I'm more worried about how to turn anything into a fiber modem, as I'm pretty sure the gateway that AT&T gave me is a piece of crap (has to be rebooted every 2-3 weeks otherwise it gets really slow, hard to configure, probably has all sorts of malware and security holes on it). Any guides on that?
How to turn anything into a router
211–220 of 276 posts
Re: How to turn anything into a router
#212This article and many comments here missess the most important detail: Nobody wanna be a full time SysAdmin.
Sure, follow the article and you will get things.....working but will also turn you into a SysAdmin.
Homelab is my hobby, CLI aka command line interface is where I spend most of the time playing with my linux containers BUT you do wanna a GUI to manage network stuff.
Do you wanna do this right and once?? And trully open-source meaning, you will never have to pay to use it??
1. OpenWRT: It supports many WiFi6/7 wireless router, it provides you router, wireless, basic firewall, plugins. Set it once and forget. My dumb OpenWRT wireless only access point has been running for years. It used to be my main router, same device.
2. OPNSense: This is like going from an EV to a V12 bi-turbo: It will work out of the box, you change things ONLY if you wanna mess around. Provide your ISP login when installing it and everything works out of the box.
My OPNSense baremetal has dozens of firewall rules and what not but from an every day life pov, I do not touch it other than check for updates and neither should you.
Good luck troubleshooting network problems via CLI only if you have no idea of what is going on and just followed some article online.
Re: How to turn anything into a router
#213I've got one of those N100+10Gbit router devices with a handful of ports. It seems a pretty reasonable device with one of the router distros running on it, but it doesn't seem nearly as efficient as my ucg-fiber/route10 devices, and that wouldn't bother me except that I suspect the packet latency is significantly higher too. Those devices AFAIK have hardware programmable router chips, which means the forwarding is do…
From what I can tell you're pretty much right. A linux bridge cannot possibly be as efficient or speedy as a dedicated switch asic. OpenWRT has support for a few different hardware switch kernel APIs, but you can't exactly buy one of those on a PCIe card and I've never seen one of those N100-class boards with one instead of a set of i226 ethernet controllers taking most of the PCIe lanes.
Mikrotik sells the CCR2004-1G-2XS-PCIe, which is a fascinating device:
https://mikrotik.com/product/ccr2004_1g_2xs_pcie
It is a full Mikrotik router stripped down to just a board and hung off a PCIe interface. Iirc by default it exposes a virtual gigabit interface to the host and otherwise acts exactly like a CCR2004 running RouterOS.
Doesn't really buy you anything vs a RB5009 unless you can use the pair of 25Gbps ports, but it sure is neat.
Re: How to turn anything into a router
#214This is a great writeup! Perhaps I can put in a plug for the create_ap script which I have been maintaining for many years ( http://github.com/dlenski/create_ap ). It's a shell script that allows you to turn any ol' Linux computer into a WiFi router in one quick command-line: By default, it will setup your WiFi card as an access point (allows WPA2/3, MAC filtering, etc), setup packet forwarding and routing, and run a…
Any tips on good wifi chipsets that do not suck in AP mode?
If you're okay with old, battle-tested, cheap (and about 2-3 generations back in terms of performance)…
Any ath10k card is great. They support up to 802.11ac, cost about $10 (e.g. amazon.com/dp/B07HDXP9R4), and can run AP in either the 2.4 GHz or 5 GHz bands.
The firmware and driver are very stable and they in terms of regulatory constraints they defer entirely to the Linux kernel (which means you can use https://github.com/singe/wifi-frequency-hacker or similar for frequency hacking).
I don't have much personal experience with ath11k (802.11ax) or ath12k (802.11be), but I've heard good things about them generally.
For use in a real, practical access point, you want to avoid Intel cards. Intel's firmware completely locks down the ability to run a 5 GHz AP. For whatever reason, Intel takes a maddeningly conservative view of regulatory restrictions. They clearly don't want their cards to be used in APs. On the other hand, Intel's cards have a nice feature that they support dual-channel operation with a single radio (e.g. `iw list` shows `channels <= 2`), which is extremely handy for running a quick-and-dirty 2.4 GHz access point while staying connected to a WiFi network.
Re: How to turn anything into a router
#215Earlier quoted context omitted.
I guess I'm different. I typically want my router/firewall/network services box to Just Work. I've made a career in deep-in-the-weeds system administration and engineering. Having to hunt down man pages, examples, tutorials, etc for the dozen or so fiddly bits make up a modern Linux- (or BSD-) based router was fun the first time, not so much the 10th. Been there, done that, got the t-shirt. I will concede that the Op…
I feel almost exactly the same as you on the subject. When I was young and starry eyed I built my own router out of a PC running openBSD, all by hand. Nice learning experience, interesting OS, but definitely not maintenance free especially around system updates as back then openBSD packages and sys upgrades required recompiling everything. Now I do the same mini-PC thing as the OP's article but I just put OpnSense on…
I've been running OpenBSD as a router for almost 20 years I think? These days, the only ongoing maintenance it requires of me is running `syspatch` and `pkg_add -u` periodically to keep things up-to-date, and then `sysupgrade` when a new release comes around. It's way more hassle-free than in the old days.
Re: How to turn anything into a router
#216I’ve been using OpnSense/pfsense [0] for years and would highly recommend it. It has a great automatic update experience, config backups, builtin wireguard tunnels and advanced features like packet filtering options via suricata. When I am doing network management on my weekends, I’m so glad I’m not stuck in the Linux terminal learning about networking internals and can instead just go to a webui and configure my rou…
I agree on principal, but I often find that the GUI abstractions don't always map to the linux tooling/terminology/concepts, which often ends with a head bashing against the wall thinking "this is linux, I know it can do it, and I can do it by hand, but what is this GUI trying to conceptualize?!?!" I was recently introduced to a Barracuda router, and bashed my head against the wall long enough to discover it had an s…
I had a similar experience with FreeNAS (now called TrueNAS): I'm sure it's great for some people, but I ended up fighting the abstraction layer way more than I benefited from it. I personally found it easier to just run Samba on plain FreeBSD/OpenZFS.
Re: How to turn anything into a router
#217I'm more worried about how to turn anything into a fiber modem, as I'm pretty sure the gateway that AT&T gave me is a piece of crap (has to be rebooted every 2-3 weeks otherwise it gets really slow, hard to configure, probably has all sorts of malware and security holes on it). Any guides on that?
pon.wiki is a great resource
Re: How to turn anything into a router
#218Something I did not see in the article are router specific tuning such as net.ipv4.ip_early_demux = 0 net.ipv4.tcp_early_demux = 0 net.ipv4.udp_early_demux = 0 in /etc/sysctl.d/10_router.conf to slightly reduce overhead when being used primarily as a router. There are many other router related knobs but those I would always set especially if trying to reduce overhead for VoIP/Gaming setups. There are many other knobs…
If you write the large write-up explaining those rabbit holes, let me know. I'd like to read it.
Re: How to turn anything into a router
#219I recommend replacing hostapd with an enterprise access point plugged directly into an ethernet port on the router. Most support VLAN tagging based on SSID, so you can still set up different subnets and firewall rules for the different SSIDs. As much as I love hostapd... the performance using commodity hardware has always sucked for me. I can get 150MB/s over wifi with my proprietary AP!
Agreed. I also have had some good times with hostapd, and I've done a lot with commodity wifi hardware in the past (I'm known as the guy that was able to get WiFi working for PyCon when nobody else could). But these days I've been running a Ruckus R620 at home and it's been a huge improvement over 4 Google WiFi APs spread around the house with ethernet backhaul.
Re: How to turn anything into a router
#220Earlier quoted context omitted.
> Why not? It seems like you weren't really asking, but I'll answer anyway. It's bad security practice, and opens up your network to attack and/or compromise, you're massively increasing the attack surface, and a compromise of one of those components leaves the attacker sat on your edge router, at which point your entire network is fair game. Generally speaking you shouldn't expose anything on your edge router / fire…
It was a genuine question, and while you reiterate the author's point about this being "bad security practice," neither you nor the author explain why this is the case. I don't believe physical separation really buys you much here. At most, if may reduce downtime if you do indeed get pwned, but I think that you can achieve the same objective through a combination of containers, VMs, and UNIX users. And running multip…
> opens up your network to attack and/or compromise, you're massively increasing the attack surface, and a compromise of one of those components leaves the attacker sat on your edge router, at which point your entire network is fair game.
That's your answer.