3 ms·

I've been thinking I wanted a router with two wi-fi networks. One that goes through the ISP and one that goes out over a proxy. I haven't found a solution jus

by jopsen 9y ago

I've been thinking I wanted a router with two wi-fi networks. One that goes through the ISP and one that goes out over a proxy. I haven't found a solution just yet. I guess a raspberry pi with iptables and routing based on device ID could do the trick too.

c22 9y ago
Why not just set up two wifi routers? This is surely also the best solution for ensuring data compartmentalization.
null0pointer 9y ago
I have just set this up a week ago at my apartment. I use hostapd and dnsmasq on a raspberry pi to make it a wireless AP. It is connected to the primary router via ethernet and uses iptables to route wifi traffic via ethernet. Then I just installed OpenVPN to route traffic via a VPN. I haven't tested for DNS leaks yet as this is an ongoing project. There are a couple of other things on my todo list still. Such as easier switching of VPN node (current method is to ssh in and restart OpenVPN with a new config...) and ad blocking. Hope this can help you although it's still a bit immature and quite hacky IMO
- jopsen 9y ago
  Neat, I considers using a raspberry pi, but I'm not sure the range is ideal.
kuon 9y ago
I use the following configuration: I run two tinyproxy instances on my home server and I point all browser traffic to the first instance. The first instance run with the default routing table on port 8888 and has entries like upstream localhost:8889 ".somesite.com" the second instance, which run on port 8889 is run with the vpn as default route (I use setfib under FreeBSD). With this setup, traffic goes by default directly on the net, but the tinyproxy config file can be used to redirect some traffic through the VPN. Of course, you can do it the other way around to have traffic by default on the VPN and direct some traffic.
- jopsen 9y ago
  Won't this leak DNS and won't lots of system process go avoid the HTTP_PROXY settings?
  - kuon 9y ago
    I have my own DNS server on my local network. And yes, this is only for my browser. But this is intended. If you want to route all traffic to a vpn for a specific machine, you can use pf rules to forward an ip through another routing table.

by jopsen 9y ago

c22 9y ago

Why not just set up two wifi routers? This is surely also the best solution for ensuring data compartmentalization.

null0pointer 9y ago

I have just set this up a week ago at my apartment. I use hostapd and dnsmasq on a raspberry pi to make it a wireless AP. It is connected to the primary router via ethernet and uses iptables to route wifi traffic via ethernet. Then I just installed OpenVPN to route traffic via a VPN. I haven't tested for DNS leaks yet as this is an ongoing project. There are a couple of other things on my todo list still. Such as easier switching of VPN node (current method is to ssh in and restart OpenVPN with a new config...) and ad blocking. Hope this can help you although it's still a bit immature and quite hacky IMO

jopsen 9y ago
Neat, I considers using a raspberry pi, but I'm not sure the range is ideal.

kuon 9y ago

I use the following configuration: I run two tinyproxy instances on my home server and I point all browser traffic to the first instance. The first instance run with the default routing table on port 8888 and has entries like upstream localhost:8889 ".somesite.com" the second instance, which run on port 8889 is run with the vpn as default route (I use setfib under FreeBSD). With this setup, traffic goes by default directly on the net, but the tinyproxy config file can be used to redirect some traffic through the VPN. Of course, you can do it the other way around to have traffic by default on the VPN and direct some traffic.

jopsen 9y ago
Won't this leak DNS and won't lots of system process go avoid the HTTP_PROXY settings?
- kuon 9y ago
  I have my own DNS server on my local network. And yes, this is only for my browser. But this is intended. If you want to route all traffic to a vpn for a specific machine, you can use pf rules to forward an ip through another routing table.