How to turn anything into a router • Hacker News Board

Re: How to turn anything into a router

#141

Post by pak9rabid » Mon, Mar 30, 2026, 5:59 PM UTC

pdntspa wrote: post #109

Can anyone recommend a good, energy-efficient, inexpensive dual-NIC SBC or miniPC? Last time I looked into this there were not many good options.

I've gone through quite a few embedded devices for exactly this use case. So far I've used:

- Soekris net4501 (x86, 486-class CPU) (discontinued)

- PCEngines alix2d3 (x86, AMD Geode LX800) (discontinued)

- PCEngines APU (x86, AMD T40E) (my current router/firewall) (discontinued)

I'm also currently using an APU2 as one of my wireless access points (with hostapd).

All of these have been solid machines that have given me zero problems.

The next system I plan to use is going to be a Banana Pi R4 (ARM Cortex A73), it's a solid choice for a simple router/firewall/DNS/DHCP box. It has a built-in 4-port gigabit switch where each interface can be used as normal Linux interfaces, as well as 2 SFP+ ports that are capable of supporting up to 10 gig ethernet.

It's also one of the few systems that offers true hardware offloading for connection tracking, so things like netfilter flowtables don't have to use any main CPU processing.

I'm currently experimenting with a Banana Pi R4 as a Wifi7 access point (running Debian with hostapd), however the current state of the wifi7 module for it (BPI-R4-NIC-BE14) and Linux driver (mt7996e) is still pretty young and a bit buggy (i.e., limiting transmit power to 6 dBm without patching the driver to override it, and there's apparently a lack of RF shielding which can contribute to low SNR on the receiving end). With the proper patches in place it makes a decent Wifi 6 access point. I'm hoping these issues get ironed out in the future and I can use it as a true Wifi7 AP. frank-w is doing outstanding work to help support the open source community with this new hardware.

Re: How to turn anything into a router

#142

Post by teleforce » Mon, Mar 30, 2026, 6:00 PM UTC

bluedino wrote: post #47

This really takes me back. My first actual 'use' for Linux was making routers out of leftover computers. The perfect machine back then was a 100MHz Pentium, in a slimline desktop case. At the time, the Pentium III was the current desktop chip, so you'd have a pile of early Pentium-class machines to use. And even a 10mb ISA network card (3Com if possible) would have plenty of power for the internet connections of the…

Someone need to write a new book on Linux router.

The old one is getting really old now, nearly 25 years ago [2].

[1] Book Review: Linux Routers - A Primer for Network Administrators, 2nd Ed:

https://www.linuxjournal.com/article/6314

Re: How to turn anything into a router

#143

Post by pak9rabid » Mon, Mar 30, 2026, 6:02 PM UTC

sgt wrote: post #103

tuetuopay wrote: post #35

Earlier quoted context omitted.

I’ll pick nftables over iptables any day, it’s leagues better (granted, it’s not hard). The nftables wiki is great, as the syntax and modules are documented in a single easy to read page. As an added bonus, you get atomic updates of all chains for free. Granted, for simple usecases, ufw or firewalld may be simpler though.

Definitely an upgrade over iptables. I kinda miss ipchains though.

You can still use the iptables interface for nftables rules if you'd like, but I think you miss out on things like atomic application of rulesets, ranges, lists, and variables (not shell variables).

Re: How to turn anything into a router

#144

Post by znpy » Mon, Mar 30, 2026, 6:06 PM UTC

0xCMP wrote: post #127

radlad wrote: post #85

Earlier quoted context omitted.

The primary reason I stick to iptables instead of nft is that I already learned iptables decades ago, and some software I interact with still defaults to iptables and/or does not have full support for nft. Why do you doubt the sanity of people sticking to iptables? What makes nft compelling?

My main reason is that nft applies configs atomically. It also has very good tracing/debugging features for figuring out how and why things aren't working as expected. That said, I think many distros are shipping `iptables` as the wrapper/compatibility layer over nft now anyways.

as somebody that's not a network engineer by day and has barely grokked iptables, could you recommend some resources for learning nftables ?

Re: How to turn anything into a router

#145

Post by znpy » Mon, Mar 30, 2026, 6:09 PM UTC

adolph wrote: post #77

chungy wrote: post #65

OpenWrt has a generic x86 PC build that can also be used to turn basically any random PC into a router, complete with an operating system actually designed and developed for that purpose.

OpenWRT is great if it fits your use case. If one has reason to stray from the happy path a disadvantage is that the OpenWRT uses a single binary like Busybox and doesn't use glibc. This is great for embedded/low power machines like the OG WRT54G, but not as optimal for when you have an entire random PC. I don't recall the exact things I was looking for but I moved on to pfSense and didn't look back.

> This is great for embedded/low power machines like the OG WRT54G, but not as optimal for when you have an entire random PC.

There are steps in the middle :)

I'm running OpenWRT on the recent WRT3200ACM and it's going beautifully.

Re: How to turn anything into a router

#146

Post by pak9rabid » Mon, Mar 30, 2026, 6:15 PM UTC

rashkov wrote: post #68

Anyone know how necessary UPnP is? From what I can tell, this setup does not run UPnP for automatic port forwarding

You'd need to run a daemon like miniupnpd to enable UPnP, however I'd avoid it if you can, as it can be a significant security risk.

Re: How to turn anything into a router

#147

Post by lowdude » Mon, Mar 30, 2026, 6:16 PM UTC

Fwirt wrote: post #125

You actually don't even need two interfaces on the box if you have a managed switch. It's not too difficult to configure your only interface as an 802.11q trunk port, and then you can use the managed switch as a sort of "interface expander". This is referred to as a "router on a stick" configuration, and it's how my home network is configured. Plus, if it's a PoE managed switch, you can install some cheap enterprise…

I have actually been curious about this: How good can a WiFi mesh get latency-wise, given the right equipment, and how close would a consumer router setup be to that, do you happen to know?

Re: How to turn anything into a router

#148

Post by drnick1 » Mon, Mar 30, 2026, 6:18 PM UTC

sgt wrote: post #9

nftables syntax is pretty tough to read. I wonder why they didn't go for an easier to read DSL. I do understand it's likely super fast to parse though, and has a 1:1 relationship to its struct in the kernel.

I personally stick to iptables. nftables does not seem to be an improvement at all. iptables is terse but logical.

Re: How to turn anything into a router

#149

Post by pak9rabid » Mon, Mar 30, 2026, 6:21 PM UTC

brcmthrowaway wrote: post #129

Does routing on Linux have any hardware acceleration for IP packets?

Yes. You can take advantage of Netfilter's flowtable infrastructure and if you have the right hardware (NVIDIA/Mellanox ConnectX-5 or MediaTekMT7621) it will actually offload the processing of these packets to the NIC hardware. This only applies to established connections, however, but that typically accounts for like 95% of the traffic passing through.

Re: How to turn anything into a router

#150

Post by HeWhoLurksLate » Mon, Mar 30, 2026, 6:21 PM UTC

hughes wrote: post #138

I wonder if consumer routers will end up being built in a trivially-not-a-router configuration - something akin to a pull-tab or turn of the screw that closes a circuit, transforming the device from legally something else into a router after it's purchased. What a dumb timeline.

"this here is a virtual network appliance, so called because it doesn't have any ports on it - wait, why are you taking off that blanking panel? That's illegal!"