261–270 of 276 posts
You actually don't even need two interfaces on the box if you have a managed switch. It's not too difficult to configure your only interface as an 802.11q trunk port, and then you can use the managed switch as a sort of "interface expander". This is referred to as a "router on a stick" configuration, and it's how my home network is configured. Plus, if it's a PoE managed switch, you can install some cheap enterprise…
This really takes me back. My first actual 'use' for Linux was making routers out of leftover computers. The perfect machine back then was a 100MHz Pentium, in a slimline desktop case. At the time, the Pentium III was the current desktop chip, so you'd have a pile of early Pentium-class machines to use. And even a 10mb ISA network card (3Com if possible) would have plenty of power for the internet connections of the…
You guys with your dedicated hardware. :) I did routing duties for my LAN with my primary desktop for about a decade, variously with Linux, OS/2 (anyone remember InJoy?), and FreeBSD -- starting with 486 hardware. Most of that decade was with dial-up. The first iteration involved keying in ipfwadm commands from, IIRC, Matt Welsh's very fine Running Linux book. WAN speeds were low; doing routing with my desktop box wa…
This is the move. Let's you upgrade the different parts of the network separately. I have 3 components, an N150 router/fw/DNS/VPN box with 2.5GB NICs running OPNSense. A cheap but surprisingly good 2.5GB managed switch, and a cheap wifi 6 VLAN tag capable wifi access point.
Earlier quoted context omitted.
Yes. You can take advantage of Netfilter's flowtable infrastructure and if you have the right hardware (NVIDIA/Mellanox ConnectX-5 or MediaTekMT7621) it will actually offload the processing of these packets to the NIC hardware. This only applies to established connections, however, but that typically accounts for like 95% of the traffic passing through.
Awesome. I wonder if packet processing can be GPU accelerated
I've got one of those N100+10Gbit router devices with a handful of ports. It seems a pretty reasonable device with one of the router distros running on it, but it doesn't seem nearly as efficient as my ucg-fiber/route10 devices, and that wouldn't bother me except that I suspect the packet latency is significantly higher too. Those devices AFAIK have hardware programmable router chips, which means the forwarding is do…
I've got a 10G fiber connection, and I swapped out a Fortigate 100F for a server running VyOS. I had performance problems, because the 10G to 1G transition caused dropped packets at the switch. I was able to solve it by shaping the traffic to the 1G devices to handle queuing in the router, which is something this particular Fortigate can't do. (High end routers have algorithms like WRED designed to get TCP to behave nicely on 10G to 1G drops, but I don't want the noise of a Cisco in my basement.)
Earlier quoted context omitted.
Which bands and capabilities did you have in mind? For a basic 2.4 GHz, almost anything at this point. Intel and some iteris chipsets are well supported. mt7996 is good for wifi 7. You can also check the suggested hardware list on the kismet project for good recommendations for older bands and protocol versions
> Intel and some iteris chipsets are well supported. Intel chipsets categorically do not support AP mode
I have had good luck with intel in the past but it was only a very specific version. Don’t recall the exact specifics as it was a little while ago now.
Mediatek is still the best bet, though.
Earlier quoted context omitted.
My main reason is that nft applies configs atomically. It also has very good tracing/debugging features for figuring out how and why things aren't working as expected. That said, I think many distros are shipping `iptables` as the wrapper/compatibility layer over nft now anyways.
as somebody that's not a network engineer by day and has barely grokked iptables, could you recommend some resources for learning nftables ?
Here is their example relevant to the current article: https://wiki.nftables.org/wiki-nftables/index.php/Simple_rul...
“Just use OPNsense” is great advice for production, but terrible advice for learning. This article is valuable precisely because it shows how little magic is actually involved in routing.
In additon, compared to PF/OPNsense or OpenWRT (Linux based), you have more control and exposure to the underlying network concepts with VyOS. You're not configuring the kernel manually, but you still learn quite a bit.
I've no deep knowledge of the field, but my understanding is a lot of router/switch hardware uses dedicated hardware designs to ensure they deliver the bandwidth and ultra-low latency even if the device is absolutely slammed with traffic.
I've read before routing/switching in software like pfsense or similar can potentially struggle under some workloads dedicated hardware does not, but I've never seen a good analysis of the trade offs with actual benchmarks.
I'm sure most recent modern CPUs can probably handle a lot, but people often repurpose old SBCs they have like Raspberry Pis etc for projects like this.
Earlier quoted context omitted.
Which bands and capabilities did you have in mind? For a basic 2.4 GHz, almost anything at this point. Intel and some iteris chipsets are well supported. mt7996 is good for wifi 7. You can also check the suggested hardware list on the kismet project for good recommendations for older bands and protocol versions
> Intel and some iteris chipsets are well supported. Intel chipsets categorically do not support AP mode
> Intel chipsets categorically do not support AP mode
This is not true.
Intel chipsets do support AP mode; what they don't support is 5 GHz AP.
You wouldn't want to run a 2.4-GHz-only router for any kind of real-world long-term use, but if you just want to start a quick-and-dirty 2.4 GHz AP for testing/hacking/reverse-engineering, Intel chipsets are very good for this because they have out-of-the-box support for channel-hopping to support simultaneous client+AP operation.
More details in my previous comment: https://news.ycombinator.com/item?id=47581204
I'm curious - for power consumption, considering that you can get RaspPi products for so cheaply, is a discarded laptop more or less impactful on your electrical bill than a RaspPi? Like is the "free" laptop going to cost you more in the long-run then a nice little power-sipping ARM like a Pi5? Or do you need those extra operations-per-second that the more power-hungry x86 CPU gets you?
Everything outside of power equipment -- like HVAC, refrigerator, laundry dryer, etc -- is a rounding error on most power bills.
10W running 24/7 means about 7.3 kWh/month. In my area the average kW/h costs about $0.13 CAD
So a good rule of thumb is that every 10W 24/7 is about $1CAD/mo.
So assuming 30W for a laptop and 6W for a pi4, that means a difference of $29/yr. Which isn't a lot but isn't a rounding error either.