151–160 of 276 posts
This is a great writeup! Perhaps I can put in a plug for the create_ap script which I have been maintaining for many years ( http://github.com/dlenski/create_ap ). It's a shell script that allows you to turn any ol' Linux computer into a WiFi router in one quick command-line: By default, it will setup your WiFi card as an access point (allows WPA2/3, MAC filtering, etc), setup packet forwarding and routing, and run a…
Surely something like OPNsense/PFsense would be better for the average user than setting up all the software manually?
Anyone know how necessary UPnP is? From what I can tell, this setup does not run UPnP for automatic port forwarding
A router only really needs one network interface. Any computer with a single network interface, maybe even an (old) laptop, can be used. Anything x86 from at least the last 10 years is energy efficient and fast enough to route at gigabit speed. If you don't care about energy usage, any x86-based computer from the last 20 years is fast enough. The magic trick is to use VLANs, which require switches that support VLANs,…
Sounds interesting. I always wanted to use a Raspberry PI as router (to have one as backup in case the OpenWRT Linksys goes down), but couldn't wrap my head around properly how to overcome the single network port (I think the usual recommendation is to use an extra USB network card/adapter). Can you elaborate more about this VLAN stuff (you would put your modem, your router, and all your machines on the switch... and…
This of course means you need a VLAN-aware switch that this single ethernet port can plug into, configured as a VLAN trunk (in Cisco terms) port. You would then want to configure one of the other switch ports as a VLAN access port assigned to VLAN 100 (untagged). This is the port you would plug your cable modem into. Then (in the simplest example) you could assign all the rest of the switch ports to VLAN 200 (untagged), and you would plug all your LAN devices into them.
Lots of "just use X" comments but the article is about showing the bare minimum/how easy the core part of routing actually is. Also, if you have ever used docker or virtual machines with NAT routing (often the default), you've done exactly the same things. If you have ever enabled the wifi hotspot on an android phone also, you've done pretty much what the article describes on your phone. All of these use the same Lin…
Windows PCs had (have?) that Internet connection sharing feature for a long time. It was really just a checkbox to enable NAT too.
Sometimes I think combining a firewall/router/switch/AP/file server/etc into a device called a "router" really confuses people. Even people who should know better.
It becomes harder if you try to do it with 10 Gbps. Most CPUs struggle with it without dedicated accelerator chips.
Why not? I use an old gaming PC as a "router" (machine exposed to the WAN), and run dozens of services on it besides the firewall/NAT (iptables). Among others: email, Web server, multiple game servers, and many internal services (DNS, hostapd, loads of Docker containers).
Anyone has done mesh WiFi (ideally triband) using off the shelf parts and Linux? I have an Orbi AX system which works reliably, but now I want to upgrade the radio to WiFi 7 and that means I need to upgrade all the hardware. Hoping to move to using off the shelf parts so in the future I can just change the radio (ideally bunch of USB sticks). I understand this is not strictly just the router. I can (and used to have)…
That's a bigger can of worms than you might expect. Most consumer WiFi chips only barely support AP mode, and I'm not aware of any that can do multiple bands simultaneously. You'd probably need 4 adapters on the repeater for triband. One to connect upstream, one for each downstream band. Three instances of hostapd all configured with the same SSID and auth for each downstream interface. Then there's the roaming issue…
> While it may seem appealing, I would highly recommend against installing loads of software right on the router, and instead forward traffic to a device in a DMZ or VLAN. Why not? I use an old gaming PC as a "router" (machine exposed to the WAN), and run dozens of services on it besides the firewall/NAT (iptables). Among others: email, Web server, multiple game servers, and many internal services (DNS, hostapd, load…
It seems like you weren't really asking, but I'll answer anyway.
It's bad security practice, and opens up your network to attack and/or compromise, you're massively increasing the attack surface, and a compromise of one of those components leaves the attacker sat on your edge router, at which point your entire network is fair game.
Generally speaking you shouldn't expose anything on your edge router / firewall, it's a safety barrier.
You can sit things behind it in a "DMZ" and port-forward and isolate them etc so that there's no packets terminating on the actual edge device itself.m, that lowers the risk of a full network level compromise.
Chances are you might be fine and never have a problem, but it's still recommended against.