6 ms·

From my experience, Nix makes lot more reliable and easier to configure router. ymmv

LeBit 3y ago
You are comparing bananas and windows.
rnhmjoj 3y ago
I just finished building a router based on NixOS and I must disagree. NixOS modules mostly targets desktop and servers, but the network specific configuration is still very lacking. A few examples: - up until a couple of weeks ago the hostapd module was basically a toy: could only manage a single SSID, no way to configure the radios, hardcoded to WPA2-PSK; - the NixOS firewall is still based on iptables and conflicts with nftables, so you must disable and manually write rules; - the `networking.nat` module (NAT44) doesn't do NAT reflection; - I had to write a module for Jool (NAT64, SIIT); - I had to write a module for libreswan (IPsec); - I had to write a module for automatic rollbacks, otherwise you can loose access if you make a mistake. Vyatta and VyOS also provide a much higher level abstraction over the software that is being configured (e.g. you don't have to deal with a specific IPsec implementation). Finally, once you do `nixos-rebuild switch` you're on your own, while with vyatta you have a clean command line interface to inspect the state of the router and manage it.
- gbraad 3y ago
  does vyatta/vyos store the configuration in a single file or easy to back up config? I do not remember anymore how this was done, but I believe that is the appeal what 'nix' was mentioned.
  - rnhmjoj 3y ago
    Yes, it does.
- solarkraft 3y ago
  Thanks for the warning; sounds like my mileage would have varied quite a bit. Do you think that, had your use case been simpler, you'd have enjoyed the experience?
  - rnhmjoj 3y ago
    Well, I actually enjoyed contributing to NixOS, but running it on a router is certainly not a "it works out-of-the-box" experience. Even if you are building a simple SOHO router you need to know a lot more about the implementation details (which daemon does what, how to write firewall rules, how to setup the network interfaces, etc.). This is because NixOS is general-purpose OS, unlike VyOS or openwrt.
- sp0ck 3y ago
  And this is just basic routing and firewall with NAT. Now try to setup 20 MPLS L3-VPN's + dozen VPLS services on top of IS-IS routed network with that ;-)
gbraad 3y ago
do you have an example of a router setup? curious what this would look like.

You are comparing bananas and windows.

I just finished building a router based on NixOS and I must disagree. NixOS modules mostly targets desktop and servers, but the network specific configuration is still very lacking. A few examples: - up until a couple of weeks ago the hostapd module was basically a toy: could only manage a single SSID, no way to configure the radios, hardcoded to WPA2-PSK; - the NixOS firewall is still based on iptables and conflicts with nftables, so you must disable and manually write rules; - the `networking.nat` module (NAT44) doesn't do NAT reflection; - I had to write a module for Jool (NAT64, SIIT); - I had to write a module for libreswan (IPsec); - I had to write a module for automatic rollbacks, otherwise you can loose access if you make a mistake. Vyatta and VyOS also provide a much higher level abstraction over the software that is being configured (e.g. you don't have to deal with a specific IPsec implementation). Finally, once you do `nixos-rebuild switch` you're on your own, while with vyatta you have a clean command line interface to inspect the state of the router and manage it.

gbraad 3y ago
does vyatta/vyos store the configuration in a single file or easy to back up config? I do not remember anymore how this was done, but I believe that is the appeal what 'nix' was mentioned.
- rnhmjoj 3y ago
  Yes, it does.
solarkraft 3y ago
Thanks for the warning; sounds like my mileage would have varied quite a bit. Do you think that, had your use case been simpler, you'd have enjoyed the experience?
- rnhmjoj 3y ago
  Well, I actually enjoyed contributing to NixOS, but running it on a router is certainly not a "it works out-of-the-box" experience. Even if you are building a simple SOHO router you need to know a lot more about the implementation details (which daemon does what, how to write firewall rules, how to setup the network interfaces, etc.). This is because NixOS is general-purpose OS, unlike VyOS or openwrt.
sp0ck 3y ago
And this is just basic routing and firewall with NAT. Now try to setup 20 MPLS L3-VPN's + dozen VPLS services on top of IS-IS routed network with that ;-)

gbraad 3y ago

do you have an example of a router setup? curious what this would look like.