Hacker News Reader

Comment by gigel82 | Hacker News Reader

That sounds interesting for routing applications.

I was just looking into building a custom router using an older PC and a dual-port 2.5GbE NIC. OpnSense sounds like a solid choice, but I'd prefer a Linux solution because the CPU is pretty beefy and wouldn't mind running a few Dockers on the side (yes, I know multi-purposing a router is a bad idea but meh).

View on HN

The kernel already does zero-copy routing; io_uring is for UDP and TCP.

For a given value of "zero"; the packets are still copied from NIC buffers and wrapped in sk_buff.

Maybe headers are parsed but my understanding is that the whole packet is not copied.

It's a NAT router so needs at minimum to masquerade (change the src/dest IP in the packet headers to match the internal / public). I'd also be running fail2ban or crowdsec for the bare intrusion detection.

A "beefy CPU" will sit twiddling its thumbs forwarding traffic between 2.5g interfaces. Any CPU on the market can do that in between naps.

It depends if GP wants to do deep packet inspection or other processing on the data. Otherwise, yes, you are right.

Have you considered vyos as a Linux alternative to *sense?

Additionally, you could set the box up as a hypervisor, pass the NIC through to the router VM, and have the other VMs/containers use a bridge or some more advanced virtual networking.

That obviously has potential downsides, but I had a bit of fun doing it before downsizing my server

Even with opnsense, put a packet filter and wireguard to the box, and I guarantee you'll use your CPU and memory with a 2.5GbE NIC...

Reply on news.ycombinator.com