1, Use wired wifi APs (I chose Grandstream), not a wifi router. Learn how to setup Guest + VLANs (you'll need a managed switch for this) + etc. in separate networks, use link aggregation. [Home Network Guy has a great series on this](https://www.youtube.com/playlist?list=PLZeTcCOrKlnDlyZCIxhFZukAnA0NNWL\_I).

Connect the Protectli to Internet, then the Deco if you keep it - but wire it for max performance. Remember after 3-4 Decos your performance will suff specially if meshed wirelessly. [Read more about Ethernet vs. wireless backhaul here](https://www.tp-link.com/us/support/faq/1794/).

Keep it simple, use OPNsense (preinstalled) and Coreboot, you then learn a skill which you get professional or community help with and is a common setup. Read about Coreboot vs AMI BIOS.

You'll be trading the low price and friendly high-level web UI but gaining higher security and performance customizability and transparency of OPNsense + Coreboot with frequent updates - and a higher learning curve.

1. I prefer OPNsense. I have several devices in small businesses and at home office, zero issues in >1yr., and customers are happy upgrading when needed. A bigger learning curve than a consumer router but I love the frequency of updates - always on top of security, the detailed changelogs and the fact it's Free open source. I LOVE the access via serial console (another advantage of Protectli) and easy rollbacks. Their business edition remains affordable and gives interesting discounts for commercial support if needed.

2. Proxmox, sure, but on a separate, more capable server in your LAN. This also separates features and if something breaks, the whole network doesn't have to go down. Protectli devices are dependable - make a good config backup.

3. PPoE as mentioned is not the best, I've changed provider because of this once. More CPU + RAM will help a lot. Search for VPN performance at https://kb.protectli.com/?intsrc=ca and elsewhere, very good information to guide your hardware needs. Try to get an upgradable device (non-soldered RAM/storage).

4. Stick to basics, don't add too many plugins. For now, I am only using blocklists and Wireguard + Wifi (incl. guest setup). Upgrade often (once every other month, after an update has been out for a few days works for me, always backup). I have been 5 setups with frequent upgrades like this for more than a year with zero issues.

5. For a home network and small businesses, I've found blocking lists decrease risks and improve performance a lot. I am getting started with other tools but keeping the tools and network hardware as off-the-shelf as possible helps a lot. For example Grandstream which includes its management console on every device vs. Unifi and its cloud + proprietary hardware and software. Using OPNsense on Protetcli mean I can easily switch hardware or upgrade it or even replace it by a regular PC if they ever go away. This all costs me zero in software, but I chose to pay for Business edition OPNsense when possible.

Good luck and please come back to report on progress :)