Hacker News Reader

Comment by aborsy | Hacker News Reader

Wireguard’s founder, Jason Donenfeld, reviewed Wireguard implementation in Pfsense/FreeBSD. The review was very negative, with numerous pointers to critical (sometimes childish) security flaws.

Why would someone use a router operating system with such strongly negative review from a respected security specialist?

A minimal Linux installation is an option, if your firewall is simple.

View on HN

I've been quietly nibbling away at making my own "router distro" since PFsense's wireguard fiasco

I never much liked PFsense as a project. It feels very convoluted, and the hardware they sell (I was an early adopter of the then-new SG1000 appliance) is laughably exaggerated in its capabilities

But the Wireguard event is where they went from "incompetent" to "malicious" in my eyes

I ordered a Rasberry Pi 4 compute module and this accompanying ethernet breakout kit after seeing a review from Jeff Geerling (Raspberry Pi accessory mad scientist) and am currently waiting for it to arrive https://www.dfrobot.com/product-2242.html

I know I could just use something like OpenWRT, indeed I do have a lot of respect for the OpenWRT project. But I feel that the distro is more geared toward, well, routers. Devices with maybe 32 megs of flash storage and a slow MIPS CPU. Not a moderately powerful ARM machine with 8 gigs of RAM and gigabytes of SD or eMMC storage

In 2014 I decided that what I wanted most out of my house router was ongoing software updates from the distro, and that I would be willing to pay more for the hardware in exchange.

For seven years, then, I've had a mini-ITX x86-64 box with a small SSD, 4GB RAM, and 5 gigabit NICs running Debian Stable. It's been upgraded in place and I see no reason why the upgrade to Bullseye in a month or two won't go as smoothly.

I think a Pi4 is roughly comparable in computation capacity, perhaps less so in I/O -- but what I've got is clearly overkill, anyway.

That's effectively my current setup, some random Dell i3-4310 machine. But it's just overkill as hell for a basic router on a 100 megabit internet link

The Pi one can apparently saturate a gigabit iperf test without issue, so it sounds like a great replacement and rainy day project

These systems here make pretty bad ass router/firewalls:

https://www.pcengines.ch/apu2.htm

I've been using them for years w/out any issue. I just run standard Debian stable as well, with a few tweaks to make it more friendly for a read-only operating environment (to prevent wearing out the flash memory).

I’m very happy with my Proxmox x86 host running OpenWRT x86 in a container. It works beautify. I love how fast it is to take a backup/snapshot to try out new configurations and rollback in case of issues. The same host runs plenty of other services like home assistant.

I had pfSense working before OpenWRT but wanted wireguard so I made the switch.

I’ve been exploring this as well with the same hardware stack. Any interest in collaborating? If so, hit me up with the info in my profile.

I think your programming experience likely dwarfs mine. But I'll send you an email when I put some form of working prototype up on Github

I appreciate the interest though!

Maybe look at Vyos? It is what I switched to after leaving pfSense. Linux based and cli only. Based on Debian, you can escape the router cli to get a plain Debian terminal and use apt to install whatever you want if you care to.

I'm not a super huge fan of Debian as a whole (I've been a Gentoo user for over 10~ years at this point)

I'm probably going to roll some sort of minimal Gentoo based system and then just augment it as-needed from there

May I ask what's the point of the compute module + ethernet addon? Why not a normal pi4?

from what I remember, CM4 provides more functions and I/Os than you can get from Pi4. Just put it in the specialized motherboard (some boards have specific features to supplement CM4).

I strongly recommend you to watch Jeff Geerling YouTube channel, you will see the why it is beneficial to use CM4 over Pi4.

USB ethernet gets bogged down with interrupts if you start pushing lots of packets through it

The board I linked is the Pi's ethernet as eth0 and a Realtek gigabit NIC over PCI-E 1x as eth1 (instead of USB3 which is what the Pi 4 uses the PCI-E for)

As a result it can do a full gigabit of traffic with minimal overhead

These days OpenWRT targets hardware that's beefier. You actually have to do a lot of pruning to get OpenWRT to fit on devices with <64MB of storage.

The implementation got pulled from FreeBSD and a new implementation have been made by contributors including Donenfeld, though it will likely not end up in mainline FreeBSD before the next release.

Shout out for Shorewall, i've been using it as my primary firewall-helper for nearly 20 years with 0 upgrade hassle.

It's a perfect-balance of power and simplicity. It doesn't have a web interface but is just a nice way configure Linux' built-in networking features.

It doesn't consume any extra resources and will run anywhere Linux does.

Reply on news.ycombinator.com