5 ms·

I also use Debian 12 for my home router (switched away from OPNsense). It's an old PC that became redundant when I built a new one, now stripped down to just th

I also use Debian 12 for my home router (switched away from OPNsense). It's an old PC that became redundant when I built a new one, now stripped down to just the motherboard in a benchtable. The LAN NIC is an Intel I350 card and wifi is from an AR9280-based PCIe card, so no problems with firmware etc. Unlike TFA I did not try to replace my ISP-provided ONT, and I use nftables (via firewalld) instead of iptables, unbound instead of dnsmasq, and systemd-networkd instead of dhclient and radvd. I also run haproxy to terminate TLS for some exposed LAN servers, and a local OpenSUSE package repository since many of my LAN machines are OpenSUSE. For the internet facing services (chrony, haproxy, unbound) I wrote systemd override files to harden them (run as non-root, temporary mounts instead of direct filesystem access, etc). I also run them in individual network namespaces. I highly recommend a Linux-based router if you have the hardware to spare and want a completely customizable and secure router, never having to worry about ISP malware or lack of updates again. Of course if what you have is more embedded than a full x86 motherboard then something like OpenWRT would be better than Debian.

thedougd 3y ago
I’m finding I can do pretty much everything between systemd-networkd and firewalld. The addition of policies that allow specifying ingress and egress zones was the last piece to make firewalld really useful on a router.
mindslight 3y ago
Flexibility indeed. My first router was Linux/ipfwadm, and after many years of trying various off the shelf devices I finally came back to straight GNU/Linux. Debian for the longest time, now NixOS, as a virtual machine on a larger host. I use nftables directly, with a template engine - the same config generates rules for two premises routers and a bunch of cloud hosts (with a fully-connected mesh of wireguard links between each pair of routers, of course) The rules make extensive use of policy routing, such that every device on my network has its own view of what services it is allowed to access, and what Internet horizon it sees. Loading the rules fails safe in that forwarding is only enabled after a successful (re)load, and the rules fail safe such that if a connection doesn't have a valid fwmark then it's not allowed to go out any interface. This allows me to do things like have two web browsing VMs that display side by side, one coming from my physical infrastructure IP and one coming from a often-rotated data center IP. The system has served me well, but is obviously quite bespoke. I'd love to factor it out some day and publish it for general consumption, but I haven't quite figured out how to retain the flexibility while making it have broad appeal.
sschueller 3y ago
I stuck with OPNsense when I upgraded but I virtualized everything which make everything so much easier. [1] You can just replace the router if you want or revert it if an update fails. No more digging up an USB to Serial adapter to connect to the the console on an ALIX board. [1] https://sschueller.github.io/posts/wiring-a-home-with-fiber/ https://sschueller.github.io/posts/wiring-a-home-with-fiber/
- SamuelAdams 3y ago
  Can you do more of a write up on the software side? How does proxmox get an internet connection for updates, if OpnSense is virtualized?
  - sschueller 3y ago
    I will write another blog post about it eventually. Proxmox is connected to the network via additional external NIC at the moment.
    - scns 3y ago
      Please do a Show HN when you are done.
  - vladvasiliu 3y ago
    Not OP, and I don't use proxmox, but in my case the host is just another client of the router. Of course, if the router is borken for whatever reason, the host won't get any updates. But if that's the case, upgrading the host is unlikely to be my top priority. If I really need to update the host with no router: I plug my iPhone via USB, and I'm off to the races.
- Arnavion 3y ago
  I switched away from OPNsense because it's insecure and its maintainers are incompetent. https://news.ycombinator.com/item?id=34839161 https://news.ycombinator.com/item?id=34839161 It's basically a Manjaro vs Arch situation. FreeBSD is fine, but these downstreams like pfSense / OPNsense with only a handful of maintainers just delay patches pointlessly. I'd much rather use upstream directly. (I switched to Debian instead of FreeBSD because, if I was going to have to set up networking from scratch, I'd much rather do it in an OS I'm more familiar with.)
bwj982 3y ago
I'm doing the exact same thing, I switched ISPs and found that PFsense would only give me 10% of my WAN bandwidth due to the way the pppoe daemon is threaded. My new firewall is Debian managed by Ansible, the playbook sets up pppoe, nftables and nettopng. I really missed pfblockerng, so I wrote a shell script to download Firehol feeds and inject them as a set into my nftables rules. Whole thing works great off a Proxmox J3455/8Gb mini PC with 2 NICs, leaving room for some LXC and Docker containers/

thedougd 3y ago

I’m finding I can do pretty much everything between systemd-networkd and firewalld. The addition of policies that allow specifying ingress and egress zones was the last piece to make firewalld really useful on a router.

mindslight 3y ago

Flexibility indeed. My first router was Linux/ipfwadm, and after many years of trying various off the shelf devices I finally came back to straight GNU/Linux. Debian for the longest time, now NixOS, as a virtual machine on a larger host. I use nftables directly, with a template engine - the same config generates rules for two premises routers and a bunch of cloud hosts (with a fully-connected mesh of wireguard links between each pair of routers, of course) The rules make extensive use of policy routing, such that every device on my network has its own view of what services it is allowed to access, and what Internet horizon it sees. Loading the rules fails safe in that forwarding is only enabled after a successful (re)load, and the rules fail safe such that if a connection doesn't have a valid fwmark then it's not allowed to go out any interface. This allows me to do things like have two web browsing VMs that display side by side, one coming from my physical infrastructure IP and one coming from a often-rotated data center IP. The system has served me well, but is obviously quite bespoke. I'd love to factor it out some day and publish it for general consumption, but I haven't quite figured out how to retain the flexibility while making it have broad appeal.

sschueller 3y ago

I stuck with OPNsense when I upgraded but I virtualized everything which make everything so much easier. [1] You can just replace the router if you want or revert it if an update fails. No more digging up an USB to Serial adapter to connect to the the console on an ALIX board. [1] https://sschueller.github.io/posts/wiring-a-home-with-fiber/ https://sschueller.github.io/posts/wiring-a-home-with-fiber/

SamuelAdams 3y ago
Can you do more of a write up on the software side? How does proxmox get an internet connection for updates, if OpnSense is virtualized?
- sschueller 3y ago
  I will write another blog post about it eventually. Proxmox is connected to the network via additional external NIC at the moment.
  - scns 3y ago
    Please do a Show HN when you are done.
- vladvasiliu 3y ago
  Not OP, and I don't use proxmox, but in my case the host is just another client of the router. Of course, if the router is borken for whatever reason, the host won't get any updates. But if that's the case, upgrading the host is unlikely to be my top priority. If I really need to update the host with no router: I plug my iPhone via USB, and I'm off to the races.
Arnavion 3y ago
I switched away from OPNsense because it's insecure and its maintainers are incompetent. https://news.ycombinator.com/item?id=34839161 https://news.ycombinator.com/item?id=34839161 It's basically a Manjaro vs Arch situation. FreeBSD is fine, but these downstreams like pfSense / OPNsense with only a handful of maintainers just delay patches pointlessly. I'd much rather use upstream directly. (I switched to Debian instead of FreeBSD because, if I was going to have to set up networking from scratch, I'd much rather do it in an OS I'm more familiar with.)

bwj982 3y ago

I'm doing the exact same thing, I switched ISPs and found that PFsense would only give me 10% of my WAN bandwidth due to the way the pppoe daemon is threaded. My new firewall is Debian managed by Ansible, the playbook sets up pppoe, nftables and nettopng. I really missed pfblockerng, so I wrote a shell script to download Firehol feeds and inject them as a set into my nftables rules. Whole thing works great off a Proxmox J3455/8Gb mini PC with 2 NICs, leaving room for some LXC and Docker containers/