My dream is of Open source 802.11ac Wi-Fi router. Is there any open hardware that works well?
PC engines APU have some coreboot board for router. You can run any OS you wanted on it.
OpenBSD Router Guide
41–50 of 53 posts
Re: OpenBSD Router Guide
#42For a year I had success with a Beaglebone Green[0] and OpenBSD installed and in a "Router on a stick" configuration[1]. It wasn't amazing preformance, but it was in a rural area with a slow ISP anyway. IPSec performance was sufficient for the single client I ever used with it. For the year prior to this one, I had FreeBSD in almost the same configuration running on a Raspberry Pi (1!!!) B. Both were rock solid stabl…
not sure about any particulars of the issue you describe but it sounds like the terminal could not support something about your session to vi. maybe running GNU screen or tmux would make things work better?
I was connecting from a Linux laptop, and GNU screen was the terminal I used.
This was from 5 years ago. I believe I found a discussion online somewhere that touched upon the issue. Today, the closest thing I can find is this bug on pfSense: https://redmine.pfsense.org/issues/9569
Re: OpenBSD Router Guide
#43Some criticisms, from somebody who doesn't know a whole ton about networking:
Can pure DNS site filtering really work these days? I have to imagine more and more of the internet is behind cloudflare / cloudfront / etc, and you probably can't block/grant access to a single site without catching a bunch of unrelated ones as well. An HTTP(S) proxy approach seems like it would work a lot better. No offense to the author, they clearly know their stuff, but this feels like they know networking pretty well and want to use it to solve a problem that it's no longer suited for. I remember the internet of the 90s and DNS filtering would have worked a treat back then.
Why does the term VLAN not show up anywhere in the guide? Can't VLANs (with radius (?)) be used to segment traffic without requiring multi-port NICs (and running N ethernet cables if I want to have access to N different network segments from the same room)? (I really, clearly, don't know that much about networking)
Increasingly, I get frustrated by network- and machine/OS-focused security measures. I don't want to bother with making sure all the unix user ids on all the machines on my network match in order for unix permissions to work right. I don't want to think about tagging traffic in iptables with unix users and only allowing traffic that belongs to my personal user to egress over the 'trusted' NIC. These things should be handled by app-layer controls, sort of BeyondCorp for everything.
Re: OpenBSD Router Guide
#44how many network cards / ports should I have in the hardware device?
Re: OpenBSD Router Guide
#45how many network cards / ports should I have in the hardware device?
Two at minimum, one for WAN and one for LAN. Other than that, however many you really want or need.
Re: OpenBSD Router Guide
#46Nice article. Running your own router is a nice way to learn a bit of networking, has a better track record of security updates, and helps you act as a part on the Internet. I run NixOS on a https://www.pcengines.ch/apu2e2.htm .
Hey, I've got an apu2c4 and was actually thinking about installing Ubuntu or Debian and try to run ansible on it, but your Nixos idea sounds good. Do you have any references for the setup? Have you found any downsides? The reason I want to move away from pfsense is the lack of support for Wireguard.
I used https://gist.github.com/tomfitzhenry/35389b0907d9c9172e5d790... to install it (different model but it worked for me).
The router uses systemd-networkd, unbound, corerad, hostapd.
I'm not in a position to share my config yet. If you give me contact details, I can share a few bits.
Downsides:
* When you screw up, you can lose Internet connectivity.
* When you screw up, you can lose access to your router. I mitigate this by securing exposing the router on the Internet, and then using 4G to SSH to the router.
* It took a while for me to figure out how to get a decent IPv6 setup.
* NixOS specific: if you find some config on StackOverflow (eg) it takes a bit of time to figure out how to fit that into NixOS.
The result is great though:
* this router has been through 2-3 major upgrades, and it just works.
* NixOS is modern/popular enough that it has had wireguard/corerad packaged for a while.
* I have confidence my router is actually behaving according to its config, because NixOS does a great job of that. This allows me to easily rebuild, which is useful if I experiment with something but give up: revert code, then deploy and the router is back to its previous state.
Re: OpenBSD Router Guide
#47Some criticisms, from somebody who doesn't know a whole ton about networking: Can pure DNS site filtering really work these days? I have to imagine more and more of the internet is behind cloudflare / cloudfront / etc, and you probably can't block/grant access to a single site without catching a bunch of unrelated ones as well. An HTTP(S) proxy approach seems like it would work a lot better. No offense to the author,…
[deleted]
Re: OpenBSD Router Guide
#48Some criticisms, from somebody who doesn't know a whole ton about networking: Can pure DNS site filtering really work these days? I have to imagine more and more of the internet is behind cloudflare / cloudfront / etc, and you probably can't block/grant access to a single site without catching a bunch of unrelated ones as well. An HTTP(S) proxy approach seems like it would work a lot better. No offense to the author,…
> Can pure DNS site filtering really work these days? I have to imagine more and more of the internet is behind cloudflare / cloudfront / etc, and you probably can't block/grant access to a single site without catching a bunch of unrelated ones as well.
You're thinking about IP filtering. When site is behind Cloudflare/Cloudfront/... it _may_ share an IP with some other site, but it will most probably have a distinct DNS name that can be filtered upon during DNS resolution.
pi-hole/nextdns do this quite successfully for adblocking on network layer.
Re: OpenBSD Router Guide
#49Re: OpenBSD Router Guide
#50Some criticisms, from somebody who doesn't know a whole ton about networking: Can pure DNS site filtering really work these days? I have to imagine more and more of the internet is behind cloudflare / cloudfront / etc, and you probably can't block/grant access to a single site without catching a bunch of unrelated ones as well. An HTTP(S) proxy approach seems like it would work a lot better. No offense to the author,…
>I don't want to bother with making sure all the unix user ids
A Directory Server + Kerberos + NFSv4 is maybe what you want?
Something like https://www.freeipa.org