Hacker News Reader

Comment by pimeys | Hacker News Reader

Just ordered a Chinese box with 8th gen U-series i5, 8 GB of RAM and 120 GB of SSD. Has six ethernet connections, HDMI and COM. Planning to install OpenWRT to it, and with AES-NI the system should be easily able to push the full 1 Gbps of traffic through Wireguard.

I've had whatever routers before, but mostly when using some VPN to hide the traffic from your home network, and if having fast enough internet, a good CPU is a must.

View on HN

I still put the important part of my network behind my own router similar to yours (and in terms of security I think ubuntu server + whatever you need has likely much smaller attack surface than OpenWRT which is a piece of software just too tasty not to be exploited).

Outside that, wifi part is hard to get right and smart switches are nice to have, but they are PITA if the firmware is never updated and there's no single place to nicely manage it all.

I'm having already Unifi's AP's, the controller running in my NAS and a good switch for the current setup.

Do you have some better suggestions for the router software? I'd love to run Opnsense, but a native Wireguard client is a must, and so is a good web interface for the setup.

Can you expand on the security of an Ubuntu server (acting as firewall, router and vpn), versus a dedicated router hardware and software (eg pfsense or OpenWRT)?

openwrt contributor's focus is consumer hardware support.

I don't think the distro was ever security audited.

Link to the box you got? That sounds interesting.

Also curious, and wondering how much that cost.

$350-$400ish search AliExpress for "i5 7200U firewall"

Oh, sorry!

These are available from Europe, but I've heard good things from US about similar boxes, when I searched with "best pfsense computer". Not the same brand, but similar hardware.

https://www.amazon.de/gp/product/B08JHKZMTN/ref=ppx_yo_dt_b_...

Let's see how it works, but I expect it to be much faster than my current ARMv7 box. Of course if you have space for a rack, go with something actively cooled. In our apartment, we expect the router to not make any noise.

Despite the name in the Amazon listing, it has nothing to do with Mikrotik; also a 1Gbit ARM Mikrotik router/firewall can be had for considerably less.

How fast are the ARM CPU they have in their routers, do they support AES-NI and how much data you can push with VPN encryption through their boxes?

The current ARMv7 I have goes to about 100 degrees Celsius and loads in the level of 4 to 6 when downloading a bunch of data full speed.

I'm not sure if they support AES-NI on ARM. I found some changelogs indicating that they do support it on x86 and x64, and most ARM routers list "hardware IPsec" encryption, so maybe?

I can't read German, but maybe it's a bare Mikrotik router board in a custom enclosure?

That said, it also says 'Pfsense', so I suppose more likely it's a typical 'Chinesium' listing.

similar boxes are on amazon, with worse(ish) specs under the brand "Protectli "

Raspberry pi 4 compute module might be good for building your own router too. You can attach a pcie network extension or usb to Ethernet for local usage. All of that would cost under $70.

https://www.raspberrypi.org/products/compute-module-4/?varia...

https://www.zahradnik.io/raspberry-pi-as-a-home-router

Edit: You would be better served by other boards from this benchmark repo for vpn usage: https://github.com/ThomasKaiser/sbc-bench/blob/master/Result...

It's worth noting that the Unifi gateways have hardware offload for traffic routing.

While a Raspberry Pi might work for some folks, it's worth noting that these are two very different performance classes.

How is it great with one NIC?

Ethernet adapter and USB speeds seem less than ideal.

I don't need many ethernet ports so it works for me. My home network speed is less than a gigabit.

It's definitely not for people like OP but may work for other people who don't want to pay much and still have something decent that they can hack themselves.

I have tried to flash open firmware on my router before but it didn't work out. I had a raspberry pi already so I decided to convert it into a router and use it.

A Pi 4 can handle about 1 Gb without issue. It is a great option for consumer workloads at consumer prices. I've certainly seen far worse consumer gear.

The CM4 can hit up to ~3.4 Gbps for one interface over PCI-E, and 4.15 Gbps if you also use the onboard Gigabit interface. Use a 1, 2, or 4-port network card and you can do some interesting things at 1+ Gbps: https://pipci.jeffgeerling.com/#network-cards-nics

It misses AES-NI though, so missing encryption hardware and would be subpar if running a VPN client for the network...

FWIW, I tried using OpenWRT on a box with similar specs to yours and it was a nightmare. Ended up using FreeBSD instead and it was a vastly better experience. I think OpenWRT might only be worth it on very low-spec hardware.

Hey! Could you please share what you think didn't work so well with OpenWRT? I'm currently running a Turris Omnia with their custom OpenWRT that I know how to use and it's been working quite well. What's missing is a better CPU to run Wireguard encryption full speed through our fast internet connection.

I'm seriously thinking about pfSense or Opnsense, but FreeBSD still misses native Wireguard support, leaving the encryption to the go implementation, which is subpar for our use cases. But, I'd be happy to run Opnsense, with jails and all those goodies from FreeBSD.

Wireguard has been merged into upstream FreeBSD almost a couple months ago.

FreeBSD 13 is out in March 2021 and opnSense with that system much later. Might be a bit complex to go that route right now, but it might be a great choice one year from now...

Since Netgate (the company behind pfSense) paid for the Wireguard work, you can make a good bet that same will appear in a near-future release of pfSense.

"with AES-NI the system should be easily able to push the full 1 Gbps of traffic through Wireguard"

You were probably thinking of OpenVPN? Wireguard is not based on AES and thus has no use for AES-NI.

i've got this on my todo list of projects. looks super interesting. there seem to be a lot of flavors of these boxes and i'm having a difficult time figuring which one will work best. i don't know anything about the manufacturers.

Reply on news.ycombinator.com