5 ms·

A router only really needs one network interface. Any computer with a single network interface, maybe even an (old) laptop, can be used. Anything x86 from at l

A router only really needs one network interface. Any computer with a single network interface, maybe even an (old) laptop, can be used. Anything x86 from at least the last 10 years is energy efficient and fast enough to route at gigabit speed. If you don't care about energy usage, any x86-based computer from the last 20 years is fast enough. The magic trick is to use VLANs, which require switches that support VLANs, which can be had for cheap. VLANS also allows you to create separate isolated networks for IoT or other 'less secure' or untrusted devices. I’ve always made my own routers by using low-power devices running Linux (Debian) with IPtables and now NFtables. No special router OS or software required. Highly recommend. P.S. that single network interface is very likely never a bottleneck because network interfaces are full-duplex. Only when your router is also your file server (not recommended), internet traffic and file server traffic could start to compete with each other.

ata_aman 7mo ago
Have you noticed significantly slowed network speeds over WiFi?
- louwrentius 7mo ago
  Not that I know of, why would that happen?
  - ata_aman 7mo ago
    Wouldn’t all traffic be routed through the OS/processor on board?
    - gsck 7mo ago
      Wait until you hear about CAPWAP!
    - louwrentius 7mo ago
      A CPU from the last 20 years can route traffic at gigabit speed. It's only something to worry about for a Raspberry Pi3 or something similarly 'crippled'.
      - colinb 7mo ago
        I think I understand why this is true for plain IP forwarding. There isn’t much to break the cache and the lookups are few and fast. What’s the cheapest (new) computer that can drive a 1Gb port with NAT? With a busy encrypted (wireguard?) connection? [I don’t think qos has a lot of use in the domestic environment; sure, someone here does it but I think it’s much less mainstream than the features I already mentioned. ] Such a device could drive my home. But in a couple of years I suspect I’ll want 2Gb or 10. In the past I’ve tended to use a device until its crappy power supply failed. So I guess I’m hoping for a >5 year life span/upgrade capacity. For all I know the answer to my question is one of those passively cooled four port n100 bricks from AliExpress. Anecdata happily accepted.
        lstodd 7mo ago
        Wireguard adds nothing unless you'd want to terminate it on the router. In which case it adds so very little it's unnoticeable. About any n100 will do. Question is in their reliability which mostly comes down to power regulation components quality. Not performance. One of my installs runs on a repurposed old android phone. Which has about 100 times CPU capacity of the router I write this through, and that one being cheap tplink shit still terminates wireguard at link speed which is 100Mbps. You don't need fancy gear for routing. And you don't usually need gigabit uplink because speed is limited way upstream. But if you want "the right gear and damn the price" go get a Microtik. They are very good.
        toast0 7mo ago
        > What’s the cheapest (new) computer that can drive a 1Gb port with NAT? What's the cheapest new computer you can find? That will work. If you have PPPoE, you need to be a bit more careful; depending on your OS and NICs, it's possible for inbound traffic to only use one core; low power laptop cpu may not have enough throughput from a single cpu, but my information is a little dated. I did 1G NAT on a dual core haswell [1] for a long time. [1] https://www.intel.com/content/www/us/en/products/sku/82723/intel-pentium-processor-g3258-3m-cache-3-20-ghz/specifications.html https://www.intel.com/content/www/us/en/products/sku/82723/i...
    - estimator7292 7mo ago
      You'd be shocked to find out how old and weak the CPU in your current router is. Typically they're on par with low end desktop CPUs from 10-15 years ago.
      - ata_aman 7mo ago
        I assume the real router OS is extremely neutered to basically only route traffic and filter inbound with everything else being removed? But yeah I can definitely see that.
      - tuetuopay 7mo ago
        Except actual routers don't handle the traffic on the CPU, they have dedicated hardware to actually handle the packets. The CPU basically runs the OS, configures the hardware router, and does housekeeping tasks (e.g. ARP or FDB expirations, NAT cleanup, etc). The only packets that ever reach it are "trap to CPU" situations that don't require acceleration as those are rare or expensive to implement in hardware (e.g. better suited to a CPU). Those usually include management protocols (ICMP, ARP, NDP, STP, etc) or packets with unknown destination (e.g. the first packet to an IP that requires ARP resolution). That's how you can have multi-Gbps on a router with a 200MHz MIPS CPU. Or Tbps on a router with a quad-core Xeon.
        deleted 7mo ago
        [deleted]
newnewfun 7mo ago
Yea, I would add openwrt x86 provides a decent interface for management. Gave dad a little minicomputer with openwrt when he upgraded his internet. He can change wifi password and such and is happy.
icedchai 7mo ago
Yes, but some folks are wary of using the same physical port for external and internal traffic. Fears of "VLAN hopping" remain, even if unfounded. Also, you'll hit a performance wall since you are sharing a single gigabit port between external and internal traffic. Obviously may not be an issue for many, but if you have gigabit fiber...
- louwrentius 7mo ago
  I have gigabit fiber and none of this is an issue. VLAN hopping is only possible due to misconfiguration. I'd like to be proven otherwise if that's not the case. VLANs are used EVERYWHERE where it matters. And no, the single port is absolutely not a bottleneck because the port is full-duplex.
  - estimator7292 7mo ago
    What happens if one node on your network is downloading at 1Gbit and another is uploading at 1Gbit? Both get 500Mbit. Bottleneck.
    - gruez 7mo ago
      That's going to be super rare. If it's just LAN traffic it shouldn't hit your router at all and you won't have the bottleneck issue. The actual cases would need to be quite contrived, like you're backing up your media library at the same time you're updating cod warzone.
      - simoncion 7mo ago
        > The actual cases would need to be quite contrived... As someone who works a programming job from home, I can tell you that the cases are not at all contrived. I've also heard from folks who have lots of roommates (whether or not those roommates are their swarm of children) that heavy simultaneous upload and download traffic is very common. You can get away with a router that has a single physical port. It's generally just easier and better to have more than one physical port... and even 10gbit-capable ethernet ports are pretty damn cheap. (I can get two 10gbit ports for about the same price as two 1gbit ports... ~30 USD.)
binaryturtle 7mo ago
Sounds interesting. I always wanted to use a Raspberry PI as router (to have one as backup in case the OpenWRT Linksys goes down), but couldn't wrap my head around properly how to overcome the single network port (I think the usual recommendation is to use an extra USB network card/adapter). Can you elaborate more about this VLAN stuff (you would put your modem, your router, and all your machines on the switch... and in the switch you tell the router connection to double use the connection for WAN and LAN separated via VLANs? And put the modem into the "WAN VLAN" too?) Ideally the PI also should to what the extra DSL Modem does… but I guess that's where the dram must stop. :D
- louwrentius 7mo ago
  I've created a blog post about this: https://louwrentius.com/raspberry-pi-as-a-router-using-a-single-network-interface.html https://louwrentius.com/raspberry-pi-as-a-router-using-a-sin...
- tuetuopay 7mo ago
  The TL;DR is to have two vlans on the cable from your switch (called a "trunk"), "lan" and "wan", carrying the respective LAN and WAN networks. Then, on the Pi, create two vlans on the underlying Ethernet interface. Then those two VLAN interfaces can be configured just like the LAN and WAN interfaces of the router. On the switch, you’d dedicate one port to the WAN by adding it to the WAN VLAN without tagging, and the other interfaces do the LAN VLAN, also untagged.
- pak9rabid 7mo ago
  When you setup your single ethernet port (let's call it eth0) as a VLAN trunk port, you'll get the ability to configure multiple virtual interfaces off of it. How many virtual interfaces you get depends on how many VLANs you want to tag traffic for. For example, if you have 2 VLANS with ids 100 and 200 (100 being your public Internet-facing traffic, and 200 being your LAN traffic), you would then have interfaces eth0.100 and eth0.200 to work with that you can then use in your firewall scripts as if they were two separate, physical interfaces. This of course means you need a VLAN-aware switch that this single ethernet port can plug into, configured as a VLAN trunk (in Cisco terms) port. You would then want to configure one of the other switch ports as a VLAN access port assigned to VLAN 100 (untagged). This is the port you would plug your cable modem into. Then (in the simplest example) you could assign all the rest of the switch ports to VLAN 200 (untagged), and you would plug all your LAN devices into them.
globular-toast 7mo ago
Pretty sure switches that support VLANs are more expensive than a NIC. I think even a 4 port GigE Intel NIC can be had for less. But you might want VLANs anyway, so it's an interesting thing to consider.
- hrmtst93837 7mo ago
  [flagged]
- fargle 7mo ago
  Netgear GS305e supports VLANs and can be ~$21
EvanAnderson 7mo ago
It only needs one port, but for most simple networks two ports on the router means less configuration. The "router on a stick" paradigm using VLANs to a share a single physical port is perfectly valid. You're creating a "now you have two problems" scenario in which you need a VLAN-capable switch and have VLAN configuration to make. I typically like the ISP router on a dedicated router port to make monitoring the physical link and/or cycling the physical link easier. Unless your ISP is >1Gbps adding a second port to most devices is as easy as adding a USB NIC.
- cestith 7mo ago
  Technically you can route without isolation, but VLANs are definitely a good idea if you’re using a single port. There are 2.5 Gbps, 5, and even 10 Gbps USB NICs these days, although 10 Gbps ones are pretty expensive and require really recent USB ports. I agree I want my local network and my WAN port separate, if for no other reasons than so I can use ssh to get into the router from my LAN with the WAN port disabled.
sta1n 7mo ago
[dead]

ata_aman 7mo ago

Have you noticed significantly slowed network speeds over WiFi?

louwrentius 7mo ago
Not that I know of, why would that happen?
- ata_aman 7mo ago
  Wouldn’t all traffic be routed through the OS/processor on board?
  - gsck 7mo ago
    Wait until you hear about CAPWAP!
  - louwrentius 7mo ago
    A CPU from the last 20 years can route traffic at gigabit speed. It's only something to worry about for a Raspberry Pi3 or something similarly 'crippled'.
    - colinb 7mo ago
      I think I understand why this is true for plain IP forwarding. There isn’t much to break the cache and the lookups are few and fast. What’s the cheapest (new) computer that can drive a 1Gb port with NAT? With a busy encrypted (wireguard?) connection? [I don’t think qos has a lot of use in the domestic environment; sure, someone here does it but I think it’s much less mainstream than the features I already mentioned. ] Such a device could drive my home. But in a couple of years I suspect I’ll want 2Gb or 10. In the past I’ve tended to use a device until its crappy power supply failed. So I guess I’m hoping for a >5 year life span/upgrade capacity. For all I know the answer to my question is one of those passively cooled four port n100 bricks from AliExpress. Anecdata happily accepted.
      - lstodd 7mo ago
        Wireguard adds nothing unless you'd want to terminate it on the router. In which case it adds so very little it's unnoticeable. About any n100 will do. Question is in their reliability which mostly comes down to power regulation components quality. Not performance. One of my installs runs on a repurposed old android phone. Which has about 100 times CPU capacity of the router I write this through, and that one being cheap tplink shit still terminates wireguard at link speed which is 100Mbps. You don't need fancy gear for routing. And you don't usually need gigabit uplink because speed is limited way upstream. But if you want "the right gear and damn the price" go get a Microtik. They are very good.
      - toast0 7mo ago
        > What’s the cheapest (new) computer that can drive a 1Gb port with NAT? What's the cheapest new computer you can find? That will work. If you have PPPoE, you need to be a bit more careful; depending on your OS and NICs, it's possible for inbound traffic to only use one core; low power laptop cpu may not have enough throughput from a single cpu, but my information is a little dated. I did 1G NAT on a dual core haswell [1] for a long time. [1] https://www.intel.com/content/www/us/en/products/sku/82723/intel-pentium-processor-g3258-3m-cache-3-20-ghz/specifications.html https://www.intel.com/content/www/us/en/products/sku/82723/i...
  - estimator7292 7mo ago
    You'd be shocked to find out how old and weak the CPU in your current router is. Typically they're on par with low end desktop CPUs from 10-15 years ago.
    - ata_aman 7mo ago
      I assume the real router OS is extremely neutered to basically only route traffic and filter inbound with everything else being removed? But yeah I can definitely see that.
    - tuetuopay 7mo ago
      Except actual routers don't handle the traffic on the CPU, they have dedicated hardware to actually handle the packets. The CPU basically runs the OS, configures the hardware router, and does housekeeping tasks (e.g. ARP or FDB expirations, NAT cleanup, etc). The only packets that ever reach it are "trap to CPU" situations that don't require acceleration as those are rare or expensive to implement in hardware (e.g. better suited to a CPU). Those usually include management protocols (ICMP, ARP, NDP, STP, etc) or packets with unknown destination (e.g. the first packet to an IP that requires ARP resolution). That's how you can have multi-Gbps on a router with a 200MHz MIPS CPU. Or Tbps on a router with a quad-core Xeon.
      - deleted 7mo ago
        [deleted]

newnewfun 7mo ago

Yea, I would add openwrt x86 provides a decent interface for management. Gave dad a little minicomputer with openwrt when he upgraded his internet. He can change wifi password and such and is happy.

icedchai 7mo ago

Yes, but some folks are wary of using the same physical port for external and internal traffic. Fears of "VLAN hopping" remain, even if unfounded. Also, you'll hit a performance wall since you are sharing a single gigabit port between external and internal traffic. Obviously may not be an issue for many, but if you have gigabit fiber...

louwrentius 7mo ago
I have gigabit fiber and none of this is an issue. VLAN hopping is only possible due to misconfiguration. I'd like to be proven otherwise if that's not the case. VLANs are used EVERYWHERE where it matters. And no, the single port is absolutely not a bottleneck because the port is full-duplex.
- estimator7292 7mo ago
  What happens if one node on your network is downloading at 1Gbit and another is uploading at 1Gbit? Both get 500Mbit. Bottleneck.
  - gruez 7mo ago
    That's going to be super rare. If it's just LAN traffic it shouldn't hit your router at all and you won't have the bottleneck issue. The actual cases would need to be quite contrived, like you're backing up your media library at the same time you're updating cod warzone.
    - simoncion 7mo ago
      > The actual cases would need to be quite contrived... As someone who works a programming job from home, I can tell you that the cases are not at all contrived. I've also heard from folks who have lots of roommates (whether or not those roommates are their swarm of children) that heavy simultaneous upload and download traffic is very common. You can get away with a router that has a single physical port. It's generally just easier and better to have more than one physical port... and even 10gbit-capable ethernet ports are pretty damn cheap. (I can get two 10gbit ports for about the same price as two 1gbit ports... ~30 USD.)

binaryturtle 7mo ago

Sounds interesting. I always wanted to use a Raspberry PI as router (to have one as backup in case the OpenWRT Linksys goes down), but couldn't wrap my head around properly how to overcome the single network port (I think the usual recommendation is to use an extra USB network card/adapter). Can you elaborate more about this VLAN stuff (you would put your modem, your router, and all your machines on the switch... and in the switch you tell the router connection to double use the connection for WAN and LAN separated via VLANs? And put the modem into the "WAN VLAN" too?) Ideally the PI also should to what the extra DSL Modem does… but I guess that's where the dram must stop. :D

louwrentius 7mo ago
I've created a blog post about this: https://louwrentius.com/raspberry-pi-as-a-router-using-a-single-network-interface.html https://louwrentius.com/raspberry-pi-as-a-router-using-a-sin...
tuetuopay 7mo ago
The TL;DR is to have two vlans on the cable from your switch (called a "trunk"), "lan" and "wan", carrying the respective LAN and WAN networks. Then, on the Pi, create two vlans on the underlying Ethernet interface. Then those two VLAN interfaces can be configured just like the LAN and WAN interfaces of the router. On the switch, you’d dedicate one port to the WAN by adding it to the WAN VLAN without tagging, and the other interfaces do the LAN VLAN, also untagged.
pak9rabid 7mo ago
When you setup your single ethernet port (let's call it eth0) as a VLAN trunk port, you'll get the ability to configure multiple virtual interfaces off of it. How many virtual interfaces you get depends on how many VLANs you want to tag traffic for. For example, if you have 2 VLANS with ids 100 and 200 (100 being your public Internet-facing traffic, and 200 being your LAN traffic), you would then have interfaces eth0.100 and eth0.200 to work with that you can then use in your firewall scripts as if they were two separate, physical interfaces. This of course means you need a VLAN-aware switch that this single ethernet port can plug into, configured as a VLAN trunk (in Cisco terms) port. You would then want to configure one of the other switch ports as a VLAN access port assigned to VLAN 100 (untagged). This is the port you would plug your cable modem into. Then (in the simplest example) you could assign all the rest of the switch ports to VLAN 200 (untagged), and you would plug all your LAN devices into them.

globular-toast 7mo ago

Pretty sure switches that support VLANs are more expensive than a NIC. I think even a 4 port GigE Intel NIC can be had for less. But you might want VLANs anyway, so it's an interesting thing to consider.

hrmtst93837 7mo ago
[flagged]
fargle 7mo ago
Netgear GS305e supports VLANs and can be ~$21

EvanAnderson 7mo ago

It only needs one port, but for most simple networks two ports on the router means less configuration. The "router on a stick" paradigm using VLANs to a share a single physical port is perfectly valid. You're creating a "now you have two problems" scenario in which you need a VLAN-capable switch and have VLAN configuration to make. I typically like the ISP router on a dedicated router port to make monitoring the physical link and/or cycling the physical link easier. Unless your ISP is >1Gbps adding a second port to most devices is as easy as adding a USB NIC.

cestith 7mo ago
Technically you can route without isolation, but VLANs are definitely a good idea if you’re using a single port. There are 2.5 Gbps, 5, and even 10 Gbps USB NICs these days, although 10 Gbps ones are pretty expensive and require really recent USB ports. I agree I want my local network and my WAN port separate, if for no other reasons than so I can use ssh to get into the router from my LAN with the WAN port disabled.

sta1n 7mo ago

[dead]