7 ms·

I wish more folks administered a basic Linux router of their own. I'm talking a mainline distro and iptables set to masquerade (for IPv4).

mkopec 3y ago
It's fun until you try to add Wi-Fi to the mix :) OpenWRT seems to have patches and better out-of-the-box configs for hostapd and related packages.
- wryun 3y ago
  The sweet spot in my opinion is to use an ordinary Linux box as the router and just wire up whatever wireless router(s) you have lying around for the APs (give them a static address in the appropriate subnet and you're done). No need to run OpenWRT on on the AP, since it's just mindlessly pushing packets around on the internal network. For bonus points, block it from accessing the internet itself.
  - AviationAtom 3y ago
    This is definitely the way. I used to use UniFi, but have kicked it to the curb. Omada is my AP Zen now.
    - vamega 3y ago
      Why Omada over Unifi? Aren’t they mostly the same? Both need a controller running somewhere, and not sure why one would be better/worse than the other.
      - AviationAtom 3y ago
        Actually not true. Omada has the ability to be controlled from a controller, but it is not required. It has a built-in web administration panel. Beyond that TP-Link just puts out a solid product, at a solid price point, without all the constant issues you tend to get with how Ubiquiti keeps mucking with their firmware.
    - ulkhf 3y ago
      I'm also an Omada fan. I just have two APs right now but I love controlling them from a single dashboard and look forward to adding their ER605 router so I can put my security cameras on a separate VLAN.
      - AviationAtom 3y ago
        I had been shaky in my opinion of them, being a China-based company, but after hearing the rave reviews I had to give them a shot. I've been nothing but happy and impressed. Wi-Fi APs are supposed to serve a few basic purposes, and serve them well. TP-Link has a winner so far in Omada. I just need to get my controller setup now, so I can play with the dashboard. I had heard some features are missing from the controller that are on the AP web interface though. Which of them had you noticed missing?
  - mkopec 3y ago
    I have a PC Engines apu2 board (x86 based) with a Mediatek Wi-Fi 6 card, running OpenWRT. Can do gigabit over Wi-Fi with PPPoE based WAN. If I had to get another AP it would probably be another apu2, too bad these are outrageously expensive now. (should probably disclose that I am one of the devs that maintained the apu2 coreboot boot firmware) My problem with APs running proprietary FW is that I don't trust them to be secure, even if the vendor does updates, you never know what they're doing in the background. E.g. some APs have a hidden secondary SSID for their proprietary mesh implementation. With OpenWRT I can set them up exactly the way I want to, using open standards (mesh, roaming) instead of vendor-specific crap.
    - aojdwhsd 3y ago
      Interesting, which Mediatek card are you using? I'm thinking about doing the same thing.
      - mkopec 3y ago
        I've got this one from AsiaRF: https://www.asiarf.com/shop/wifi-wlan/wifi_mini_pcie/wifi6-4t4r-dual-bands-selectable-mpcie-card-ieee802-11ax-ac-a-b-g-n-2-4g-5ghz-aw7915-np1/ https://www.asiarf.com/shop/wifi-wlan/wifi_mini_pcie/wifi6-4... . OpenWRT has drivers for it in the repository, so it's pretty simple to set up. I'm happy with it, but I did have to get a heatsink for it, since otherwise it overheats easily. Since I got it they released a couple of dual-band dual-concurrent cards like this one: https://www.asiarf.com/shop/wifi-wlan/wifi_mini_pcie/wifi6e-3000-802-11ax-3t3r-dbdc-mpcie/ https://www.asiarf.com/shop/wifi-wlan/wifi_mini_pcie/wifi6e-... , which is pretty neat, since you don't need to get a separate card for 2.4GHz devices.
        aojdwhsd 3y ago
        Thanks. There's a message on the page of the newer card "Main board Power Supply design please provide 3.3V 3.5A, minimum 3.3V 3A" - do you think this would be a problem for an APU2? One more thing - how is the signal range for you?
chatmasta 3y ago
That really means maintaining device tree files and complicated CI runners for every combination of device and distribution. There's a reason OpenWRT is so popular.
- blueflow 3y ago
  No? Any linux-running machine with sufficient network interfaces does.
wryun 3y ago
Or nftables...
- AviationAtom 3y ago
  I'm working on getting on your level but not quite there yet. On a semi-related note I will say it's infuriating that replacement Linux networking stack components are released with features missing. I hadn't dug into nftables enough yet to say whether that is the case, but netplan and, to a lesser degree, systemd-networkd have driven me bonkers. Most of my gripes were related to IPv6 and DHCPv6-PD. The people supporting the replacements never seem to be in any rush to add missing features back into the replacement. Most would think you'd wait until the replacement has reached feature parity with it's predecessor(s) before pushing it out to mainline.
  - klooney 3y ago
    Iptables currently runs on top of nftables, so it's probably not missing much.
rektide 3y ago
Yeah. I wish so much some AP grade chipsets made their way to off-the-shelf m.2 and USB hardware. I'd love to just run Debian, use my old Chromeboxes, but the availability of wifi add-ons is abysmal. I did have some OK success with wifi 5 Compex cards but wifi6 seems to have only exotic hard to get hardware with bizarre form factors available. USB has always been a no go, works to a point then collapses, in my experience (buying every high end Alfa USB card I could get my hands on).
josteink 3y ago
> I wish more folks administered a basic Linux router of their own. I'm talking a mainline distro and iptables set to masquerade (for IPv4). I used to do that. But then I found OpenWRT which took away all the grunt-work and just worked OOB. So why wouldn't I use that instead?

mkopec 3y ago

It's fun until you try to add Wi-Fi to the mix :) OpenWRT seems to have patches and better out-of-the-box configs for hostapd and related packages.

wryun 3y ago
The sweet spot in my opinion is to use an ordinary Linux box as the router and just wire up whatever wireless router(s) you have lying around for the APs (give them a static address in the appropriate subnet and you're done). No need to run OpenWRT on on the AP, since it's just mindlessly pushing packets around on the internal network. For bonus points, block it from accessing the internet itself.
- AviationAtom 3y ago
  This is definitely the way. I used to use UniFi, but have kicked it to the curb. Omada is my AP Zen now.
  - vamega 3y ago
    Why Omada over Unifi? Aren’t they mostly the same? Both need a controller running somewhere, and not sure why one would be better/worse than the other.
    - AviationAtom 3y ago
      Actually not true. Omada has the ability to be controlled from a controller, but it is not required. It has a built-in web administration panel. Beyond that TP-Link just puts out a solid product, at a solid price point, without all the constant issues you tend to get with how Ubiquiti keeps mucking with their firmware.
  - ulkhf 3y ago
    I'm also an Omada fan. I just have two APs right now but I love controlling them from a single dashboard and look forward to adding their ER605 router so I can put my security cameras on a separate VLAN.
    - AviationAtom 3y ago
      I had been shaky in my opinion of them, being a China-based company, but after hearing the rave reviews I had to give them a shot. I've been nothing but happy and impressed. Wi-Fi APs are supposed to serve a few basic purposes, and serve them well. TP-Link has a winner so far in Omada. I just need to get my controller setup now, so I can play with the dashboard. I had heard some features are missing from the controller that are on the AP web interface though. Which of them had you noticed missing?
- mkopec 3y ago
  I have a PC Engines apu2 board (x86 based) with a Mediatek Wi-Fi 6 card, running OpenWRT. Can do gigabit over Wi-Fi with PPPoE based WAN. If I had to get another AP it would probably be another apu2, too bad these are outrageously expensive now. (should probably disclose that I am one of the devs that maintained the apu2 coreboot boot firmware) My problem with APs running proprietary FW is that I don't trust them to be secure, even if the vendor does updates, you never know what they're doing in the background. E.g. some APs have a hidden secondary SSID for their proprietary mesh implementation. With OpenWRT I can set them up exactly the way I want to, using open standards (mesh, roaming) instead of vendor-specific crap.
  - aojdwhsd 3y ago
    Interesting, which Mediatek card are you using? I'm thinking about doing the same thing.
    - mkopec 3y ago
      I've got this one from AsiaRF: https://www.asiarf.com/shop/wifi-wlan/wifi_mini_pcie/wifi6-4t4r-dual-bands-selectable-mpcie-card-ieee802-11ax-ac-a-b-g-n-2-4g-5ghz-aw7915-np1/ https://www.asiarf.com/shop/wifi-wlan/wifi_mini_pcie/wifi6-4... . OpenWRT has drivers for it in the repository, so it's pretty simple to set up. I'm happy with it, but I did have to get a heatsink for it, since otherwise it overheats easily. Since I got it they released a couple of dual-band dual-concurrent cards like this one: https://www.asiarf.com/shop/wifi-wlan/wifi_mini_pcie/wifi6e-3000-802-11ax-3t3r-dbdc-mpcie/ https://www.asiarf.com/shop/wifi-wlan/wifi_mini_pcie/wifi6e-... , which is pretty neat, since you don't need to get a separate card for 2.4GHz devices.
      - aojdwhsd 3y ago
        Thanks. There's a message on the page of the newer card "Main board Power Supply design please provide 3.3V 3.5A, minimum 3.3V 3A" - do you think this would be a problem for an APU2? One more thing - how is the signal range for you?

chatmasta 3y ago

That really means maintaining device tree files and complicated CI runners for every combination of device and distribution. There's a reason OpenWRT is so popular.

blueflow 3y ago
No? Any linux-running machine with sufficient network interfaces does.

wryun 3y ago

Or nftables...

AviationAtom 3y ago
I'm working on getting on your level but not quite there yet. On a semi-related note I will say it's infuriating that replacement Linux networking stack components are released with features missing. I hadn't dug into nftables enough yet to say whether that is the case, but netplan and, to a lesser degree, systemd-networkd have driven me bonkers. Most of my gripes were related to IPv6 and DHCPv6-PD. The people supporting the replacements never seem to be in any rush to add missing features back into the replacement. Most would think you'd wait until the replacement has reached feature parity with it's predecessor(s) before pushing it out to mainline.
- klooney 3y ago
  Iptables currently runs on top of nftables, so it's probably not missing much.

rektide 3y ago

Yeah. I wish so much some AP grade chipsets made their way to off-the-shelf m.2 and USB hardware. I'd love to just run Debian, use my old Chromeboxes, but the availability of wifi add-ons is abysmal. I did have some OK success with wifi 5 Compex cards but wifi6 seems to have only exotic hard to get hardware with bizarre form factors available. USB has always been a no go, works to a point then collapses, in my experience (buying every high end Alfa USB card I could get my hands on).

josteink 3y ago

> I wish more folks administered a basic Linux router of their own. I'm talking a mainline distro and iptables set to masquerade (for IPv4). I used to do that. But then I found OpenWRT which took away all the grunt-work and just worked OOB. So why wouldn't I use that instead?