US equipment authorization unless its maker holds a Conditional Approval. Routers that were already authorized stay legal to sell and use, and the FCC has extended firmware and security updates for them to at least January 1, 2029, according to GL.iNet‘s summary of the waiver.
Several brands have that approval now. ASUS received it in September 2026 for its RT, ROG, ZenWiFi and other lines through March 2028, and Netgear and Amazon eero were approved earlier in the year. TP-Link’s application was still pending when we checked. Every TP-Link router in this guide is an existing, authorized model, in stock and fully legal, but TP-Link cannot launch new models in the US until that changes, so factor that in if you want a long upgrade path within one brand.
What Wi-Fi 7 really gets you
The big gains are 320 MHz channels and Multi-Link Operation. The catch is that 320 MHz only exists on 6 GHz, so dual-band Wi-Fi 7 routers top out at roughly Wi-Fi 6 class speeds on 5 GHz, and MLO behaves differently by vendor. UniFi uses a single-radio mode that switches between bands rather than aggregating them, and ASUS hides MLO behind a manual toggle.
Clients set the ceiling too. Most laptops and phones are two-stream devices, and plenty skip 320 MHz, so real single-client results land around 1.5 to 2.4 Gbps at close range. Tom’s Hardware measured 2,410 Mbps at six feet on the GT-BE98 Pro with a FastConnect 7800 client, which is about as good as it gets today. If your wired network is 1 GbE, a 2.5G or 10G port matters as much as the radio.
Best overall: ASUS RT-BE92U
The RT-BE92U is the router we would buy for most homes. It is tri-band with 320 MHz on 6 GHz, has one 10G port plus four 2.5G ports, and runs ASUS firmware with a WireGuard server and client. Asuswrt-Merlin supports it too, which gives you a long-lived alternative firmware without leaving the ASUS hardware.
Dong Knows Tech scored it 8.5 out of 10 and flagged the single 10G port and mid-tier range at 40 feet as the weak spots. ASUS can keep launching new US models until at least March 2028, and existing models get firmware updates to at least 2029. Around $265, though Amazon currently lists it with a later ship date, so check the date before you order.
The homelab catch: the RT-BE92U is not on the ASUS VLAN-supported model list, so you cannot put its LAN ports on tagged VLANs. Guest Network Pro isolates Wi-Fi clients only. If you need port VLANs, buy the RT-BE88U below, or the tri-band ASUS RT-BE96U at about $630, which is on that list.
Budget: TP-Link Archer BE230
At around $80, the Archer BE230 is the cheapest credible way into Wi-Fi 7, and it is the most-reviewed pick here. It is dual-band only, without 6 GHz or 320 MHz, but it has a 2.5G WAN and a 2.5G LAN port, which a lot of routers twice the price still lack. Dong Knows Tech measured sustained speeds around 1.5 Gbps.
Know before you buy: firmware is the TP-Link stock build only, with no Merlin or OpenWrt path, and VLAN support is limited to ISP tagging. TP-Link’s FCC application was still pending, as covered above. If you would rather avoid that, the ASUS RT-BE58U at about $145 is the closest alternative.
OpenWrt-based home router: GL.iNet Flint 3
The Flint 3 is the tinkerer’s pick. The GL.iNet firmware is built on an OpenWrt fork with LuCI included, so you get packages, VLANs and a WireGuard server and client on hardware with five 2.5G ports and tri-band 320 MHz radios. ServeTheHome measured around 10 to 13W of power draw and called it a decent router for the price.
Two caveats: GL.iNet rates its WireGuard throughput at up to 680 Mbps, down from about 900 on the older Flint 2, and it is not in mainline OpenWrt yet. A community port exists, with MLO working, but the Qualcomm Wi-Fi firmware still hangs under sustained load, although it now recovers on its own. About $210.
UniFi ecosystem: Ubiquiti UniFi Dream Router 7
If you already run UniFi switches or access points, the UDR7 is the obvious router. It combines a 10G SFP+ port, four 2.5G ports, tri-band Wi-Fi 7 and the full UniFi Network stack, including VLANs, zone-based firewall rules and WireGuard, in one box. Dong Knows Tech rated it 8.9 and measured IPS throughput around 2.3 Gbps.
Limits: its MLO is the single-radio eMLSR type, 2.4 GHz was the slowest in its class, and the one PoE port is low power. There is no OpenWrt route at all. Amazon US has no UDR7 in stock from Ubiquiti right now, only reseller listings well above list price, so buy it direct from Ubiquiti at about $279 ($307 with the surcharge Ubiquiti adds at checkout). The fanless UniFi Express 7 is the smaller alternative at $199 direct, and it has no new US unit in stock on Amazon right now either, so order that one from Ubiquiti too.
Flagship: ASUS ROG Rapture GT-BE98 Pro
The GT-BE98 Pro is the fastest router here and the one we already point to in our Wi-Fi 8 vs Wi-Fi 7 comparison. It has two separate 6 GHz radios, so a 320 MHz client and a busy 6 GHz network do not share one channel, plus two 10G ports and four 2.5G ports. Tom’s Hardware gave it an Editor’s Choice award with 2,410 Mbps at six feet and 2,050 Mbps at 25 feet.
Is it worth it? Only with several 6 GHz clients and a 10G wired backbone. For one fast laptop, the RT-BE92U gets most of the way for less than half the price. Merlin supports it. About $685.
Wired homelab: ASUS RT-BE88U
The RT-BE88U skips 6 GHz entirely, which sounds like a strange pick for a Wi-Fi 7 guide until you look at the back panel. It has a 10G RJ45 port, a 10G SFP+ cage, a 2.5G WAN/LAN port, three more 2.5G ports and four 1G ports, which makes it the best wired hub here for a rack with a 10G switch or a fiber uplink.
Pair it with a dedicated 6 GHz access point from our Wi-Fi 7 access points guide if you need 320 MHz coverage. Merlin supports it, and the 2 GB of RAM leaves room for add-ons. About $340.
Travel and mainline OpenWrt: GL.iNet Beryl 7
The Beryl 7 is a travel router, but it is also the cheapest Wi-Fi 7 hardware with official OpenWrt support. The GL-MT3600BE joined the OpenWrt 25.12.5 service release because its MediaTek Filogic chipset uses the in-tree mt76 driver. It has two 2.5G ports, and NAS Compares measured WireGuard close to its 1,100 Mbps rating.
It skips 6 GHz, and 512 MB of RAM limits heavy add-ons. For hotel Wi-Fi, a home lab VPN endpoint or a test bench for OpenWrt itself, it is hard to beat at about $130. Our travel router guide compares it with other WireGuard and Tailscale options.
Mesh: TP-Link Deco 7 Pro BE63
For a large house where one router will not reach, the Deco BE63 is the mesh we would pick. Each node has four 2.5G ports for wired backhaul, and Tom’s Hardware measured around 1,900 Mbps at short range on 6 GHz. The linked listing is the two-pack.
The trade-offs: everything runs through the Deco app, there are no user VLANs, and it carries the same pending TP-Link FCC status as the BE230. Homelab users who need VLANs should build mesh-style coverage from a router plus wired access points instead. About $300 for two nodes.
OpenWrt on Wi-Fi 7: where it really stands
If running mainline OpenWrt is the point, the chipset decides everything. As of October 2026, Wi-Fi 7 in stable OpenWrt releases, and on every retail router, comes only through MediaTek radios on the mt76 driver. The US retail devices in the 25.12 series include the GL.iNet Beryl 7 and the ASUS ZenWiFi BT8, alongside the Banana Pi BPI-R4 board.
- Qualcomm Wi-Fi 7 routers, including the Flint 3 and TP-Link Archer BE550 and BE800, are still community ports or unmerged pull requests.
- Broadcom Wi-Fi 7 routers, which covers the ASUS models here and the Archer BE230, have no OpenWrt Wi-Fi path. On ASUS, Asuswrt-Merlin is the alternative firmware.
- The OpenWrt One is a Wi-Fi 6 board, and the planned OpenWrt Two hadn’t reached retail when we checked.
Qualcomm and Broadcom buyers are left with vendor firmware or Merlin. That’s fine for a home network, but it limits how far you can script the router. If it bothers you, stop asking the Wi-Fi box to be the firewall at all.
Wi-Fi 7 router or a dedicated homelab gateway
For many homelabs, the best router is a wired gateway that owns routing, VLANs and multi-WAN. A Wi-Fi 7 router from this list then runs in access point mode beside it. On its own, a Wi-Fi 7 router is still the right call when you have one internet line, a few VLANs for IoT and guests, and no rack. Once you want intrusion prevention on a multi-gig line, a second ISP, or a firewall you can rebuild without touching the Wi-Fi, split the two jobs.
Splitting them costs one more box and one more management plane, and it buys you isolation. A broken firewall rule or a gateway update no longer drops every wireless client, and the radio can move to the next Wi-Fi generation without migrating a single rule. We’d reach for a dedicated gateway the day a second WAN or an IPS shows up on the wish list:
- Stay on the Wi-Fi 7 router: one ISP line, VLANs only for IoT and guests, WireGuard for remote access. The UDR7 and Flint 3 also take a second WAN, so a backup line alone isn’t a reason to add hardware.
- Add a UniFi Cloud Gateway: you already run UniFi switches or access points and want one controller for all of it, with a vendor-published IPS figure to plan against.
- Run OPNsense, pfSense or OpenWrt yourself: you want full control of the rule set, packages like Suricata or mwan3, and hardware you can reinstall. A fanless four-port box or a Proxmox VM both work.
- Pick a guided appliance: you want VLANs, multi-WAN and IPS from a phone app without learning a firewall OS. Firewalla’s Gold line sits here.
We route each gateway below to the page where we rank and price it, rather than ranking them again here. Ports, VLAN and multi-WAN support come from the vendor spec pages, and the IPS column is the vendor’s own figure. We haven’t throughput-tested these gateways ourselves, so treat that column as the ceiling the vendor claims, not a measured result.
| Gateway | WAN and LAN ports | VLANs and multi-WAN | Vendor IPS figure | Price band (Oct 2026) | Where we cover it |
|---|---|---|---|---|---|
| UniFi Cloud Gateway Max (and Max-NS) | 5x 2.5GbE, any port can be WAN | Yes; up to 4 WANs, load balancing and failover | 2.3 Gbps | $199 (NS, no storage) to $279 direct, $219 to $307 with the checkout surcharge | UniFi gateway comparison |
| UniFi Cloud Gateway Fiber | 1x 10GbE RJ45, 2x 10G SFP+, 4x 2.5GbE | Yes; up to 6 WANs, load balancing and failover | 5 Gbps | About $279 direct ($307 with the checkout surcharge) | UniFi gateway comparison |
| Firewalla Gold Plus | 4x 2.5GbE | Yes; two WANs, load balancing or failover | Not published | About $679 direct | Vendor spec page (no page of ours yet) |
| Protectli Vault VP2430e | 4x 2.5GbE (Intel I226-V) | Yes, from OPNsense, pfSense or OpenWrt | Depends on the OS and rules | About $470 barebones | OpenWrt router picks |
| Banana Pi BPI-R4 | 2x 10G SFP+, 4x 1GbE | Yes, from OpenWrt (mwan3 for multi-WAN) | Not published | About $335 board to $400 kit | OpenWrt router picks |
| OpenWrt One (Wi-Fi 6) | 1x 2.5GbE, 1x 1GbE | Yes, from OpenWrt (mwan3 for multi-WAN) | Not published | About $125 to $146 | OpenWrt router picks |
Read the ports column before the price. Only the UCG-Fiber and BPI-R4 have 10G uplinks, so they pair naturally with the RT-BE88U’s SFP+ cage or a 10G switch. The 2.5GbE-only boxes cap a multi-gig line at 2.5 Gbps per link. If the second WAN you have in mind is cellular, our 5G failover router guide covers the modem side. For the DIY boxes, our OPNsense vs pfSense mini PC comparison shows what IDS costs in throughput on that class of hardware, from published tests. A plain four-port box running OPNsense or pfSense is also the hardware our firewall hardware guide ranks.
If a Proxmox host already runs around the clock, the cheapest gateway is a VM. Our guides cover OPNsense on Proxmox VE and an OpenWrt VM router. Give the VM a WAN and a LAN bridge, cable the Wi-Fi 7 router’s LAN port to the LAN side and switch it to access point mode. That assumes two NICs in the host; with one NIC you need a VLAN-aware bridge and a managed switch to keep WAN and LAN apart. Check that its AP mode can map SSIDs to VLAN tags before you rely on it, because the dedicated units in our Wi-Fi 7 access point guide do that by design. The catch is that a host reboot now takes the whole house offline, so keep the old router’s config saved as a fallback.
Firmware, VLAN and VPN matrix
| Router | Alternative firmware | User VLANs | Multi-WAN | WireGuard | Fastest wired port |
|---|---|---|---|---|---|
| ASUS RT-BE92U | Asuswrt-Merlin | Wi-Fi only (Guest Network Pro), no LAN VLANs | Dual WAN, plus USB 4G/5G tethering | Server and client | 10G |
| TP-Link Archer BE230 | None | ISP tagging only | No, single WAN port | Server and client | 2.5G |
| GL.iNet Flint 3 | Stock is OpenWrt-based; mainline port in progress | Yes | Two Ethernet WANs plus repeater and tethering; failover or load balancing | Server and client | 2.5G |
| UniFi Dream Router 7 | None | Yes | Up to 4 WANs, load balancing | Server and client | 10G SFP+ |
| ASUS GT-BE98 Pro | Asuswrt-Merlin | Yes | Dual WAN, plus USB 4G/5G tethering | Server and client | 10G |
| ASUS RT-BE88U | Asuswrt-Merlin | Yes | Dual WAN and WAN aggregation | Server and client | 10G RJ45 and 10G SFP+ |
| GL.iNet Beryl 7 | Mainline OpenWrt 25.12 | Yes | Ethernet, repeater and USB tethering; failover or load balancing | Server and client | 2.5G |
| TP-Link Deco BE63 | None | No | No, one WAN port at a time | Limited, in the app | 2.5G |
Multi-WAN is where the TP-Link picks fall away for homelab use. Neither the BE230 nor the Deco BE63 can hold two wired WANs at once; the BE63 can fail over to a phone hotspot on firmware 1.3.0 and later, but a second wired line means adding a gateway in front. ASUS dual WAN offers failover or session-based load balance, and load balance can break DDNS and port forwarding, so a homelab that publishes services usually runs it in failover. If two WANs and VLANs on wired ports both matter, the Flint 3, UDR7, GT-BE98 Pro and RT-BE88U cover both without extra hardware.
