9 ms·

Teaching a cheap ethernet switch new tricks (2019)

229 points by throwoutway 5y ago

bluedino 5y ago
How much throughput does a device like this get with wireguard?
- Hello71 5y ago
  Normally, terrible. These systems are built with anemic, usually single-core CPUs usually in the low 100s MHz. The only way they can actually do gigabit switching is by hardware offload to dedicated ASICs. Anything going through the main CPU, even without encryption, will have terrible performance.
baybal2 5y ago
You don't need ONIE, nor any of that "Open" Compute stuff. Linux has recently got native framework for control of switching chips called "Distributed Switch Architecture." This turns a lot of very cheap hardware with very basic hardware switching chips into high performance routers.
- ComputerGuru 5y ago
  Can that do L2 port management as well or is it restricted to L3 operations?
  - stephen_g 5y ago
    Yes. For example, if you bridge switch ports, it actually sets up the switch to do it in the switch hardware instead of in the kernel.
- stephen_g 5y ago
  I don’t think there are any DSA drivers for Broadcom switch ICs (like the one in the device in the article) though? At least not in mainline last time I checked… EDIT: No, actually, I was mistaken - there is one Broadcom series supported now I look again, BCM53xx, of which the one in the article does indeed appear to be. Looks like since the 4.8 kernel though, so not in the 4.4 kernel that comes with the device.
  - josteink 5y ago
    OpenWRT 21.02 supports DSA for select devices OOB (replaces swconf) and ships with a really recent 5.4 Linux kernel for all supported devices. So going for a cheap, 2nd hand router supported by OpenWRT is probably the easiest and cheapest way there.
- dhess 5y ago
  Interesting! Is there a site that documents which off-the-shelf switch models work with DSA?
  - wtallis 5y ago
    The most recent release of OpenWRT has started to migrate to DSA: https://openwrt.org/releases/21.02/notes-21.02.0#initial_dsa_support https://openwrt.org/releases/21.02/notes-21.02.0#initial_dsa... Their table of supported hardware for each of the platforms now using DSA probably includes all of the most affordable devices, since OpenWRT is mostly focused on consumer-grade equipment (and mostly routers/APs, but they support some purpose-built switches using Realtek CPUs).
geenew 5y ago
My main thought reading this as a non-network admin was of Mr Robot, and all the Linux installs on low level hardware used for hacks on that show. Very interesting read and lots of upside to what is discussed, but the thought of the uncountable, almost invisible operating systems running in a large network give me a odd feeling in the pit of my stomach. So many potential places for malfeasance to hide.
- myself248 5y ago
  Keep that feeling in the pit of your stomach for a few years. Watch as a multitude of forces (mostly related to surveillance capitalism) foist billions of such devices on unsuspecting consumers. Tell anyone who'll listen, how shortsighted this is, how much of a fall it's setting us up for. Watch it happen anyway. Watch it accelerate. Watch the devices grow in complexity, capability, connectivity, and vulnerability. Watch innumerable manufacturers go out of business with no software-update succession plan, no code escrow, no upgrade path for victi^H^H^H^H^H end users. The pit of your stomach gets pretty damn sick of the state of things.
  - matheusmoreira 5y ago
    Cyberpunk used to be fiction. It disgusts me when I realize I'm already living in it.
    - bigiain 5y ago
      That feeling in the pit of your stomach when you realise you've been _building_ it hurts. I still feel complicit. I worked for a hardware startup in 2013/2014. Part of my role was to populate and run the private pacman server that the devices got their OS and software updates from (we ran ARCH, but didn't connect to the public ARCH pacman repos, because we had some hardware specific code and kernel mods we needed to work, so we tested everything that updated on there public pacman repos before letting the devices load them). The startup failed after the first batch of products were shipped - as they are wont to do. Much acrimony about who owned what. I kept the Linode instance running the pacman server on my own credit card for years, but eventually the domain name (or perhaps the dns hosting, I don't recall) expired and the only devices that still knew how to get to the repo were my own. If I'd have a heads-up that dns was going to die, I could have pushed a config change to use a domain name under my control, but it just unexpectedly switched off. There were only a few hundred devices I was keeping software updates flowing to. But the feeling of despair when I was no longer able to do that and finally decommissioned that Linode server was heartbreaking.
Damogran6 5y ago
I'm not seeing them on this side of the pond for less than about $425...did the author drop a zero in the price?
- rusk 5y ago
  Sadly since the majority of these [ONIE] switches are aimed at datacenter deployments they are generally unsuitable for use on my desk. ... On top these switches would be aggressively priced out of my budget ... That was until I found the Dell N1100 series, ... And I found a cheap vendor that sold refurbished ones for around 85 GBP. > did the author drop a zero in the price? Not far off ...
  - benjojo12 5y ago
    (Author here) These switches got a lot more expensive at the start of the pandemic, I think the chipsets became hard to source.
    - dspillett 5y ago
      Some network devices and other kit became harder to find (or jumped in price) as people upgraded their home environments for working from home. While many buying for themselves would have stuck with even cheaper consumer-grade kit, companies that wanted to monitor/manage their remote workers' network would have wanted something that is possible to monitor/manage from afar (which a bog standard “dumb switch” wouldn't offer).
      - navaati 5y ago
        Oh the horror, does that actually happen ?
        dspillett 5y ago
        Yes, but rarely. Usually in "high security" businesses worried about exfiltration of client data or other company secrets & data assets, when it is done. Basically they give you a work network extension at home that piggy-backs on your connection but keeps itself segregated from the rest of your home network (so hopefully not monitoring that, but you never know!) via VPN and managed switch/router. Like a normal VPN-from-home scenario but with more careful control/monitoring as if your location were a fuller satellite office. Potentially useful for support too, though that is a beneficial side effect rather than a reason to go to the extra effort.
rusk 5y ago
Minor Quibble: £85 is not a cheap ethernet switch. It's an entertaining and informative read, but it's more like low-end datacentre hardware than that cheap €25 switch I've got in my home office. A little disappointing as I was hoping I'd have a cheeky high-bandwidth raspberry-pi alternative on my hands ...
- bserge 5y ago
  My favorites are TP-Link's WDR3600/4300, AC1200 and AC1750. Yeah, not switches per se, but $20-40, Gigabit Ethernet, dual band Wifi, very stable and fast with OpenWRT, can do anything. You can daisy chain a few of them if you need more ports, it's rather fun.
  - potiuper 5y ago
    Or instead of being a penny pincher get an AX wireless router and not contribute more ewaste.
    - brnt 5y ago
      Which would you recommend?
      - potiuper 5y ago
        The AX series is the current TP-Link offering for most use cases starting at ~$80: https://www.newegg.com/p/pl?N=50012120%20100158096%20601356803&Manufactory=12120 https://www.newegg.com/p/pl?N=50012120%20100158096%206013568... In addition, the AX3200 Belkin (RT3200) is $100, and the $140 Linksys (E8450) are both listed as supporting OpenWRT.
        danhor 5y ago
        It seems like at least the TP-Link AX50 won't have openwrt support anytime soon (or more likely at all), so even worse for long usage times.
      - 5y ago
coding-saints 5y ago
I love I can still unexpectedly find a post that reminds me of why I even decided to focus on tech-related career. Great article! For me, following you down the rabbit hole is better than the result. Thanks.
wyager 5y ago
The author mentioned that 10gig switches were expensive and loud, but these days you can get fanless 10gig switches for pretty cheap. I have a fanless mikrotik switch at home with 4 10Gb SFP+ ports that cost like $130 (and has excellent industrial design).
- hosteur 5y ago
  Cool. Which one?
  - cure 5y ago
    Presumably the CRS112-8G-4S-IN, though I'm not sure that those SFP cages can do 10 Gigabit...
    - dale_glass 5y ago
      That won't do, no. You need SFP+, for example https://mikrotik.com/product/css610_8g_2s_in https://mikrotik.com/product/css610_8g_2s_in
  - wyager 5y ago
    CRS305-1G-4S+IN
caminante 5y ago
Off-topic, but I just learned about another, practical networking utility, yesterday. "powerline adaptors" [0] Basically, buy these adaptors and for ~$100, you can have create a "wired" LAN connection using power outlets in a home. [0] https://www.techradar.com/news/the-best-powerline-adaptors https://www.techradar.com/news/the-best-powerline-adaptors
- techopoly 5y ago
  Can confirm, these are legit. Make sure you're aware of any outlets on the outside of your building though, as these could be plugged into with malicious intent.
  - severino 5y ago
    > Make sure you're aware of any outlets on the outside of your building though I guess this also means inside your neighbor's home, if you live in an apartment building, right? That's why those devices typically use AES for encrypting the signal between the paired ones.
    - cma 5y ago
      I would assume any neighbor's houses that come off the same transformer too.
- jchw 5y ago
  In practice, my problem with these is reliability. They can have noticeable issues with maintaining an uninterrupted, low latency connection suitable for real time use, in my experience; and this was with a fairly high end powerline adapter. This is unfortunate, because it would be very convenient if you didn’t have to deal with making ethernet cable runs all over the place…
  - gattilorenz 5y ago
    > In practice, my problem with these is reliability. They can have noticeable issues with maintaining an uninterrupted, low latency connection True,especially when a microwave, washing machine or other motor starts sending noise down the power line...
Amin699 5y ago
This kernel is actually pretty new! This is a good sign for us, since embedded devices have a habit of running reasonably old kernels with limited features. The downside is that there is generally very limited support for ONIE devices running arm, and after a large amount of searching, there are no compatible ONIE images for this device at all, other than the already installed Dell OS.
anonymousisme 5y ago
The Dell N1100 is a nice switch, but a relatively new product (<3 years old). Also, the article mentions how noisy the cooling fans can be in "enterprise" grade switches, but they are quite loud in the N series too (at least in the case of the N3048). Early this year, I got contacted by DellEMC via a voicemail message, which I initially thought was spam or phishing because they should have used the email associated with my DellEMC support account. It turned out that the voicemail was legit, and the message was that I needed to update the firmware in all of our switches (including N1100) before 7/27/2021, or they would all stop working(!) It turns out that the feature license management system had a root certificate that was due to expire, and all licensed features would cease to function if the switches were not upgraded. I spent about a day on the phone with them upgrading our switches, and (almost) everything turned out okay in the end. Below is my survey response to their support feedback request: 1) The products should not have a built-in time-bomb that causes them to stop working after only a few years. 2) Dell should have informed us of this issue by email. Instead they left a very "phishing" like voicemail on a manager's phone. (Not the phone of the registered point-of-contract for the cluster.) Perhaps this was done to avoid leaving evidence of #1 above? 3) I spent over an hour on hold when I returned the call, and was then disconnected. After trying again (to an extension other than the one given in the message), I reached somebody who confirmed the issue. I spent another four hours on the phone resolving it. 4) Shortly after all of the above, I discovered a new issue that severely impacted the cluster. The n3048 switch would no longer auto-negotiate a 100Mbps Ethernet link. Our network watchdog device (iBoot) was continuously cycling the power on our Internet Ingress (ONT+ASA). 5) I spent even more time troubleshooting and resolving this issue (by locking the iBoot port to 100Mbps instead of leaving it on Auto). 6) I did not waste any more of my time by reporting this issue. The technician I worked with to upgrade these switches assured me that the firmware releases we used were "stable".
- benjojo12 5y ago
  (Post Author here) The non POE N1100's are fanless, Thankfully don't really contain any features that would require licencing, that being said also has no hardware Layer 3 capability, so not really in the same class as the N3XXX or N2XXX's The licencing thing does suck though, that's poor from Dell who normally (at least switches wise) do a reasonably good job for the price.
m463 5y ago
I've been running openwrt on switches for a while. I originally had two mikrotik rb2011* switches and a rb750gl, now I have two rb3011 switches.
system2 5y ago
TP-Link 5 port ethernet switch is cheap which is $12. The one in the article is not, which is $690. I know companies with server included budget less than this "cheap" switch. Nice tricks but clickbait title.
phibz 5y ago
I just bought a Friendlyarm r4s two port gigabit rk3399 4GB linux SBC for $90 USD. It supposedly has hardware acceleration for networking. Though I see 910 Mbps vs the 950Mbps I was getting with the ATT router. I was able to acquire my EAP-TLS certs and can connect directly to the ONT. I even got ipv6 prefix delegation and wireguard working. Next up is transparent ad blocking a la pihole. It's a fantastic device if all you need is 2 ports.
rootsudo 5y ago
The writing reminds me of a 2600 article. I miss those days. Super cool though! I'll pick one up, eventually :)
axiolite 5y ago
An interesting read, but I just don't understand why ONIE was even desirable. Cheap OpenWRT switches+routers can do Wireguard as easily as any Linux system.

229 points by throwoutway 5y ago

bluedino 5y ago

How much throughput does a device like this get with wireguard?

Hello71 5y ago
Normally, terrible. These systems are built with anemic, usually single-core CPUs usually in the low 100s MHz. The only way they can actually do gigabit switching is by hardware offload to dedicated ASICs. Anything going through the main CPU, even without encryption, will have terrible performance.

baybal2 5y ago

You don't need ONIE, nor any of that "Open" Compute stuff. Linux has recently got native framework for control of switching chips called "Distributed Switch Architecture." This turns a lot of very cheap hardware with very basic hardware switching chips into high performance routers.

ComputerGuru 5y ago
Can that do L2 port management as well or is it restricted to L3 operations?
- stephen_g 5y ago
  Yes. For example, if you bridge switch ports, it actually sets up the switch to do it in the switch hardware instead of in the kernel.
stephen_g 5y ago
I don’t think there are any DSA drivers for Broadcom switch ICs (like the one in the device in the article) though? At least not in mainline last time I checked… EDIT: No, actually, I was mistaken - there is one Broadcom series supported now I look again, BCM53xx, of which the one in the article does indeed appear to be. Looks like since the 4.8 kernel though, so not in the 4.4 kernel that comes with the device.
- josteink 5y ago
  OpenWRT 21.02 supports DSA for select devices OOB (replaces swconf) and ships with a really recent 5.4 Linux kernel for all supported devices. So going for a cheap, 2nd hand router supported by OpenWRT is probably the easiest and cheapest way there.
dhess 5y ago
Interesting! Is there a site that documents which off-the-shelf switch models work with DSA?
- wtallis 5y ago
  The most recent release of OpenWRT has started to migrate to DSA: https://openwrt.org/releases/21.02/notes-21.02.0#initial_dsa_support https://openwrt.org/releases/21.02/notes-21.02.0#initial_dsa... Their table of supported hardware for each of the platforms now using DSA probably includes all of the most affordable devices, since OpenWRT is mostly focused on consumer-grade equipment (and mostly routers/APs, but they support some purpose-built switches using Realtek CPUs).

geenew 5y ago

My main thought reading this as a non-network admin was of Mr Robot, and all the Linux installs on low level hardware used for hacks on that show. Very interesting read and lots of upside to what is discussed, but the thought of the uncountable, almost invisible operating systems running in a large network give me a odd feeling in the pit of my stomach. So many potential places for malfeasance to hide.

myself248 5y ago
Keep that feeling in the pit of your stomach for a few years. Watch as a multitude of forces (mostly related to surveillance capitalism) foist billions of such devices on unsuspecting consumers. Tell anyone who'll listen, how shortsighted this is, how much of a fall it's setting us up for. Watch it happen anyway. Watch it accelerate. Watch the devices grow in complexity, capability, connectivity, and vulnerability. Watch innumerable manufacturers go out of business with no software-update succession plan, no code escrow, no upgrade path for victi^H^H^H^H^H end users. The pit of your stomach gets pretty damn sick of the state of things.
- matheusmoreira 5y ago
  Cyberpunk used to be fiction. It disgusts me when I realize I'm already living in it.
  - bigiain 5y ago
    That feeling in the pit of your stomach when you realise you've been _building_ it hurts. I still feel complicit. I worked for a hardware startup in 2013/2014. Part of my role was to populate and run the private pacman server that the devices got their OS and software updates from (we ran ARCH, but didn't connect to the public ARCH pacman repos, because we had some hardware specific code and kernel mods we needed to work, so we tested everything that updated on there public pacman repos before letting the devices load them). The startup failed after the first batch of products were shipped - as they are wont to do. Much acrimony about who owned what. I kept the Linode instance running the pacman server on my own credit card for years, but eventually the domain name (or perhaps the dns hosting, I don't recall) expired and the only devices that still knew how to get to the repo were my own. If I'd have a heads-up that dns was going to die, I could have pushed a config change to use a domain name under my control, but it just unexpectedly switched off. There were only a few hundred devices I was keeping software updates flowing to. But the feeling of despair when I was no longer able to do that and finally decommissioned that Linode server was heartbreaking.

Damogran6 5y ago

I'm not seeing them on this side of the pond for less than about $425...did the author drop a zero in the price?

rusk 5y ago
Sadly since the majority of these [ONIE] switches are aimed at datacenter deployments they are generally unsuitable for use on my desk. ... On top these switches would be aggressively priced out of my budget ... That was until I found the Dell N1100 series, ... And I found a cheap vendor that sold refurbished ones for around 85 GBP. > did the author drop a zero in the price? Not far off ...
- benjojo12 5y ago
  (Author here) These switches got a lot more expensive at the start of the pandemic, I think the chipsets became hard to source.
  - dspillett 5y ago
    Some network devices and other kit became harder to find (or jumped in price) as people upgraded their home environments for working from home. While many buying for themselves would have stuck with even cheaper consumer-grade kit, companies that wanted to monitor/manage their remote workers' network would have wanted something that is possible to monitor/manage from afar (which a bog standard “dumb switch” wouldn't offer).
    - navaati 5y ago
      Oh the horror, does that actually happen ?
      - dspillett 5y ago
        Yes, but rarely. Usually in "high security" businesses worried about exfiltration of client data or other company secrets & data assets, when it is done. Basically they give you a work network extension at home that piggy-backs on your connection but keeps itself segregated from the rest of your home network (so hopefully not monitoring that, but you never know!) via VPN and managed switch/router. Like a normal VPN-from-home scenario but with more careful control/monitoring as if your location were a fuller satellite office. Potentially useful for support too, though that is a beneficial side effect rather than a reason to go to the extra effort.

rusk 5y ago

Minor Quibble: £85 is not a cheap ethernet switch. It's an entertaining and informative read, but it's more like low-end datacentre hardware than that cheap €25 switch I've got in my home office. A little disappointing as I was hoping I'd have a cheeky high-bandwidth raspberry-pi alternative on my hands ...

bserge 5y ago
My favorites are TP-Link's WDR3600/4300, AC1200 and AC1750. Yeah, not switches per se, but $20-40, Gigabit Ethernet, dual band Wifi, very stable and fast with OpenWRT, can do anything. You can daisy chain a few of them if you need more ports, it's rather fun.
- potiuper 5y ago
  Or instead of being a penny pincher get an AX wireless router and not contribute more ewaste.
  - brnt 5y ago
    Which would you recommend?
    - potiuper 5y ago
      The AX series is the current TP-Link offering for most use cases starting at ~$80: https://www.newegg.com/p/pl?N=50012120%20100158096%20601356803&Manufactory=12120 https://www.newegg.com/p/pl?N=50012120%20100158096%206013568... In addition, the AX3200 Belkin (RT3200) is $100, and the $140 Linksys (E8450) are both listed as supporting OpenWRT.
      - danhor 5y ago
        It seems like at least the TP-Link AX50 won't have openwrt support anytime soon (or more likely at all), so even worse for long usage times.
    - 5y ago

coding-saints 5y ago

I love I can still unexpectedly find a post that reminds me of why I even decided to focus on tech-related career. Great article! For me, following you down the rabbit hole is better than the result. Thanks.

wyager 5y ago

The author mentioned that 10gig switches were expensive and loud, but these days you can get fanless 10gig switches for pretty cheap. I have a fanless mikrotik switch at home with 4 10Gb SFP+ ports that cost like $130 (and has excellent industrial design).

hosteur 5y ago
Cool. Which one?
- cure 5y ago
  Presumably the CRS112-8G-4S-IN, though I'm not sure that those SFP cages can do 10 Gigabit...
  - dale_glass 5y ago
    That won't do, no. You need SFP+, for example https://mikrotik.com/product/css610_8g_2s_in https://mikrotik.com/product/css610_8g_2s_in
- wyager 5y ago
  CRS305-1G-4S+IN

caminante 5y ago

Off-topic, but I just learned about another, practical networking utility, yesterday. "powerline adaptors" [0] Basically, buy these adaptors and for ~$100, you can have create a "wired" LAN connection using power outlets in a home. [0] https://www.techradar.com/news/the-best-powerline-adaptors https://www.techradar.com/news/the-best-powerline-adaptors

techopoly 5y ago
Can confirm, these are legit. Make sure you're aware of any outlets on the outside of your building though, as these could be plugged into with malicious intent.
- severino 5y ago
  > Make sure you're aware of any outlets on the outside of your building though I guess this also means inside your neighbor's home, if you live in an apartment building, right? That's why those devices typically use AES for encrypting the signal between the paired ones.
  - cma 5y ago
    I would assume any neighbor's houses that come off the same transformer too.
jchw 5y ago
In practice, my problem with these is reliability. They can have noticeable issues with maintaining an uninterrupted, low latency connection suitable for real time use, in my experience; and this was with a fairly high end powerline adapter. This is unfortunate, because it would be very convenient if you didn’t have to deal with making ethernet cable runs all over the place…
- gattilorenz 5y ago
  > In practice, my problem with these is reliability. They can have noticeable issues with maintaining an uninterrupted, low latency connection True,especially when a microwave, washing machine or other motor starts sending noise down the power line...

Amin699 5y ago

This kernel is actually pretty new! This is a good sign for us, since embedded devices have a habit of running reasonably old kernels with limited features. The downside is that there is generally very limited support for ONIE devices running arm, and after a large amount of searching, there are no compatible ONIE images for this device at all, other than the already installed Dell OS.

anonymousisme 5y ago

The Dell N1100 is a nice switch, but a relatively new product (<3 years old). Also, the article mentions how noisy the cooling fans can be in "enterprise" grade switches, but they are quite loud in the N series too (at least in the case of the N3048). Early this year, I got contacted by DellEMC via a voicemail message, which I initially thought was spam or phishing because they should have used the email associated with my DellEMC support account. It turned out that the voicemail was legit, and the message was that I needed to update the firmware in all of our switches (including N1100) before 7/27/2021, or they would all stop working(!) It turns out that the feature license management system had a root certificate that was due to expire, and all licensed features would cease to function if the switches were not upgraded. I spent about a day on the phone with them upgrading our switches, and (almost) everything turned out okay in the end. Below is my survey response to their support feedback request: 1) The products should not have a built-in time-bomb that causes them to stop working after only a few years. 2) Dell should have informed us of this issue by email. Instead they left a very "phishing" like voicemail on a manager's phone. (Not the phone of the registered point-of-contract for the cluster.) Perhaps this was done to avoid leaving evidence of #1 above? 3) I spent over an hour on hold when I returned the call, and was then disconnected. After trying again (to an extension other than the one given in the message), I reached somebody who confirmed the issue. I spent another four hours on the phone resolving it. 4) Shortly after all of the above, I discovered a new issue that severely impacted the cluster. The n3048 switch would no longer auto-negotiate a 100Mbps Ethernet link. Our network watchdog device (iBoot) was continuously cycling the power on our Internet Ingress (ONT+ASA). 5) I spent even more time troubleshooting and resolving this issue (by locking the iBoot port to 100Mbps instead of leaving it on Auto). 6) I did not waste any more of my time by reporting this issue. The technician I worked with to upgrade these switches assured me that the firmware releases we used were "stable".

benjojo12 5y ago
(Post Author here) The non POE N1100's are fanless, Thankfully don't really contain any features that would require licencing, that being said also has no hardware Layer 3 capability, so not really in the same class as the N3XXX or N2XXX's The licencing thing does suck though, that's poor from Dell who normally (at least switches wise) do a reasonably good job for the price.

m463 5y ago

I've been running openwrt on switches for a while. I originally had two mikrotik rb2011* switches and a rb750gl, now I have two rb3011 switches.

system2 5y ago

TP-Link 5 port ethernet switch is cheap which is $12. The one in the article is not, which is $690. I know companies with server included budget less than this "cheap" switch. Nice tricks but clickbait title.

phibz 5y ago

I just bought a Friendlyarm r4s two port gigabit rk3399 4GB linux SBC for $90 USD. It supposedly has hardware acceleration for networking. Though I see 910 Mbps vs the 950Mbps I was getting with the ATT router. I was able to acquire my EAP-TLS certs and can connect directly to the ONT. I even got ipv6 prefix delegation and wireguard working. Next up is transparent ad blocking a la pihole. It's a fantastic device if all you need is 2 ports.

rootsudo 5y ago

The writing reminds me of a 2600 article. I miss those days. Super cool though! I'll pick one up, eventually :)

axiolite 5y ago

An interesting read, but I just don't understand why ONIE was even desirable. Cheap OpenWRT switches+routers can do Wireguard as easily as any Linux system.