Comment by IntelMiner | Hacker News Reader

Comment by IntelMiner | Hacker News Reader

Parent Full thread

I've been quietly nibbling away at making my own "router distro" since PFsense's wireguard fiasco

I never much liked PFsense as a project. It feels very convoluted, and the hardware they sell (I was an early adopter of the then-new SG1000 appliance) is laughably exaggerated in its capabilities

But the Wireguard event is where they went from "incompetent" to "malicious" in my eyes

I ordered a Rasberry Pi 4 compute module and this accompanying ethernet breakout kit after seeing a review from Jeff Geerling (Raspberry Pi accessory mad scientist) and am currently waiting for it to arrive https://www.dfrobot.com/product-2242.html

I know I could just use something like OpenWRT, indeed I do have a lot of respect for the OpenWRT project. But I feel that the distro is more geared toward, well, routers. Devices with maybe 32 megs of flash storage and a slow MIPS CPU. Not a moderately powerful ARM machine with 8 gigs of RAM and gigabytes of SD or eMMC storage

In 2014 I decided that what I wanted most out of my house router was ongoing software updates from the distro, and that I would be willing to pay more for the hardware in exchange.

For seven years, then, I've had a mini-ITX x86-64 box with a small SSD, 4GB RAM, and 5 gigabit NICs running Debian Stable. It's been upgraded in place and I see no reason why the upgrade to Bullseye in a month or two won't go as smoothly.

I think a Pi4 is roughly comparable in computation capacity, perhaps less so in I/O -- but what I've got is clearly overkill, anyway.

That's effectively my current setup, some random Dell i3-4310 machine. But it's just overkill as hell for a basic router on a 100 megabit internet link

The Pi one can apparently saturate a gigabit iperf test without issue, so it sounds like a great replacement and rainy day project

These systems here make pretty bad ass router/firewalls:

https://www.pcengines.ch/apu2.htm

I've been using them for years w/out any issue. I just run standard Debian stable as well, with a few tweaks to make it more friendly for a read-only operating environment (to prevent wearing out the flash memory).

I’m very happy with my Proxmox x86 host running OpenWRT x86 in a container. It works beautify. I love how fast it is to take a backup/snapshot to try out new configurations and rollback in case of issues. The same host runs plenty of other services like home assistant.

I had pfSense working before OpenWRT but wanted wireguard so I made the switch.

These days OpenWRT targets hardware that's beefier. You actually have to do a lot of pruning to get OpenWRT to fit on devices with <64MB of storage.

Maybe look at Vyos? It is what I switched to after leaving pfSense. Linux based and cli only. Based on Debian, you can escape the router cli to get a plain Debian terminal and use apt to install whatever you want if you care to.

I'm not a super huge fan of Debian as a whole (I've been a Gentoo user for over 10~ years at this point)

I'm probably going to roll some sort of minimal Gentoo based system and then just augment it as-needed from there

I’ve been exploring this as well with the same hardware stack. Any interest in collaborating? If so, hit me up with the info in my profile.

I think your programming experience likely dwarfs mine. But I'll send you an email when I put some form of working prototype up on Github

I appreciate the interest though!

May I ask what's the point of the compute module + ethernet addon? Why not a normal pi4?

USB ethernet gets bogged down with interrupts if you start pushing lots of packets through it

The board I linked is the Pi's ethernet as eth0 and a Realtek gigabit NIC over PCI-E 1x as eth1 (instead of USB3 which is what the Pi 4 uses the PCI-E for)

As a result it can do a full gigabit of traffic with minimal overhead

from what I remember, CM4 provides more functions and I/Os than you can get from Pi4. Just put it in the specialized motherboard (some boards have specific features to supplement CM4).

I strongly recommend you to watch Jeff Geerling YouTube channel, you will see the why it is beneficial to use CM4 over Pi4.

Reply on news.ycombinator.com