The RISC-V Router by Start9 makes advanced networking and network security accessible to everyone. Built on a RISC-V processor with an open-source boot stack and operating system, it is the most open router on the market — and the only one designed specifically for the complex needs of home-based self-hosting.
Units are expected to ship no later than September 2026.
Pre-orders and donations will be used to fund development and are therefore non-refundable.
- Maximally Open Source: The Start9 router is built on RISC-V — an open instruction set architecture — with a fully open-source boot stack (OpenSBI, U-Boot), open-source Linux kernel, and published board schematics.
- User-friendly:
Unlike other routers, especially routers with advanced functionality, the Start9 router is accessible to non-technical
users. Our modern GUI is easy to use and provides sane defaults
for users who just want a plug-and-play experience.
- StartOS-friendly: StartOS users will be able to link their server to automate port forwarding for streamlined clearnet experience.
- Processor: SpacemiT K1 8-core RISC-V chip
- Memory: 4GB LPDDR4 RAM
- Storage: 16GB eMMC
- Ethernet: 1 WAN Gb, 1 LAN Gb
- WiFi: AsiaRF AW7915-NP1 Wi-Fi 6 (11ax) 4T4R Mini PCIe Module, 2401 Mbps
- OpenSBI: a firmware layer in the boot process, providing runtime services from the machine mode (M-mode) to the supervisor mode (S-mode) kernel, abstracting platform-specific hardware details and making operating systems more portable across different RISC-V systems. Learn more.
- StartWRT: Start9's fork of OpenWrt, including a modern GUI, that reimagines the router experience from first principles.
- What is open: The RISC-V instruction set, board schematics, boot stack (OpenSBI + U-Boot), Linux kernel, and the OS.
- What's closed: the WiFi radio firmware — true of every WiFi 5/6 card; there is no open-firmware option for modern WiFi from any manufacturer. There are two early boot binaries (DRAM initialization and the first-stage bootloader) that execute once at startup and are closed; open-source replacements are in progress.
Security Profiles
Every device on the network receives a Security Profile, which determines its permissions on the network, including:
- Which other devices on the network it can see
- What DNS servers it uses
- What access it has to the Internet: all, none, IP whitelist, IP blacklist
- How it accesses the Internet: direct, or using a VPN (or VPN chain)
- When WiFi is available
Points of Entry
How a device joins the network determines the Security Profile it receives. There are three ways a device can gain access to a network:
- Ethernet: each port maps to a different Security Profile. Note that this device has 1 built-in LAN port but comes with a 4-port switch that will inherit its Security Profile for connected devices.
- WiFi: each password maps to a different Security Profile.
- VPN: each server maps to a different Security Profile. See "Inbound VPNs" below.
WiFi (Identity PSK)
Instead of a "primary" network and a "guest" network, StartWRT uses Identity PSK to provide a single network with multiple passwords, each leading to a different Security Profile. For example, when a guest comes to visit, they connect using the "guest" password, which leads to the "guest" Security Profile, restricting what they can see on the network and forcing their Internet traffic out through a specific VPN.
Inbound VPNs
Create as many Inbound VPN Servers as you need for personal or shared remote access to the home network. Like Ethernet ports and WiFi passwords, each VPN server leads to a different Security Profile.
Outbound VPNs
Connect unlimited, network-wide outbound VPN clients for Internet privacy. Optionally chain VPN clients together to avoid consolidating activity with a single provider and achieve multi-jurisdictional resilience.
Example. Mark has accounts with Mullvad VPN and Proton VPN. Whenever he makes a request to the Internet, it goes through Mullvad VPN, then through Proton VPN, then to the final destination. This ensures neither Mullvad nor Proton knows his Internet activity unless they collaborate with each other.
WiFi Blackout Schedules
Optionally disable WiFi in hardware on a schedule. e.g. disable WiFi from 10pm-7am in order to prevent WiFi usage or to limit radiofrequency EMF exposure.
One-click dynamic DNS
Use Start9 dynamic DNS for free with a single click. No account necessary.
Optionally use another dynamic DNS provider.
Help Mode
Toggle "Help Mode" to get a detailed explanation of everything in the current view, including links to external resources. Toggle again to make it disappear.