Comment by ktta | Hacker News Reader

Comment by ktta | Hacker News Reader

This might seem weird, but I use an old PC with a wireless card in it (get one with a good antenna, and connect wireless APs via ethernet if you want more coverage). I've put Ubuntu server on it, and it has quite a few advantages over my old router which had OpenWrt

1. Persistent DNS cache using pdnsd (even after reboot because it is on-disk) with a long minimum global TTL. You would imagine this would be a problem, but surprisingly I haven't had any. I've only had to get in once to correct something. You can manually purge a specific domain, and all of them if you think something is wrong.

2. Powerful enough for good OpenVPN settings. Automatically routes through a VPN, and can be disabled for a specific client if needed. The AES instructions (which are on any Intel chip after 2008) help out immensely compared to using just a generic router.

3. Smoother LAN transfers. A cheap gigabit PCIe card (Intel EXPI9402PT - on ebay for about $20) which takes away local transfer rate problems, especially if you have an NAS.

4. Use it as an NAS. It isn't a good idea to mix devices which need good security with non-critical systems, like NAS so be sure about your settings and know what you are doing.

Another cool thing is port forwarding to the remote VPN instance so you can login remotely and check out your network or access any files/media you have on your NAS.

There are more things people can do which give more control and/or better experience, like setting up rate limiting on clients, custom settings for clients with unknown MAC addresses, etc. Traffic shaping is a good one (prioritize specific type of connections over another - example VoIP > Netflix > torrent).

The extra power really opens up the possibilities of what a router can do.

If anyone has any questions, I'd be glad to help out.

Something to keep in mind is that even at idle, a PC will probably run at 50W or so. This would cost $80-100/year to run where I live, which isnt insignificant. Unless you are using it as a NAS, need very high speed OpenVPN (>100MBit/s), or other things that a PC can do best, you're much better off with something like an ER-X, which has a max power draw of 5W, and has no problem doing gigabit line-speed routing/NAT/etc.

True, power consumption should be considered. I guess doing this would be a good choice if someone has a NAS already running.

>you're much better off with something like an ER-X I pretty much recommend a plain jane router which can run DD-WRT for anyone. All this is clearly overkill, and more importantly useless for most people.

Another choice is getting a cheap NUC like x86 device and get AP-only devices for good coverage.

>The AES instructions (which are on any Intel chip after 2008) help out immensely compared to using just a generic router.

Be careful, this isn't true... most low end Intel chips (Celeron, Pentium, i3) don't support AES-NI. Starting with Skylake chips (2015/2016-era), the whole processor line supports AES-NI. See https://en.wikipedia.org/wiki/AES_instruction_set

That's good to know, thanks for the correction

How did you set it up specifically, what ubuntu packages are needed on the pc? Can you point to a resource where I can go from, I have a pc with two network cards an incoming line and a switch. To working DHCP, port forwarding and a firewall for the things connected to the switch?

For setting it up as a router first, I recommend this[1] guide

I usually build the software from source so I don't know if every thing will work fine for you. Nevertheless here are the package names I remember from when I first set it up.

pdnsd - for DNS caching read the manual so you can write a good config, and don't forget to change the bind IP to an interface so that it is accessible to the local network

openvpn, easy-rsa - Initial setup[2] there is a bug which for which there is a temporary fix[3]. Might be fixed by now.

Port forwarding: I currently use iptables, but I've been trying to move to nftables, which I recommend. Here's how I do it for now (this must be done on the OpenVPN server):

tun0 is the openvpn interface

eno1 is the public ethernet interface of your VPN

Say the IP addr of openvpn CLIENT (router in this case) is 10.8.0.2 - eno1 port you want to forward to is 1234

say the client port (the router port to be forwarded) is 6789

#iptables -t nat -A PREROUTING -p tcp -i eno1 --dport 1234 -j DNAT --to-destination 10.8.0.2:6789

#iptables -A FORWARD -p tcp -d 10.8.0.2 --dport 6789 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

The above commands are not persistent so save them to /etc/iptables.conf

I always choose very conservative settings for firewall. Only a single port is forwarded to the VPN. Rest are closed, spoof open ports, and have a honeypot if you want.

There are many guides on iptables, but I would again recommend nftables. You're going to have to dig deep sometimes since it is still new.

If you have questions about anything, just google. Chances are, it has already been covered several times.

[1]: https://arstechnica.com/gadgets/2016/04/the-ars-guide-to-bui...

[2]: https://www.digitalocean.com/community/tutorials/how-to-set-...

[3]: https://bugs.launchpad.net/serverguide/+bug/1504676

> 1. Persistent DNS cache using pdnsd (even after reboot because it is on-disk) with a long minimum global TTL.

What problem does this solve? Is it a bid to improve privacy?

Performance. Most routers also have DNS caches for the same thing. It is often recommended to use OpenDNS servers for privacy, but it is slower than your ISP's DNS or Google's.

This is especially useful when you have an application which doesn't cache DNS requests and issues a new one for every connection. Torrenting gets a big boost for example.

Privacy is just a side effect.

I would be surprised to learn that most routers DNS implementations enforce "a long minimum global TTL". What do you define as long by the way?

EDIT: Also, "Torrenting gets a big boost for example." sounds strange, don't trackers give out IP addresses? Why would BitTorrent be DNS bound?

Most routers just have a DNS cache, not a global TTL, sorry about the misunderstanding.

I have it set up to be 1 day. Most websites have been setting up low TTLs like 1 hour or less because they don't want to take a chance in case of a problem, and DNS is cheap or free these days.

About your statement - 'don't trackers give out IP addresses?', what do you mean?

Often trackers are addressed by their domain (I've never actually seen a tracker without one). So each torrent has its own specific set of trackers. So all those trackers are frequently resolved and contacted for peer exchange.

Well, trackers give out the addresses of peers. If those addresses were given out as hostnames, there'd be a lot of DNS work involved, but they don't (as far as I'm aware).

So then the DNS curb would be looking up the hostnames of the trackers, which I'd guess would be under a dozen or so hosts (I don't know, I'm just guessing) per torrent. That seems unlikely to be a hot-spot to the degree that enforcing a long cache would provide a "big boost" to overall performance.

When you have 1000+ torrents seeding 24/7, even the tracker lookups add up. Usually you aren't downloading. Most of the time, torrents stay idle which will make DNS requests a significant portion of the total traffic. Sure, this might seem overkill, but when the VPN is already slowing down things for you, you do whatever needed to shave those seconds.

OpenDNS look up for Google just now took me 500ms, even without the VPN. I use tunnel mode for DNS on the NAS, which can easily double it.

Reply on news.ycombinator.com