12 ms·

How to turn anything into a router

• omani 6mo ago
  you might as well just use vyos.
• louwrentius 6mo ago
  A router only really needs one network interface. Any computer with a single network interface, maybe even an (old) laptop, can be used. Anything x86 from at least the last 10 years is energy efficient and fast enough to route at gigabit speed. If you don't care about energy usage, any x86-based computer from the last 20 years is fast enough. The magic trick is to use VLANs, which require switches that support VLANs, which can be had for cheap. VLANS also allows you to create separate isolated networks for IoT or other 'less secure' or untrusted devices. I’ve always made my own routers by using low-power devices running Linux (Debian) with IPtables and now NFtables. No special router OS or software required. Highly recommend. P.S. that single network interface is very likely never a bottleneck because network interfaces are full-duplex. Only when your router is also your file server (not recommended), internet traffic and file server traffic could start to compete with each other.
  • ata_aman 6mo ago
    Have you noticed significantly slowed network speeds over WiFi?
    • louwrentius 6mo ago
      Not that I know of, why would that happen?
      • ata_aman 6mo ago
        Wouldn’t all traffic be routed through the OS/processor on board?
        • gsck 6mo ago
          Wait until you hear about CAPWAP!
        • louwrentius 6mo ago
          A CPU from the last 20 years can route traffic at gigabit speed. It's only something to worry about for a Raspberry Pi3 or something similarly 'crippled'.
          • colinb 6mo ago
            I think I understand why this is true for plain IP forwarding. There isn’t much to break the cache and the lookups are few and fast. What’s the cheapest (new) computer that can drive a 1Gb port with NAT? With a busy encrypted (wireguard?) connection? [I don’t think qos has a lot of use in the domestic environment; sure, someone here does it but I think it’s much less mainstream than the features I already mentioned. ] Such a device could drive my home. But in a couple of years I suspect I’ll want 2Gb or 10. In the past I’ve tended to use a device until its crappy power supply failed. So I guess I’m hoping for a >5 year life span/upgrade capacity. For all I know the answer to my question is one of those passively cooled four port n100 bricks from AliExpress. Anecdata happily accepted.
            • lstodd 6mo ago
              Wireguard adds nothing unless you'd want to terminate it on the router. In which case it adds so very little it's unnoticeable. About any n100 will do. Question is in their reliability which mostly comes down to power regulation components quality. Not performance. One of my installs runs on a repurposed old android phone. Which has about 100 times CPU capacity of the router I write this through, and that one being cheap tplink shit still terminates wireguard at link speed which is 100Mbps. You don't need fancy gear for routing. And you don't usually need gigabit uplink because speed is limited way upstream. But if you want "the right gear and damn the price" go get a Microtik. They are very good.
            • toast0 6mo ago
              > What’s the cheapest (new) computer that can drive a 1Gb port with NAT? What's the cheapest new computer you can find? That will work. If you have PPPoE, you need to be a bit more careful; depending on your OS and NICs, it's possible for inbound traffic to only use one core; low power laptop cpu may not have enough throughput from a single cpu, but my information is a little dated. I did 1G NAT on a dual core haswell [1] for a long time. [1] https://www.intel.com/content/www/us/en/products/sku/82723/intel-pentium-processor-g3258-3m-cache-3-20-ghz/specifications.html https://www.intel.com/content/www/us/en/products/sku/82723/i...
  • newnewfun 6mo ago
    Yea, I would add openwrt x86 provides a decent interface for management. Gave dad a little minicomputer with openwrt when he upgraded his internet. He can change wifi password and such and is happy.
  • icedchai 6mo ago
    Yes, but some folks are wary of using the same physical port for external and internal traffic. Fears of "VLAN hopping" remain, even if unfounded. Also, you'll hit a performance wall since you are sharing a single gigabit port between external and internal traffic. Obviously may not be an issue for many, but if you have gigabit fiber...
    • louwrentius 6mo ago
      I have gigabit fiber and none of this is an issue. VLAN hopping is only possible due to misconfiguration. I'd like to be proven otherwise if that's not the case. VLANs are used EVERYWHERE where it matters. And no, the single port is absolutely not a bottleneck because the port is full-duplex.
      • estimator7292 6mo ago
        What happens if one node on your network is downloading at 1Gbit and another is uploading at 1Gbit? Both get 500Mbit. Bottleneck.
        • gruez 6mo ago
          That's going to be super rare. If it's just LAN traffic it shouldn't hit your router at all and you won't have the bottleneck issue. The actual cases would need to be quite contrived, like you're backing up your media library at the same time you're updating cod warzone.
          • simoncion 6mo ago
            > The actual cases would need to be quite contrived... As someone who works a programming job from home, I can tell you that the cases are not at all contrived. I've also heard from folks who have lots of roommates (whether or not those roommates are their swarm of children) that heavy simultaneous upload and download traffic is very common. You can get away with a router that has a single physical port. It's generally just easier and better to have more than one physical port... and even 10gbit-capable ethernet ports are pretty damn cheap. (I can get two 10gbit ports for about the same price as two 1gbit ports... ~30 USD.)
  • binaryturtle 6mo ago
    Sounds interesting. I always wanted to use a Raspberry PI as router (to have one as backup in case the OpenWRT Linksys goes down), but couldn't wrap my head around properly how to overcome the single network port (I think the usual recommendation is to use an extra USB network card/adapter). Can you elaborate more about this VLAN stuff (you would put your modem, your router, and all your machines on the switch... and in the switch you tell the router connection to double use the connection for WAN and LAN separated via VLANs? And put the modem into the "WAN VLAN" too?) Ideally the PI also should to what the extra DSL Modem does… but I guess that's where the dram must stop. :D
    • louwrentius 6mo ago
      I've created a blog post about this: https://louwrentius.com/raspberry-pi-as-a-router-using-a-single-network-interface.html https://louwrentius.com/raspberry-pi-as-a-router-using-a-sin...
    • tuetuopay 6mo ago
      The TL;DR is to have two vlans on the cable from your switch (called a "trunk"), "lan" and "wan", carrying the respective LAN and WAN networks. Then, on the Pi, create two vlans on the underlying Ethernet interface. Then those two VLAN interfaces can be configured just like the LAN and WAN interfaces of the router. On the switch, you’d dedicate one port to the WAN by adding it to the WAN VLAN without tagging, and the other interfaces do the LAN VLAN, also untagged.
    • pak9rabid 6mo ago
      When you setup your single ethernet port (let's call it eth0) as a VLAN trunk port, you'll get the ability to configure multiple virtual interfaces off of it. How many virtual interfaces you get depends on how many VLANs you want to tag traffic for. For example, if you have 2 VLANS with ids 100 and 200 (100 being your public Internet-facing traffic, and 200 being your LAN traffic), you would then have interfaces eth0.100 and eth0.200 to work with that you can then use in your firewall scripts as if they were two separate, physical interfaces. This of course means you need a VLAN-aware switch that this single ethernet port can plug into, configured as a VLAN trunk (in Cisco terms) port. You would then want to configure one of the other switch ports as a VLAN access port assigned to VLAN 100 (untagged). This is the port you would plug your cable modem into. Then (in the simplest example) you could assign all the rest of the switch ports to VLAN 200 (untagged), and you would plug all your LAN devices into them.
  • globular-toast 6mo ago
    Pretty sure switches that support VLANs are more expensive than a NIC. I think even a 4 port GigE Intel NIC can be had for less. But you might want VLANs anyway, so it's an interesting thing to consider.
    • hrmtst93837 6mo ago
      [flagged]
    • fargle 6mo ago
      Netgear GS305e supports VLANs and can be ~$21
  • EvanAnderson 6mo ago
    It only needs one port, but for most simple networks two ports on the router means less configuration. The "router on a stick" paradigm using VLANs to a share a single physical port is perfectly valid. You're creating a "now you have two problems" scenario in which you need a VLAN-capable switch and have VLAN configuration to make. I typically like the ISP router on a dedicated router port to make monitoring the physical link and/or cycling the physical link easier. Unless your ISP is >1Gbps adding a second port to most devices is as easy as adding a USB NIC.
    • cestith 6mo ago
      Technically you can route without isolation, but VLANs are definitely a good idea if you’re using a single port. There are 2.5 Gbps, 5, and even 10 Gbps USB NICs these days, although 10 Gbps ones are pretty expensive and require really recent USB ports. I agree I want my local network and my WAN port separate, if for no other reasons than so I can use ssh to get into the router from my LAN with the WAN port disabled.
  • sta1n 6mo ago
    [dead]
• b112 6mo ago
  This will certainly work, but the whole mesh networking and more advanced aspects of a real wifi router won't really be present. I get by without it, but I can imagine some won't be able to.
  • JohnFen 6mo ago
    If you're tech-savvy and building your own router, you can add those advanced aspects in if you want them. I'd be willing to bet, though, that the overwhelming majority of people who use consumer routers aren't doing anything remotely advanced. A how-to that covers the majority of use cases is valuable even when it excludes advanced use cases.
    • Tostino 6mo ago
      There are a whole lot of normal people using mesh networking Wi-Fi routers. Honestly, most of the least technical people that I know are all using mesh networks because their houses require it.
      • JohnFen 6mo ago
        Certainly. But it's still a minority use case. Perhaps someone else will (or did) write up a how-to for support mesh networking in your homebrew router.
        • Hikikomori 6mo ago
          Home mesh is mostly about having wireless backhaul, and you can certainly do that if you have (preferably) two radios, you just set up one radio as a client to your main AP. Even if you aren't doing wireless backhaul you just rely on regular client behaviour to transition between APs, can enable 802.11r to improve this. Enterprise "mesh" typically uses wired backhaul for performance and can help clients roam quicker with a controller (auth, not deciding to roam). Controller can also adjusts radio power so APs aren't talking over each other if they're too close. Mesh isn't any magic, just regular wifi.
• sgt 6mo ago
  nftables syntax is pretty tough to read. I wonder why they didn't go for an easier to read DSL. I do understand it's likely super fast to parse though, and has a 1:1 relationship to its struct in the kernel.
  • tuetuopay 6mo ago
    I’ll pick nftables over iptables any day, it’s leagues better (granted, it’s not hard). The nftables wiki is great, as the syntax and modules are documented in a single easy to read page. As an added bonus, you get atomic updates of all chains for free. Granted, for simple usecases, ufw or firewalld may be simpler though.
    • sgt 6mo ago
      Definitely an upgrade over iptables. I kinda miss ipchains though.
      • pak9rabid 6mo ago
        You can still use the iptables interface for nftables rules if you'd like, but I think you miss out on things like atomic application of rulesets, ranges, lists, and variables (not shell variables).
  • drnick1 6mo ago
    I personally stick to iptables. nftables does not seem to be an improvement at all. iptables is terse but logical.
• timw4mail 6mo ago
  Surely something like OPNsense/PFsense would be better for the average user than setting up all the software manually?
  • MathMonkeyMan 6mo ago
    I appreciated learning what's involved, though.
  • fragmede 6mo ago
    In this day and age, if that's what you're after, you can just point an AI at the problem and give it shell access, and it'll just do what you describe (Claude code, codex, etc).
  • drnick1 6mo ago
    Not necessarily. For one, the BSD has, or at least used to have much worse driver support for wireless adapters. With a regular server/desktop Linux distro, it's also easier to run other services on the same device. For example, nothing prevents you from running nginx and hosting a website, or a personal email server.
  • Gud 6mo ago
    Why? Configuring FreeBSD is extremely straightforward.
• julcol 6mo ago
  if fancy a bit more of capability, dockerized opnsense and just play right with your vlans. One cable is enough into your switch...did I said managed... and your opn/telco eth exit.
• LatticeAnimal 6mo ago
  I’ve been using OpnSense/pfsense [0] for years and would highly recommend it. It has a great automatic update experience, config backups, builtin wireguard tunnels and advanced features like packet filtering options via suricata. When I am doing network management on my weekends, I’m so glad I’m not stuck in the Linux terminal learning about networking internals and can instead just go to a webui and configure my router. 0: https://opnsense.org/ https://opnsense.org/
  • globular-toast 6mo ago
    Yep, this is the way. You will learn loads using Linux but this is not something you want to go wrong. I used a lower power Intel Atom mini PC with an additional NIC as a router for years. I tested it and found it could route around 300Mb/s which was plenty. But then I got gigabit internet. So I bought an Intel 4 port GigE card from eBay and now run OPNSense as a VM. If you get the right Intel card you can pass through ports to VM individually, which is nice for playing (don't know the exact details but look for cards with virtualisation support, mine is an 82575GB I think). To be fair, my setup still probably has too much to go wrong, due to the VM thing, but I just haven't got round to getting dedicated hardware, and it's worked fine for a couple of years now.
  • jasonjayr 6mo ago
    I agree on principal, but I often find that the GUI abstractions don't always map to the linux tooling/terminology/concepts, which often ends with a head bashing against the wall thinking "this is linux, I know it can do it, and I can do it by hand, but what is this GUI trying to conceptualize?!?!" I was recently introduced to a Barracuda router, and bashed my head against the wall long enough to discover it had an ssh interface, and linux userland, and was able to solve my immediate problem by directly entering the commands to get it to [temporarily] do what I needed. (Of course, using the GUI to reapply settings wiped my manual configuration...) I've used pfsense, OpenWRT, Barracuda, Verizon's OEM router (Actiontec) and they all represent the same functionality wildly differently.
    • ZenoArrow 6mo ago
      > I've used pfsense, OpenWRT, Barracuda, Verizon's OEM router (Actiontec) and they all represent the same functionality wildly differently. Worth noting that pfSense (and OPNsense) are not Linux-based, they're based on BSD, specifically FreeBSD. While it's possible to have standard router OS web UIs that are cross platform, the underlying technology is different, so it's not really a surprise that there will be differences in how the devices running these OSes are configured.
• deleted 6mo ago
  [deleted]
• Ir0nMan 6mo ago
  A fun project that results in a unique and stylish router is repurposing a Mac Pro Trashcan. They can be picked up for a few hundred dollars, offer dual 1GbE Intel NICs that work natively on Linux, and have plenty of CPU and RAM overhead. Throw OPNsense on there and you’re off to the races.
  • whalesalad 6mo ago
    Performance per watt is not ideal on the trash can. But totally doable.
  • wffurr 6mo ago
    The idle power usage on those is atrocious compared to say an Intel N100 or an Arm system.
• smashed 6mo ago
  Lots of "just use X" comments but the article is about showing the bare minimum/how easy the core part of routing actually is. Also, if you have ever used docker or virtual machines with NAT routing (often the default), you've done exactly the same things. If you have ever enabled the wifi hotspot on an android phone also, you've done pretty much what the article describes on your phone. All of these use the same Linux kernel features under the hood. In fact there is a good chance this message traversed more than one Linux soft router to get to your screen.
  • abustamam 6mo ago
    Yeah I find it more interesting to see how it's built from scratch, then I can decide if it's worth doing myself or just using X. I think this is a good software principle in general.
  • doubled112 6mo ago
    Basically any computer is a router if you're brave enough. Windows PCs had (have?) that Internet connection sharing feature for a long time. It was really just a checkbox to enable NAT too. Sometimes I think combining a firewall/router/switch/AP/file server/etc into a device called a "router" really confuses people. Even people who should know better.
    • j45 6mo ago
      It is much, much easier than it used to be. The documentation and videos alone available make something like this a very welcoming learning experience that anyone can complete step by step by pausing a video and replaying it.
      • doubled112 6mo ago
        Like most things, really. I used to build routers from old PCs, but eventually those tiny appliances caught up with the performance/functionality I need. You can do a lot of routing on a $70 Mikrotik, although they might not be "easy".
• lucasay 6mo ago
  “Just use OPNsense” is great advice for production, but terrible advice for learning. This article is valuable precisely because it shows how little magic is actually involved in routing.
  • seniorThrowaway 6mo ago
    SOHO toys don't do routing in a real sense at all
    • deleted 6mo ago
      [deleted]
  • Denatonium 6mo ago
    I would recommend VyOS Stream for this situation. It has better performance and hardware compatibility than *BSD-based software routers, and it also has a nice CLI that is syntactically similar to Vyatta and EdgeOS (found on Ubiquiti's Edgerouter line). In additon, compared to PF/OPNsense or OpenWRT (Linux based), you have more control and exposure to the underlying network concepts with VyOS. You're not configuring the kernel manually, but you still learn quite a bit.
• proxysna 6mo ago
  Pleasant thing about routers that is is so simple to build one after learning basics of networking and pretty much any OS or distro can act as one. There are obvious choices like OPN\PFSENSE, OpenWRT, DD-WRT, FreshTomato, but literally any PC with a single Ethernet port can act as one. My favorite setup was a laptop running Ubuntu and the whole router setup was in a single netplan file + dnsmasq for DHCP. Edit: And ofc best cheap device imo is OrangePI R1 LTS and a whatever usb wifi dongle. Came in clutch a few times, such a nice little device.
  • leptons 6mo ago
    Been using DD-WRT for years. Current setup is a $50 Dell Optiplex i5 from ebay running x86 DD-WRT. I put an intel 4x 1Gbit NIC in it, and it's been an excellent router for years.
• zoobab 6mo ago
  Love the "An ExpressCard-PCIe bridge in the ThinkPad’s expansion bay". Would you have a picture of the ExpressCard laptop connector?
  • burner420042 6mo ago
    I did this back when, just using a 100mbit NIC express card. Ran openbsd for a few years like that, the base OS included everything needed. I recall it used 24MB of ram and closer to 30MB if ssh'd in. It was very handy to have a local login when playing with firewall rules.
  • yabones 6mo ago
    It would be something a bit like this: https://www.ebay.com/itm/115721630079 https://www.ebay.com/itm/115721630079 Before Thunderbolt was common, people attempted to use external GPUs with this sort of expander, but it worked really poorly.
• askl 6mo ago
  > you can make a router out of basically anything resembling a computer. So if anything can be turned into a router will importing anything be banned as well?
• bluedino 6mo ago
  This really takes me back. My first actual 'use' for Linux was making routers out of leftover computers. The perfect machine back then was a 100MHz Pentium, in a slimline desktop case. At the time, the Pentium III was the current desktop chip, so you'd have a pile of early Pentium-class machines to use. And even a 10mb ISA network card (3Com if possible) would have plenty of power for the internet connections of the day. But 100mb PCI cards were still fairly cheap. Install two NICs, load your favorite Linux distro, and then follow the IP-Masquerading HOWTO and you've got internet access for the whole apartment building, office, or LAN party. Eventually I moved on to Linux Firewalls by Robert Ziegler for a base to build on. After that I started piling other services on, like a spam filter, Squid cache, it was amazing to get so much use out of hardware that was going to just get thrown out.
  • ssl-3 6mo ago
    You guys with your dedicated hardware. :) I did routing duties for my LAN with my primary desktop for about a decade, variously with Linux, OS/2 (anyone remember InJoy?), and FreeBSD -- starting with 486 hardware. Most of that decade was with dial-up. The first iteration involved keying in ipfwadm commands from, IIRC, Matt Welsh's very fine Running Linux book. WAN speeds were low; doing routing with my desktop box wasn't a burden for it at all. And household LANs weren't stuffed full of always-on connected devices as they are today; if the Internet dipped out for a few minutes for a reboot, that wasn't a big deal at all. I stayed away from dedicated hardware until two things happened: I started getting more devices on the LAN, and I saw that Linksys WRT54G boxes were getting properly, maturely hackable. So around 2004 I bought a WRT54GS (for the extra RAM and flash) and immediately put OpenWRT on it. This lead to a long rabbit hole of hacks (just find some GPIO lines and an edge connector for a floppy drive, and zang! ye olde Linksys box now has an SD card slot for some crazy-expensive local storage!). I goofed around with different consumer router-boxes and custom firmware for a long number of years, and it all worked great. Bufferbloat was a solved problem in my world before the term entered the vernacular. And I was happy with that kind of thing at home, with old Linksys or Asus boxes doing routing+wifi or sometimes acting as extra access points... until the grade of cheap routers I was playing with started getting relatively slower (because my internet was getting relatively faster) and newer ones were becoming less-hackable (thanks, binary blob wifi drivers). --- I decided to solve that problem early in 2020. Part of the roadmap involved divorcing the routing from the wifi completely -- to treat the steering of packets and the wireless transmission of data as two completely distinct problems. I used a cheap Raspberry Pi 4 kit to get this done. The Pi4 just does router/DNS/NTP/etc duties like it's 1996 again. Dedicated access points (currently inexpensive Mikrotik devices) handle all wifi duties. That still works very well. Pi4 is fast enough for me with the WAN connections available here (which top out at 400Mbps) even while using SQM CAKE for managing buffers, and power consumption of the whole kit is too low to care about. The whole OpenWRT stack just plods along using right around 64MB of RAM. VLANs are used to multiply the Ethernet interface into more physical ports (VLANs were used to do this inside the OG WRT54G, too). It's sleepy, reliable, and performant. --- And it'll keep being fine until I get a substantially-faster WAN connection. For that, maybe one of the China-sourced N150 boxes, with 10gb SFP+ ports, will be appropriate -- after all, OpenWRT runs on almost anything including AMD64 and the UI is friendly-enough. But there's no need to upgrade the router hardware until that time. Right now, all of my routing problems are still completely solved.
• fio_ini 6mo ago
  I am truly sorry. I can't understand the physical networking from the pics or the description... I'm probably just missing something. There is one blue plug going from the laptop to the cisco switch or the pci wifi module? I see a blue plug going to each device. So I'm guessing everything is plugged into the cisco switch? if you could show all the wiring and label it (according to the table below) i think it would add a lot of value for someone less familiar with these kinds of setups (like me)
  • yabones 6mo ago
    Hey, op here, this was almost a decade ago, but I'll try to describe what's going on here. It's kind of a crappy picture. * WAN connection comes in by coax, into my cheapo cable modem (off screen), and then by Ethernet into the franken-NIC sitting on top of the laptop. * The NIC on top is a normal PCIe card, but with the bracket missing. The ExpressCard riser [1] is connected by a mini-HDMI cable, the flat black cable, which curves up, around, and back in from the left side into the laptop * Then, the blue cable on the side of the laptop is a VLAN trunk going into the Cisco switch on port 23/24, outside the picture. * From there, another port on the switch is setup as an access/untagged port going into one of the LAN ports on the D-Link acting as the access switch I don't think it was set up here, but at one point I also had a dock under the ThinkPad, with the serial adapter wired up to the switch's console port so I could manage everything by ssh'ing into the router. [1] https://www.ebay.com/itm/115721630079 https://www.ebay.com/itm/115721630079 Also note that all the cables were hand-crimped because I was too cheap to buy new patch cables at the time. I was in college, and truly had more time than money back then. it's the kind of doohickey made by only somebody very young, very crazy, or a bit of both. ;)
• FuriouslyAdrift 6mo ago
  Routing is pretty easy for most use cases... firewalling an Internet connection, on the other hand, is just about impossible (thanks TLS 1.3) without pretty serious overhead, 3rd party maintained live subscriptions, TLS interception, and a willingness to say "no" to a lot of the shenanigans that modern programs and devices try to pull. I recommend the free home version of Sophos for the least painful way to do it. Buy a Palo Alto with a full subscription if you are really serious.
• solarkraft 6mo ago
  Maybe someone in this thread has a couple of ideas: What’s the simplest way to spin up a simple „cattle, not pet“ routing VM? I don’t want to mess with any state, I just want version controllable config files. Ideally, if applying a version fails, it would automatically roll back to the previous state. OpenWRT seems like it fits my description most closely, but maybe someone here is a fan of something more flashy/modern.
  • bembem_c 6mo ago
    OPNsense. I use it on dell optiplex SFF for about 8 years. Was never tempted to use VM for routing, but many do. Version control is in the GUI, you can adapt for your needs the number of changes you need. automatic config.xml backup also possible.
  • tombert 6mo ago
    I recommend Pfsense or OpnSense if your hardware works with a FreeBSD-based thing. They're super easy to set up and don't have many surprises. After I upgraded to a 10GbE ethernet card in my previous router, my card didn't work correctly with FreeBSD-based stuff anymore. I changed to ClearOS and that was actually comparably easy to Pfsense...maybe even easier? I recommend checking that one out.
    • miladyincontrol 6mo ago
      While I am a linux advocate for networking in the current day outside of hyper specific CDN use cases (a la netflix)... its pretty common for people to just virtualize opnsense/pfsense to take advantage of linux network drivers. Especially if their actual routing requirements are modest and dont require full use of the hardware. Beyond getting support for devices completely absent on freebsd, quality of drivers, bugs much more rapidly squashed, and general misc features absent on the bsd side like NBASE-T.
      • tombert 6mo ago
        I don't know enough about this level of IT to rebut this. I use Linux for my router now because my server is NixOS, so I was able to consolidate my router into my server and turn off a machine (and thus save a little power), and I have so thoroughly drunk the Kool-aid for NixOS that I kind of want to put it everywhere. I run the latest kernel and I update daily, so I think most bugfixes (and hopefully security updates) will manifest quick enough.
• shmerl 6mo ago
  It becomes harder if you try to do it with 10 Gbps. Most CPUs struggle with it without dedicated accelerator chips.
  • drnick1 6mo ago
    Absolutely not. My 8700k is able to saturate a 25Gbps link without breaking a sweat. It could still push more than 4Gbps of encrypted traffic (Wireguard tunnel).
    • shmerl 6mo ago
      Sure, what I mean is common router CPUs. High end desktop CPU won't break a sweat.
• ghc 6mo ago
  Here I was thinking this article would tell me how to turn my unmanaged switches into routers, but no, "anything" actually means "any fully featured general purpose computer with networking".
  • HugoTea 6mo ago
    I suppose if you manage to get OpenWRT or something onto your switch you could use it as a router.
    • wtallis 6mo ago
      That's theoretically possible but a bad idea for a managed switch, because they seldom have enough CPU performance or IO between the CPU and switch silicon to provide respectable routing performance. For an unmanaged switch, it's more likely that whatever CPU core is present (if any) doesn't have enough resources to run a real network stack.
• nottorp 6mo ago
  Hmm I've always had a manually configured low power generic box as router. But I've never even tried to set up my own access point, I just pay Unifi for that [1]. The software part is doable but I don't want to learn to handle the signal issues. [1] Switched to Unifi in anger after my first consumer level 5 Ghz wifi needed reboots weekly because it was overheating. Do yourself a favour and get the semi pro stuff, Unifi or others.
  • tombert 6mo ago
    I've been running a custom router for about a decade, but I too have haven't tried handling the wifi on my own. It's always been easy to get an external access point and there's a bit of a guarantee that it's done correctly. I kind of feel like that's cheating though; I've outsourced the hardest part of the project to someone else. Maybe one of these days I'll take an old NUC or something and buy a decent wifi antenna for it and try and do it properly. [1] Initially pfsense, then OpnSense, then ClearOS, and now some custom firewall rules in NixOS.
  • burner420042 6mo ago
    So it's been awhile but the best and simplest way I think is use an access point. I don't want my wireless gear doing routing. From a logic stand point they acts as wireless "bridge" to the physical network, and nothing more. DHCP, etc. stay handled in one place for the entire network, back on the physical router.
• jrm4 6mo ago
  [flagged]
• bitwize 6mo ago
  Qotom mini PCs are my cheatcode. These little PCs are often available with multiple NICs, and I use one as a wifi bridge/router for my office network. Put Linux or FreeBSD on one and you have a very capable little network-appliance box.
• chungy 6mo ago
  OpenWrt has a generic x86 PC build that can also be used to turn basically any random PC into a router, complete with an operating system actually designed and developed for that purpose.
  • adolph 6mo ago
    OpenWRT is great if it fits your use case. If one has reason to stray from the happy path a disadvantage is that the OpenWRT uses a single binary like Busybox and doesn't use glibc. This is great for embedded/low power machines like the OG WRT54G, but not as optimal for when you have an entire random PC. I don't recall the exact things I was looking for but I moved on to pfSense and didn't look back.
    • znpy 6mo ago
      > This is great for embedded/low power machines like the OG WRT54G, but not as optimal for when you have an entire random PC. There are steps in the middle :) I'm running OpenWRT on the recent WRT3200ACM and it's going beautifully.
  • moffkalast 6mo ago
    And of course probably 1000x the power usage compared to the average off the shelf router that runs off a borderline microcontroller.
    • socalgal2 6mo ago
      good point! I think you can run it on a PI though.
      • moffkalast 6mo ago
        Otoh it would make sense if you could combine it with a home server, then it's just a side process and you actually save power by not having an extra device. Though you'd still need a switch or two. And a fiber modem which already has a router and a switch built-it. Oops.
• st_goliath 6mo ago
  > sudo systemctl enable [email protected] :-) Let me guess, ".*@.*\..*"?
• rashkov 6mo ago
  Anyone know how necessary UPnP is? From what I can tell, this setup does not run UPnP for automatic port forwarding
  • YouAreWRONGtoo 6mo ago
    [dead]
  • pak9rabid 6mo ago
    You'd need to run a daemon like miniupnpd to enable UPnP, however I'd avoid it if you can, as it can be a significant security risk.
  • drnick1 6mo ago
    Not necessarily at all and a huge security risk.
  • simoncion 6mo ago
    It's quite useful, but -like just about everything- not necessary. Run it in what miniupnpd calls "secure mode" (which prevents clients from adding rules for IPs they can't talk from), put the daemons's rules after your manually-managed ones and -because of today's world of NAT hole-punching and "just tunnel it over HTTPS, it's the universal firewall bypass protocol" techniques- you're exactly as secure as if you had it off.
• hmaxwell 6mo ago
  I'm curious about the policy rationale behind banning router imports. If a government were considering legislation like that, what would the primary concern usually be? Given that so much internet traffic is now protected by TLS/SSL and other encryption, why would it still matter if citizens were using routers that might be backdoored? Is the concern mainly things like botnets and DDoS activity, weak default credentials on network equipment, or compromised business networks where poorly secured routers or attached NAS devices could expose sensitive or proprietary data? In other words, is the concern less about decrypting traffic and more about using the router as a foothold for surveillance, disruption, or access to poorly secured internal systems?
  • nathas 6mo ago
    It's everything you mention in the second paragraph, and additionally just the ability to turn them off. Imagine everyone had their routers disabled simultaneously. I don't know if the cell networks could function with the surge in standard traffic that would happen, and then you've effectively plunged all or part of the country into a communication blackout. I think "turn it off permanently by bricking it" is almost as bad as "leverage for DDoS". I worked on Bot Mitigation at Amazon, and we once saw a ton of traffic that was heavily distributed amongst consumer devices world-wide, but surprisingly in the US too. We suspected compromised routers that were using the home page as a health check. There was a lot of investigation I did, and the short realization after talking with the network engineers is that the amount of traffic, and distribution of sources, would be impossible to stop. There merely isn't enough bandwidth in the world to stop so many residential device if it hits a specific target. To be clear, this was coming from less than half of active Amazon customers, not everyone in the US. Anyway, it wasn't routers, but it was a consumer device, and it wasn't nefarious, it was incompetence (in code), as usual.
    • gruez 6mo ago
      >Imagine everyone had their routers disabled simultaneously. I don't know if the cell networks could function with the surge in standard traffic that would happen, and then you've effectively plunged all or part of the country into a communication blackout. IME cell networks definitely can't cope with a loss of all routers in an area, given how mobile data becomes basically unusable when there's a power outage. That said, "everyone had their routers disabled" is probably not realistic, given that there are plenty of non-chinese router vendors.
• DesiLurker 6mo ago
  is this the new age .. how to run doom on it?
• hoechst 6mo ago
  tl;dr: echo 1 > /proc/sys/net/ipv4/ip_forward iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
• maybe_pablo 6mo ago
  I did kind of the opposite, I made my main beefy gaming computer the router, then connected to it a nice wireless AP in bridge mode to serve internet to the rest of the computers. That way I can have a local llm agent manage my network and firewall by simply asking.
  • mayhemducks 6mo ago
    good god man are you insane?
• YouAreWRONGtoo 6mo ago
  [dead]
• nickdothutton 6mo ago
  When I got started, the NSFnet backbone was a bunch of IBM RS/6000 systems with comms cards. There were no routers.[1] [1] https://www.rcsri.org/collection/nsfnet-t3/ https://www.rcsri.org/collection/nsfnet-t3/
  • icedchai 6mo ago
    There were routers, just no T3 (45 megabit) capable routers.
• StillBored 6mo ago
  I've got one of those N100+10Gbit router devices with a handful of ports. It seems a pretty reasonable device with one of the router distros running on it, but it doesn't seem nearly as efficient as my ucg-fiber/route10 devices, and that wouldn't bother me except that I suspect the packet latency is significantly higher too. Those devices AFAIK have hardware programmable router chips, which means the forwarding is done 100% without the interaction of the main CPU, so there isn't any interrupt/polling/etc delays when a packet arrives, the header gets rewritten, the checksum verified and off it goes. Anyone actually measured this? I see a lot of bandwidth/etc style tests but few that can show the actual impact of enabling disabling deep packet inspection and a few of the other metrics that I actually care about. Serve the home seems to have gotten some fancy test HW but they don't seem to be running these kinds of tests yet.
  • zrail 6mo ago
    From what I can tell you're pretty much right. A linux bridge cannot possibly be as efficient or speedy as a dedicated switch asic. OpenWRT has support for a few different hardware switch kernel APIs, but you can't exactly buy one of those on a PCIe card and I've never seen one of those N100-class boards with one instead of a set of i226 ethernet controllers taking most of the PCIe lanes. Mikrotik sells the CCR2004-1G-2XS-PCIe, which is a fascinating device: https://mikrotik.com/product/ccr2004_1g_2xs_pcie https://mikrotik.com/product/ccr2004_1g_2xs_pcie It is a full Mikrotik router stripped down to just a board and hung off a PCIe interface. Iirc by default it exposes a virtual gigabit interface to the host and otherwise acts exactly like a CCR2004 running RouterOS. Doesn't really buy you anything vs a RB5009 unless you can use the pair of 25Gbps ports, but it sure is neat.
  • HexPhantom 6mo ago
    It's less about "hardware is always lower latency" and more about when the fast path stays enabled vs when you fall off it
  • rayiner 6mo ago
    The hardware-based routers have low latency. Fortigate advertises under 5 usec forwarding latency for its routers. Linux kernel forwarding is on the order of 10s of usec. However, under 100 usec of latency is negligible over a WAN link, where you're talking ~5 msec latency even on a fast fiber link. The downside of hardware routing is the lack of flexibility and some performance cliffs. On the consumer grade hardware routers in particular, connection setup is handled by a low-power ARM CPU. You have limits on the number of flows you can accelerate in hardware at a time, etc. I've got a 10G fiber connection, and I swapped out a Fortigate 100F for a server running VyOS. I had performance problems, because the 10G to 1G transition caused dropped packets at the switch. I was able to solve it by shaping the traffic to the 1G devices to handle queuing in the router, which is something this particular Fortigate can't do. (High end routers have algorithms like WRED designed to get TCP to behave nicely on 10G to 1G drops, but I don't want the noise of a Cisco in my basement.)
• zer00eyz 6mo ago
  I live in the SF Bay Area, and ended up with Sonic Internet, and a 10gbe connection. Routing this with anything off the shelf was going to be "very expensive". I ended up with an Opnsense box. It's an m920q (i5-8500), with riser card and a dual SFP+ nic in it. All in, it was less than 200 bucks (now it would be closer to three). I ended up with a cheap, Chinese "media converter" (from aliexpress because the same thing on amazon is 3x the price) that just had two SFP+ ports on it. That let me go from an SPF+ copper ethernet module to a DAC and not dump a bunch of heat into the 1L pc. I have to say that the functionality made it a worth while investment: traffic shaping, wireguard and the like have been mostly a joy. And the documentation for Opnsense made the setup and use (mostly) easy.
• tanvach 6mo ago
  Anyone has done mesh WiFi (ideally triband) using off the shelf parts and Linux? I have an Orbi AX system which works reliably, but now I want to upgrade the radio to WiFi 7 and that means I need to upgrade all the hardware. Hoping to move to using off the shelf parts so in the future I can just change the radio (ideally bunch of USB sticks). I understand this is not strictly just the router. I can (and used to have) a router as separate device, but any mesh WiFi right now that I can find need a pricy router that acts as the coordinator, essentially negates the economic benefits.
  • Havoc 6mo ago
    Openwrt guys were cooking up a wifi 7 router I think. Think that’s best bet but Not super close to it though
  • segbrk 6mo ago
    That's a bigger can of worms than you might expect. Most consumer WiFi chips only barely support AP mode, and I'm not aware of any that can do multiple bands simultaneously. You'd probably need 4 adapters on the repeater for triband. One to connect upstream, one for each downstream band. Three instances of hostapd all configured with the same SSID and auth for each downstream interface. Then there's the roaming issue. This is largely what the commercial "mesh" systems try to solve: deciding / helping inform when clients should switch APs. There are many solutions and none of them are without issues, including the commercial ones. Here's a starting point: https://openwrt.org/docs/guide-user/network/wifi/roaming https://openwrt.org/docs/guide-user/network/wifi/roaming
    • tanvach 6mo ago
      Super interesting, thanks for sharing
• Pxtl 6mo ago
  I'm curious - for power consumption, considering that you can get RaspPi products for so cheaply, is a discarded laptop more or less impactful on your electrical bill than a RaspPi? Like is the "free" laptop going to cost you more in the long-run then a nice little power-sipping ARM like a Pi5? Or do you need those extra operations-per-second that the more power-hungry x86 CPU gets you?
  • krautburglar 6mo ago
    Everything outside of power equipment -- like HVAC, refrigerator, laundry dryer, etc -- is a rounding error on most power bills.
    • Pxtl 6mo ago
      Right but so's the price of a Raspberry Pi. 10W running 24/7 means about 7.3 kWh/month. In my area the average kW/h costs about $0.13 CAD So a good rule of thumb is that every 10W 24/7 is about $1CAD/mo. So assuming 30W for a laptop and 6W for a pi4, that means a difference of $29/yr. Which isn't a lot but isn't a rounding error either.
      • krautburglar 6mo ago
        Laptop/desktop wattage varies with processor and peripheral load. Unless you are pushing 10gbit and leaving the screen on 24x7, even an old box will be mostly in an idle state, with actual draw well below 30W. Even if that were not the case, paying an extra $2.50 / mo to not do ghetto fabulous bs with rpi and vlans seems like money well spent to me.
• nadav_tal 6mo ago
  [flagged]
• Havoc 6mo ago
  Just ensure the firewall appliance thing you buy has I226 intel chipset not I225 The first two versions of 225 have packet drop issues and it’s unclear to me whether v3 third time lucky fixed it. And getting the stepping info out of aliexpress supplier is hard so 226 is safer
• pdntspa 6mo ago
  Can anyone recommend a good, energy-efficient, inexpensive dual-NIC SBC or miniPC? Last time I looked into this there were not many good options.
  • bityard 6mo ago
    It's hard to recommend one thing because there are so many options and they all have different trade-offs in terms of initial cost, ease-of-use, reliability, performance, etc. A year or two back, I was able to get a brand-new fanless Intel N150 with 4x2.5G ports with 16 GB memory for about $150 from AliExpress. I run Proxmox on it, with OpnSense and a couple other things in virtual machines. These days, due to tariffs and the memory shortage, that is more like $440 now, unfortunately. I am kicking myself for not buying two, not so much because of the price increase, but because it would have come in handy multiple times to have a second one on-hand for random experiments. Given that CPU performance does _not_ tend to be critical for firewall/NAS use cases, if I had to replace it tomorrow, I would go onto eBay and get the highest-spec'd used Dell or HP mini workstation I could find for $120 and plug in a USB3 1gig ethernet dongle for the WAN side.
  • supertrope 6mo ago
    A used Sophos XG 115. Has Intel Ethernet interfaces which is preferable for BSD compatibility. 8W idle. I power it off a 802.3af to 12V splitter. If you want maximum speed a Lenovo Thinkcentre m720q has a desktop Intel CPU and a PCIe slot. You can add a 2x SFP+ NIC and PCIe riser to get 10G.
  • pak9rabid 6mo ago
    I've gone through quite a few embedded devices for exactly this use case. So far I've used: - Soekris net4501 (x86, 486-class CPU) (discontinued) - PCEngines alix2d3 (x86, AMD Geode LX800) (discontinued) - PCEngines APU (x86, AMD T40E) (my current router/firewall) (discontinued) I'm also currently using an APU2 as one of my wireless access points (with hostapd). All of these have been solid machines that have given me zero problems. The next system I plan to use is going to be a Banana Pi R4 (ARM Cortex A73), it's a solid choice for a simple router/firewall/DNS/DHCP box. It has a built-in 4-port gigabit switch where each interface can be used as normal Linux interfaces, as well as 2 SFP+ ports that are capable of supporting up to 10 gig ethernet. It's also one of the few systems that offers true hardware offloading for connection tracking, so things like netfilter flowtables don't have to use any main CPU processing. I'm currently experimenting with a Banana Pi R4 as a Wifi7 access point (running Debian with hostapd), however the current state of the wifi7 module for it (BPI-R4-NIC-BE14) and Linux driver (mt7996e) is still pretty young and a bit buggy (i.e., limiting transmit power to 6 dBm without patching the driver to override it, and there's apparently a lack of RF shielding which can contribute to low SNR on the receiving end). With the proper patches in place it makes a decent Wifi 6 access point. I'm hoping these issues get ironed out in the future and I can use it as a true Wifi7 AP. frank-w is doing outstanding work to help support the open source community with this new hardware.
• eth0up 6mo ago
  I'm currently running a Debian lite weight server on an old ml100 (onlogic) nuc. It's an old i3, with 16gb ram and no fan. But I have another. Anyone recommend a solid router setup on one of these ancient artifacts? Presently using openwrt on a proper router, though if the nuc is capable, I'd dedicate it thusly.
• dlenski 6mo ago
  This is a great writeup! Perhaps I can put in a plug for the create_ap script which I have been maintaining for many years (http://github.com/dlenski/create_ap http://github.com/dlenski/create_ap). It's a shell script that allows you to turn any ol' Linux computer into a WiFi router in one quick command-line: By default, it will setup your WiFi card as an access point (allows WPA2/3, MAC filtering, etc), setup packet forwarding and routing, and run a DHCP and DNS server. It will generally pick sensible defaults, but it's also highly customizable. If your WiFi card supports simultaneous AP and client mode, it will allow that. Its requirements are extremely minimal: basically just Linux, a compatible wireless card, and a few common configuration packages (hostapd, iw, iproute2, iptables, dnsmasq). No NetworkManager needed. I used it as my own home Internet gateway for many years, running on an ancient fanless Atom mini-PC. Because it can quickly setup and teardown WiFi networks on-the-fly, it's also a valuable tool for setting up test networks when reverse-engineering IoT devices. I use it frequently for this purpose (see https://snowpatch.org/posts/i-can-completely-control-your-smart-thermostat/#fn:3 https://snowpatch.org/posts/i-can-completely-control-your-sm...).
  • eptcyka 6mo ago
    Any tips on good wifi chipsets that do not suck in AP mode?
    • baby_souffle 6mo ago
      Which bands and capabilities did you have in mind? For a basic 2.4 GHz, almost anything at this point. Intel and some iteris chipsets are well supported. mt7996 is good for wifi 7. You can also check the suggested hardware list on the kismet project for good recommendations for older bands and protocol versions
      • zokier 6mo ago
        > Intel and some iteris chipsets are well supported. Intel chipsets categorically do not support AP mode
        • 6mo ago
• Bender 6mo ago
  Something I did not see in the article are router specific tuning such as net.ipv4.ip_early_demux = 0 net.ipv4.tcp_early_demux = 0 net.ipv4.udp_early_demux = 0 in /etc/sysctl.d/10_router.conf to slightly reduce overhead when being used primarily as a router. There are many other router related knobs but those I would always set especially if trying to reduce overhead for VoIP/Gaming setups. There are many other knobs I tune such as gro_flush_timeout and napi_defer_hard_irqs, sch_cake tuning, lowat and output limits and hundreds more but those rabbit holes would require a large write-up. My overall goal is to give family members latency, jitter and throughput numbers that improve their quality of life and gaming scores of course. Such things do not preclude additional tuning on the client and server sides as well but those are even bigger topics.
  • jcalvinowens 6mo ago
    How much does disabling early_demux actually matter? I do this too, but honestly I've never tested what difference it makes. I've always found fq_codel to be good enough for gaming through my router. But I have a 10gbps uplink.
    • Bender 6mo ago
      How much does disabling early_demux actually matter? It depends on what kind of packet rate one is pushing through the device, what type of hardware is being used as the router and how sensitive ones applications are to such things but if you want a better scientific answer run as many load tests as you can that measure packet rates, lag and jitter then disable them and run your tests again. I should add this is just one tunable related to routing. If bored dig into this a lot deeper and one will find there are many things that can be adjusted at the NIC, in the OS network stack and so much more. Some people like defaults because it is less cognitive load and some like to tweak things until they can't get better results. I believe that everyone should be able to choose their own path to satisfaction. If the defaults and fq_codel work for you then that is probably the right answer.
      • jcalvinowens 6mo ago
• Fwirt 6mo ago
  You actually don't even need two interfaces on the box if you have a managed switch. It's not too difficult to configure your only interface as an 802.11q trunk port, and then you can use the managed switch as a sort of "interface expander". This is referred to as a "router on a stick" configuration, and it's how my home network is configured. Plus, if it's a PoE managed switch, you can install some cheap enterprise surplus Aruba IAPs around the house for Wi-Fi which is a lot higher quality than a consumer router or a mesh setup. My home router was an old Thinkpad for a while, but then I switched over to a slightly newer Dell Optiplex that my work was throwing out. The plus side of that is that the i7 is total overkill for routing so I can also have my "router" run some VMs for network services and cut down on the number of boxen in my homelab rack. Alpine is a great distro for this.
  • lowdude 6mo ago
    I have actually been curious about this: How good can a WiFi mesh get latency-wise, given the right equipment, and how close would a consumer router setup be to that, do you happen to know?
    • Fwirt 6mo ago
      With modern Wi-Fi the issue isn’t really latency, it’s jitter. Most of my only moderately tech savvy friends have mesh setups that they don’t find fault with, but were also significantly more expensive than my cobbled together setup. From what I understand, my Aruba IAPs can also be configured in mesh mode so only one of them actually needs a router connection, but it was easier to just run a second CAT6 cable through my attic.
  • akdev1l 6mo ago
    >Wi-Fi which is a lot higher quality than a consumer router I am not really sure about it. My ISP provided AP can do a gigabit over wifi. I need to change it because the ISP hardcodes the dns for spying reasons. But sadly to match that performance I need to spend like $180 to get an AP with that performance
    • 6mo ago
• tonymet 6mo ago
  Great writeup. One advantage true routers have e.g. Edgerouter or Mikrotik are dedicated hardware for IP & TCP header processing. Some can offload AES for VPN encryption. This leads to cooler temps, lower power utilization & longer life. I encourage everyone to run a hardware router. A cheap dedicated wired router can be had for $50. Run PfSense or the vendor firmware . It’s very rewarding. Also a long term investment since routers tend to last for many years while wifi standards are revised every year or so .
• brcmthrowaway 6mo ago
  Does routing on Linux have any hardware acceleration for IP packets?
  • pak9rabid 6mo ago
    Yes. You can take advantage of Netfilter's flowtable infrastructure and if you have the right hardware (NVIDIA/Mellanox ConnectX-5 or MediaTekMT7621) it will actually offload the processing of these packets to the NIC hardware. This only applies to established connections, however, but that typically accounts for like 95% of the traffic passing through.
    • brcmthrowaway 6mo ago
      Awesome. I wonder if packet processing can be GPU accelerated
      • pak9rabid 6mo ago
        It looks like it can. Check out GPUDirect RDMA.
• Cuuugi 6mo ago
  Im running a Beelink EQ15 + OpnSense to do something very similar.
• tibbydudeza 6mo ago
  Nobody I know makes routers and more importantly WiFi combo AP in the US except for high end corporate stuff - even the US only cable modem stuff from Comcast are Chinese OEM ???. Some more idiocy from the FCC chair.
  • topspin 6mo ago
    SpaceX manufactures network gear (Starlink satellite internet terminals) in the US. Bastrop, Texas, specifically. Those phased array transceivers, with heaters, ethernet, GPS and WiFi are way more difficult to make than the typical indoor WiFi router.
• hughes 6mo ago
  I wonder if consumer routers will end up being built in a trivially-not-a-router configuration - something akin to a pull-tab or turn of the screw that closes a circuit, transforming the device from legally something else into a router after it's purchased. What a dumb timeline.
  • HeWhoLurksLate 6mo ago
    "this here is a virtual network appliance, so called because it doesn't have any ports on it - wait, why are you taking off that blanking panel? That's illegal!"
• ndsipa_pomu 6mo ago
  I think the NanoPi range (https://www.friendlyelec.com/index.php?route=product/category&path=69 https://www.friendlyelec.com/index.php?route=product/categor...) has great hardware for making your own router. They support various flavours of Linux, including OpenWRT (or at least their branded version called FriendlyWRT). I like the NanoPi M5 model as it supports using a NVMe so it can happily run some Docker containers on it. The case is really well made and uses passive cooling, so it's ideal for a router.
• bobbylox 6mo ago
  Try it with this! https://www.dewalt.com/en-us/product/dwp611pk/dewalt-1-14-hp-max-torque-corded-electric-variable-speed-compact-router-combo-kit https://www.dewalt.com/en-us/product/dwp611pk/dewalt-1-14-hp...
• drnick1 6mo ago
  > While it may seem appealing, I would highly recommend against installing loads of software right on the router, and instead forward traffic to a device in a DMZ or VLAN. Why not? I use an old gaming PC as a "router" (machine exposed to the WAN), and run dozens of services on it besides the firewall/NAT (iptables). Among others: email, Web server, multiple game servers, and many internal services (DNS, hostapd, loads of Docker containers).
  • alias_neo 6mo ago
    > Why not? It seems like you weren't really asking, but I'll answer anyway. It's bad security practice, and opens up your network to attack and/or compromise, you're massively increasing the attack surface, and a compromise of one of those components leaves the attacker sat on your edge router, at which point your entire network is fair game. Generally speaking you shouldn't expose anything on your edge router / firewall, it's a safety barrier. You can sit things behind it in a "DMZ" and port-forward and isolate them etc so that there's no packets terminating on the actual edge device itself.m, that lowers the risk of a full network level compromise. Chances are you might be fine and never have a problem, but it's still recommended against.
    • drnick1 6mo ago
      It was a genuine question, and while you reiterate the author's point about this being "bad security practice," neither you nor the author explain why this is the case. I don't believe physical separation really buys you much here. At most, if may reduce downtime if you do indeed get pwned, but I think that you can achieve the same objective through a combination of containers, VMs, and UNIX users. And running multiple, somewhat redundant machines also has obvious downsides such as increased power consumption, increased maintenance burden, additional space and cabling, etc.
      • efreak 6mo ago
        > opens up your network to attack and/or compromise, you're massively increasing the attack surface, and a compromise of one of those components leaves the attacker sat on your edge router, at which point your entire network is fair game. That's your answer.
• p0w3n3d 6mo ago
  There's a famous Polish song "Mój jest ten kawałek podłogi", written in times of Soviet influence, about a man building wall around his home, but later he gets hungry and there's no exit... Anyone with translate.kagi can find it and translate
• mintplant 6mo ago
  This seems like it might be a good place to ask: does anyone know of a low-cost, readily-available SBC box with built-in dual Ethernet interfaces? I've been very interested in some of Radxa's boards in the ~$30-70 range, like the E52C [0] and the E20C [1], but they don't have many distributors and seem to have stocking issues [2]. [0] https://radxa.com/products/network-computer/e52c/ https://radxa.com/products/network-computer/e52c/ [1] https://radxa.com/products/network-computer/e20c/ https://radxa.com/products/network-computer/e20c/ [2] https://shop.allnetchina.cn/products/radxa-e52c?variant=50345799254332 https://shop.allnetchina.cn/products/radxa-e52c?variant=5034...
  • forinti 6mo ago
    Banana Pi makes SBCs with lots of networking ports.
    • deleted 6mo ago
      [deleted]
  • whalesalad 6mo ago
    Not sure if this counts as low cost... https://store.minisforum.com/products/minisforum-ms-r1-workstation https://store.minisforum.com/products/minisforum-ms-r1-works...
    • mintplant 6mo ago
      Quite a bit beefier and pricier than I'm looking for, yes! But thank you anyway.
  • zymhan 6mo ago
    If you're okay with used, I got an "industrial" mini PC with loads of connectivity for maybe $125? https://support.onlogic.com/product-documentation/industrial-products/ml500-series https://support.onlogic.com/product-documentation/industrial... And there are plenty of configurations at lower prices, as well as many other manufacturers in this space.
• jcalvinowens 6mo ago
  I recommend replacing hostapd with an enterprise access point plugged directly into an ethernet port on the router. Most support VLAN tagging based on SSID, so you can still set up different subnets and firewall rules for the different SSIDs. As much as I love hostapd... the performance using commodity hardware has always sucked for me. I can get 150MB/s over wifi with my proprietary AP!
  • linsomniac 6mo ago
    Agreed. I also have had some good times with hostapd, and I've done a lot with commodity wifi hardware in the past (I'm known as the guy that was able to get WiFi working for PyCon when nobody else could). But these days I've been running a Ruckus R620 at home and it's been a huge improvement over 4 Google WiFi APs spread around the house with ethernet backhaul.
• SamDc73 6mo ago
  [dead]
• F00Fbug 6mo ago
  That works and it's a great writeup, but it's a lot of manual work. Just get OPNsense (great if you have the horsepower) or OpenWRT (for a smaller machine). You'll learn a lot doing from scratch, but initial setup and maintenance will be much easier with a purpose-built distro. I've been running various homebrew routers for close to 20 years now; OPNsense is fantastic. Bonus, run it as a VM on your Proxmox host and eliminate a few wires!
• xon94010 6mo ago
  Love fanless appliance for my routers. I've been using a Fitlet2 for the past 6 or 7 years. Never had an issue. Running pfsense on it. https://fit-iot.com/web/products/fitlet2/ https://fit-iot.com/web/products/fitlet2/
• thomasjudge 6mo ago
  To me the single nic/double nic decision is a tradeoff between simplicity and complexity, and where you want that complexity to live. A single nic may be physically "simpler" but you need additional software complexity with VLANS and a VLAN aware switch. A double nic is mabe physically more complex but it allows you to have a simpler software setup (no VLAN's)
• gigatexal 6mo ago
  nftables syntax makes me love pf’s syntax even more. Shudder man shudder.
• nostrademons 6mo ago
  I'm more worried about how to turn anything into a fiber modem, as I'm pretty sure the gateway that AT&T gave me is a piece of crap (has to be rebooted every 2-3 weeks otherwise it gets really slow, hard to configure, probably has all sorts of malware and security holes on it). Any guides on that?
  • frantathefranta 6mo ago
    pon.wiki is a great resource
• h4kunamata 6mo ago
  This article and many comments here missess the most important detail: Nobody wanna be a full time SysAdmin. Sure, follow the article and you will get things.....working but will also turn you into a SysAdmin. Homelab is my hobby, CLI aka command line interface is where I spend most of the time playing with my linux containers BUT you do wanna a GUI to manage network stuff. Do you wanna do this right and once?? And trully open-source meaning, you will never have to pay to use it?? 1. OpenWRT: It supports many WiFi6/7 wireless router, it provides you router, wireless, basic firewall, plugins. Set it once and forget. My dumb OpenWRT wireless only access point has been running for years. It used to be my main router, same device. 2. OPNSense: This is like going from an EV to a V12 bi-turbo: It will work out of the box, you change things ONLY if you wanna mess around. Provide your ISP login when installing it and everything works out of the box. My OPNSense baremetal has dozens of firewall rules and what not but from an every day life pov, I do not touch it other than check for updates and neither should you. Good luck troubleshooting network problems via CLI only if you have no idea of what is going on and just followed some article online.
  • krautburglar 6mo ago
    If you know your platform, it is set-it-and-forget-it. I use CLI OpenBSD as a router, and it has been far less trouble than any of the ready-made GUI ones I have ever used. The ready-mades are brutally under-powered, have snowflake UIs that have to be re-learned on each revision, and have very short firmware update windows, so have to be replaced (and the UI re-learned) every few years. While with my OpenBSD thing, it's just `sysupgrade` then `pkg_add -u` -- for almost a decade now. But yeah, if you're just copy-pasting without understanding, OPNSense is far better.
• csacc 6mo ago
  Im confused, does this work with two wifi cards or does it require ethernet?
  • a96 6mo ago
    Works with anything to anything that can pass IP traffic.
• s0rce 6mo ago
  My first router used the Freesco project (https://www.freesco.org/ https://www.freesco.org/) it had 2 pci network cards in an old pentium 80 that booted linux off a floppy, probably around 1999.
• deleted 6mo ago
  [deleted]
• diablevv 6mo ago
  [dead]
• p0w3n3d 6mo ago
  I wonder how much energy does the old Thinkpad consume, however I'm grateful for the tutorial. It sure can be used in other hardware
• t312227 6mo ago
  hello, about 20 or 25 years ago i used whatever old hardware i could find in someones cellar or a junkyard together with 2 NICs and a floppy-disk drive / FDD based linux-distribution ... it outgrew its original media - FDD - and is still active, as a router-focused distribution: * https://www.fli4l.de/ https://www.fli4l.de/ just my 0.02€
• HexPhantom 6mo ago
  This is a fun throwback to the "routers are just computers" mindset that a lot of people forget once they've only ever used consumer gear
• giobox 6mo ago
  Whats the verdict on sizing a general purpose CPU to become the basis of a software router? I've no deep knowledge of the field, but my understanding is a lot of router/switch hardware uses dedicated hardware designs to ensure they deliver the bandwidth and ultra-low latency even if the device is absolutely slammed with traffic. I've read before routing/switching in software like pfsense or similar can potentially struggle under some workloads dedicated hardware does not, but I've never seen a good analysis of the trade offs with actual benchmarks. I'm sure most recent modern CPUs can probably handle a lot, but people often repurpose old SBCs they have like Raspberry Pis etc for projects like this.
• timkofu 6mo ago
  I used to use VyOS for this.