12 ms·
Raspberry Pi as a router using a single network interface
- cf100clunk 5y agoTitle should really have said "with a managed switch".
- AnIdiotOnTheNet 5y agoIt is actually possible to do it without a managed switch (and therefore vlans). You just assign a separate subnet between your router and modem than what you use internally and put both router addresses on the same interface.
- tw04 5y agoWith a single port? How exactly are you planning on preventing one of your end-hosts from pulling the external IP by accident anytime the modem or pi gets rebooted? Are you going to make every host on the LAN a static IP? Ignoring the security implications.
- tmottabr 5y agoif your connection require authentication, like pppoe, you can just disable the dhcp on the modem and use statis addresses between the modem and the pi. then the actual connection will be established by the pi via pppoe and the only DHCP would be the pi when it is up. As for the security implications, i agree.. It surely is a crappy design for the network but it can be done..
- AnIdiotOnTheNet 5y ago> How exactly are you planning on preventing one of your end-hosts from pulling the external IP by accident anytime the modem or pi gets rebooted? Depends on the modem, but since many of them are also routers you just set them up to do single-nat to a static IP corresponding to the "WAN" address of your pi and otherwise not act as a DHCP server at all. Otherwise you could also get a static IP from your ISP so nothing ever changes. > Are you going to make every host on the LAN a static IP? No, they get DHCP addresses from the pi. > Ignoring the security implications. I said it was possible, not that it was a good idea.
- tw04 5y ago>Depends on the modem, but since many of them are also routers you just set them up to do single-nat to a static IP corresponding to the "WAN" address of your pi and otherwise not act as a DHCP server at all. Otherwise you could also get a static IP from your ISP so nothing ever changes. If your modem is doing NAT there's literally no reason for this setup. And it would cause even more issues because you'd have two DHCP servers on the same subnet offering up more than one IP. Even if you set the LAN side of the modem to disable DHCP and only offer a static address, you've still got both the "public" NAT address and "private" in the arp table of all of your hosts. You will absolutely run into issues. >No, they get DHCP addresses from the pi. If you have the modem spitting out DHCP addresses and the PI spitting out DHCP addresses you cannot force your end hosts to grab them from one or the other, they get whichever responds first.
- AnIdiotOnTheNet 5y ago> If your modem is doing NAT there's literally no reason for this setup. Unless you wanted more options than your crappy router/modem gives you. > And it would cause even more issues because you'd have two DHCP servers on the same subnet offering up more than one IP. No, I specifically said the modem would have to not act as a DHCP server at all, just turn it off. > Even if you set the LAN side of the modem to disable DHCP and only offer a static address, you've still got both the "public" NAT address and "private" in the arp table of all of your hosts. Incorrect on two counts. 1) ARP tables only store address translations for your subnet precisely because all addresses not on your subnet must be reached through a gateway. 2) there are only two addresses in the modem<->pi subnet because the pi is performing NAT/PAT for your "LAN" subnet. > You will absolutely run into issues. Maybe, it has been a while since I've done anything this silly, but as I recall from doing stuff like this in a lab I had no issues shoving as many subnets as I wanted to on the same network without VLANs. > If you have the modem spitting out DHCP addresses and the PI spitting out DHCP addresses [...] You don't. You disable DHCP on the modem.
- packetslave 5y agoThis is (or was) a pretty common network design called "router on a stick" https://en.wikipedia.org/wiki/Router_on_a_stick https://en.wikipedia.org/wiki/Router_on_a_stick I wouldn't have thought to do it with a Pi, though. Neat.
- louwrentius 5y agoThanks, I new about the term but I thought it meant something else ;) I'll add it to the article.
- aneutron 5y agoThat's a very neat trick. Thank you. I think I will use just that. I don't have much space for proper networking gear, so this will be perfect for me. Maybe with something more buff (an Intel NUC ?)
- louwrentius 5y agoYou're welcome. You can use any compute you want. Any x86 device from the last 15 years can handle gigabit internet including firewalling with iptables.
- mongol 5y agoSome day I hope there will be a Raspberry Pi with two network interfaces.
- Nux 5y agoYou can push 1Gbps through a usb3 ethernet adapter.
- CameronNemo 5y agoI tried on my rock64 and only got ~900 Mbps haha. Rpi CPU is beefier, though.
- forty 5y agoYes there a a bunch of good rk3328 based board with 2 Gb eth ports. If you need something beefier there is the rk3399 based boards (pine64's rockpro64 has only a single Ethernet port but there is for example the nanopi r4s which has 2). I'm not sure what's the heat is like if you do gigabit NAT with them though :)
- zokier 5y agoThis RK3568 board looks interesting, but I have no idea if "firefly" is any decent vendor; that is generally the problem with these random chinese boards. https://en.t-firefly.com/product/industry/rocrk3568pc.html https://en.t-firefly.com/product/industry/rocrk3568pc.html RK3568 has 2xGbe built-in, and the board has additionally a Wifi 6 chip (broadcom), seems like pretty ideal router platform to me. There are even some hints that it might have half-decent mainline support, but who knows really though..
- GhettoComputers 5y agohttps://pine64.com/product-category/single-board-computers/ https://pine64.com/product-category/single-board-computers/ Try pine64 if you must, they release hardware for the software community to add features. You can just use a spare laptop with less cost, more performance, and neglegible energy cost differences unless your electric bills are very high rates.
- sigmaprimus 5y agoNow a days with open wrt and dd-wrt firmwares for many routers, there is not much point in using RPis and switches unless they are just laying around in your junk drawer. It might be a usefull part of a RPi LAMP server setup I suppose.
- dsissitka 5y ago> Now a days with open wrt and dd-wrt firmwares for many routers, there is not much point in using RPis and switches unless they are just laying around in your junk drawer. I feel like it's the other way around. A Pi 4 is cheaper and more performant than many (Most?) consumer grade routers. They'll do cake at gig if you set the clock speed to 2 GHz.
- cf100clunk 5y agoThere is often a good increase in performance of a consumer grade router once one of the wrt flavours is installed, so in my mind it would be simpler to just flash it rather than set up a Pi4 like this. Anyways, as was said earlier, if you have a Pi4 in a drawer and you have a need and a managed switch, this is a good use.
- danhor 5y agoYou have very few consumer routers with a CPU capable of routing a gigabit with a firewall (using the Linux network stack). All (consumer) routers implement parts of this in hardware, most of which OpenWRT doesn't support. (For this reason, OpenWRT implements software offloading which skips a lot of the Linux network stack, but is partially broken in the latest release)
- cf100clunk 5y agoI was getting at what options there might be with what is at hand, which a previous commenter mentioned, but your points are probably showstoppers for anyone comparing the Pi4 vs consumer router solutions as a starting point.
- deleted 5y ago[deleted]
- supertrope 5y agoI was tempted to do this but am concerned that VLANs are not a security boundary, this might expose the switch’s control plane to WAN, and the Pi has a failure prone micro SD card. The Pi 4 CPU is faster than most consumer routers and can shape a gigabit! https://www.blackhat.com/presentations/bh-usa-02/bh-us-02-convery-switches.pdf https://www.blackhat.com/presentations/bh-usa-02/bh-us-02-co...
- louwrentius 5y agoAuthor here, I think the security of using VLANs isn't much of an issue in this context. The old layer-2 attacks you linked to are absolute risks, but not in this setting, I believe.
- supertrope 5y agoGood to know!
- zokier 5y agoVLANs absolutely can be considered security boundary. Sure, you can misconfigure switch and expose something unintentionally. But as a technology VLANs are pretty battle-hardened. Random reddit discussion on the topic https://www.reddit.com/r/networking/comments/opmjol/vlan_segmentation_as_security_do_you_trust_it/ https://www.reddit.com/r/networking/comments/opmjol/vlan_seg... That BH presentation is 20 years old now, and almost completely Cisco specific. I would not make security decisions on such data alone.
- supertrope 5y agoThanks
- CodeGlitch 5y ago> the Pi has a failure prone micro SD card This depends on the type and quality of the SD card does it not? Also you can setup the PI's OS to be read-only, so no writes to the SD card. This should extend the life of the SD card by quite a lot.
- mrmattyboy 5y agoProbably an unpopular opinion, but if you don't already know about VLANs, then probably shouldn't be connecting devices "straight to the internet" or configuring a firewall
- louwrentius 5y agoFrankly, this sounds like gate keeping, not a fan. I think that even people who do have some interest in running their own firewall, may not be familiar with VLANs.
- mrmattyboy 5y agoI could see that, but when first learning about firewalls and such, start in an isolated environment.. test with VMs, old machines, whatever. Putting machines on the internet misconfigured can both put you at risk, but can also mean another device ends up in the hands of a botnet - thinking the internet outside of a firewall is any friendlier than the "real world" in the matrix is just fantasy. If someone is interested in weapons or guns, you wouldn't want them to try out their skills by putting them straight into a war zone. If someone put a tutorial on a forum for gas-engineers, about how great and easy redoing the pipes in their house because they bought a blow torch, they'd be concerns for the safety of them and the people/houses around them, surely. > I think that even people who do have some interest in running their own firewall, may not be familiar with VLANs. Even the all-in-one appliances/disros provide a lot of documentation on the topic
- jeroenhd 5y agoI disagree. You can easily configure and manage your own failover-capable, multi-gateway home firewall without ever learning about VLANs if all you have is a cheap motherboard, a USB ethernet dongle and a cheap switch because your networking needs are quite complex before you ever even need VLANs. Maybe a home network admin might need to enter a "VLAN number" to get their traffic routed to their ISP, but that's it, and that's usually just a number you copy from some guide online. Gatekeeping people because they never learned about or worked with the VLANs found in more expensive hardware is stupid. If you know you way around VLANs but don't know how to properly configure a firewall, you're much more of a danger to the outside world than the other way around. I agree that there is some minimum skill level people should have before they hook stuff up to the public web (how to prevent being part of a botnet/DDoS amplification, how to block insecure/IoT management interfaces from the outside world, that stuff), but VLANs are an arbitrary and irrelevant thing to require people to know about.
- dormando 5y agoDid this earlier in the year with an rpi4 and a netgear managed switch. It can route 780mbit down/up (nftables)! Can probably get closer to 900mbit with some overclocking, and reduce latency slightly by pinning the rpi's clock but haven't really cared to. The hard part was finding a cheap managed switch which does _not_ expose the management interface on every vlan. This is a specific product feature (wtf?) and often the only difference between two product lines. Ended up with a netgear GS308T - the internet is full of rage at the device requiring you to log into netgear and register it, but I can confirm that I didn't have to do anything. I set it up with it connected directly to a laptop and have never signed up for a netgear account, though they may lock this down in the future. I was even able to upgrade the firmware. Would've preferred a model with ssh access but tp-link wasn't selling them at the time? Wanted to be able to mix multiple ISP's together (but ended up only having one for now), which would've been 2+ USB NICs and not great for perf. The other reason why I ended up here is because OpenWRT/etc support for wifi6 routers wasn't/isn't coming, and I want to be able to place my WAP in a different location than the router and main switch... so the WAP is a wifi6 thing running stock firmware but in "WAP mode" which turns everything off. Anyway, works fine. Image your SD card when you're done configuring it. I need to go back and put it in read-only mode but haven't cared.
- mrmattyboy 5y agoI cannot over-exaggerate how good the GS308T is for this... such good features for a low-cost, low-power, small 8-port device :) :) :)
- dormando 5y agofwiw when I bought it, it was on sale for ~$50 too. couldn't find a 2.5g switch that I liked in my price range, so went cheap as possible and will swap it when a 2.5g hits all my requirements :)
- louwrentius 5y agoRegarding the management interface being exposed on every interface: I think this might be true for the TP-LINK device I linked in my article. However, in this particular setup/context, I think the risk of this is minimal, as the actual interface should be using a private-IP address on your home network.
- deleted 5y ago[deleted]
- mishafb 5y agoWhat kind of home routing would require a Pi?
- louwrentius 5y agoThe kind of home routing that involves running your own Linux distro and firewall configuration. That may not be for everyone, it's more for tinkering. You can also run other things like VPN services, DNS, DHCP and all that shit, fully configured to your likening / needs.
- ignoramous 5y ago(n00b here) Someone mentioned above, and so I ask: have you given banana-pi r1 with openwrt a try? Would that setup be simpler than the current one with VLAN and netplan? Speaking of netplan: I didn't quite catch head or tail of it. What does it do and why is it required (in the context of the setup). For ex: ethernets: enp2s0f0: dhcp4: no # only dhcp6 allowed? # or, is dhcp now handled by wifi-ap? enp2s0f0.10: id: 10 link: enp2s0f0 # down-link? addresses: - 68.69.70.71/24 # is this modem's public-ip subnet? # or, could be anything? gateway4: 68.69.70.1 # modem's public-ip? enp2s0f0.20: id: 20 link: enp2s0f0 # up-link? addresses: - 192.168.0.1/24 # subnet for the internal network? # what does dhcp for this one? > So all the routing and NAT that needs to happen, just happens on those two virtual interfaces instead. The managed-switch NATs traffic? Or, you mean to say that rpi4 does? Or, am I misunderstanding how all of this actually works? Thanks.
- GhettoComputers 5y agoAny reason you don't want to use hardware (x86) you already own to run it? Do you have a server/cloud instance connected already?
- GhettoComputers 5y agoOne that could be served similarly with an older computer you already own, or a router that supports custom firmware like Merlin, tomato or ddwrt. You will not really have a requirement for it, the hardware for Pi is not exceptional, it has decent software support, poor hardware interfaces, higher cost to comparable SBCs. Check this out. https://advancedtomato.com/ https://advancedtomato.com/ I have hosts blocking, VPN, prioritization, and used it with USB3.0 as NAS and it was $40 (Asus AC68U I think its called 1900 as well).
- goalieca 5y agoI bought a usb 3.1 gigabit Ethernet dongle for 15$ which seemed cheaper than trying to do a managed switch. On the rpi4 I can manage unencrypted traffic with a load average of near 0.
- louwrentius 5y agoWhat you spend on the Dongle, you could spend on the fancier switch, in terms of cost it doesn't matter much. In the past, even small 8-port managed switches were upward of $70+.
- goalieca 5y agoI have a 16 port switch and there’s was a much bigger difference if I wanted to go with a quality one.
- louwrentius 5y agoThat is true, but most people at home probably don't need anything like that. You are probably outside the article's 'target audience'.
- GhettoComputers 5y agoThe Raspberry Pi is a device I always see many capabilities for that are better served by other hardware devices that people usually already own, or there is a cheaper device that can do what it does, as well as many that does it much better for the same price. I don't get the useage of the Pi anymore since its no longer fanless, it is trying to be a desktop replacement with outdated hardware, and doesn't have anything specialized for it that is exceptional, in fact it is a jack of all trades, master at none while many more have better raw specs and have much stronger performance. I don't know the audience for the Pi4 anymore, except maybe people who had a Pi3 and just wanted to port their config easily and switch the hardware they had into it. In regards to the suggestions for the better hardware, would you use an old laptop or desktop with a network card for the same purpose? It could act as a server as well, no need to get this hardware if you are going to just use it on a server you need anyway, unless you are using the hardware as a server. Edit: I am posting too fast, but to the person under me, there are much stronger SBCs that are the same size, and with the fan requirements on the Pi4, it isn't as small as it was, nor is is power efficient as other SBCs that would be much better. If using a server at home, having a router with custom FW would save much more space (the pi hole project could be easily served with a hosts blocker and custom firmware), having a blade server with virtualiziation would save even more space in terms of computation if you are comfortable with virtualized compututing, an old laptop isn't going to make a significant size difference, but if it does the Pi 4 still isn't the best hardware for the job.
- nickstinemates 5y agospace efficiency is still huge. You can get a lot of compute in a very small, portal formfactor. That shouldn't be trivialized.
- GhettoComputers 5y agoWhat scenario is that a huge factor? Most people have old x86 hardware laying around that isn't being used. If it is a huge factor, wouldn't you at that point just get a good router for less and have more space, or run virtualized computers on a server?
- tbyehl 5y ago> Bandwidth impact Article touches on but doesn't clearly explain the bandwidth impact of a 1-armed router: Every routed packet is traversing the same link twice (in+out), so usable aggregate bandwidth is halved. If you're fortunate enough to have a symmetrical Internet connection > 500Mb/s that means you can't upload and download at the maximum rate simultaneously. If you run multiple VLANs that also means the cross-VLAN traffic is competing with Internet traffic for bandwidth on the router's interface. A while back I made some potato-quality charts to illustrate because this comes up all the time when discussing Ubiquiti's MediaTek-based routers that are architected as a switch with an internal router-on-a-stick. https://imgur.com/a/vtgUp02 https://imgur.com/a/vtgUp02
- deleted 5y ago[deleted]
- iptrans 5y ago... or you could just get an Edgerouter X or a Mikrotik router for $40.
- louwrentius 5y agoThat will probably not handle firewalling + full gigabit internet.
- iptrans 5y agoWhat makes you say that? I’ve benchmarked both models with NAT and they will do 1G just fine.