4 ms·

> Second, even if I installed a VPN on my main machine, what about my phone? My laptop? My desktop? Every device would need the VPN running, and I’d have to rem

> Second, even if I installed a VPN on my main machine, what about my phone? My laptop? My desktop? Every device would need the VPN running, and I’d have to remember to connect it before browsing. It’s messy. This is what routers are for. My router (a cheap fanless box with several network ports running linux) is the only thing on my network that knows there's a VPN. I can selectively route whatever I want through it, including having a separate SSID/VLAN from which everything is routed through the VPN. It's wireguard based so there's no "installing a VPN", just an interface/network configured in systemd-networkd (once, on the router). Edit: Routing by domain name could be tricky, though. I haven't had a need for that, and a proxy with local DNS override (as in the article) might needed if it came to that. I'd still do it on the router, though.

slig 11mo ago
> a cheap fanless box with several network ports running linux Do you remember the name of the product?
- iam-TJ 11mo ago
  Two devices I use - both running Debian, and both being open-source hardware to some degree or other: PC Engines APU2, AMD x86_64, 4-core, 4GiB, 3x Gigabit Ethernet, 3 x mini PCIe, SIM slot, USB 3, Serial, SATA ports. Mine has dual band WiFi in one mPCIe, SSD in another. Turris Mox, Marvel aarch64. This can expand via plug and go via a range of extension modules. I've got one with 25 Gigabit (3 x 8-port modules) Ethernet, 1 x SFP, 5 x USB3, Wifi, Serial.
  - placatedmayhem 11mo ago
    Just a heads up that PC Engines is winding down. The chip they use in the APU2 is EOL, and they've decided to shut down altogether. https://pcengines.ch/eol.htm https://pcengines.ch/eol.htm
    - echelon 11mo ago
      Wildly ironic that an EU company doesn't ship to the EU. Regulatory compliance shouldn't be hard. The idea is to quell negative externalities, not to shut off innovation itself. > Because of unbelievably bureaucratic recycling regulations, PC Engines will NOT sell directly to end users within the EU. https://pcengines.ch/order.htm https://pcengines.ch/order.htm > EU - a single market ? > Far from it, there are separate registration and recycling schemes for each of the 28+ EU member jurisdictions (and even a few of their provinces). What part of COMMON MARKET was so hard to understand for EU lawmakers ? Since there is no single registration available, and separate registration would involve mindboggling complexity, bureaucracy and costs, we do not sell to EU end users until the EU gets their act together. Please order from EU based distributors, or as a business customer. > Business customers are expected to meet their obligations by registering in the EU countries they sell in. https://pcengines.ch/recycle.htm https://pcengines.ch/recycle.htm
      - ttkari 11mo ago
        Being based in Switzerland, which is not a member state, PC Engines is not an EU company.
      - oskarkk 11mo ago
        And in the end, 90% of people will throw it in the trash with everything else. I'm actually in the other 10%, but I live in the middle of a big city where I have electronic waste container like 300m away. Btw, that's an awful website. I like simple minimalistic websites, but some people confuse "simple" with "give literally 0 fucks about the reader" and then I have 50-word long lines to read on my 32" monitor. Just put something like {max-width: 1200px; margin: 0 auto;} on the body at least.
        mr_toad 11mo ago
        You’re lucky. For people without cars anything other than curbside recycling is usually a nightmare. Ironically.
        11mo ago
- bitwize 11mo ago
  Qotom is a good chinesium brand for small cheap fanless multi-NIC PCs: https://qotom.net https://qotom.net
  - scubbo 11mo ago
    +1, have had 10/10 experience with my Qotom - in fact I had to look up the brand to be sure that was what I had. Forgettability (due to reliability) is exactly what you want in router hardware.
- denkmoon 11mo ago
  I like protectli boxes. x86, low power, coreboot options, lots of network interfaces. The apus everyone recommends (myself included) are no longer available :(
  - deleted 11mo ago
    [deleted]
- CWuestefeld 11mo ago
  Not the poster you're responding to, but... I'm running OPNSense on a GMKtec G9 (a N150-based NUC with dual 2.5Gbps NICs), and a cheap managed switch. All-in, you can get it today for well under $300. Even that is rather overpowered for running my house. The toughest component to pin down was a mesh wifi system that supports tagging VLAN segments. That's almost exclusively enterprise territory, so it's hard to find something affordable.
  - necovek 11mo ago
    Is there a mesh wifi system that can run open source firmware? I imagine that might be the best bet for VLAN tagging too in the "affordable" sense too.
    - CWuestefeld 11mo ago
      Not that I'm aware of, and I suspect that the whole idea of mesh radio is necessarily so closely tied to the specific hardware that for this to be practical, there's have to be some canonical physical implementation available for developers to program to. For what it's worth, what I settled on is EnGenius's FitXpress products. But I'm not necessarily recommending that, I'm a bit ambivalent to it. Within its normal operational envelope it works well, but its range is far lesser than the TP-Link device I replaced, and rebooting one of the WAPs in the mesh takes seemingly forever (like, 10 minutes!).
- ndsipa_pomu 11mo ago
  Also not the OP, but I use a NanoPi M5 for my home router. I've got OpenWRT (technically FriendlyWRT, but it's the same) running on it with Docker for running NgINX and PiHole. https://www.friendlyelec.com/index.php?route=product/product&path=69&product_id=309 https://www.friendlyelec.com/index.php?route=product/product...
mr_mitm 11mo ago
You can just use FoxyProxy instead of a separate browser instance. This firefox addon will use a proxy based on URL patterns.
- Havoc 11mo ago
  You don't even need an extension - FF can do it natively via proxy file
- DaSHacka 11mo ago
  You can do this in the configuration for Firefox containers too.
tvshtr 11mo ago
my solution to this is to have centralised VPN splitter (x-ray/singbox) sitting on RPi, with tailscale attached to it. This makes it available from anywhere if the device is on TS network. With added benefit of rule based geo splitting to various zones.
Helmut10001 11mo ago
This is it. For years, I had a stable IPSec connection from Germany to the US, where packets would be routed selectively for the convenience of web browsing without geo-blocks. It was a bit excessive for what it did, but the technical challenge of trying it was worth it. [1] [1]: https://du.nkel.dev/blog/2021-11-19_pfsense_opnsense_ipsec_cgnat/ https://du.nkel.dev/blog/2021-11-19_pfsense_opnsense_ipsec_c...
- abcd_f 11mo ago
  IPsec to be precise, not IPSec.
matt-p 11mo ago
You can do it like this, or (easier IMO if your router doesn't support it) you can just setup a raspberry pi as a VPN router then set you dhcp server on your router to hand out the RPIs address. You can then switch on to the normal connection at any point you need by just changing your default gateway back to .1 2GB Pi5 maxes out the 1Gb port.
mschuster91 11mo ago
> This is what routers are for. Useless in modern days though. IP addresses with anything backed by any cloud/CDN can vanish whenever they want, you'll always need to keep track of the upstream DNS responses. That's extra fun if you do site-to-site-VPNs with a major customer. Won't name names, but they do have a habit of going through IP renumbering sprees every year or two and it's a true pain to keep the routing table, Zerotrust provider config and firewall rulesets in sync.

slig 11mo ago

> a cheap fanless box with several network ports running linux Do you remember the name of the product?

iam-TJ 11mo ago
Two devices I use - both running Debian, and both being open-source hardware to some degree or other: PC Engines APU2, AMD x86_64, 4-core, 4GiB, 3x Gigabit Ethernet, 3 x mini PCIe, SIM slot, USB 3, Serial, SATA ports. Mine has dual band WiFi in one mPCIe, SSD in another. Turris Mox, Marvel aarch64. This can expand via plug and go via a range of extension modules. I've got one with 25 Gigabit (3 x 8-port modules) Ethernet, 1 x SFP, 5 x USB3, Wifi, Serial.
- placatedmayhem 11mo ago
  Just a heads up that PC Engines is winding down. The chip they use in the APU2 is EOL, and they've decided to shut down altogether. https://pcengines.ch/eol.htm https://pcengines.ch/eol.htm
  - echelon 11mo ago
    Wildly ironic that an EU company doesn't ship to the EU. Regulatory compliance shouldn't be hard. The idea is to quell negative externalities, not to shut off innovation itself. > Because of unbelievably bureaucratic recycling regulations, PC Engines will NOT sell directly to end users within the EU. https://pcengines.ch/order.htm https://pcengines.ch/order.htm > EU - a single market ? > Far from it, there are separate registration and recycling schemes for each of the 28+ EU member jurisdictions (and even a few of their provinces). What part of COMMON MARKET was so hard to understand for EU lawmakers ? Since there is no single registration available, and separate registration would involve mindboggling complexity, bureaucracy and costs, we do not sell to EU end users until the EU gets their act together. Please order from EU based distributors, or as a business customer. > Business customers are expected to meet their obligations by registering in the EU countries they sell in. https://pcengines.ch/recycle.htm https://pcengines.ch/recycle.htm
    - ttkari 11mo ago
      Being based in Switzerland, which is not a member state, PC Engines is not an EU company.
    - oskarkk 11mo ago
      And in the end, 90% of people will throw it in the trash with everything else. I'm actually in the other 10%, but I live in the middle of a big city where I have electronic waste container like 300m away. Btw, that's an awful website. I like simple minimalistic websites, but some people confuse "simple" with "give literally 0 fucks about the reader" and then I have 50-word long lines to read on my 32" monitor. Just put something like {max-width: 1200px; margin: 0 auto;} on the body at least.
      - mr_toad 11mo ago
        You’re lucky. For people without cars anything other than curbside recycling is usually a nightmare. Ironically.
        11mo ago
bitwize 11mo ago
Qotom is a good chinesium brand for small cheap fanless multi-NIC PCs: https://qotom.net https://qotom.net
- scubbo 11mo ago
  +1, have had 10/10 experience with my Qotom - in fact I had to look up the brand to be sure that was what I had. Forgettability (due to reliability) is exactly what you want in router hardware.
denkmoon 11mo ago
I like protectli boxes. x86, low power, coreboot options, lots of network interfaces. The apus everyone recommends (myself included) are no longer available :(
- deleted 11mo ago
  [deleted]
CWuestefeld 11mo ago
Not the poster you're responding to, but... I'm running OPNSense on a GMKtec G9 (a N150-based NUC with dual 2.5Gbps NICs), and a cheap managed switch. All-in, you can get it today for well under $300. Even that is rather overpowered for running my house. The toughest component to pin down was a mesh wifi system that supports tagging VLAN segments. That's almost exclusively enterprise territory, so it's hard to find something affordable.
- necovek 11mo ago
  Is there a mesh wifi system that can run open source firmware? I imagine that might be the best bet for VLAN tagging too in the "affordable" sense too.
  - CWuestefeld 11mo ago
    Not that I'm aware of, and I suspect that the whole idea of mesh radio is necessarily so closely tied to the specific hardware that for this to be practical, there's have to be some canonical physical implementation available for developers to program to. For what it's worth, what I settled on is EnGenius's FitXpress products. But I'm not necessarily recommending that, I'm a bit ambivalent to it. Within its normal operational envelope it works well, but its range is far lesser than the TP-Link device I replaced, and rebooting one of the WAPs in the mesh takes seemingly forever (like, 10 minutes!).
ndsipa_pomu 11mo ago
Also not the OP, but I use a NanoPi M5 for my home router. I've got OpenWRT (technically FriendlyWRT, but it's the same) running on it with Docker for running NgINX and PiHole. https://www.friendlyelec.com/index.php?route=product/product&path=69&product_id=309 https://www.friendlyelec.com/index.php?route=product/product...

mr_mitm 11mo ago

You can just use FoxyProxy instead of a separate browser instance. This firefox addon will use a proxy based on URL patterns.

Havoc 11mo ago
You don't even need an extension - FF can do it natively via proxy file
DaSHacka 11mo ago
You can do this in the configuration for Firefox containers too.

tvshtr 11mo ago

my solution to this is to have centralised VPN splitter (x-ray/singbox) sitting on RPi, with tailscale attached to it. This makes it available from anywhere if the device is on TS network. With added benefit of rule based geo splitting to various zones.

Helmut10001 11mo ago

This is it. For years, I had a stable IPSec connection from Germany to the US, where packets would be routed selectively for the convenience of web browsing without geo-blocks. It was a bit excessive for what it did, but the technical challenge of trying it was worth it. [1] [1]: https://du.nkel.dev/blog/2021-11-19_pfsense_opnsense_ipsec_cgnat/ https://du.nkel.dev/blog/2021-11-19_pfsense_opnsense_ipsec_c...

abcd_f 11mo ago
IPsec to be precise, not IPSec.

matt-p 11mo ago

You can do it like this, or (easier IMO if your router doesn't support it) you can just setup a raspberry pi as a VPN router then set you dhcp server on your router to hand out the RPIs address. You can then switch on to the normal connection at any point you need by just changing your default gateway back to .1 2GB Pi5 maxes out the 1Gb port.

mschuster91 11mo ago

> This is what routers are for. Useless in modern days though. IP addresses with anything backed by any cloud/CDN can vanish whenever they want, you'll always need to keep track of the upstream DNS responses. That's extra fun if you do site-to-site-VPNs with a major customer. Won't name names, but they do have a habit of going through IP renumbering sprees every year or two and it's a true pain to keep the routing table, Zerotrust provider config and firewall rulesets in sync.