Hacker News Reader

Comment by ronnier | Hacker News Reader

For a few years now I only buy a small x86 box with dual nics and run OpenWRT. I love it. It's open source, lots of support, good community. It supports wireguard. Latest version allows you to even run docker containers.

View on HN

These are DSL modems, though. At some point there has to be some interface between the WAN side, be it DSL or coax or fiber, and your network. Even DSL adapters for PCIe slots are just systems on a stick, coming with all the features and bugs of a "router" but without the enclosure.

The interface to DSL or coax only has to be a layer 2 bridge. You can put many modems into bridge mode so they don't do any layer 3 (IP) at all. For fiber, if you don't use PON at least, even a standard SFP(+) will do.

You can tell I didn't read the article :)

Since it were modems that were affected, OpenWRT would do nothing to protect you.

OpenWrt works for some modems pretty fine. It's not straight forward as the VDSL firmware can't often be distributed but poeple use it on avm Fritzbox devices. Also LTE devices are supported. Not sure about cable modems, probably not. It's probably involved and not straight forward so for most users, even technical ones it's no alternative.

The article says that the "modems" affected are the Sagemcom F5380 and ActionTec T3200 which from a quick search looks like full fledged CPEs aka routers with a web interface and NAT, WIFI and all the stuff. They also write about Censys and banners so it looks like they had their web interface exposed to the Internet.

When I hear people say they use OpenWRT I assume they have their modem in bridge mode so that it doesn't even have an IP. OpenWRT would save you in that case.

Ah, that's what I get for not reading the article.

I’ve got an old PC Engines board with openbsd on it. It’s been remarkably trouble free for something like 8 years.

It's huge shame Pascal basically stopped building those boards since AMD and Intel wouldn't play ball. I'd really like to have something like an APU with 10G connectivity with an x86 processor that was not built and designed in China running open firmware. With PC Engines gone now, I think you're basically out of luck.

My APU2 died few years back and haven't found a decent replacement. Instead I use a Lenovo Thinkstation M720Q off eBay with the PCIe x8 riser and Intel 2 port 10GbE card. You could also fit a 4 port 1Gb card too. The thing idles at 18-19W which is less than the big white rectangular Verizon "trash can" router which idled at 22W and has horrible WiFi (I use a Unifi APLR.)

The PC Engines boards are great for that. I've got mine running OPNSense (FreeBSD) and it's not required any fuss.

Another very happy PC Engines user here, I've been running pfsense and more lately opnsense on one for over 10 years now. It has never missed a beat.

> Latest version allows you to even run docker containers.

What could possibly go wrong...

Reply on news.ycombinator.com