181–190 of 276 posts
Maybe someone in this thread has a couple of ideas: What’s the simplest way to spin up a simple „cattle, not pet“ routing VM? I don’t want to mess with any state, I just want version controllable config files. Ideally, if applying a version fails, it would automatically roll back to the previous state. OpenWRT seems like it fits my description most closely, but maybe someone here is a fan of something more flashy/mod…
> While it may seem appealing, I would highly recommend against installing loads of software right on the router, and instead forward traffic to a device in a DMZ or VLAN. Why not? I use an old gaming PC as a "router" (machine exposed to the WAN), and run dozens of services on it besides the firewall/NAT (iptables). Among others: email, Web server, multiple game servers, and many internal services (DNS, hostapd, load…
A classic example is Docker inserting its firewall rules before everything else, causing any "published" ports to be wide open even if a firewall ruleset was configured. They might have fixed this, or doubled down on their design choice. Either way, that kind of complexity can really bite you if you're not careful. https://docs.docker.com/engine/network/#published-ports
> While it may seem appealing, I would highly recommend against installing loads of software right on the router, and instead forward traffic to a device in a DMZ or VLAN. Why not? I use an old gaming PC as a "router" (machine exposed to the WAN), and run dozens of services on it besides the firewall/NAT (iptables). Among others: email, Web server, multiple game servers, and many internal services (DNS, hostapd, load…
> Why not? It seems like you weren't really asking, but I'll answer anyway. It's bad security practice, and opens up your network to attack and/or compromise, you're massively increasing the attack surface, and a compromise of one of those components leaves the attacker sat on your edge router, at which point your entire network is fair game. Generally speaking you shouldn't expose anything on your edge router / fire…
I don't believe physical separation really buys you much here. At most, if may reduce downtime if you do indeed get pwned, but I think that you can achieve the same objective through a combination of containers, VMs, and UNIX users. And running multiple, somewhat redundant machines also has obvious downsides such as increased power consumption, increased maintenance burden, additional space and cabling, etc.
Earlier quoted context omitted.
Certainly. But it's still a minority use case. Perhaps someone else will (or did) write up a how-to for support mesh networking in your homebrew router.
Where do you live to consider mesh networking a minority use case? I live in a small city apartment so I don't need one, but everyone I know outside of the city needs at least two nodes to cover their houses.
I don't live in a densely populated city.
Something I did not see in the article are router specific tuning such as net.ipv4.ip_early_demux = 0 net.ipv4.tcp_early_demux = 0 net.ipv4.udp_early_demux = 0 in /etc/sysctl.d/10_router.conf to slightly reduce overhead when being used primarily as a router. There are many other router related knobs but those I would always set especially if trying to reduce overhead for VoIP/Gaming setups. There are many other knobs…
How much does disabling early_demux actually matter? I do this too, but honestly I've never tested what difference it makes. I've always found fq_codel to be good enough for gaming through my router. But I have a 10gbps uplink.
It depends on what kind of packet rate one is pushing through the device, what type of hardware is being used as the router and how sensitive ones applications are to such things but if you want a better scientific answer run as many load tests as you can that measure packet rates, lag and jitter then disable them and run your tests again. I should add this is just one tunable related to routing. If bored dig into this a lot deeper and one will find there are many things that can be adjusted at the NIC, in the OS network stack and so much more.
Some people like defaults because it is less cognitive load and some like to tweak things until they can't get better results. I believe that everyone should be able to choose their own path to satisfaction. If the defaults and fq_codel work for you then that is probably the right answer.
A router only really needs one network interface. Any computer with a single network interface, maybe even an (old) laptop, can be used. Anything x86 from at least the last 10 years is energy efficient and fast enough to route at gigabit speed. If you don't care about energy usage, any x86-based computer from the last 20 years is fast enough. The magic trick is to use VLANs, which require switches that support VLANs,…
Pretty sure switches that support VLANs are more expensive than a NIC. I think even a 4 port GigE Intel NIC can be had for less. But you might want VLANs anyway, so it's an interesting thing to consider.
I've been running various homebrew routers for close to 20 years now; OPNsense is fantastic. Bonus, run it as a VM on your Proxmox host and eliminate a few wires!
Does routing on Linux have any hardware acceleration for IP packets?
Yes. You can take advantage of Netfilter's flowtable infrastructure and if you have the right hardware (NVIDIA/Mellanox ConnectX-5 or MediaTekMT7621) it will actually offload the processing of these packets to the NIC hardware. This only applies to established connections, however, but that typically accounts for like 95% of the traffic passing through.