4 ms·

During this week I've been playing around with replacing my USG with my existing home server - it already has two NICs - my first thought was to run OPNSense in

by bpye 6y ago

During this week I've been playing around with replacing my USG with my existing home server - it already has two NICs - my first thought was to run OPNSense in a VM but nftables on NixOS seems to work well enough - there are a few examples floating online [0,1]. OpenBSD even supports the USG [2] but I couldn't think of much reason to keep the extra hardware. The next thing I want to do is reflash my Unifi APs with OpenWRT [3] - the hardware is fine, but at that point I'll get all the support without the controller software. My home environment is fairly basic so moving away isn't too hard - this would obviously be much harder for a small business... [0] - https://francis.begyn.be/blog/nixos-home-router https://francis.begyn.be/blog/nixos-home-router [1] - http://www.willghatch.net/blog/2020/06/22/nixos-raspberry-pi-4-google-fiber-router/ http://www.willghatch.net/blog/2020/06/22/nixos-raspberry-pi... [2] - https://www.openbsd.org/octeon.html https://www.openbsd.org/octeon.html [3] - https://openwrt.org/toh/ubiquiti/start https://openwrt.org/toh/ubiquiti/start

lostlogin 6y ago
> replacing my USG with my existing home server I like this idea too, but would prefer that the router was physically separated and before any hardware that was in the network. Is this a pointless concern?
- vageli 6y ago
  It's hard to say whether or not the concern is pointless without knowing its basis. Why do you want it physically separated?
  - lostlogin 6y ago
    I had assumed a setup which had several VMs, with one being a PFSense or similar to be less secure than a standalone firewall. Reading about the pros and cons leads me to conclude that security in a virtual setup is just fine.
- neolog 6y ago
  If your server is vulnerable to some threat, adding another barrier in front of it could help.
- jefurii 6y ago
  If you have your router in a separate box then you won't have to take down your whole network if you have to restart your VM host.
zbrozek 6y ago
I _do_ run opnsense in a VM and am very happy with the setup. My requirements for APs are simple but hard to satisfy. Ceiling mount, PoE, present-day-best 802.11 standard, and openwrt-capable.
zrail 6y ago
> The next thing I want to do is reflash my Unifi APs with OpenWRT My understanding is that this doesn't work anymore because Ubiquiti started signing firmware. Your link also goes to a blank page.
- kelnos 6y ago
  Depends on the hardware, I guess? I bought an AC AP Pro last fall and had no problem flashing OpenWRT on it.
- bpye 6y ago
  That’s odd, the link works for me but the wiki was very slow earlier. From what I’ve read Ubiquiti have made it harder to flash new hardware, but even the new ax APs are supported by OpenWRT. There is a commit with some info - it seems there is a way to disable signature verification [0]. [0] - https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=fb4d7a9680117a00721936c98ce41eeb2dea95c9 https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=fb...

by bpye 6y ago

lostlogin 6y ago

> replacing my USG with my existing home server I like this idea too, but would prefer that the router was physically separated and before any hardware that was in the network. Is this a pointless concern?

vageli 6y ago
It's hard to say whether or not the concern is pointless without knowing its basis. Why do you want it physically separated?
- lostlogin 6y ago
  I had assumed a setup which had several VMs, with one being a PFSense or similar to be less secure than a standalone firewall. Reading about the pros and cons leads me to conclude that security in a virtual setup is just fine.
neolog 6y ago
If your server is vulnerable to some threat, adding another barrier in front of it could help.
jefurii 6y ago
If you have your router in a separate box then you won't have to take down your whole network if you have to restart your VM host.

zbrozek 6y ago

I _do_ run opnsense in a VM and am very happy with the setup. My requirements for APs are simple but hard to satisfy. Ceiling mount, PoE, present-day-best 802.11 standard, and openwrt-capable.

zrail 6y ago

> The next thing I want to do is reflash my Unifi APs with OpenWRT My understanding is that this doesn't work anymore because Ubiquiti started signing firmware. Your link also goes to a blank page.

kelnos 6y ago
Depends on the hardware, I guess? I bought an AC AP Pro last fall and had no problem flashing OpenWRT on it.
bpye 6y ago
That’s odd, the link works for me but the wiki was very slow earlier. From what I’ve read Ubiquiti have made it harder to flash new hardware, but even the new ax APs are supported by OpenWRT. There is a commit with some info - it seems there is a way to disable signature verification [0]. [0] - https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=fb4d7a9680117a00721936c98ce41eeb2dea95c9 https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=fb...