Comment by walterbell | Hacker News Reader

Comment by walterbell | Hacker News Reader

Given the dire security of COTS routers and Wi-Fi access points, we need alternatives which support open OS + coreboot.

$200 used: The venerable PC Engines APU2 is a fanless x86 AMD 10W TDP router with 4GB ECC RAM, TPM 2.0 and GPIO pins, open schematics and coreboot, which can run pfSense, OPNsense, OpenBSD, Linux, FreeBSD and OpenWRT, with virtualization support. mPCIe slots for WiFi, LTE & mSATA. Constrained by supply chain at present.

$200 used: HP t730 and t620 Plus thin clients have an AMD SoC with similar TDP to PC Engines APU2.

$200+: MIPS-based Ubiquiti EdgeRouter Lite/4/6/8 can run Linux and OpenBSD (octeon/MIPS), but is also supply chain constrained.

$200+: Intel-based https://protectli.com/ (coreboot) and virtualization-capable multi-NIC mini PCs s with unknown UEFI, https://news.ycombinator.com/item?id=31451142

$400 AMD/Xilinx wildcard dev board for Robotics, KR260 has Arm SoC, Xilinx FGPA and multiple 1GbE ports + 10GbE SFP, backordered 20 weeks, https://www.servethehome.com/amd-xilinx-kria-kr260-robotics-...

$400: ASRock 4x4 dual-NIC has Ryzen Embedded or 4000-series SoC with Realtek NICs, questionable BIOS and limited support focus on Linux/BSD.

$400 used: HP t740 thin client with Ryzen Embedded is Mac Mini size, with PCIe slot for low-profile quad-port or SFP NIC, https://www.servethehome.com/hp-t740-thin-client-review-tiny....

Some SOHO networking devices made by Microtik, QNAP and Ubiquiti contain Arm SoCs made by Amazon's Annapurna Labs, who also make AWS Nitro silicon, https://en.wikipedia.org/wiki/Annapurna_Labs

We need more low end hardware chips with real mainline Linux support not more PCs with NICs doing software bridging/nat/routing. The control plane is what's creating the security problems but in order to use an open control plane we very often have to throw out what makes COTS routers and Wi-Fi access points attractive for their costs - the specialized hardware.

True, but it's been a long road to opening up that specialized hardware. OpenWRT continues to plug away on Microtik gear, https://openwrt.org/toh/mikrotik/start and OpenBSD supports a few MIPS-based octeon devices, https://www.openbsd.org/octeon.html

At the high end, Microsoft/LF SONiC + OCP merchant switch silicon has provided an open networking platform for 25GbE+ data center networking.

When I last looked it seemed like you could easily do a few 100Mbps but once your WAN was >=1Gbps it seems like you become much more limited. I ended up going for an Intel box which ends up doing everything in software - is there anywhere that compares the maximum throughput for different hardware with OpenWrt?

I don't have any annoying router or CPE from my ISP. Just fibre to the basement and an ethernet plug in the wall in my apartment providing 1Gb Internet access.

So I have a few EdgeRouter Lite 3s doing NAT and port forwarding (IPv4) because they can do that in hardware. As they are not open and I don't really trust them, I just pretend that they are on the ISP side of my network (even though they are mine, and I "control" them). So their LAN ports count as the "outside" in my setup. They provide networks like 192.0.2.0/24 that I just pretend are my public IP's.

This is also where the AP with GF's phone and chrome-cast resides on a separate VLAN. This has the benefit of me being able to play around with "real network" behind the firewalls in the next layer without worrying about causing downtime and issues for her (big win).

After that I have my "real" firewalls (a bunch of APU4C4s) that segment my network into several parts and multiple layers. They have less work to do as they don't need to do any NAT/translation. It also makes the firewall rules much simpler as there are no NAT/RDR rules and I don't have to think about whether a firewall rule apply pre- or post- translation (NAT/RDR).

It would of-cause be a lot easier if I just had a /24 of public IPv4 addresses, but this setup lets me sort of pretend that I do, even though I only have two static IPv4 addresses and an extra one with DHCP.

I just recently got IPv6 with a /56 routed to me from my ISP and this is what I am messing around with currently. I have some Juniper switches (EX2200/EX3300/EX4200) that can do IPv6 routing in hardware (and ACLs), meaning that I can do things a lot more like I wanted with IPv4 because I don't need any NAT. One of the benefits for example is that I can just route a /64 to my local mirror servers over a VLAN for bulk traffic without putting any load on my firewalls. As the traffic is only to/from a few destinations and ports, ACLs in the switch are fine for me (+ local firewall on the mirror servers). This bulk traffic is probably close to 90% of my total bandwidth usage, which is just syncing the local mirrors. This means that this traffic is not clogging up the NIC queues on the firewall competing with "interactive traffic" like web-browsing, etc. Is this needed? No, not really. The firewalls can easily handle the traffic, but it is simple to remove 90% of the load on them for basically free.

All this may seem complicated and/or convoluted (and it probably is) but it makes (for me at least) my network much easier to reason about, and makes tinkering/experimenting easy and less likely to affect "production".

I'm looking forward to more XDP + eBFP, VPP, or FD.io based firewall and routing solutions as I think those are where we'll see the next big improvement in networking at. I'm hoping to get my hands on some NICs that support XDP offloading. I can see the future homelabbers leveraging SmartNICs and/or DPUs for routing/firewall applications instead of using large big iron custom ASIC switches.

An irritating thing: the t620 used to be barely worth $40-50 until someone started snapping them up and then charging a huge (100%+) markeup with "opnsense" in the title.

You might as well just buy a Dell SFF with a low-powered i5 at that point.

Dell Wyse 5060 thin clients (similar AMD SoC to PC Engines APU and HP t620 Plus) have also jumped from their $40 eBay prices.

Ryzen Embedded SoC includes 10GbE networking, but until this Decisio device, I've not seen any OEM using it. Maybe there was a chicken-and-egg issue with OS drivers.

Some interesting hardware also at https://www.ipu-system.de/ No idea if they support coreboot, though.

Reply on news.ycombinator.com