Hacker News Reader

It only needs one port, but for most simple networks two ports on the router means less configuration.

The "router on a stick" paradigm using VLANs to a share a single physical port is perfectly valid. You're creating a "now you have two problems" scenario in which you need a VLAN-capable switch and have VLAN configuration to make.

I typically like the ISP router on a dedicated router port to make monitoring the physical link and/or cycling the physical link easier.

Unless your ISP is >1Gbps adding a second port to most devices is as easy as adding a USB NIC.

Technically you can route without isolation, but VLANs are definitely a good idea if you’re using a single port.

There are 2.5 Gbps, 5, and even 10 Gbps USB NICs these days, although 10 Gbps ones are pretty expensive and require really recent USB ports.

I agree I want my local network and my WAN port separate, if for no other reasons than so I can use ssh to get into the router from my LAN with the WAN port disabled.

Pretty sure switches that support VLANs are more expensive than a NIC. I think even a 4 port GigE Intel NIC can be had for less.

But you might want VLANs anyway, so it's an interesting thing to consider.

Netgear GS305e supports VLANs and can be ~$21

Yes, but some folks are wary of using the same physical port for external and internal traffic. Fears of "VLAN hopping" remain, even if unfounded. Also, you'll hit a performance wall since you are sharing a single gigabit port between external and internal traffic. Obviously may not be an issue for many, but if you have gigabit fiber...

I have gigabit fiber and none of this is an issue.

VLAN hopping is only possible due to misconfiguration. I'd like to be proven otherwise if that's not the case. VLANs are used EVERYWHERE where it matters. And no, the single port is absolutely not a bottleneck because the port is full-duplex.

What happens if one node on your network is downloading at 1Gbit and another is uploading at 1Gbit?

Both get 500Mbit.

Bottleneck.

That's going to be super rare. If it's just LAN traffic it shouldn't hit your router at all and you won't have the bottleneck issue. The actual cases would need to be quite contrived, like you're backing up your media library at the same time you're updating cod warzone.

> The actual cases would need to be quite contrived...

As someone who works a programming job from home, I can tell you that the cases are not at all contrived.

I've also heard from folks who have lots of roommates (whether or not those roommates are their swarm of children) that heavy simultaneous upload and download traffic is very common.

You can get away with a router that has a single physical port. It's generally just easier and better to have more than one physical port... and even 10gbit-capable ethernet ports are pretty damn cheap. (I can get two 10gbit ports for about the same price as two 1gbit ports... ~30 USD.)

I agree VLAN hopping is not possible without misconfiguration but it still is a "concern" for some. I also make extensive use of VLANs on my home network.

If you're trying to push close to a gigabit up and down simultaneously that single port will become a bottleneck. I agree for most typical use cases it is not a concern.

The bottleneck exists, but is a non-issue for most home use as most consumer connections are wildly asymmetric, usually biased towards download.

Sounds interesting. I always wanted to use a Raspberry PI as router (to have one as backup in case the OpenWRT Linksys goes down), but couldn't wrap my head around properly how to overcome the single network port (I think the usual recommendation is to use an extra USB network card/adapter). Can you elaborate more about this VLAN stuff (you would put your modem, your router, and all your machines on the switch... and in the switch you tell the router connection to double use the connection for WAN and LAN separated via VLANs? And put the modem into the "WAN VLAN" too?)

Ideally the PI also should to what the extra DSL Modem does… but I guess that's where the dram must stop. :D

I've created a blog post about this: https://louwrentius.com/raspberry-pi-as-a-router-using-a-sin...

The TL;DR is to have two vlans on the cable from your switch (called a "trunk"), "lan" and "wan", carrying the respective LAN and WAN networks. Then, on the Pi, create two vlans on the underlying Ethernet interface. Then those two VLAN interfaces can be configured just like the LAN and WAN interfaces of the router. On the switch, you’d dedicate one port to the WAN by adding it to the WAN VLAN without tagging, and the other interfaces do the LAN VLAN, also untagged.

When you setup your single ethernet port (let's call it eth0) as a VLAN trunk port, you'll get the ability to configure multiple virtual interfaces off of it. How many virtual interfaces you get depends on how many VLANs you want to tag traffic for. For example, if you have 2 VLANS with ids 100 and 200 (100 being your public Internet-facing traffic, and 200 being your LAN traffic), you would then have interfaces eth0.100 and eth0.200 to work with that you can then use in your firewall scripts as if they were two separate, physical interfaces.

This of course means you need a VLAN-aware switch that this single ethernet port can plug into, configured as a VLAN trunk (in Cisco terms) port. You would then want to configure one of the other switch ports as a VLAN access port assigned to VLAN 100 (untagged). This is the port you would plug your cable modem into. Then (in the simplest example) you could assign all the rest of the switch ports to VLAN 200 (untagged), and you would plug all your LAN devices into them.

Yea, I would add openwrt x86 provides a decent interface for management. Gave dad a little minicomputer with openwrt when he upgraded his internet. He can change wifi password and such and is happy.

Have you noticed significantly slowed network speeds over WiFi?

Not that I know of, why would that happen?

Wouldn’t all traffic be routed through the OS/processor on board?

Wait until you hear about CAPWAP!

A CPU from the last 20 years can route traffic at gigabit speed. It's only something to worry about for a Raspberry Pi3 or something similarly 'crippled'.

I think I understand why this is true for plain IP forwarding. There isn’t much to break the cache and the lookups are few and fast.

What’s the cheapest (new) computer that can drive a 1Gb port with NAT? With a busy encrypted (wireguard?) connection?

[I don’t think qos has a lot of use in the domestic environment; sure, someone here does it but I think it’s much less mainstream than the features I already mentioned. ]

Such a device could drive my home. But in a couple of years I suspect I’ll want 2Gb or 10.

In the past I’ve tended to use a device until its crappy power supply failed. So I guess I’m hoping for a >5 year life span/upgrade capacity.

For all I know the answer to my question is one of those passively cooled four port n100 bricks from AliExpress. Anecdata happily accepted.

Wireguard adds nothing unless you'd want to terminate it on the router. In which case it adds so very little it's unnoticeable.

About any n100 will do. Question is in their reliability which mostly comes down to power regulation components quality. Not performance.

One of my installs runs on a repurposed old android phone. Which has about 100 times CPU capacity of the router I write this through, and that one being cheap tplink shit still terminates wireguard at link speed which is 100Mbps. You don't need fancy gear for routing. And you don't usually need gigabit uplink because speed is limited way upstream.

But if you want "the right gear and damn the price" go get a Microtik. They are very good.

> What’s the cheapest (new) computer that can drive a 1Gb port with NAT?

What's the cheapest new computer you can find? That will work. If you have PPPoE, you need to be a bit more careful; depending on your OS and NICs, it's possible for inbound traffic to only use one core; low power laptop cpu may not have enough throughput from a single cpu, but my information is a little dated.

I did 1G NAT on a dual core haswell [1] for a long time.

[1] https://www.intel.com/content/www/us/en/products/sku/82723/i...

I can drive 2+ Gbps vrfs, nats, ipsec, complex firewall rules and several routing tables through an Atom C3558. This is just using stock linux kernel networking. There are other services running on that box too.

Depending on details, it can go higher (e.g. without the ipsec being handled on the atom box, and using the 10G ports built into the chip, offload becomes helpful for TCP and UDP flows).

This is traffic in one 10G port and out the other, in this case. Multiport flows were not tested since they were out of spec for the use case.

This is not a one off - this is a product I built and has been tested in many deployment scenarios. (I can't provide more details due to employment reasons, and I won't name the employer)

You'd be shocked to find out how old and weak the CPU in your current router is. Typically they're on par with low end desktop CPUs from 10-15 years ago.

I assume the real router OS is extremely neutered to basically only route traffic and filter inbound with everything else being removed? But yeah I can definitely see that.

Except actual routers don't handle the traffic on the CPU, they have dedicated hardware to actually handle the packets. The CPU basically runs the OS, configures the hardware router, and does housekeeping tasks (e.g. ARP or FDB expirations, NAT cleanup, etc). The only packets that ever reach it are "trap to CPU" situations that don't require acceleration as those are rare or expensive to implement in hardware (e.g. better suited to a CPU). Those usually include management protocols (ICMP, ARP, NDP, STP, etc) or packets with unknown destination (e.g. the first packet to an IP that requires ARP resolution).

That's how you can have multi-Gbps on a router with a 200MHz MIPS CPU. Or Tbps on a router with a quad-core Xeon.