10 ms·
The ultimate OpenBSD router
- ericcumbee 11y agoMy only concern would be the use of a SSD for something like this. I know with PFSense and Untangle, applications like this will shred a ssd in fairly short period of time.
- pcunite 11y agoAre you writing more than 200 TB of data? http://techreport.com/review/25559/the-ssd-endurance-experiment-200tb-update http://techreport.com/review/25559/the-ssd-endurance-experim...
- detaro 11y agoThe only thing such a system should write in bigger amounts are logfiles, unless you keep very detailed logs/packet captures you shouldn't get close to the write limitations of a modern SSD, which is tens of GB per day. (You might want to change the fsync-behaviour though to limit write amplification, e.g. syslog syncs the logfile to disk after every log line, which might become a problem if you have very active logs?)
- ericcumbee 11y agoI'm not sure of the exact details. I've only done a couple untangle boxes (using NexGen appliances). 6-8 months ago colleagues that do a lot more of them were still seeing a much higher failure rate across all SSDs than with spinning disks in Untangle boxes. Although I see now that NexGen offers a SSD Option on their boxes now. so things might have improved.
- mdewinter 11y agoThis is a seriously awesome podcast. Consider listening to it, the amount of knowledge combined with two bsd-loving hosts is amazing!
- protomyth 11y agoI do love how they go back and update their tutorials. Given how much has changed since the original version, its really nice.
- jstanek 11y agoIn my experience, everything from Jupiter Broadcasting [0] is extrememly top-notch and informative. I'd highly recommend all of their shows (including BSD Now!) [0] http://jupiterbroadcasting.com http://jupiterbroadcasting.com
- tux 11y agoYeah, I've been Jupiter listerner for some time now mainly "Linux Action Show" http://www.jupiterbroadcasting.com/show/linuxactionshow/ http://www.jupiterbroadcasting.com/show/linuxactionshow/ they have a lot of useful info. Highly recommended podcast, and if you can support them with anything you can. I'm also thinking on building my own next DIY router. I'm tired of how limited the routers you buy off the shelf are. Currently running Asus RT-N56U with Padavan F/W https://code.google.com/p/rt-n56u/ https://code.google.com/p/rt-n56u/ I've also always wanted to switch to BSD distro but ports are not updated as often as "Arch Linux". If there where BSD rolling distro similar to well updated Arch Linux packages, I would consider switching.
- justincormack 11y agoYou can use pkgsrc current with any BSD if you like.
- talideon 11y agoWhich ports system? I can't say anything about OpenBSD ports, but aside from some stuff that gets very little love from people, most of the FreeBSD ports tree is kept bang up to date, and binary packages appear shortly thereafter. pkgsrc, OTOH, is only released quarterly, though if you want, you can sync with their CVS repo, though, y'know, CVS. The BSDs aren't distros, though some do have what might be called distros, such as PC BSD, pfSense, &c. being distros of FreeBSD, EdgeBSD being a distro of NetBSD. The ports system is a rolling release system for non-base software though, though the base OS isn't. The closest BSD to come to having a rolling release schedule for the base OS is OpenBSD, with its six-month release cycle. The thing is that the BSDs can't have a rolling release schedule as is found in some Linux distros because the base OS is managed separately from the ports/packages: the core OS components aren't packaged, so there's no sense in which they can 'roll'. Personally, I'd never use an OS with a rolling release cycle on a server. Too much can go wrong.
- obisw4n 11y agoThats an aweful lot of work to roll out your own router. What does this have over, say installing pfsense to a box?
- tux 11y agoSave money on power cost for one! If you installing pfSense consider small booksize or itx case.
- zf00002 11y agoNeither one will be much different if the hardware is the same.
- zf00002 11y agoFirst thing that comes to mind is having more control of which version of *BSD you want to be based on. With pfsense you're on whichever version of FreeBSD they've worked up to. That said I roll pfsense on a thin mini-itx intel board and its great.
- blfr 11y agoThat's a very ambitious take on this problem. It is pretty cool (and definitely more secure) to run OpenBSD but you can probably get most of the upside by slapping OpenWRT on the consumer router you already have. A $50 WDR3600 happily handles several VPNs, custom VLANs, an IPv6 tunnel, exotic routing, an external drive, and a Samba server while doing the typical SOHO router-y stuff, like wifi. BTW Running my own name server has solved a lot of weird slowdowns I used to experience when browsing the web or sshing. According to namebench[1], my router doesn't even crack the top three when it comes to response time so I used to have it forward queries but in practice, after it warms up, it's more reliable and delivers a smoother experience than either my ISP or Google. [1] https://code.google.com/p/namebench/ https://code.google.com/p/namebench/
- higherpurpose 11y agoWe're already seeing some large router makers (slowly) adopt OpenWRT/DD-WRT. Maybe there's a chance we can push for a status quo on using open source firmware for routers - perhaps some sort of "Android" for routers, but it needs to be fully GPL so OEMs can't lock down 95% of it like they do with Android.
- rando289 11y agoSpecifically, GPLv3 or AGPLv3 to avoid consumer device lock down.
- wtallis 11y agoA typical $50 consumer router running OpenWRT will do everything you want except traffic shaping. The cheap consumer stuff all uses slow single-core MIPS CPUs that can only do traffic shaping at tens of megabits and consequently cannot do QoS for a fast DOCSIS or fiber connection. Of course, even if you do go to the trouble of getting an Intel-powered router, you still wouldn't use OpenBSD (or anything other than Linux) for QoS.
- dfc 11y ago> you still wouldn't use OpenBSD (or anything other > than Linux) for QoS. Is this still the case? Especially in regards to OpenBSD managing a fast residential cable connection? I thought 5.6 yanked out the slow ALTQ code and brought OBSD close to linux QoS performance, especially for residential traffic management.
- dfc 11y agoDoes Soekris have any competition in this space? Any time I check I can never find any viable competitors. Soekris seems to have hit the "IDA Pro sweet spot," AKA unbelievable product priced just low enough to scare away any new competitors.
- walterbell 11y agoDell T20 Xeon with a Type-1 hypervisor to run the router VM, using VT-d to isolate a multi-port NIC to the router VM. The same box can run other VMs with FreeNAS, Linux, Windows, etc.
- dfc 11y agoI guess I should have been explicit and stated I was looking for a comparable system that competes with the soekris. Does the dell t20 really count as competition to a soekris? A quad port intel NIC and a Dell T20 w/ Xeon is at least twice as much as this soekris. And then there is the whole issue of size: Dell Soekris Width 6.89 11.40 Height 14.17 1.41 Length 17.15 6.11 Volume 1675.31 98.21
- walterbell 11y agoIt depends on whether one also needs a NAS with RAID disks, or a Windows desktop, or a media server, or a personal cloud. If you need any of those, then there is nearly zero marginal size or cost to add a router VM, with more hardware headroom and OS flexibility than a special-purpose router.
- sarnowski 11y agoActually, soekris were pretty good but they are kinda outdated. I just got an apu1d4 from pcengines[0] and OpenBSD works like a charm on it. Half the price, much more power. [0] http://www.pcengines.ch/apu1d4.htm http://www.pcengines.ch/apu1d4.htm
- zmyrgel 11y ago
- nathanvanfleet 11y agoPersonally I like to get a consumer router and put OpenWRT on it. It used to be a lot harder but it's gotten a lot more simple and effective. I have a few reflashed Netgear WNDR3700s but there are probably better ones out there that are pretty cheap too. It takes more research and work but it's more simple than having to install everything onto a clean OS install.
- pibefision 11y agoI'm using an ASUS RT-AC68U with totally open source firmware, supported by asus, with timely updateds to fix security issues. It's a 802.11ac. I really recommend it. Works very well.
- cies 11y agoAnd for the rest of us there is: http://routerboard.com http://routerboard.com Which as-far-as-I-know comes with all open source software, it very well supported by a large community.
- fencepost 11y agoThat's the Mikrotik hardware, and I don't believe RouterOS is open source. The "L3", "L4", "L5" you see on the product listings are the RouterOS license levels which control available features. You can also run OpenWRT though installing it is described as "Not straightforward."
- brunoqc 11y agoIs DNS caching still relevant these days (since we have fast connections now)?
- pcunite 11y agoI've been using MikroTik lately because I wanted to identify my traffic and Qos it differently for VoIP installations. It seems to do well with this.
- pcunite 11y agoHere is the link to the relevant section ... https://youtu.be/a-wtYUKoBa0?t=3662 https://youtu.be/a-wtYUKoBa0?t=3662
- rasz_pl 11y ago>Atom E6xx series processor no
- windlep 11y agoSo... $337 for a decent soekris board and 'ok' case... or $340 for this: http://www.amazon.com/Ubiquiti-Networks-Edgerouter-Router-ERPro-8/dp/B00IA5J8M8/ http://www.amazon.com/Ubiquiti-Networks-Edgerouter-Router-ER... The latter has a complete open-source OS, you can ssh in and re-flash it yourself easily, a great community, the same TCP hardware offload, etc. I have been spec'ing out a BSD+soekris board setup for years, but when the Edgerouter came on the market it was a no-brainer. The fact that it works-out-of-box with little effort (for someone experienced with networking) is a big win, and that its quite easy to re-flash it and tweak as desired sure doesn't hurt. While I really dig the DIY-router stuff, and was about to do it myself, Ubiquiti has sure made it hard to go that route when they can supply dang good products for the same price or less. Edit: Added bit that this isn't a "zero effort for newbs" type product. If you've never setup a router, there'll be some research in your future to setup an Edgerouter, or BSD router.
- FireBeyond 11y agoI just use the same hardware (Soekris net6501) with pfSense 2.2. Still requires a little more work than the Ubiquiti, which I might try next time. But it works pretty well 'out of the box', too.
- chrissnell 11y agoDifferent strokes for different folks. The Soekris hardware has a reputation for being industrial-strength and very resistant to harsh environmental conditions. The board requires no fans (the Ubiquiti has them) and has Intel NICs. The Soekris case fits nicely in a small cabinet in the average branch office and you don't need a proper cabinet for it. Disadvantage for some but for my little office, the Soekris is perfect. The speed of the Soekris is completely sufficient for our 100 Mbps biz class cable.
- thirsteh 11y agoIt turns out a lot of the processing is offloaded to proprietary drivers on the EdgeRouter board. It's great for running their stock firmware, but not so great running OpenBSD. Ended up going with the new PC Engines apu1d4 board (http://www.pcengines.ch/apu.htm http://www.pcengines.ch/apu.htm) rather than a Soekris. I believe it's the best of the options for an OpenBSD router.
- chrissnell 11y agoAllow me to save all of you who follow this guide $14 and hours of headaches: don't waste your time with the internal USB port on the Soekris net6501. The little Sandisk Cruzer drives that fit inside the case are total crap. The two that I bought lasted less than a day each. I think that writing the 4GB PFsense image to them was enough to kill them. Unfortunately for me, it didn't kill them in an obvious way. In my case, strange things started happening in PFsense. DNS became half-broken, DHCP for new clients didn't function, etc. I finally realized what was wrong and threw the USB drives in the trash and bought some of these guys and the problem was solved: http://amzn.com/B00ELQZD10 http://amzn.com/B00ELQZD10
- hobarrera 11y agoMost consumer routers include an access point too nowadays. The downside of this OpenBSD setup, is that you still need a consumer grade AP next to your router (that's exactly the setup I have). OpenBSD still doesn't support 802.11 > g, regrettably.
- fmajid 11y agoI just added an OpenBSD firewall in bridge mode between my Comcast router and the rest of my network. It's implemented on a Shuttle DS57U (dual-core 1.5GHz Broadwell Celeron 3205U), with 16GB Crucial DDR3L RAM and a 128GB Crucial SSD (leftover parts). Total price: $358. It's a pretty sweet box: fanless, metal chassis, dual Intel Gigabit Ethernet. The only (minor) quibble is the CPU doesn't have AES-NI.