241–250 of 276 posts
Earlier quoted context omitted.
You don't even need more than one NIC: https://en.wikipedia.org/wiki/Router_on_a_stick
Iirc classic WRT-841 and similar "300Mbit WiFi" generation 4-100Mbit-ports Wi-Fi routers had the CPU attached via an on-SoC gigabit link to a vlan capable switch that has the 4 100BASE-TX ports exposed.
I guess it's cheaper than having to redesign an entire SoC, but still...
Earlier quoted context omitted.
On the other hand, I can think of a lot of things I've seen done and done myself because they were "obviously" beneficial, which turned out to make no difference or be slightly harmful when I rigorously tested them. Finding the balance is hard. I find as I get older I'm less inclined to twiddle knobs, but that isn't necessarily a universally good thing :)
Well like I said, some people like defaults because it is less cognitive load and some like to tweak things until they can't get better results. I believe that everyone should be able to choose their own path to satisfaction. If the defaults and fq_codel work for you then that is probably the right answer.
This really takes me back. My first actual 'use' for Linux was making routers out of leftover computers. The perfect machine back then was a 100MHz Pentium, in a slimline desktop case. At the time, the Pentium III was the current desktop chip, so you'd have a pile of early Pentium-class machines to use. And even a 10mb ISA network card (3Com if possible) would have plenty of power for the internet connections of the…
I’ve been using OpnSense/pfsense [0] for years and would highly recommend it. It has a great automatic update experience, config backups, builtin wireguard tunnels and advanced features like packet filtering options via suricata. When I am doing network management on my weekends, I’m so glad I’m not stuck in the Linux terminal learning about networking internals and can instead just go to a webui and configure my rou…
Surely something like OPNsense/PFsense would be better for the average user than setting up all the software manually?
Configuring FreeBSD is extremely straightforward.
Earlier quoted context omitted.
At $2k out the door that's way more reasonable than I thought it'd be. Too bad I can't fill it with old spinning rust.
And no (mention of) ECC.
Size of RAM 32 GB ECC
RAM type DDR4
[0] https://cdn.mikrotik.com/web-assets/product_files/RDS2216-2X...>
Earlier quoted context omitted.
Not much different. FreeBSD's pf is a port of OpenBSD's pf, and nftables are heavily influenced by them. At this point I rather doubt the sanity of people still sticking to iptables tbh. So there is approximately one concept of "packet filter done right". UI madness is on UI authors.
The primary reason I stick to iptables instead of nft is that I already learned iptables decades ago, and some software I interact with still defaults to iptables and/or does not have full support for nft. Why do you doubt the sanity of people sticking to iptables? What makes nft compelling?
And, like, maybe I'm missing something, but I've found that sets are insufficiently powerful and maps are insufficiently well-documented. You can't have nested sets... that is sets that are defined (partially or completely) in terms of other sets. You also can't share sets across tables (or have "global" sets)... so that list of interfaces that'd be really good to apply to all of your rules? Yeah, you've gotta duplicate it in every damn table. And maps? My big beef with them is that the documentation makes two things very unclear:
1) What part of the nftables rule is going to do a lookup of the key in the map and what part will get the value. Like, seriously. Check out the nft(8) man page and look at their mapping examples. The k:v selection and insertion logic is clear as mud. I can guess a couple of possible interpretations, but if they explicitly state the logic, I must have skipped over it.
2) If it's even possible to have a multi-component key, to -for example- cook up a "verdict map" that fills out the statements:
iifname $NAME oifname != $NAME $VERDICT
iifname $NAME1 oifname $NAME2 $VERDICT
"The CLIs are much less nice to use" is kind of a theme I've noticed with some of these replacement networking-management tools. 'bridge' is way less nice to use than 'brctl' [0], 'ss' is quite a bit more obnoxious than 'netstat', etc, etc.
Though, to be clear, I find 'ip' to be a much better tool than 'ifconfig'... at least the Linux version of 'ifconfig'. Maybe the BSD version is great.
[0] It doesn't help at all that you have to use both 'ip' and 'bridge' to manage bridges.
Earlier quoted context omitted.
Well like I said, some people like defaults because it is less cognitive load and some like to tweak things until they can't get better results. I believe that everyone should be able to choose their own path to satisfaction. If the defaults and fq_codel work for you then that is probably the right answer.
I am more curious that OpenWrt doesn't set these (demux) settings. It feels a bit like looking for advice on ZFS tuning and finding out 10 years later that what you were told was completely wrong.
Where this concept gets a little unnerving is the medical industry. Imagine if your doctor did not stay on top of the evolution on medicine and technology. They would confidently perform the same actions and prescriptions they did a decade ago even if it was now know that those things were not only wrong but also wildly dangerous and ineffective.
At least with routers and ZFS we are hopefully not using those to save lives and in the example in this thread it is just tiny change among hundreds of changes that have evolved with only marginal gains.
I’ve been using OpnSense/pfsense [0] for years and would highly recommend it. It has a great automatic update experience, config backups, builtin wireguard tunnels and advanced features like packet filtering options via suricata. When I am doing network management on my weekends, I’m so glad I’m not stuck in the Linux terminal learning about networking internals and can instead just go to a webui and configure my rou…
I recently dumped opnsense because they took a stand against a few things I was trying to do (ex, webUI on wan port IIRC) which make sense at a high level. But I _HATE_ devices that think they know better than me. I was trying to configure it on a _LAN_ such that the identified WAN side was actually my local lan, and I spent an hour hacking it to work and was like "you know if they can't get this shit right i'm out".…
Some recent changes are driving me up the wall though - their new UIs for configuring VPNs (IPSEC and OpenVPN) are far less intuitive than what they've termed the 'legacy' UI and I note that recent versions have introduced a firewall rule migration feature that I'm not touching with a 9-ft barge pole.
These changes are making me wary about using opnSense in future, which is a pity because other than pfSense there isn't really a fully-featured, open-source firewall OS that comes close to matching it (and pfSense has its own issues). Linux is great and all - and I do use it for routing/firewall/VPN in places on our network - but there doesn't seem to be a dedicated network appliance distro that bundles in a comprehensive Web UI. Apart from OpenWRT and its ilk, but I'm not convinced that that's suitable for enterprise deployment.
about 20 or 25 years ago i used whatever old hardware i could find in someones cellar or a junkyard together with 2 NICs and a floppy-disk drive / FDD based linux-distribution ...
it outgrew its original media - FDD - and is still active, as a router-focused distribution:
just my 0.02€