Home router

Greetings, I had recently some hardware problems with my old garbage-router so now I want to buy/make something durable, simple and with native (or just good) support of NETBSD/OPENWRT/DDWRT or just any other linux or *bsd distro. You suggestions ?

You can always get a ME_cleaner compatible small form factor PC. If you are looking to build then just get an itx ryzen system. We need more detail of your needs/wants/paranoias

Me-clean motherboard are rare now, rysen is not secure because AMD_PSP. I need a solid router under 200$, with good free os support, 1gbs or 100mbs or 10mbs lan, no wireless , no (or just less) spy software/hardware blobs or else.

Turris Omnia is around $200. It has full gigabit wan and even sfp slot to skip ISP optical modems.

also, if i will find a motherboard with no me, will it be possible to install multiple eth ports, if it has 1 or 2 pci slots. or maybe i will have to use ethernet switch ?

what do you also think about ubiuqiti routers ? looks like they have linux support.

>>9778 I used an old Pentium 4 box + OpenBSD as a router for awhile and it worked fine. All you really need is a little old office PC with a few empty PCI slots, some cheap NIC's from aliexpress and a small HDD (CF card or SD card might work well too!). CPU, RAM and HDD aren't too important because it doesn't take much to route packets. Now, if you're a frequent idler on IRC like me you'll probably want to install GNU screen + irssi on the machine so you can SSH into it whenever you want. That way you don't have to worry about reconnecting to IRC when you reboot your main PC. You could even run a web server and a few other things on it too. Careful when picking an old PC though, some nutburst-era machines have leaky caps. Out of 6 of the same HP tower that I got, only ONE had no bad caps and that actually changed just recently :c Anyway, good luck OP. Here's the guide I used to setup the OpenBSD router; https://www.openbsd.org/faq/pf/example1.html

>>9830 Not sure if it's still the case, but back when I looked at them they wanted me to install software on my machine to configure their equipment. Thanks but no fuarrrking thanks.

#9838 ok, thank you

>>9836 sounds like some librebooted 775 will fit my needs great, thank you.

>>9830 https://www.theregister.co.uk/2019/11/07/ubiquiti_networks_phone_home/ Ubiquiti is now on my personal soykaflist.

Has anyone ever used MikroTik routers? They seem nice and based.

>>9885 they have low memory, low rom and botnet os

I'd recommend separating out device roles. Have a dedicated AP that is a different device than your firewall. Reduces attack surface and has the added benefit of service resilience. It also makes it so you can use weaker hardware without it getting overloaded as easily.

There's also APU2 board from from PC Engines - probably everything you'd need from a router/ap, plus corebootable. Might be showing some age now, but still looks pretty decent for the job.

Banana Pi has some promising devices for routers. If you don't care about money, so does SolidRun. A decent router machine with 2 ports and a cheap (or not) switch will generally do fine. You could even use one with a single port and a managed switch (VLAN isolation + Linux virtual VLAN interfaces), but then you need to trust the security of the switch (which likely uses a proprietary OS firmware). This works without meaningfully degrading performance mostly because since Fast Ethernet Full-Duplex operation is available. >>9908 's recommendation of an APU2 is also an option, depends mainly on how strong you want the CPU to be and how much RAM. If you do a lot of simultaneous connections, RAM matters.

>>9778 Protectli / anything pfsense based isnt a bad bet. You get an open source OS.

NanoPi R2S seems like a nice new budget option. PC Engines APU2 still seems to be the best mid-range option. A full server if you want virtualization and chaining of VM's

I would wager on Qotom being the best option currently.

>>10838 Coreboot is a huge plus for a router

i just run linux on a low power x86 box i bought at a recycler. it was kind of a lucky score to find something like that used, but you can always do a mini itx build with one of those cpu-embedded boards. i have an asrock one i use as a fileserver and it's good enough (be extra careful to buy the right RAM; embedded boards in general and asrock embedded boards specifically are kind of particular about this). just get one with two 1G ethernet ports and a cheap switch to give you more LAN ports. i assume you aren't going to saturate 1G uplink so the fact that it doesn't have hardware routing/firewall implemented with ASICs shouldn't really matter for that. of course it's a lot easier to saturate 1G on your LAN, or at least bottleneck a weak embedded CPU if it's handling all of the networking itself, so if you heavily use a NAS or something on your home network you may want to look into getting a managed switch of some kind. a layer 3 managed switch in particular will let you do all of the static routing and subnetting stuff on your LAN so your router can only concern itself with NAT and firewall (plus dhcp/dns/vpn or whatever if you want to put those on there too).

>>10834 >Protectli >>10838 >Qotom I didn't know about either of these, very cool. Was I just out of the loop or have the options for mini-pcs really taken off these past few years? There's even a datacenter in the city near me that does mini-pc colocation for around the price of an entry-level dedicated server lease.

>>9830 >Ubiquiti my friends that are network admin types hype them a lot. by general computing standard's they're kind of soykafty, like >>9849 said, but if you want "proper" enterprise networking gear ubiquiti is at least better than cisco or juniper, both on price and openness. for a home network compromising raw performance for the flexibility and FOSS support that a more conventional x86 board gives you is probably the better option. i'd only look at ubiquiti if i wanted something with dedicated hardware for packet filtering or whatever.

I still don't understand why anyone would want a Qotom that has an intel CPU over an APU2 which runs on coreboot and an AMD CPU if they are about the same price.

>>9778 APU2 - placed my order yesterday. Very Check yo0toob for some reviews/tutorials. https://pcengines.ch/apu2.htm

>>11444 I put a heatsink on mine. Runs about 5°C cooler.

>>11449 what software are you running? Did you add a radio? which one? Would love to hear your experiences. I did a double -take when I saw the heatsink on the bottom of your case, then remembered that's exactly where the cpu is.

>>11451 OPNsense - libressl: DNScrypt-proxy, Suricata, OpenVPN, loads of URL table blocklists... I use a seperate device for wireless. I'm happy about the APU2, no compaints, applying coreboot updates using flashrom is easy. OPNsense is pretty sweet too.

i'd suggest something in the mikrotik routerboard series. they are low-cost devices with a lot of the features of really expensive enterprise devices available in the software. the downside of these are that you have to configure them from scratch yourself, which takes a little bit of previous networking experience. i think the cheapest one looks like a simple 5 port switch, but since all routerboard devices share the same exact software you can configure it to be a firewall, a router, or a really powerful switch that deals with vlans. you have control over these functions on the level of individual ports too. it's pretty good. seems like few people use these devices but they are my favorite for their versatility. i think these are truly the devices that give me the most amount of control and freedom over what happens on my network.

>>11498 seems neat but the software is closed source so how do you know if you really have control over your network?

>>11501 But it's what linuxbros from forums always recommend! So it must be good, right?

ODROID-H2+ ?

>>11501 well if you cant verify trust to your own satisfaction then you can't trust it. use something else like an openwrt device. you can be as solipsistic as you like about it, if that's what makes you feel like you're doing something about your core device security in spite of your own powerlessness. i'm not going to read and personally audit the source of openwrt or tomato at any point in my lifetime so if i use them, how can i know i have control over my network?

>>11588 Because other people do this? It's the difference between trusting people who work at a company and trusting "people".

I am looking forward to the librerouter https://librerouter.org/ But what is something to get in the interim? Just a simple gizmo that runs openbsd and has multiple ports without obvious backdoors.

>>11792 If you need OpenBSD maybe look at supported ARM board? You may need a USB Ethernet adapter. https://www.openbsd.org/arm64.html

>>11792 Cool project. I personally bought pic related on a local eBay equivalent for just €10 and installed LibreCMC on it

Just here to ask for pic related. 'router' = the one that came with isp I want client2.1 to access telnet of the 'router' but it seems I can't do that. I also tried installing telnet via opkg so I could just ssh into the openwrt and access telnet natively but I had no free space left. Theoretically that one would work. I'm not really well-versed with configuring the firewall/forwarding, how do I make client2.1 access the telnet of isp 'router'?

>>11985 neat >>11449 It can be clocked at 1400 permanently using enough heatsink sysctl dev.cpu.0 dev.cpu.0.freq_levels: 1400/-1 1200/-1 1000/-1 dev.cpu.0.freq: 1400

What does lain think of D-Link DSR series? I need something like this for a small-business operational scenario. Built-in IPS and painless VPN looks promising. Is it a good idea to have a dedicated "firewall" device?

what soc would make a good router with 9front or openbsd running on it?

>>10842 my problem with those is pretty much any cheap psu is a fire hazard and is inefficient

why would you make your own router? i dont understand at all ive always used whatever router

what's the cheapest soc that at least has usb 3 so I'm not limited to slow as hell usb 2 Ethernet adapters

>>11444 could you please test 9front? here's how testing Ethernet Should work bind -b '#l0' /net ip/ipconfig ether /net/ether0 if that doesn't work your device may be hired numbered differently it might be '#l1' and ether1 you can do this from the live cd

>>12783 security lol

>>12783 You tend to get more control and aren't tied to whatever features the manufacturer decided to put in the router's web api. Most consumer routers don't have a good way to do anything special with subnets, for example. They also can't usually do anything with vlans. The firewall is usually extremely limited (just "which ports are open"). A proper firewall can define rules for packets going in any direction across any pair of (possibly virtual) interfaces. You can also do more advanced things like filtering on source IP or protocol or define how it's going to handle different connection states. Additionally if their router is just a box running linux it makes it easy to throw other related network services on it so that they're always up. A DNS nameserver/resolver is a popular choice, but some people put their VPN on there or even stuff like file hosts or web servers (I wouldn't recommend the latter. Your router should have a minimal attack surface and should spend its CPU cycles routing packets, not serving content. Unless you have your router in some kind of overkill containerized server installation with lots of cores you're probably better off just buying more cheap hardware.)

You can build multi plug router from arduino/raspbery PI parts. There are even projects like https://create.arduino.cc/projecthub/bananapi/banana-pi-bpi-r64-open-source-router-with-mtk-mt7622-27b062 but dunno if they require nonfree blobs in this particular case.