10 ms·
Building My Own Home Router
- socceroos 12y agoStill trying to find a great home router that I can slap something like pfSense on.
- noonespecial 12y agoI use these little guys. A bit overpriced and only 100mb but they work well, run pfsense, openWRT etc and generally do what I want for years in a closet with no further intervention. http://www.pcengines.ch/ http://www.pcengines.ch/
- anderiv 12y agoThat, and the ~6 watt current draw at full tilt (at least that's what it was when I was load testing a couple of 2d3 boards) is very nice on the utility bill. Their newly-released APU boards are very nice, with GigE interfaces, increased RAM, and much faster CPUs.
- socceroos 12y agoYeah, fanless/low power draw is a must for me. I'm willing to pay a bit more for it too. But since I also want to run a transparent proxy it needs a bit of beef.
- buddylw 12y agoI've been running PFSense on an old Acer Aspire (now called veriton) and it's worked decently well for home use (100 Mbit downstream internet). It's only real downside was a single gigabit NIC, so I had to use VLANs and a router-on-a-stick configuration on a managed switch. Since the hardware is aging (and I want more NICs for no good reason) I recently found the edgerouter from Ubiquiti. It's running a modified version of Vyetta/vyos and shares its powerful CLI. It's also dirt cheap at <$100 and has been said (I haven't tried to max it out yet) to handle 500Mbit throughput. So far I haven't found anything that it can't do. It will also POE a few Ubiquiti access points, if you are into those. Makes a really nice home setup for the home network engineer for <$200.
- vhost- 12y agoHere's what I built: (Copied and pasted from one of my gists) Motherboard: http://www.gigabyte.com/products/product-page.aspx?pid=4918#ov http://www.gigabyte.com/products/product-page.aspx?pid=4918#... RAM: http://www.amazon.com/Crucial-PC3-12800-204-Pin-Notebook-CT25664BF160B/dp/B005LDLP8W/ref=sr_1_2?s=electronics&ie=UTF8&qid=1409717153&sr=1-2 http://www.amazon.com/Crucial-PC3-12800-204-Pin-Notebook-CT2... Hard drive: http://www.amazon.com/gp/product/B008U3038I/ref=oh_aui_detailpage_o04_s00?ie=UTF8&psc=1 http://www.amazon.com/gp/product/B008U3038I/ref=oh_aui_detai... Case: http://www.amazon.com/gp/product/B00HWYRYMY/ref=oh_aui_detailpage_o03_s00?ie=UTF8&psc=1 http://www.amazon.com/gp/product/B00HWYRYMY/ref=oh_aui_detai... OS: Debian Wheezy Software: iptables, isc-dhcpd, bind9, openvpn edit: formatting
- stock_toaster 12y agoA little pcengines apu4[0][1] or a lanner[2][3] - both work very well with pfsense. [0]: http://store.netgate.com/APU1C4.aspx [1]: kit http://store.netgate.com/APU4.aspx [2]: http://www.lannerinc.com/products/x86-network-appliances/desktop/fw-7541 [3]: kit http://store.netgate.com/Netgate-FW-7541-BTO-P1893.aspx
- akerl_ 12y agoThe second post (http://nickpegg.com/2014/8/building_my_own_home_router,_part_2_-_802.11.html#disqus-thread http://nickpegg.com/2014/8/building_my_own_home_router,_part...) mentions issues with getting the 7260-ac to do 5GHz. Does anybody have suggestions for another card that would allow that without having to do kernel-level hijinks?
- cbhl 12y agoI imagine it's just ac drivers not being mature yet. You'll probably be fine if you stick to 802.11n stuff for now.
- sounds 12y agoHave a look at TP-Link cards with an Atheros chipset. They're cheap and work quite well out of the box.
- zokier 12y agoQCA stuff tends to be the best bet for Linux wireless.
- rstephenson2 12y agoDoes anyone know of anything a bit larger? There are a lot of great little devices for running WRT for your home, but are there any open distributions for, say, a 50-person startup? At that level, things like maximum connection count and QoS play more of a role. Is it possible to just scale up the hardware and run openWRT, or are there other concerns?
- m0shen 12y agoAs mentioned elsewhere in this thread: https://www.pfsense.org/ https://www.pfsense.org/ works when you provide enough horsepower.
- walterbell 12y agoUbiquiti has a $100 device that will route 1 million packets/sec, distro is Vyatta based on FreeBSD, http://www.ubnt.com/edgemax/edgerouter-lite/ http://www.ubnt.com/edgemax/edgerouter-lite/
- Titanous 12y agoI have one and highly recommend it. The distro is actually Debian-based and is mostly an open source fork of Vyatta but has some proprietary bits for the Cavium offload.
- m-app 12y agoI was intrigued at first especially after reading the comparison with Cisco and Juniper gear and seeing that the Ubiquiti was out performing them. But when I read up on the forums I noticed that as soon as you enable any interesting advanced features the performance will drop because hardware offloading is disabled. A couple of examples: a modify firewall rule, load-balancing, netflow, QoS and probably many more. For a couple of end user benchmarks: http://community.ubnt.com/t5/EdgeMAX/kernel-compilation/td-p/466677/page/3 http://community.ubnt.com/t5/EdgeMAX/kernel-compilation/td-p...
- vonskippy 12y agoRolling your own firewall is almost always a bad idea. Hardening a full blown distro is a terrible place to start, and no place for a novice to "guess" that they have it locked down "enough". There are numerous open source firewall distro's that have the advantage of being authored by people well practiced in security coding, pen testing, etc, and are continually crowd tested for loopholes and shortcomings. It's your edge device for security - not exactly a place you want to take risks with.
- akerl_ 12y agoGiven that you get a stateful firewall as a facet of NAT, the main risk would be if your edge device was listening on the external interface with vulnerable services. I appreciate the level of specific engineering that goes into purpose-built firewall distros, but "locking down" a device whose sole function is to perform NATing for a network is not terribly complicated.
- nickpegg 12y agoI agree with this to an extent, a complete novice probably shouldn't take this sort of leap without understanding the configuration involved in securing down a Linux box. I wouldn't say it's out of the reach of most people familiar enough with Linux, though. Regarding security programming, etc., I expose as little as possible to the world. Of the services that I do expose, I'm relying on pre-packaged software and the maintainers of Debian to keep it patched for me. I trust that those people mostly know what they're doing, and any code I write will mostly just be for internal automation.
- blueking 12y agoWell if you really care about security you should run OpenBSD not linux. And it installs secure by default. Just grab the book of pf and write out your firewall rules.
- zenciadam 12y agoBack in the mid-to-late 90s there were no home routers as they exist today. Just threw Openbsd on a machine with multiple interfaces and it worked just fine.
- blueking 12y agoThese are the best SBC routers on the market. It used to be between Soekris and pcengines, but Soekris dropped the ball. and the enclosures are also very nice too http://pcengines.ch/apu.htm http://pcengines.ch/apu.htm http://pcengines.ch/case1d2u.htm http://pcengines.ch/case1d2u.htm It uses coreboot, which you can recompile from source to be reasonably sure no BIOS backdoors, and it also has a hard firmware flash write jumper (thanks to me)... to make sure your recompiled BIOS doesn't get overwritten remotely when a vulnerability is found in your OS (easy with coreboot if you leave the .config in the firmware image which is the default). I suggest you run the latest OpenBSD, and add the NEUG USB RNG. This is a dream machine. 64bit 1ghz dual core... up to 4 gigs of ram,low power, great great design, two PCIe card slots, gig eth. The best. And I have tried everything. Building your own PC tower as a firewall, well been there. Its not the way. Fun project sure, but wasteful and inefficient. There are a few really good cheap routers that can run OpenWRT amazingly fast ie. http://www.amazon.com/TP-LINK-TL-WR841N-Wireless-Router-300Mpbs/dp/B001FWYGJS/ http://www.amazon.com/TP-LINK-TL-WR841N-Wireless-Router-300M... If you 1. add the packet shaping module and fill in your modems speed 2. replace the routers /etc/hosts file to block all internet advertising inc youtube ads with this ; http://winhelp2002.mvps.org/hosts.htm http://winhelp2002.mvps.org/hosts.htm and 3. change the DNS to googles 8.8.8.8 and 8.8.4.4 Then you have the ultimate home router setup. But if you want secure / vpn / tor bridge etc then you need to go to the above mentioned with OpenBSD and be careful to buy a compatible wifi PCIe card.
- walterbell 12y agoWhat would be the total hardware cost for a single PC engines router?
- naner 12y agoAbout $150 I think from the shop page: apu1c - $136 case1d2u - $8.7 ac18vus - $4.5
- blueking 12y ago1 APU.1D4 system board 4GB USD155.00 USD155.00 8471.5000 TW 235g 1 Enclosure 3 LAN, alu, USB USD8.70 USD8.70 8473.3000 CN 241g 1 SSD M-Sata 16GB MLC Phison USD22.00 USD22.00 8523.5100 TW 10g 1 Compex WLE200NX miniPCI express card USD18.70 USD18.70 8517.7000 CN 10g Shipping + handling USD42.40 Total USD246.80 496g Assuming 4GB RAM, SSD, Wifi N, enclosure... oops add $5 for the AC adapter.
- nullc 12y agoNow if only there were a PCI ADSL2+ modem that was a real network interface and not another crappy, exploitable, buffer bloat infested, traffic intercepting cesspool (but embedded on a PCI card)...
- mindslight 12y agoAny DSL modem is going to be a proprietary cesspool of who knows what - putting that on a trusted PCI bus seems like the exact wrong thing to do. I was just looking into ADSL2+ routers supported by OpenWRT and concluded it wasn't worth the bother. Just get any old proprietary ADSL2+ modem, set it to bridge mode, and treat its ethernet as the actual demarc point. Better galvanic isolation, too.
- nullc 12y agoOne problem there is that you lose all queue management and it seems they all do awful things. Many of them also randomly intercept and tamper with tcp connections even while not natting.
- mindslight 12y agoYes, it's less than ideal. But I don't think you're ever going to find a nice, proper, trustable device. Communications gear is basically just complex software (DSP and the like). The parts count will be minimized to keep costs down, so the necessarily-proprietary parts get mingled with the needlessly-proprietary ones. Redeveloping those blobs as free software is certainly possible, but it will always lag behind the proprietary version. IMHO, that effort is better spent on working around the brokenness of such devices - maintain your own txqueue at a slightly slower rate than the modem, etc. (My thinking on the "ideal cellphone" is the same - physically separate the baseband from the personal computer, with an IP-only interface (eg Wifi) between them.) FWIW, I haven't noticed any packet mangling from my ADSL2+ modem in bridge mode, but I haven't looked very hard either.
- walterbell 12y ago
- rsync 12y agoAn older laptop with two xircom realports[1][2] is a great platform for a router. First, you never, ever have to futz around with monitors, monitor cables, serial cables, terminals, etc., because the kvm is built in. I don't care how slick your tools are, when things aren't working, you don't want to spend the first 15 minutes dicking around with tip and ring and your null modem cable, etc. Second, with two xircom realports, you have a laptop with up to three full size rj45 ports, which is very handy. No dongles. Bonus: it has a built in UPS! [1] xircom realports were these really slick full-height pcmcia cards that were modular and you could mix and match them ... and they had real, full size rj11 or rj45 ports in them. [2] xircom realports work in FreeBSD 8.3-RELEASE, but neither 8.2 nor 8.4. So you need to choose a pfsense build based on 8.3 ...
- callesgg 12y agoI used to say the same stuff about the built in ups in my laptop server. Until I almost burned down my house. Aparently laptop battery charge controllers do not work as intended when plugged in for long periods. Otherwise laptops are perfect as cheap low power servers.
- mnw21cam 12y agoSounds like you had a duff charger circuit. However, yes, a LiIon battery is not meant to be left continuously on charge. A lead-acid battery (typically used in UPSes) is meant to be left continuously on charge.
- simoncion 12y agoShouldn't the charging controller in the laptop stop charging the battery once the battery is at full charge? It seems to me that a great many folks leave their laptops plugged in for weeks or months at a time, and that this would be something that a laptop designer would account for. (Anecdata: The six-ish year old battery in my primary laptop still holds ~60% of its original maximum charge. This laptop spends the vast majority of its time on, with the battery installed, and plugged in to an AC outlet.)
- chrissnell 12y agoI undertook a similar project last year to replace my outdated Soekris router: http://output.chrissnell.com/post/39550480075/the-jack-of-all-trades-home-server http://output.chrissnell.com/post/39550480075/the-jack-of-al... I built a mid-tier server-grade machine with Intel NICs and I run ESXi on it. My firewall (pfSense/FreeBSD) runs virtualized in an instance. It's very flexible, stable, and the performance is outstanding. I used VMware's vSwitches to connect the pfSense VM with dedicated NIC ports for each network segment.
- brooksbp 12y agoHighly recommend Mikrotik for those interested in something beyond your average household router. Their Tilera-based CCR series routers are quite nice and affordable. More L2-L7 features than you could wish to nerd out with for your home network. Also agree with the statement that rolling your own is generally a bad idea.
- watt 12y agoYeah, Mikrotik routers are insanely feature-rich. I got RB2011UiAS-2HnD-IN (Level5 licence). I would recommend RB951G-2HnD (Level4) actually, because I have no use for SFP optical cage or 5 extra 100mbit ports (both have 1+4 gigabit ports). Both run on Atheros AR9344 600MHz CPU.
- yCloser 12y agoI don't like this that much. It's expensive. My netgear router takes 11W. I have a mini-itx amd c60, takes 25W without wifi.
- windexh8er 12y agoBeyond the coreboot argument I don't see a whole lot of value in the SBC router arena anymore. I used to be "that guy" as well, but since purpose-built hardware exists that does routing better there's no point. AMD and Intel CPUs are pointless in this space - you can get far more packet performance, accelerated in hardware, with CPUs like Cavium (MIPS). I happen to work for a company that uses a lot of Cavium processors in it's products and they are the defacto standard in networking gear that is accelerated today. There is a little company called Ubiquiti (not who I'm employed by) has one of the best values in this space for the money. You can buy a $99 router that has a dual-core 500MHz Cavium which will do 1M PPS, oh - and I forgot to mention it runs Vyatta, so hack away. http://www.ubnt.com/edgemax/edgerouter-lite/ http://www.ubnt.com/edgemax/edgerouter-lite/ I get it - there are people who want to run soup-to-nuts on a SBC, and there are legitimate use cases. The reality is that Wifi in those platforms is flat out: horrible (again, go buy Ubiquiti UniFi for $80 and get real RF performance - http://www.ubnt.com/unifi/unifi-ap/ http://www.ubnt.com/unifi/unifi-ap/) Putting an underpowered mPCI card that's sitting around all kinds of other RF noise and likely deployed in the wrong location compared to where your users are anyway isn't ever ideal. But if you have a hypervisor laying around your house (and 9 times out of 10 on HN that's probably the case) throw your voice at a small instance - or a Raspberry Pi if you're worried about your carbon footprint / electrical bill. There's no shame in that - and at the end of the day you're going to have a far better network in terms of performance and reliability. SBCs are at that weird middle ground of being not worth the money when there's much better hardware targeted at what you're trying to accomplish. They feel, still, very 2005ish to me as they haven't really changed or added value - but the cost is still outrageous for what you get. At the end of the day don't get caught up in MHz at your router - it's about accelerated packet performance. The Cisco and Juniper's of the world have known this for, well, ever. I have no relation to Ubiquiti what-so-ever other than having purchased a lot of their products over the years for personal use - and the brand is nothing short of undervalued IMO. I'm enthralled that they've branched out from a great line of cheap and reliable RF products to switching, routing, voice, video and even a small nugget of security (although - the L3/L4 firewall of days gone by is nothing more than useless in today's landscape).
- tacoman 12y agoThis mirrors my experience pretty closely and I think is really good advice, especially the comment regarding RF performance. Dedicated APs (especially the Ubiquiti devices) seem to have far superior performance than anything I've ever built myself. I ended up buying an APU1C to play with, but in the end that's all I'm doing with it.
- bcl 12y agoInstead of reinventing (and unexpectedly exposing your whole network) you should use something like shorewall to setup your firewall. http://shorewall.net/ http://shorewall.net/
- Alupis 12y agoPFsense and some old hardware with 2 nics... instant DIY home router.
- gonzo 12y agoOr even pfSense with new hardware.
- WizzleKake 12y agoIf you want to switch the device that gets assigned an IP address by Comcast's DHCP servers, all you need to do is reset the cable modem. At least that is how it always was for me. I have a gigabit ethernet connection now, so I quit using a router. All the ones that I have couldn't manage more than 500 megabits/sec through the WAN port, even though they were supposedly gigabit. I did some research at www.smallnetbuilder.com and I found that generally speaking, "gigabit router" actually means "router with a gigabit switch" unless you are buying something that isn't marketed to consumers.
- dtaht3 12y agoThis thread has been pretty good. Disclaimer: I run the cerowrt project as part of bufferbloat.net's efforts to reduce latency across the internet. The hardware it runs on is getting long in the tooth (netgear wndr3800), and we've been trying to find new hardware as a base for a while. I LIKE ubnt's gear, however their default firmware for their APs did not do ipv6 when last I looked, which makes it a non-starter. Most of their gear takes a load of openwrt barrier breaker quite well (or dd-wrt), and that's what I do to most of it. Openwrt has excellent features, gui, firewalling and security, and runs on a huge variety of platforms so if you can find an off-the-shelf platform you like that it runs on, goferit. The edgerouter lite (vyatta based) is ok (does do ipv6), but the hardware forwarding engine is not featureful enough on the edge gateway side to do everything I need it to do, and when disabled to use software rate limiting, we are only getting forwarding rates in the 70-90Mbit range. The edgerouter pro is better... Work is in progress on that front, see the ubnt edgerouter beta forums for more details. I keep hoping cavium will put more effort into their forwarding engine firmware... Nearly no platform out there today is terribly good at doing forwarding rates > 100mbits with QoS/AQM/packet scheduling enabled, certainly nothing in the below 150 dollar range that i know of. The APU box mentioned here barely forwards at greater than 500mbit without qos. You CAN do pretty well with e1000e based boxes today, but the ivy bridge/rangeley stuff is WAY better than the atom is for packet processing. In either case you are getting well above the 200 dollar range and into potential heat and cooling issues. Lastly, most of the first and second generations of 802.11ac gear are pretty terrible at getting anywhere close to the peak rates of the medium, partially due to hardware limitations, and partially due to terrible queue management. Obviously I'm pretty focused on delivering a low latency network experience using the algorithms developed by the bufferbloat.net project... YMMV. At the moment what I'm leaning towards at the > 100mbit level is dedicated hardware for each of the gateway and wifi functions, and that steers towards rangeley gateway (running openwrt) and ubiquiti (or at least atheros based) wifi (also running openwrt).
- alexnewman 12y agoTotally want to build a NSA proof WIFI router. The problem is the wireless cards themselves are a big gaping threat.