Discussion
How to turn anything into a router
b112: This will certainly work, but the whole mesh networking and more advanced aspects of a real wifi router won't really be present.I get by without it, but I can imagine some won't be able to.
JohnFen: If you're tech-savvy and building your own router, you can add those advanced aspects in if you want them.I'd be willing to bet, though, that the overwhelming majority of people who use consumer routers aren't doing anything remotely advanced. A how-to that covers the majority of use cases is valuable even when it excludes advanced use cases.
louwrentius: A router only really needs one network interface.Any computer with a single network interface, maybe even an (old) laptop, can be used. Anything x86 from at least the last 10 years is energy efficient and fast enough to route at gigabit speed. If you don't care about energy usage, any x86-based computer from the last 20 years is fast enough.The magic trick is to use VLANs, which require switches that support VLANs, which can be had for cheap. VLANS also allows you to create separate isolated networks for IoT or other 'less secure' or untrusted devices.I’ve always made my own routers by using low-power devices running Linux (Debian) with IPtables and now NFtables.No special router OS or software required.Highly recommend.P.S. that single network interface is very likely never a bottleneck because network interfaces are full-duplex. Only when your router is also your file server (not recommended), internet traffic and file server traffic could start to compete with each other.
binaryturtle: Sounds interesting. I always wanted to use a Raspberry PI as router (to have one as backup in case the OpenWRT Linksys goes down), but couldn't wrap my head around properly how to overcome the single network port (I think the usual recommendation is to use an extra USB network card/adapter). Can you elaborate more about this VLAN stuff (you would put your modem, your router, and all your machines on the switch... and in the switch you tell the router connection to double use the connection for WAN and LAN separated via VLANs? And put the modem into the "WAN VLAN" too?)Ideally the PI also should to what the extra DSL Modem does… but I guess that's where the dram must stop. :D
corndoge: Akchtually...this is more about how to turn anything into a wireless AP. It does route though! There's also free software like FRRouting that will give you real internet grade routing capabilities.
Tostino: There are a whole lot of normal people using mesh networking Wi-Fi routers. Honestly, most of the least technical people that I know are all using mesh networks because their houses require it.
LatticeAnimal: I’ve been using OpnSense/pfsense [0] for years and would highly recommend it. It has a great automatic update experience, config backups, builtin wireguard tunnels and advanced features like packet filtering options like suricata.When I am doing network management on my weekends, I’m so glad I’m not stuck in the Linux terminal learning about networking internals and can instead just go to a webui and configure my router.0: https://opnsense.org/
icedchai: Yes, but some folks are wary of using the same physical port for external and internal traffic. Fears of "VLAN hopping" remain, even if unfounded. Also, you'll hit a performance wall since you are sharing a single gigabit port between external and internal traffic. Obviously may not be an issue for many, but if you have gigabit fiber...
julcol: if fancy a bit more of capability, dockerized opnsense and just play right with your vlans. One cable is enough into your switch...did I said managed... and your opn/telco eth exit.
timw4mail: Surely something like OPNsense/PFsense would be better for the average user than setting up all the software manually?
EvanAnderson: It only needs one port, but for most simple networks two ports on the router means less configuration.The "router on a stick" paradigm using VLANs to a share a single physical port is perfectly valid. You're creating a "now you have two problems" scenario in which you need a VLAN-capable switch and have VLAN configuration to make.I typically like the ISP router on a dedicated router port to make monitoring the physical link and/or cycling the physical link easier.Unless your ISP is >1Gbps adding a second port to most devices is as easy as adding a USB NIC.
ata_aman: Have you noticed significantly slowed network speeds over WiFi?
louwrentius: Not that I know of, why would that happen?
ata_aman: Wouldn’t all traffic be routed through the OS/processor on board?
estimator7292: You'd be shocked to find out how old and weak the CPU in your current router is. Typically they're on par with low end desktop CPUs from 10-15 years ago.
louwrentius: I've created a blog post about this: https://louwrentius.com/raspberry-pi-as-a-router-using-a-sin...
Ir0nMan: A fun project that results in a unique and stylish router is repurposing a Mac Pro Trashcan. They can be picked up for a few hundred dollars, offer dual 1GbE Intel NICs that work natively on Linux, and have plenty of CPU and RAM overhead. Throw OPNsense on there and you’re off to the races.
globular-toast: Pretty sure switches that support VLANs are more expensive than a NIC. I think even a 4 port GigE Intel NIC can be had for less.But you might want VLANs anyway, so it's an interesting thing to consider.
louwrentius: I have gigabit fiber and none of this is an issue.VLAN hopping is only possible due to misconfiguration. I'd like to be proven otherwise if that's not the case. VLANs are used EVERYWHERE where it matters. And no, the single port is absolutely not a bottleneck because the port is full-duplex.
estimator7292: What happens if one node on your network is downloading at 1Gbit and another is uploading at 1Gbit?Both get 500Mbit.Bottleneck.
JohnFen: Certainly. But it's still a minority use case.Perhaps someone else will (or did) write up a how-to for support mesh networking in your homebrew router.
sgt: nftables syntax is pretty tough to read. I wonder why they didn't go for an easier to read DSL. I do understand it's likely super fast to parse though, and has a 1:1 relationship to its struct in the kernel.
tuetuopay: I’ll pick nftables over iptables any day, it’s leagues better (granted, it’s not hard). The nftables wiki is great, as the syntax and modules are documented in a single easy to read page.As an added bonus, you get atomic updates of all chains for free.Granted, for simple usecases, ufw or firewalld may be simpler though.
jasonjayr: I agree on principal, but I often find that the GUI abstractions don't always map to the linux tooling/terminology/concepts, which often ends with a head bashing against the wall thinking "this is linux, I know it can do it, and I can do it by hand, but what is this GUI trying to conceptualize?!?!"I was recently introduced to a Barracuda router, and bashed my head against the wall long enough to discover it had an ssh interface, and linux userland, and was able to solve my immediate problem by directly entering the commands to get it to [temporarily] do what I needed. (Of course, using the GUI to reapply settings wiped my manual configuration...)I've used pfsense, OpenWRT, Barracuda, Verizon's OEM router (Actiontec) and they all represent the same functionality wildly differently.
whalesalad: Performance per watt is not ideal on the trash can. But totally doable.
louwrentius: A CPU from the last 20 years can route traffic at gigabit speed. It's only something to worry about for a Raspberry Pi3 or something similarly 'crippled'.
colinb: I think I understand why this is true for plain IP forwarding. There isn’t much to break the cache and the lookups are few and fast.What’s the cheapest (new) computer that can drive a 1Gb port with NAT? With a busy encrypted (wireguard?) connection?[I don’t think qos has a lot of use in the domestic environment; sure, someone here does it but I think it’s much less mainstream than the features I already mentioned. ]Such a device could drive my home. But in a couple of years I suspect I’ll want 2Gb or 10.In the past I’ve tended to use a device until its crappy power supply failed. So I guess I’m hoping for a >5 year life span/upgrade capacity.For all I know the answer to my question is one of those passively cooled four port n100 bricks from AliExpress. Anecdata happily accepted.
lucasay: “Just use OPNsense” is great advice for production, but terrible advice for learning. This article is valuable precisely because it shows how little magic is actually involved in routing.
ZenoArrow: > I've used pfsense, OpenWRT, Barracuda, Verizon's OEM router (Actiontec) and they all represent the same functionality wildly differently.Worth noting that pfSense (and OPNsense) are not Linux-based, they're based on BSD, specifically FreeBSD. While it's possible to have standard router OS web UIs that are cross platform, the underlying technology is different, so it's not really a surprise that there will be differences in how the devices running these OSes are configured.
proxysna: Pleasant thing about routers that is is so simple to build one after learning basics of networking and pretty much any OS or distro can act as one. There are obvious choices like OPN\PFSENSE, OpenWRT, DD-WRT, FreshTomato, but literally any PC with a single Ethernet port can act as one. My favorite setup was a laptop running Ubuntu and the whole router setup was in a single netplan file + dnsmasq for DHCP.
bluedino: This really takes me back. My first actual 'use' for Linux was making routers out of leftover computers.The perfect machine back then was a 100MHz Pentium, in a slimline desktop case. At the time, the Pentium III was the current desktop chip, so you'd have a pile of early Pentium-class machines to use. And even a 10mb ISA network card (3Com if possible) would have plenty of power for the internet connections of the day. But 100mb PCI cards were still fairly cheap.Install two NICs, load your favorite Linux distro, and then follow the IP-Masquerading HOWTO and you've got internet access for the whole apartment building, office, or LAN party.Eventually I moved on to Linux Firewalls by Robert Ziegler for a base to build on.After that I started piling other services on, like a spam filter, Squid cache, it was amazing to get so much use out of hardware that was going to just get thrown out.
avhception: Ha, that's very close to my story as well. I had a 166Mhz Pentium and it was all PCI cards and 100mbit by then. That was essentially the start of my career.
jrm4: We are just scraping the surface here; let's imagine a really easy to use and install bit of router software that includes all kinds of p2p bells and whistles.The extreme difficulty of setting up networking and routers is (obviously?) a weird endgame result of how companies and safety and capitalism and restriction intersect* and given the relatively insane regulatory ideas we're seeing these days, time for another look at all of this.*edit, and not, e.g. an inherent property of "networking technology," it does NOT have to be this hard.
nottorp: Hmm I've always had a manually configured low power generic box as router.But I've never even tried to set up my own access point, I just pay Unifi for that [1]. The software part is doable but I don't want to learn to handle the signal issues.[1] Switched to Unifi in anger after my first consumer level 5 Ghz wifi needed reboots weekly because it was overheating. Do yourself a favour and get the semi pro stuff, Unifi or others.
solarkraft: Maybe someone in this thread has a couple of ideas:What’s the simplest way to spin up a simple „cattle, not pet“ routing VM? I don’t want to mess with any state, I just want version controllable config files. Ideally, if applying a version fails, it would automatically roll back to the previous state.OpenWRT seems like it fits my description most closely, but maybe someone here is a fan of something more flashy/modern.
bembem_c: OPNsense. I use it on dell optiplex SFF for about 8 years. Was never tempted to use VM for routing, but many do.Version control is in the GUI, you can adapt for your needs the number of changes you need. automatic config.xml backup also possible.
ghc: Here I was thinking this article would tell me how to turn my unmanaged switches into routers, but no, "anything" actually means "any fully featured general purpose computer with networking".
tuetuopay: Except actual routers don't handle the traffic on the CPU, they have dedicated hardware to actually handle the packets. The CPU basically runs the OS, configures the hardware router, and does housekeeping tasks (e.g. ARP or FDB expirations, NAT cleanup, etc). The only packets that ever reach it are "trap to CPU" situations that don't require acceleration as those are rare or expensive to implement in hardware (e.g. better suited to a CPU). Those usually include management protocols (ICMP, ARP, NDP, STP, etc) or packets with unknown destination (e.g. the first packet to an IP that requires ARP resolution).That's how you can have multi-Gbps on a router with a 200MHz MIPS CPU. Or Tbps on a router with a quad-core Xeon.
Hikikomori: Home mesh is mostly about having wireless backhaul, and you can certainly do that of you have (preferably) two radios, you just set up one radio as a client to your main AP.Even if you aren't doing wireless backhaul you just rely on regular client behaviour to transition between APs, can enable 802.11r to improve this.Enterprise "mesh" typically uses wired backhaul for performance and can help clients roam quicker with a controller (auth, not deciding to roam). Controller can also adjusts radio power so APs aren't talking over each other if they're too close.Mesh isn't any magic, just regular wifi.
hmaxwell: I'm curious about the policy rationale behind banning router imports. If a government were considering legislation like that, what would the primary concern usually be? Given that so much internet traffic is now protected by TLS/SSL and other encryption, why would it still matter if citizens were using routers that might be backdoored?Is the concern mainly things like botnets and DDoS activity, weak default credentials on network equipment, or compromised business networks where poorly secured routers or attached NAS devices could expose sensitive or proprietary data? In other words, is the concern less about decrypting traffic and more about using the router as a foothold for surveillance, disruption, or access to poorly secured internal systems?
nathas: It's everything you mention in the second paragraph, and additionally just the ability to turn them off.Imagine everyone had their routers disabled simultaneously. I don't know if the cell networks could function with the surge in standard traffic that would happen, and then you've effectively plunged all or part of the country into a communication blackout.I think "turn it off permanently by bricking it" is almost as bad as "leverage for DDoS".
DesiLurker: is this the new age .. how to run doom on it?
cestith: Technically you can route without isolation, but VLANs are definitely a good idea if you’re using a single port.There are 2.5 Gbps, 5, and even 10 Gbps USB NICs these days, although 10 Gbps ones are pretty expensive and require really recent USB ports.I agree I want my local network and my WAN port separate, if for no other reasons than so I can use ssh to get into the router from my LAN with the WAN port disabled.
burner420042: So it's been awhile but the best and simplest way I think is use an access point. I don't want my wireless gear doing routing. From a logic stand point they acts as wireless "bridge" to the physical network, and nothing more. DHCP, etc. stay handled in one place for the entire network, back on the physical router.
chungy: OpenWrt has a generic x86 PC build that can also be used to turn basically any random PC into a router, complete with an operating system actually designed and developed for that purpose.
moffkalast: And of course probably 1000x the power usage compared to the average off the shelf router that runs off a borderline microcontroller.
moqmar: That sounds like you might like VyOS. I found it to be relatively easy to achieve exactly what I wanted, but went back to a GUI as it turned out I wanted a pet and not start a farm.
ImJamal: There are a few reasons- Access to data (dns/ips, domain names (if not using ESNI), amount of traffic, etc) of sites you are visiting- Access to the inside of your network where it can attack machines that may not be secure- DDoS- The ability to shut down your internetI'm sure there are more.
thequux: NixOS using https://github.com/thequux/nix-zone-firewall/ worked well for me for many years. I only stopped using it because my poor embedded Linux machine started having issues and it made more sense to go with a Mikrotik than to buy a new device to run as a soft router.
tombert: I recommend Pfsense or OpnSense if your hardware works with a FreeBSD-based thing. They're super easy to set up and don't have many surprises.After I upgraded to a 10GbE ethernet card in my previous router, my card didn't work correctly with FreeBSD-based stuff anymore. I changed to ClearOS and that was actually comparably easy to Pfsense...maybe even easier? I recommend checking that one out.
miladyincontrol: While I am a linux advocate for networking in the current day outside of hyper specific CDN use cases (a la netflix)... its pretty common for people to just virtualize opnsense/pfsense to take advantage of linux network drivers. Especially if their actual routing requirements are modest and dont require full use of the hardware.Beyond getting support for devices completely absent on freebsd, quality of drivers, bugs much more rapidly squashed, and general misc features absent on the bsd side like NBASE-T.
accrual: I briefly put a Pentium MMX 200MHz system in service a few years back to bridge my parents to their neighbor's WiFi (with consent of course) when their DSL line was down for a few days. I installed a PCI Ethernet and WiFi card, booted into OpenBSD, and amazingly it was fast enough to get them through the downtime. :)
