6 ms·
What changes when you turn a Linux box into a router
- eqvinox 7mo ago[flagged]
- oxygen_crisis 7mo agoTechnically it's an IPv4 router once you enable net.ipv4.ip_forward in step 1, the rest is enabling a whole lot of supplementary services and operations not intrinsic to the definition of a router.
- TacticalCoder 7mo agoI didn't see in TFA --although I may have missed it-- where it said it was replacing the ISP's router/CPE. Anything routing traffic is a router. At home I've got both a CPE given by my ISP and my own router that routes and bridges traffic between two LANs of mine (192. and 10.). Moreover the lack of IPv6 inside our own LANs is, for many of us, a feature. It doesn't mean we don't have an IPv6 address: it just means we have the choice and did choose to have our own LANs on IPv4 only. And, no, I don't care that it makes some programmers at some megacorp' lives more difficult to "reach" inside my networks. I'm the boss at my home and my router is IPv4 only. And I've got that in addition to my ISP's CPE.
- 0o_MrPatrick_o0 7mo agoI wouldn’t call it a cpe unless it translates the connection from the clec/co into IP. IMO, it’s a plain old router/switch/bridge.
- trelane 7mo agoWhat is "CPE" in this context? It's probably not "Common Platform Enumeration" (my top results for "cpe linux") or "Customer-Premises Equipment." ("cpe networking")
- bombcar 7mo agoI think it's your second one (used to be called the "modem" in the modem→router→ pc setups of yore).
- trelane 7mo ago> CPE generally refers to devices such as telephones, routers, network switches, residential gateways (RG), set-top boxes, fixed mobile convergence products, home networking adapters and Internet access gateways that enable consumers to access providers' communication services and distribute them in a residence or enterprise with a local area network (LAN). https://en.wikipedia.org/wiki/Customer-premises_equipment https://en.wikipedia.org/wiki/Customer-premises_equipment Given that the Wikipedia definition of CPE includes routers, I don't see how calling it CPE precludes it being a router, as the poster claimed: > That's not a router, that's a CPE, and one without IPv6 support
- bombcar 7mo agoI think a CPE could (be/include) a router, but usually it refers to the demarc between the provider's network and the customer's (no matter who owns/manages it). For a Linux box to be a true CPE you'd likely need somewhat of a specialized card, one that can communicate directly to the next device up the line (e.g, take commercial fiber or cable in, ISDN modem, etc). If it just shoots out ethernet into some other box next to it, it's likely not a CPE.
- Hikikomori 7mo agoPlenty of isps that provide internet over regular ethernet. But it's a ye olde telecom provider term that referred to the phone, that you also didnt own yourself. Doesn't always apply cleanly these days.
- BenjiWiebe 7mo agoReally? They have buried Cat5/6 cable speaking Ethernet coming onto your property? I've never heard of that before. How does that work? Your ISP would always have to have some infrastructure within 100 meters of your router then.
- marssaxman 7mo agoThank you for informing me that a novel definition of the term "router" has come along since the last time I turned a Linux box into a router. The world changes in strange ways sometimes!
- nullsanity 7mo ago[dead]
- gerdesj 7mo agoNo need for "a" in "a CPE" (Customer Premise Equipment - its singular and plural inclusive already) - you wasted a character there 8) IPv6 support is not required for a router. You'll note they also fail to offer IPX/SPX or ATM and many more.
- tremon 7mo agoAside from the fact that "a CPE" is grammatically incorrect, you are also semantically wrong. A router is any device connected to multiple networks that can forward packets between them; and consumer-premises equipment includes everything that's directly connected or consumes a service from a telecom provider. Landline phones, set-top boxes and satellite decoders are also examples of CPE. It's like me stating "you're not a man, you're a human!" and then expecting you to be in awe of my profound wisdom.
- Havoc 7mo agoUsed to run a virtualized firewall setup. And then one day discovered that somewhere along the lines I had made a change (or an update changed something) that meant proxmox admin interface was being served publicly. That's despite confirming during initial setup that it isn't. So now I do not do any funky stuff with firewalls anymore. Separate appliance with opnsense bare metal.
- tarruda 7mo agoI currently do something similar. My router is a 16GB n150 mini PC with dual NICs. The actual router OS is within openwrt VM managed by Incus (VM/Container hypervisor) that has both NICs passed through. One of the NICs is connected to another OpenWrt wifi access point, and the other is connected to the ISP modem. The n150 also has a wifi card that I setup as an additional AP I can connect to if something goes wrong with the virtualization setup. Been running this for at least 6 months and has been working pretty well.
- Joel_Mckay 7mo agoBoth port specific firewall rules, and web-server IP permissions are important. For example, bandwidth rate-limiting may be inhibited for admin SSH or package updates, and LAN IPv4 private ranges for your host address pool are set. Finally, your internal DHCP should statically bind your admin computer MAC to a fixed LAN host IP to further reduce issues. Personally, I always build my NAS from scratch, as I have lost count of the number of problems web-GUI have caused over the years. =3
- gerdesj 7mo agoFair enough and I think you have done the right thing - opnsense is pretty decent - and the clear delineation between collision domains helps avoid showing too much ankle to the internet 8) I think your initial setup was perfectly valid. Then you diagnosed a fault and fixed it with aplomb, in a way that you could verify. The key point is: "in a way you could verify" and you failed safe. Well played. Proxmox itself has a useful firewall implementation too, although it takes a bit of getting used to because you can set it at the cluster, host and VM levels. I personally love it because it is easier to manage than individual host based firewalls, which I also do, but I'm a masochist! For smaller systems I generally use the cluster level to keep all the rules in one place.
- ValveFan6969 7mo ago[dead]
- ValdikSS 7mo agoThe Linux box instantly turns into a router as soon as you run `sysctl net.ipv4.ip_forward=1`, because the default policy for FORWARD table is ACCEPT. You need to explicitly reconfigure the iptables/nftables to prevent that from happening. Some software, say LXD/Incus, enable forwarding automatically upon installation/startup, and do not configure firewall to block non-their traffic, making the machine an open router. I've reported that, the developers said that's by design (despite other virtualization/containerization systems block forwarding if they happen to enable the sysctl).
- 3abiton 7mo agoA stupid question, what's the risk?
- tremon 7mo agoThe risk is minimal if you control or trust both networks. A network boundary is a natural choke point for access control, so that's where it's usually implemented. For an ipv4 boundary router (as is the topic of the post) you almost certainly need to configure Network Address Translation because your internal network addresses are non-routable on the Internet (at uni my dorm had public IP addresses for each student computer, fun times). As for the GP's example, running VM's or containers* on your own machine? I'd say the default ACCEPT policy is fine. However, silently changing such a setting on software installation is a problem because if the machine is multi-homed (i.e. has more than one network interface), you've now created a network route outside of the network admin's control. * The default for docker and podman is to use a private network, not a bridge anyway.
- fc417fc802 7mo agoIt's can also commonly be a problem if for example you are connected to multiple LANs via wireguard or similar.
- Dibby053 7mo agoBasically you're introducing a hole. For example, if you have some devices in your network (like a dodgy TV box) that are not supposed to reach the internet or other parts of the network, the computer with net.ipv4.ip_forward=1 could be used as a pivot. Depending on the routing tables you probably would also need to enable IP masquerading (NAT) to allow bidirectional communication.
- gxs 7mo agoMy very first exposure to Linux was in 2000, my school was about to throw away an old gateway computer and I took it home and turned it into router As a kid with no AI, no google, it was quite a feat and I’m still very proud of it Was my introduction into how the internet works and I’ll never forget working with ipchains I remember enduring a lot of people in forums calling me a noob, but only after spending collective hours answering my dumb questions I credit a big part of my moderate success in tech, to being familiar with stuff at just a tad bit lower of a level than the average bear To my friend Sam who I haven’t talked to in 20 years, thanks for the idea
- vaylian 7mo agoStories like these make me sad when I think about chat control and age verification. Kids in the future may no longer be allowed to talk to random helpful strangers on the internet about computers and other technical topics, because apparently the internet is too dangerous for children.
- pphysch 7mo agoSuppose the age verification checks stopped. Where exactly are these kids supposed to find "random helpful strangers" on the Internet that isn't also a major vector for predation or nonsensical AI spam? The open friendly ~safe Internet died long ago.
- gxs 7mo agoReddit? Discord? Other niche forums like the Subaru owner forums or the various audiophile forums? HN? There are so many places where no one even thinks to ask your age, they just help/troll/etc If age verification were in place, you may be forbidden from posting to those places which is mind boggling stupid to me I just don’t see the argument for age verification, it’s just yet another government overreach. It’s a well known thing to use children for any privacy reasons encroaching bills and they are always called “the save the children from online predators and other evil doers” so that you can be easily vilified if you oppose them
- 7mo ago
- freetime2 7mo agoAre there any preconfigured images/installers available for a major Linux distro to turn them a router with safe and sensible defaults? I know there is OpenWrt, but my experience is that is more geared toward running on embedded wifi hardware than an x86 machine. The x86 install comes with a tiny root partition that's actually pretty difficult to resize, for example, and upgrades are quite brittle compared to standard Linux distros. And there's also pfSense and OPNsense, but these run on FreeBSD which seems to lag behind Linux for hardware support. There's no support for the Aquantia AQC113 NIC, for example (although it looks like this may finally have been added in the last month or so). Something like an Ubuntu Appliance [1] would be quite nice. [1] https://ubuntu.com/appliance https://ubuntu.com/appliance
- ask2sk 7mo agoIpfire and Untangle seems suitable for your use case
- Joel_Mckay 7mo agoThose look pretty cool too. =3
- Joel_Mckay 7mo agoModified Ubuntu LTS server image will work, and a minimal Debian kernel will have far less bloat. Note pfSense/FreeBSD is fairly robust, and a mature project. Keep in mind most network appliances have dedicated hardware hand-off adapters, and so the CPU isn't involved in routing once the connection is setup. It is why people can use a $30 SoC, and still be able to saturate several 10Gb/100Gb ports. =3
- assimpleaspossi 7mo agoFreeBSD probably supports the hardware you have. If not, just buy the hardware that supports FreeBSD.
- erinnh 7mo agoThe best is likely Vyos. It acts quite similarly to routers from the likes of Arista/Cisco/Juniper. https://vyos.io/ https://vyos.io/
- chatmasta 7mo agoThis is an excellent post and great reference material. I’ve done this a few times before and the information was scattered all over the place. I appreciate the clear and concise writing here. I even added it to my HN favorites - a rare accolade! One thing I’d add, is that the best explanation I’ve ever seen for this, is the famous diagram [0] on Wikipedia of the netfilter API — I remember when I saw that, everything clicked into place. I’m not sure how up to date it is now, but it’s really good. [0] https://commons.wikimedia.org/wiki/File:Netfilter-packet-flow.svg https://commons.wikimedia.org/wiki/File:Netfilter-packet-flo...
- functional_dev 7mo agoThe wiki diagram helped me too, thanks! One thing I did not understand before: why SNAT must happen at POSTROUTING? Because the exit interface is only known after the routing decision... before that kernel does not know which source IP to write this visual schematic made it click for me - https://vectree.io/c/linux-netfilter-packet-flow-tables-chains-hooks-and-connection-tracking https://vectree.io/c/linux-netfilter-packet-flow-tables-chai...
- sorz 7mo agoI feels wrong to not mention IPv6 in 2026. - net.ipv6.conf.all.forwarding=1 - nftables is default to `ip` family which only applies to IPv4. Setting it to `inet` will allow rules to apply to both IPv4 & 6; or `ip6` for IPv6 only. You can skip NAT rules, usually. - dnsmasq: in addition to DNS and DHCP, turns on router advertisement with SLAAC. Some devices can get IPv6 address from stateful DHCPv6 server, others (e.g. Android) only work with SLAAC.
- binkHN 7mo agoWhile I run Linux on my production workstation, I use OpenBSD as my router and firewall at home. I find the configuration of OpenBSD for this a lot more simple and everything that's needed, even for IPv6, is in the base install.
- dfir-lab 7mo ago[flagged]
- jcalvinowens 7mo agoPeople saying "the FOWARD chain defaults to ACCEPT" are missing the deeper point: with the kconfig most distros use, the filtering code doesn't even exist at all until you load the kernel modules! At the lowest level, it is impossible to have a default DROP for forwarding, because nftables is an optional piece of the kernel that often isn't loaded.
- ValdikSS 7mo agoWell it's kind of possible to block it with routing tables+rules only, but you're right. This is also painful if iptables/nftables binaries are not installed.
- rkagerer 7mo agoThis is a great article. It explains steps I used to fumble through stabbing in the dark following piecemeal examples trying to bring up quick and dirty networking on an oddball Linux device (like a BPI-R4 or router VM).
- evanjrowley 7mo agoSet Linux as router in one command. Support Internet sharing, redsocks, Wifi hotspot, IPv6. Can also be used for routing VM/containers https://github.com/garywill/linux-router https://github.com/garywill/linux-router