Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to turn anything into a router

nbailey.ca

Post reply on HN
Print view View original

71–80 of 276 posts

Re: How to turn anything into a router

#71

Post by toast0 »

colinb wrote: post #41
louwrentius wrote: post #19

Earlier quoted context omitted.

A CPU from the last 20 years can route traffic at gigabit speed. It's only something to worry about for a Raspberry Pi3 or something similarly 'crippled'.

I think I understand why this is true for plain IP forwarding. There isn’t much to break the cache and the lookups are few and fast. What’s the cheapest (new) computer that can drive a 1Gb port with NAT? With a busy encrypted (wireguard?) connection? [I don’t think qos has a lot of use in the domestic environment; sure, someone here does it but I think it’s much less mainstream than the features I already mentioned.…

> What’s the cheapest (new) computer that can drive a 1Gb port with NAT?

What's the cheapest new computer you can find? That will work. If you have PPPoE, you need to be a bit more careful; depending on your OS and NICs, it's possible for inbound traffic to only use one core; low power laptop cpu may not have enough throughput from a single cpu, but my information is a little dated.

I did 1G NAT on a dual core haswell [1] for a long time.

[1] https://www.intel.com/content/www/us/en/products/sku/82723/i...

Re: How to turn anything into a router

#72

Post by cestith »

EvanAnderson wrote: post #27
louwrentius wrote: post #3

A router only really needs one network interface. Any computer with a single network interface, maybe even an (old) laptop, can be used. Anything x86 from at least the last 10 years is energy efficient and fast enough to route at gigabit speed. If you don't care about energy usage, any x86-based computer from the last 20 years is fast enough. The magic trick is to use VLANs, which require switches that support VLANs,…

It only needs one port, but for most simple networks two ports on the router means less configuration. The "router on a stick" paradigm using VLANs to a share a single physical port is perfectly valid. You're creating a "now you have two problems" scenario in which you need a VLAN-capable switch and have VLAN configuration to make. I typically like the ISP router on a dedicated router port to make monitoring the phys…

Technically you can route without isolation, but VLANs are definitely a good idea if you’re using a single port.

There are 2.5 Gbps, 5, and even 10 Gbps USB NICs these days, although 10 Gbps ones are pretty expensive and require really recent USB ports.

I agree I want my local network and my WAN port separate, if for no other reasons than so I can use ssh to get into the router from my LAN with the WAN port disabled.

Re: How to turn anything into a router

#73

Post by hmaxwell »

I'm curious about the policy rationale behind banning router imports. If a government were considering legislation like that, what would the primary concern usually be? Given that so much internet traffic is now protected by TLS/SSL and other encryption, why would it still matter if citizens were using routers that might be backdoored?

Is the concern mainly things like botnets and DDoS activity, weak default credentials on network equipment, or compromised business networks where poorly secured routers or attached NAS devices could expose sensitive or proprietary data? In other words, is the concern less about decrypting traffic and more about using the router as a foothold for surveillance, disruption, or access to poorly secured internal systems?

Re: How to turn anything into a router

#75

Post by nathas »

hmaxwell wrote: post #73

I'm curious about the policy rationale behind banning router imports. If a government were considering legislation like that, what would the primary concern usually be? Given that so much internet traffic is now protected by TLS/SSL and other encryption, why would it still matter if citizens were using routers that might be backdoored? Is the concern mainly things like botnets and DDoS activity, weak default credenti…

It's everything you mention in the second paragraph, and additionally just the ability to turn them off.

Imagine everyone had their routers disabled simultaneously. I don't know if the cell networks could function with the surge in standard traffic that would happen, and then you've effectively plunged all or part of the country into a communication blackout.

I think "turn it off permanently by bricking it" is almost as bad as "leverage for DDoS".

I worked on Bot Mitigation at Amazon, and we once saw a ton of traffic that was heavily distributed amongst consumer devices world-wide, but surprisingly in the US too. We suspected compromised routers that were using the home page as a health check. There was a lot of investigation I did, and the short realization after talking with the network engineers is that the amount of traffic, and distribution of sources, would be impossible to stop. There merely isn't enough bandwidth in the world to stop so many residential device if it hits a specific target. To be clear, this was coming from less than half of active Amazon customers, not everyone in the US.

Anyway, it wasn't routers, but it was a consumer device, and it wasn't nefarious, it was incompetence (in code), as usual.

Re: How to turn anything into a router

#76

Post by jen20 »

hmaxwell wrote: post #73

I'm curious about the policy rationale behind banning router imports. If a government were considering legislation like that, what would the primary concern usually be? Given that so much internet traffic is now protected by TLS/SSL and other encryption, why would it still matter if citizens were using routers that might be backdoored? Is the concern mainly things like botnets and DDoS activity, weak default credenti…

> is the concern less about decrypting traffic and more about using the router as a foothold for surveillance, disruption, or access to poorly secured internal systems?

That should probably be the technical concern. Even if you have traffic protected by TLS, you still typically have enough metadata to cause some problems for users individually, but the assumption that foreign equipment is back-doored by some security service or other is probably safe.

Re: How to turn anything into a router

#77

Post by adolph »

chungy wrote: post #65

OpenWrt has a generic x86 PC build that can also be used to turn basically any random PC into a router, complete with an operating system actually designed and developed for that purpose.

OpenWRT is great if it fits your use case. If one has reason to stray from the happy path a disadvantage is that the OpenWRT uses a single binary like Busybox and doesn't use glibc. This is great for embedded/low power machines like the OG WRT54G, but not as optimal for when you have an entire random PC. I don't recall the exact things I was looking for but I moved on to pfSense and didn't look back.

Re: How to turn anything into a router

#78

Post by ImJamal »

hmaxwell wrote: post #73

I'm curious about the policy rationale behind banning router imports. If a government were considering legislation like that, what would the primary concern usually be? Given that so much internet traffic is now protected by TLS/SSL and other encryption, why would it still matter if citizens were using routers that might be backdoored? Is the concern mainly things like botnets and DDoS activity, weak default credenti…

There are a few reasons

- Access to data (dns/ips, domain names (if not using ESNI), amount of traffic, etc) of sites you are visiting

- Access to the inside of your network where it can attack machines that may not be secure

- DDoS

- The ability to shut down your internet

I'm sure there are more.

Re: How to turn anything into a router

#79

Post by moqmar »

solarkraft wrote: post #52

Maybe someone in this thread has a couple of ideas: What’s the simplest way to spin up a simple „cattle, not pet“ routing VM? I don’t want to mess with any state, I just want version controllable config files. Ideally, if applying a version fails, it would automatically roll back to the previous state. OpenWRT seems like it fits my description most closely, but maybe someone here is a fan of something more flashy/mod…

That sounds like you might like VyOS. I found it to be relatively easy to achieve exactly what I wanted, but went back to a GUI as it turned out I wanted a pet and not start a farm.

Re: How to turn anything into a router

#80

Post by moffkalast »

chungy wrote: post #65

OpenWrt has a generic x86 PC build that can also be used to turn basically any random PC into a router, complete with an operating system actually designed and developed for that purpose.

And of course probably 1000x the power usage compared to the average off the shelf router that runs off a borderline microcontroller.
Post reply on HN