3 ms·
That sounds interesting for routing applications. I was just looking into building a custom router using an older PC and a dual-port 2.5GbE NIC. OpnSense sound
by gigel82 5y ago
That sounds interesting for routing applications.
I was just looking into building a custom router using an older PC and a dual-port 2.5GbE NIC. OpnSense sounds like a solid choice, but I'd prefer a Linux solution because the CPU is pretty beefy and wouldn't mind running a few Dockers on the side (yes, I know multi-purposing a router is a bad idea but meh).
- wmf 5y agoThe kernel already does zero-copy routing; io_uring is for UDP and TCP.
- kzemek 5y agoFor a given value of "zero"; the packets are still copied from NIC buffers and wrapped in sk_buff.
- wmf 5y agoMaybe headers are parsed but my understanding is that the whole packet is not copied.
- gigel82 5y agoIt's a NAT router so needs at minimum to masquerade (change the src/dest IP in the packet headers to match the internal / public). I'd also be running fail2ban or crowdsec for the bare intrusion detection.
- jeffbee 5y agoA "beefy CPU" will sit twiddling its thumbs forwarding traffic between 2.5g interfaces. Any CPU on the market can do that in between naps.
- MayeulC 5y agoIt depends if GP wants to do deep packet inspection or other processing on the data. Otherwise, yes, you are right.
- pimeys 5y agoEven with opnsense, put a packet filter and wireguard to the box, and I guarantee you'll use your CPU and memory with a 2.5GbE NIC...
- ahepp 5y agoHave you considered vyos as a Linux alternative to *sense? Additionally, you could set the box up as a hypervisor, pass the NIC through to the router VM, and have the other VMs/containers use a bridge or some more advanced virtual networking. That obviously has potential downsides, but I had a bit of fun doing it before downsizing my server