For wifi what you can do to break free from the proprietary black box “mesh” networks is to build it youself using openwrt. I’d only recommend it if you find learning networking fun, not a chore, as it takes some fiddling.
https://openwrt.org/docs/guide-user/network/wifi/roaming

Having a pfsense between your LAN and the ISP means the ISP won’t know as much about your LAN devices, they are usually the true admin of the ISP router and can see what it sees.

I imagine you’ve run factory reset on the switches you bought second hand, should be enough.

Bonus: If you want to break ip cameras free check out https://thingino.com/ and https://frigate.video/

Ahh, another cultured person. The only thing you’ll get out of having a pfSense or Open sense box is a better firewall. If you want to properly segment your network with vlans and what can talk to what. My setup sounds like the same as yours. ISP box in bridge mode > Asus RT-AX86 (stock firmware cause I’ve been lazy) > pi-hole > network. I have a little Asus travel router in the garage in mesh mode.

I have two avenues to travel for an upgrade. I could grab on of those N100 boxes that they have on Amazon with the dual NIC and throw pfSense on it and AP mode the Asus router or I can spend money, cause I like nice things and grab a Ubiquity UDMpro and one of there PoE switches, cause I like PoE, and then throw the Asus stuff in AP mode.

I personally like Ubiquity cause it isn’t Chineseium or Cisco with their shitty patching. Both options also give me experience messing around with industry standard firewalls (for the job experience). It really comes down to if you wanna stick with open source or not.

Sorry, I don’t understand your Ethernet cable from the fiber box to router question.

I also have one of those USB NICs, never tried it like that though. I’d assume it’ll work. Only one way to fins out.

I haven’t meshed with many straight APs that aren’t Ubiquity. The have a network controller app that has a webpage that let’s you set them all up. I’m surprised your WiFi router doesn’t have an AP mode.

Buying used is good, just factory reset everything you get. Keep that stuff out of the landfill.

Set up some computer with a pair of nics to run pfsense. Get two wireless routers that are supported by openwrt/tomato/whatever. Get a switch that operates at the highest link rate in your network. Plug it all up and configure the two wireless routers to operate their wireless network as either access point&wds or wds, I can’t remember which.

If you are worried about the security of the brand name WiFi router, i would just try to set up pfsense on a stick(need only one NIC). I am pretty sure i have seen an official guide for that.

So basically, you plug your switch (access port) to the isp router, and plug the pfsense box into another port(trunk port) on your switch. Define a vlan for internet, and have that access port tagged with the same vlan. Then turn off routing in your brand name router and use it as a pure access point. Now you can play with vlans as much as you want

I wouldn’t worry about the isp router, it has no access to your network, and most traffic going through it should be encrypted anyway. And for your brand named access points, you can block them from accessing internet.

Edit: The guide: Official documentation for “router on a stick”

It depends on your threat model or how I like to call it: the paranoia level. Since all connections go through the ISP router anyway you won’t really gain that much privacy unless you directly put a VPN on your router.

Here is what you could potentially stop leaking:

• MAC addresses of your devices
• DNS queries if you use unencrypted DNS

Also theoretically, the router could be an entry point to do attacks against your devices.

People who use pfsense mostly do that because they want more features. For example I have an IoT VLAN that cannot talk to the internet.

For privacy the simplest thing would be to try and put a custom firmware on your WiFi router, like OpenWRT.

Everything else is a bit of an overhaul. And in the end, you always have to trust that the WiFi access points manufacturers firmware does not exfiltrate data.

Also, I would just try plugging in to the modem and see what happens. Most likely you’re just wasting power right now with that ISP router.