17 ms·
Redoing all my home networking
- matt_wulfeck 9y agoYou’re interested in advanced home networking, a dual nic nuc running pfsense is going to give you a ton more options while at the same time teaching you real networking.
- SteveNuts 9y agoAre there dual NIC Intel NUCs now? Last time I looked I couldn't find one.
- tjoff 9y agoYou can hook up an extra nic on the miniPCI-e slot. But that is a bit hacky. You can also use one NIC and VLANs.
- insertnickname 9y agoAre there any disadvantages to using a single NIC with VLANs rather than two NICs for a router?
- SteveNuts 9y agoMostly just bandwidth, if you have a dedicated storage device it's pretty easily to saturate a 1Gbe NIC.
- paulfurtado 9y agoMy one complaint is the lack of plug sensing: if you unplug a cable modem and plug it back in, that typically does things like triggering a DHCP request, which doesn't happen when the cable modem is plugged into a switch port on a vlan.
- azdle 9y agoIt's also easier for misconfigurations to lead to security issues since your switch resetting to default means your network is now connected directly to the internet. I had this happen after the power went out last time, luckily I'm on a PPPoE connection so it wasn't really connected to the net. Replaced my NUC + managed switch setup after that.
- graystevens 9y agoNope but there are certainly some articles discussing the use of USB NICs, and their performance. http://www.virten.net/2016/06/additional-usb-nic-for-intel-nucs/ http://www.virten.net/2016/06/additional-usb-nic-for-intel-n...
- PascLeRasc 9y agoZotac makes ZBoxes with two NICs, they're about the same price.
- KaiserPro 9y agoI have one of these, they have the advantage over the NUC being that are silent and cheaper. The only NUCs that are worth it are the i5/i7s but they are rather warm and need a fan. (I have a first gen i5, its fucking awesome though.)
- Skunkleton 9y agoI run a NUC as my router, with only one NIC. I use tagged vlans to separate the networks, and have a cheapo switch that understands tagged vlans. Unless you have a really nice external network connection, you don't really need multiple NICs for your router.
- graystevens 9y agoThis is the route I’ve just started down - a NUC with as much memory I can shove into it. Doesn’t cost a fortune to run, and as basically silent. Love it.
- nickysielicki 9y agoJessie Frazelle is not somebody just getting started, I am all but certain that she knows about pfsense and chose to not use it. There are a lot of reasons to not use pfsense. Basically no SQM (eg: fq_codel), everything is a giant php script running as root, tons of simple features (eg: backup) have to be implemented as plugins unless you pay for the commercial support, and the most important of all: because it's not a normal freebsd system, you don't know exactly where to look when something breaks; you don't just have to find the broken config file, you have to find the script responsible for generating that broken config file. I am not a fan of pfsense. It's more likely that she'd go with a simple linux system considering the projects she's worked on, but I think it's cool that she didn't do that, either. There's something to be said for not having a bunch of different systems to maintain. Ubiquiti equipment is a bargain. You pay a one-time fee for equipment that is probably twice marked up from what it costs to make, and in result you get immediate patching of things like that recent WPA2 bug, great throughput via hardware acceleration, advanced features, etc., for a very long time. Set it and forget it.
- deleted 9y ago[deleted]
- x0x0 9y agoWorth it for the link to Carolyn's my little pony k8s cluster, mastered by Twilight Sparkle. Obvs. http://carolynvanslyck.com/blog/2017/10/my-little-cluster/ http://carolynvanslyck.com/blog/2017/10/my-little-cluster/
- mindslight 9y agoIt's weird the things that people do when discovering personal computing. No sense in transcoding one's DVDs (and even buying more machines to do it faster?!) when they can be torrented quicker and with higher quality even! But we've all got to start somewhere, I suppose. The simple approach is to make a list of your physical media collection, stow it away for backup purposes, and download the collection over time. Then eventually you can even move towards torrenting the rest of your media and drop that netflix subscription that's supporting the destruction of net neutrality!
- philsnow 9y ago"we've all got to start somewhere" is pretty condescending. If the author is in the united states, torrenting the videos would violate copyright (when you torrent (if you don't have uploading disabled somehow), you redistribute without authorization). Transcoding DVDs you've already bought is not distribution.
- dzdt 9y agoIn the United States, ripping the DVD's to a drive violates the DMCA. You are illegal either way, just by transcoding you are violating a grossly unjust law instead of a disproportionate but justifiable one. And no one will catch you for ripping discs, except possibly if you brag about it on the internet.
- philsnow 9y ago.... IANAL but yeah I think you're right. walp
- 9y ago
- cdancette 9y agoI really like Mikrotik hardware (https://mikrotik.com/products https://mikrotik.com/products) for home routers and wireless access points. Their products are not very expensive, the hardware is great, and the OS is highly configurable.
- zxcmx 9y agopcengines APU2 is also a pretty sweet platform: https://www.pcengines.ch/apu2.htm https://www.pcengines.ch/apu2.htm Also for homelabbers the https://www.supermicro.com/products/system/Mini-ITX/SYS-E300-8D.cfm https://www.supermicro.com/products/system/Mini-ITX/SYS-E300... is like the "ultra-NUC", really small but 2x10 gbe NICS built in, plus IPMI.
- illamint 9y agoHow loud is that little Supermicro, though?
- zxcmx 9y agoYeah definitely noisier. https://tinkertry.com/supermicro-superserver-sys-e200-8d-and-sys-e300-are-here https://tinkertry.com/supermicro-superserver-sys-e200-8d-and... shows about 60db(!) with fans at full blast during spinup but 42db or so when dialled down. So not too bad. The difference with IPMI tho is you can safely put them in the attic or wherever.
- ThrowawayR2 9y agoThe Xeon D's are nice (8 physical / 16 logical cores for less than 45W for the D-1541) but I wouldn't recommend buying Supermicro's pre-assembled machines for home lab use; they are noisy. It would be better to buy their bare motherboards instead (e.g. http://www.supermicro.com/products/motherboard/Xeon/D/X10SDV-8C-TLN4F.cfm http://www.supermicro.com/products/motherboard/Xeon/D/X10SDV...) and self-install it into a low-noise mini-ITX case instead.
- tarellel 9y agoI setup a couple of Mikrotik routers at my work and it's done wonders. The CCR (Cloud-Core Routers) are absolutely amazing, but probably overkill for most home users. But considering when I first started at my job the network was an absolute nightmare. Because they were using a NetGear Nighthawk AC1900 (N7000), for around 70-80 users at any given time across 3 separate buildings. Considering every desk has 2 or 3 connected devices (Computer, VoIP phone, and some people also have laptops as well, plus everyone wants to connect their cellphones to the wifi). Now they treat me like a god dam wizard in disguise. They went from massive internet congestion, slow speeds, and phone calls always dropping (VoIP), to smooth sailing. The previous IT guy still works there, but he's more of a media guy. Now, for the most part I do general IT support and a ton of web development for company, without a ton of oversight.
- torvald 9y agoI often ask people I interview what their home network looks like and what their visions are. This often open doors to both inner motivation and thoughts you don't find elsewhere in an ordinary tech interview.
- jeffwass 9y agoWhat percentage have done anything beyond the default wifi-router that comes with their provider?
- pwg 9y agoHere on HN likely a much higher percentage than in the general population. In my case, the default wifi-router that came from the provider sits unplugged and idle.
- Spivak 9y agoNo idea but I'll submit myself for counting. I replaced my provider's router with some Unifi gear and am running DHCP/DNS/Storage/Backups/Misc. off a small server running KVM. I would be excited to talk about my lab in an interview.
- arca_vorago 9y agoWho even uses the provided router? Docsis is a horrible spec and basically a perma-backdoor, use your own cable modem if you can manage it with your isp, turn off everything and pass through to your own edge firewall, and keep the WiFi router separate, preferably on a DMZ.
- icebraining 9y agoWho cares if the ISP controls the router? They control my connection to the Internet anyway. I just assume my LAN is untrustworthy, and authenticate & encrypt everything inside it.
- yardie 9y agoI wish someone had asked me about my homelab. Trying to run a homelab from a sailboat presented some very unique challenges (power, no physical internet) and opportunities (low interference, environmental data). While most homelabbers are hacking on pfsense or other networking tools I was hacking our boats NMEA sensor network.
- jlgaddis 9y agoBoth Ubiquiti and Mikrotik gear are great for home use, especially for us techies, and the Ubiquiti stuff especially can often be hacked on a bit. Just remember to protect your management interfaces and keep everything up-to-date.
- CommieBobDole 9y agoI've found that the home lab is a great place for cast-off corporate equipment either bought from ebay or scrounged from data center upgrades. Mine, assembled at little to no cost, consists of: 42u IBM-branded cabinet Cisco ASA 5510 firewall Dell R610 running ESXi Old Dell 2950 full of 2TB drives running FreeNAS Cisco 'Small Business' 50 port managed switch A couple of 4U server cases containing the guts of obsolete gaming systems, repurposed as assorted servers If you've got the space and can deal with the noise, I can't say too many good things about the R610s - available dirt cheap, and though they're about four generations old at this point, still perform decently since Intel/AMD have, until recently, pretty much stagnated on CPU performance. Luckily I have a basement.
- amenghra 9y agoThat’s really cool! I have a bunch of old hardware, unfortunately I can only bring them online when I want to play with them and don’t have any permanent space. Do you know how many watts you consume? Are alternatives to old enterprise gear from eBay going to be cheaper from an electricity point of view?
- ThrowawayR2 9y agoI'm kind of guessing here but: -Cisco ASA 5510 firewall - 100W -Dell R610 running ESXi - 400W -Old Dell 2950 full of 2TB drives running FreeNAS - 400W -Cisco 'Small Business' 50 port managed switch - 100W -A couple of 4U server cases containing the guts of obsolete gaming systems, repurposed as assorted -servers - 2 x 300W So, maybe 1600W under medium load? A 15A circuit can deliver 1800W max., so it would be occupying one whole circuit. Hardly worth it, considering the noise, heat, space, and power. Old enterprise hardware gets given away for a reason.
- akeating 9y agoyeah, I considered holding onto a pair of old 2950s but ditched them considering my peak electricity rate is 43c kw/h. This setup makes me shudder.
- 9y ago
- tgarma1234 9y agoThe best thing about the home lab is that I can buy whatever I want and I don't have to sit there arguing with a sysadmin at work about whether this is going to be a problem on the network.
- EGreg 9y agoSo how much does it cost to set up UniFi for the home and what are the benefits?
- raesene9 9y agoUnifi kit is, relatively, cheap for managed networking equipment, exact prices will depend on what country you're in. I've got 3 Unifi APs , a 24-port switch and a security gateway. Personally I like managed kit 'cause it provides some insight into whats happening on your network. If you see a slowdown what's causing it, what devices do I have connected etc. Additionally, Ubiquiti has a nice manager interface which makes updating the firmware pretty easy, which is nice security patches are needed and making those easy to apply is a good thing.
- madlynormal 9y agoI'm a huge fan of using UniFi products in the home. I run a UniFi Switch 8 and UniFi UAP-AC-Pro, covering around 2300sqft. The setup cost around $250.
- craftyguy 9y agoHow quickly do they patch vulnerabilities, and what guarrantees do they provide to continue doing so for the life of the product? As "sexy" as these products look, they look to me like yet another walled garden.
- madlynormal 9y agoBeing that these products are catered more towards enterprise, and pro-sumer users I would think they'd be inclined to release patches in a timely manner. After taking a quick peek at their software change logs going back to ~2013, they consistently release monthly patches.
- letsgetphysITal 9y agoUbiquiti had patches for the KRACK vulnerability before public disclosure. https://help.ubnt.com/hc/en-us/articles/115013737328-Ubiquiti-Devices-KRACK-Vulnerability https://help.ubnt.com/hc/en-us/articles/115013737328-Ubiquit...
- wyc 9y agoOne of my favorite pieces of equipment in my home lab has to be an APU2 running OpenBSD as a router. It's cheap, feels solid, and pf lets me configure complex network routing rules with quite a nice interface. Hasn't choked yet. IPsec built into the OS! https://www.pcengines.ch/apu2.htm https://www.pcengines.ch/apu2.htm
- decasteve 9y agoI did the same and have the exact sentiments about the APU2+OpenBSD.
- Niten 9y agoI've been running OpenBSD on an APU2 as a router for over a year (and on the ALIX it replaced many more years). OpenBSD makes it so dead simple to setup the basics that (unlike with my NAS) I've never been tempted to try a GUI distribution such as pfSense, yet it also gives you the flexibility to do more esoteric things like forwarding DNS using DNSCrypt, or allowing UPnP, but only to the PlayStation on a VLAN that can't talk to your main network. And the PC Engines gear works perfectly with OpenBSD.
- chrissnell 9y agoCan that APU2 do filtering at full wire speed on those 1Gb NICs? In my experience, many of the smaller SBPC routers can't keep up. I'm running a Netgate 4860 at home and it keeps up with my gigabit fiber connection but several of my previous attempts would not (Soekris, etc.).
- lucaspiller 9y agoI also have gigabit, and in my research it seems that the APU2 tops out around 600mbit. Newer hardware like the Celeron 3855U should handle gigabit fine though.
- mrpippy 9y agoMy OpenBSD router (a VM running on ESXi) is probably the most satisfying piece of modern technology I have. A joy to configure, update (every 6 months), and does exactly what I need it to with zero problems.
- Niten 9y agoTIL that you can run an SSH agent using an OpenPGP smartcard on a non-rooted Chromebook now. EDIT: Tried following the linked instructions but nassh just hung while trying to connect, with no prompt from Smart Card Connector :( Oh well, at least it's possible in principle. https://chromium.googlesource.com/apps/libapps/+/master/nassh/doc/hardware-keys.md https://chromium.googlesource.com/apps/libapps/+/master/nass...
- chrissnell 9y agoPulling your SSH keys from Github to your authorized_keys file is a terrible idea, even with 2FA enabled on the GitHub side. You're trusting Github to manage access to your home network and all of its SSH-able machines!
- StavrosK 9y agoTrue, but it would be pretty nifty if there were a thing that would download an authorized_keys file, check the PGP signature against a key I had specified, and copy the file to the SSH dir if the signature was okay.
- craftyguy 9y agoUh, why couldn't you just sign your authorized_keys file and post it somewhere public? Then you just literally download, verify signature, and 'import' it (overwrite or append to existing file).
- StavrosK 9y agoYes, that's exactly what I said "would be nifty" above. I meant a client-side bash script or similar.
- craftyguy 9y agoHere's a start: https://bpaste.net/show/049673c13cbf https://bpaste.net/show/049673c13cbf You can clear sign an authorized_keys file with "gpg --clearsign <authorized_keys>", then just pass the resulting *.asc file to this script. It will verify the signature and 'import' it by copying it to ~/.ssh.
- StavrosK 9y agoLooks good, thanks! Good way to update all my machines' SSH keys.
- 9y ago
- rdl 9y agoI don't think I'd spend the money for UAC-AC-SHD ($600?) vs. UAC-AC-PRO ($100). Maybe UAC-AC-HD ($250) if I had a lot of 4-stream devices, but enh.
- xupybd 9y agoI love playing with this sort of stuff, but my home network works really well with one AP and really cheap gear. If I had a few more people using it maybe then I could justify that sort of investment.
- amq 9y agoHad great experience with sub-$50 TP-Links + LEDE. I can hardly justify $149 and can't imagine buying one for $549.
- TheAceOfHearts 9y agoLooking at the Unifi controller setup, I'm a bit perplexed as to why they would choose to use MongoDB, although I'll admit I lack experience with everything related to networking. I'd think that using SQLite would allow for a simpler setup while providing better performance. Am I missing or misunderstanding something? Does anyone have suggestions for beginner friendly guides to home networking? My home setup is pretty hacky, and I'd love to setup something more secure as well as improving my understanding. Right now I have an ASUS RT-AC66U router with asuswrt-merlin, and it runs an OpenVPN server, so I can remotely access my home network. How do people setup their home network domain name and device hostnames? I have the router set to update a public DDNS entry each time it connects to the internet, and a LAN DHCP Server with manually assigned IP and hostname for each known MAC address. This works alright for home devices, but it gets awkward for mobile devices and laptops. How do you restrict sharing functionality to VPN connections? Should your hostname remain the same regardless of what network you're connected to, or should it vary? Do you use IPv6? My ISP supports IPv6, and I had enabled it on my router for a few months, but eventually ended up turning it off since I felt uncertain that everything was configured securely. Am I just being paranoid? Is it ever worth setting up a RADIUS Server for WPA2-Enterprise wireless security? I kinda like the idea of having a centralized location for handling authN/authZ, but the relationship between the different technologies (Kerberos, LDAP, ActiveDirectory, etc) is pretty confusing, and nobody seems to do a good job at explaining how it all ties together. Right now I just generate an SSH key per device, and I import it to each device which should allow connections. But that increases the friction of deploying home services, which gets a bit demotivating. What monitoring tools do people setup for their home network? Do you handle updates manually or do you have that process automated? Every time I consider setting up a network monitoring tool, I kinda end up going down the rabbit hole and getting overwhelmed by the huge number of options. Many of these tools kinda assume that the user is already familiarized with best practices and that they know exactly what they want, which couldn't be further from the truth in my case.
- notwedtm 9y agoJust letting you know that the reason you are probably not receiving any responses is because nearly every question you ask is either easily Google-able, or you are asking for opinions versus facts. Want to know if IPv6 is secure? Do research to find out. Then you will know for sure.
- jonstewart 9y agoIgnorant dev here: why would I want to buy custom hardware when whatever off-the-shelf 2013ish netgear/linksys router I have can do port forwarding and max out my connection?
- sitharus 9y agoIn my case (also a dev) because my 2015 Fritz!Box wasn't coping in a dense WiFi area (I can see over 200 other APs from my apartment). I was also running in to issues while really pushing my network, I couldn't get much over 100Mbps in a multi-client environment. A single client-to-client test could go much higher, but I was running in to CPU load issues when using multiple clients, possibly related to NAT rewriting. The main advantage is following the UNIX philosophy (albeit in a limited manner). The security gateway does NAT, VPN and firewalling, the APs do wireless and the switches switch packets. The CPUs can't get overloaded with other tasks. I don't think I'm anything like an average user though. I have over 20 devices on my home network continually and 100Mbit fibre to my home - though with my new gear I could increase that to 800Mbit.
- zackelan 9y agoFor higher-end home connections (100mbit - gigabit) those older "Wi-Fi aisle at Best Buy" type of routers may or may not be able to saturate the connection. By separating the router and wireless APs you also get the ability to place multiple APs throughout your home for improved signal.
- colemickens 9y agoMy Netgear WND4000 was updated to a build that makes it trivial to permanently lock yourself out of your router. In fact, it will nearly guaranteedly happen if you install their most recent firwmare update from a wireless client. My Mikrotik and Netgear both regularly shut down when I max out my Internet connection. I've had days where I've had to manually restart them numerous times trying to push large docker images to AWS. They both have spotty upnp implementations, which I need to work because there are game consoles in this apartment and upnp is necessary to get them online reliably. The Mikrotik's AP is pretty terrible. Doesn't even span a small 1BR in Seattle. Netgear's models are notorious for being vulnerable to stupid exploits even after numerous hacky patchy series. The most handwavey one: I find consumer routers just sorta need to be replaced every few years. I spent less doing the whole Unifi thing recently than I've spent on routers and such in the last 6 years. I don't think I'll be needing to replace this gear any time soon, and Unifi isn't really custom hardware at all. They non-rack mount stuff is relatively affordable if you're willing to make a moderate investment.
- nodesocket 9y agoI currently have an Apple AirPort Time Capsule (latest 2 TB version with AC support), but I've been looking at Google Wifi. Honest question, why spend all the extra cash for Unifi gear? Google Wifi is mesh, and should all just work.
- chaboud 9y agoI had a few simple reasons: 1) PoE wired backhaul. 2) Way more management and configuration control. 3) Separability of routing, switching, and wireless. 4) Simple L2TP VPN endpoint support. I'm very happy with my choice, and I just installed AP's only at my folks' place over Thanksgiving. Simple remote management may be Overkill, but I'm willing to wager that the lifecycle in this gear will be much better than the once-every-18-months dance that they've been doing with extenders, routers, etc.
- KaiserPro 9y agorange. I have a 1930s solid brick built house, and a 50 meter garden with a "work shed" at the other end. with two I have the entire house, garden and shed covered at a decent speed.
- iaml 9y agoI, for one, don't want google anywhere near my home network.
- tlrobinson 9y agoI have an irrational fetish for rack-mount gear in my home lab. Are there any good rack-mount NUCs, or similar?
- blinkingled 9y agoSome older workstations (e.g. Dell T7500) are rack mountable. If you use Windows 10 they can suspend and wake up on LAN to save you power and they should cost you less than the NUC on eBay. It's what I use - Hyper-V on domain joined W10 Pro which can be remote managed so no monitor necessary - it's suspended most of the time - WOL and my VMs are ready to go!
- andrewguenther 9y agoFor all the people asking "why?" It's the same reason people pour money into home theater, cars, or any other hobby. People do this because they enjoy it.
- krolley 9y agoI like to have the "perfect" setup. Of course, that definition is relative and ever-changing. In reality, I end up spending an insane amount of time adjusting, switching to different software, or trying to get the last 1% of a feature working. It's not always enjoyable :-)
- darrmit 9y agoUnifi gear is great until you need something that the UI can’t do and figure out you’ve got to load a custom JSON config file from the controller. Their support is also atrociously bad. The Unifi product is getting better, but I sometimes wish I had gone with their EdgeRouter line instead of Unifi for routing and switching. I would say it’s certainly good enough for home, but I’d hesitate to use it in a lab environment where configs might get a little more unique.
- karlshea 9y agoI agree, I've got all UniFi at home except for my router, which is an EdgeRouter X.
- lvillani 9y agoI was under the impression that they were going to decommission the EdgeRouter line as more and more features get added to their UniFi line. (I have both and my EdgeRouter X feels definitely in “maintenance mode”).
- stephen_g 9y agoNo. They're trying to position the UniFi line as their 'enterprise networking' line and the EdgeMax line as their 'carrier networking' products (a lot of their customers are running small ISPs). Software wise, the UniFi line does seem a little more actively developed, but new EdgeRouter products are and have been coming out (like the 10Gbit EdgeRouter Infinity a little while ago, and the new EdgeRouter 4 etc.). I think a lot of the software slowness might have been that some of the devs on the EdgeMax team left (judging by the staff posting on the forums), so it's probably been taking a while for the new devs to get up to speed.
- ssijak 9y agoDoing stuff from terminal is easy. Finding anything on their forum is easy. And they answer all the questions. I got all things UNIFI, same as the guy that made the post, and I am not network engineer. Setting up the networking was easy and fun.
- 2bluesc 9y agoI've been experimenting with pfSense running via KVM on my Linux workstation. Was considering buying a Ubiquiti ER-4, but I don't think I can go back. I'm considering buying a CompuLab fitlet 2 to give pfSense a permanent home but may end up leaving it on my workstation. The increase in power consumption over leaving my workstation on 24/7 is probably neglible. But the fitlet2 seems simpler.
- outworlder 9y ago> I always have some random side project I am working on, whether it is making the world’s most over engineered desktop OS all running in containers Identified the author immediately by the opening sentence. The "overengineered" CoreOS deskop was great, I wish it became an actual project.
- sandGorgon 9y agoim actually very puzzled why more people dont use Mikrotik/RouterOS switches ? they seem super powerful at a fraction of the cost of "enterprise switches". It almost feels that Cisco is aspirational..
- lucaspiller 9y agoOver the summer I upgraded to gigabit symmetric fibre and wanted something a bit more 'enterprise' at home that wouldn't have any issues keeping up (compared to consumer wifi router running OpenWRT I'd used before). I bought a Mikrotik RB750Gr3 "hEX" and Unifi UAP-AC-Lite - it was around €180, so the same as buying a good consumer router. I admit I haven't had any performance issues with the router (although I'm not running any complicated routing rules), and out of the box it was setup to run as a NAT router, so it was just plug and play. However once I started digging into it I started reaching the limitations. As others have said the documentation is pretty bad, and the only way to tell if something is supported by your hardware is usually to try it and see what happens (or read a 40 page thread in the forums). Here are a few things I had issues with: - Using a USB LTE dongle as a backup WAN connection. At first the device wasn't recognised, I then connected it through a powered USB hub and it worked, but then after rebooting it wasn't recognised again, but if I physically reconnected it then it worked - but for a 'backup' that kind of sucked (this was later fixed in a software update). - VLANs. I wanted some ports to be tagged on a certain vlan, no matter what the device was sending (I want to have a 'media' VLAN), after I while I found out the hardware doesn't support that though, so I gave up on that idea. I setup the AP to have a guest network running on a separate vlan, and wanted that to have no access to my network, after trying for a few hours (and usually locking myself and having to factory reset the router each time) I gave up. This was only a stop-gap anyway, as I'd planned to get a managed PoE switch. - VPNs. I wanted to setup an outgoing OpenVPN client, and route some traffic through it based on IP (Netflix). I also wanted to setup an incoming OpenVPN server, so I could access my network from the outside. RouterOS has built in support for OpenVPN, but the features are somewhat limited, for example as a client it doesn't support certificate authentication (but as a server it does). The Unifi was a breeze in comparison, like the Apple of networking gear, but in the same way the options are somewhat limited (and having to install an application to configure networking gear feels weird). To be honest I liked OpenWRT better than both of these... the documentation, ease of use, and being a developer I feel right at home editing configuration files. I assume PFSense would be a good choice too.
- dreta 9y agoI wanted to find out more about the author, because the post looked interesting. Should not have started with Twitter. Why do people feel the need to wear their political agenda on their sleeve so much in this industry. "I love writing opinionated blog posts that make dudes go all ape shit and territorial if I didn’t do it the same way as them. Think for yourselves :) there can be more than one way ya doofuses it’s all about what your personal tradeoffs are." Is this the kind of response you want to have to people sharing their opinions on a public forum; having a productive discussion that you started.
- KaiserPro 9y agoI have: o Zotac dual nic with pfsense o netgear 24 port switch with vlans (no PoE, too expensive) o i5 NUC o quadcore atom ZFS storage box o 2x unifi AC APs o Many raspberry pis for environmental sensors/control and the like There are a number of VLANs some for public things like cheapy chinese CCTV (don't want that seeing the internal network) media and the spouse(s) Everything was controlled with puppet, now migrated to ansible. I was tempted to replace most of it with an old HP z600, but that would blow the power budget (all the compute when on consumes < 45watts) a z600 with dual CPU pulls about 100-130. There is an hosted Atom box that provide website, VPN and backup coordination.
- walrus01 9y agoOne of the best possible things you can do for your home network, if you have the knowledge to do it properly, is to separate the functions of modem, router and WAP into three separate devices. The cablemodems provided by Comcast, Charter and other that have built in NAT and wifi are atrocious and bug-ridden security nightmares. Example of a basic separated setup: DOCSIS 3.0 cablemodem that is a dumb layer 2 bridge: https://www.amazon.com/TP-Link-Download-Certified-Spectrum-TC-7610/dp/B010Q29YF8/ref=dp_ob_title_ce https://www.amazon.com/TP-Link-Download-Certified-Spectrum-T... router good for up to a 150-200 Mbps class cablemodem connection, $50: https://www.amazon.com/Ubiquiti-Networks-ER-X-Router/dp/B0144R449W https://www.amazon.com/Ubiquiti-Networks-ER-X-Router/dp/B014... if you want to mess around with stuff from the CLI, a ubiquiti edgerouter is actually a very tiny debian system. their edgerouter OS is a fork of vyatta and is developed by a team of people they hired away from vyatta when brocade acquired them. 802.11ac 2x2 MIMO dual band WAP: https://www.amazon.com/Ubiquiti-Unifi-Ap-AC-Lite-UAPACLITEUS/dp/B015PR20GY https://www.amazon.com/Ubiquiti-Unifi-Ap-AC-Lite-UAPACLITEUS... or go for the more expensive 3x3 MIMO and 802.11ac wave2 WAPs if you really feel the need for it. set up the unifi controller in a virtualbox VM that runs on your laptop and use it to do the initial setup/provisioning. bring up the VM whenever you need to make changes.
- DeltaWhy 9y agoWhat's the benefit of separating router and WAP vs. running OpenWRT on a wireless router?
- purplezooey 9y agoThe home lab is dead. With EC2 spot instances you can get machines for far cheaper than it costs to power them at home, unless you live in a place with super cheap power like less than $0.08/Kwh.