Hacker News Reader

Comment by aborsy | Hacker News Reader

How about OPNSense on open hardware of your choice, and passing messy wireless to separate AP?

OpenWRT is very good, but the installation and upgrades are not easy. There is a zoo of images for different hardware, installation options and tools. It has to run on small devices, so there are limitations. The documentation on Wiki is scattered and could be improved.

I had to search forums for weeks for a custom package installation for my router. Right now I have been trying to upgrade to the latest version via LUCI for a while, and it stucks. Probably have to wait for few weeks, go through CLI and maybe search forums again.

I just thought I am paying a hefty time price for a bit more expensive x86 mini pc and AP.

View on HN

Your OpenWrt ecosystem knowledge seems oudated; upgrades are a solved problem since the advent of "Attended Sysupgrade": https://openwrt.org/docs/guide-user/installation/attended.sy...

It's been included in all suitable default image configurations starting with OpenWrt release 25.12.

I do run OpenWrt on my x86-based router, on my AP, and even on my managed switches, and have no regrets.

Indeed, I was referring to Attended Sysupgrade in luci or CLI.

So an image released in March? I’m not sure I’d proclaim it completely solved when it’s been ga for all of three months.

With the 25.12 release, the luci app to use ASU for upgrades became installed by default in OpenWrt's "vanilla" images the project builds and provides for supported hardware and devices.

Previous OpenWrt releases at least as far back as 21.02 could be equipped with the same degree of ASU support by installing a single package (luci-app-attendedsysupgrade) and its dependencies.

What switches are you running it on?

Netgear GS308T, Netgear GS108T v3, and HPE JG925A.

>OpenWRT is very good, but the installation and upgrades are not easy.

The solution is to use image-builder and bake your config into the image.

All of that is a nope. The solution is that a router should have a standard unattended upgrade system built into it that is on by default and pulls from the stable release stream, preserves your configuration automatically with a 100% guarantee of it working, automatically falls back to the last known working image if the update fails, and has a way to notify you of what’s going on with it. This must work out of the box with the first install without you having to do anything at all or even be aware of it except perhaps setting the time of day and day of week/month when the router is allowed to reboot itself for the upgrades (but the default should be set automatically by the system). Anything less than that is simply broken for anything that is considered production quality. Words like “image builder” and “config baked into the image” are for those developing the system, not end users.

hahaha You try building that all in to a small flash chip mate. Good luck!

That’s why I prefer things like Debian, OPNSense, etc. It IS hard. But that doesn’t mean that not doing it should be considered a done deal.

A multitude of router products manage to do this.

> The solution is that a router should have a standard unattended upgrade system built into it that is on by default...

Mmm, no. Unexpected downtime for infrastructure is godawful... just ask Windows Home users.

OpenWRT has a "Click a button to upgrade" thing, just like just about every consumer/prosumer-grade equipment does. [0] It also has a command-line tool that one can use to automate upgrades, for environments where the phrase "production grade" is actually an important thing to think about. [1]

[0] <https://openwrt.org/docs/guide-user/installation/attended.sy...> [2]

[1] <https://openwrt.org/docs/guide-user/installation/sysupgrade....> [2]

[2] Those documents mention that you need to install some things to get operator-initiated upgrades. As of March, the button to click is installed by default, and the CLI tool is installed on systems that have enough disk space for it. [3]

[3] <https://openwrt.org/releases/25.12/notes-25.12.0#integration...>

Upgrades are “owut upgrade” these days. Pretty straightforward.

Maybe so. The documentation seems to be all over the map, and the GUI suggests using "attended sysupgrade" for upgrades.

...which I tried doing, a week or so ago, for a minor point release update within the 25.12.x series. And then the router went out to lunch and didn't come back.

Getting it going again wasn't so bad as such things go. My router has a huge advantage here in that it's a Raspberry Pi 4, so it's easy to remove/replace/re-do the flash device and start over.

(Except: I get all out of sorts when I need to do Internet stuff to fix my Internet connection while that Internet connection is absent.)

Yeah, for non-X86 devices, getting to U-boot with pressing a combination of PINs in particular order and conditions and releasing at right time is a pain.

I think I wasted $100,000 in salary for $100 more in device cost, in setting up an OpenWRT router.

Apart from installation and upgrades, the OS itself is nice, very flexible and capable.

Well-said.

I've got other options for routing hardware and software (of course I do), but I generally keeping using OpenWRT. Looking back, it seems like I've had it around in some form or other in active use for about 20 years so far.

Part of what keeps it around is the flexibility and the home-network-centric hack-value. I mean, this whole thing grew out of a shell injection exploit on a Linksys WRT54G. :)

Anyway, it can keep whatever counts as a slow WAN connection today feeling responsive and quick with cake SQM, even while loaded heavy with traffic and users. It's nice in that way, even though enterprise types don't seem to be interested in that kind of thing at all.

I could take a nice Juniper router home from work to use instead and it would absolutely trounce the packet-forwarding performance of my cheap OpenWRT box...while also doing nothing at all to make my home-gamer WAN limitations more tolerable.

So OpenWRT is still my answer, with the warts and upgrade woes and all.

> OpenWRT is very good, but the installation and upgrades are not easy.

Agreed that separate router and dumb AP is the way. Every time I updated OpenWRT there was some gotcha that created an unexpected headache where I had to rebuild my elaborate configuration from scratch.

I'm not convinced A -> G upgrade paths are tested, only A -> B -> ... -> F -> G but who manually updates with that level of discipline?

You're right, it's interesting that this device isn't the most technically superior in hardware or software, and isn't the most casual user friendly. It seems to be targeting a segment I can't bucket other than loyalists. Maybe good hardware & software for the cost?

> How about OPNSense on open hardware of your choice

Yes, it's a possibility, but if you want to tinker, I think a plain Linux distro like Debian is better. Turning it into a router is literally a couple of kernel parameters and a few iptables rules to set up NAT. Nowadays that's less than fives minutes of work with Claude.

This buys you much better performance and hardware compatibility relative to a BSD system, as well as lower resource usage and attack surface (no GUI or other unnecessary additions). WiFi support on BSD is bad, but on Linux you can use hostapd and almost immediately get an access point for free. And of course Linux is also better if you intend to run other stuff on the same hardware.

Please support your claim about (networking) performance of BSD-based systems and Linux with some source(s). It surprised me. Thank you.

Anecdotal, but I was never able to get FreeBSD (TrueNAS CORE, OpnSense) to get anywhere near 10 Gbps. Using Mellanox or Intel NICs. The Linux equivalents (TrueNAS SCALE, OpenWrt) handled it fine on the same hardware.

But what if you don't want to tinker? I switched to OPNsense as a direct replacement for our Asus "WiFi routers", and it has been phenomenal, reliable, and does everything needed - when you just want it to work, it really just does. But when you want more advanced functions, there are tons of plugins and stuff that you can run natively, while still having a true CLI.

I suppose it comes down to what you said - "if you intend to run other stuff on the same hardware." Is it a good idea to run all sorts of extra stuff on your literal firewall/router? And if you did, I'd assume using a hypervisor is safer anyway? That way you can have the GUI and reliability of OPNsense but have a Linux distro beside it.

You also said that Linux has much better performance vs BSD, which seems rather far fetched. Got any data for that?

One other thing: OPNsense comes with a ton of helpful rules to eliminate bot traffic, allow IPv6, different NATs, VLANS, etc which you'd have to add manually. Not the end of the world, but worth considering.

> Is it a good idea to run all sorts of extra stuff on your literal firewall/router?

I don't see any reason not to. I run dozens on services, both bare metal and containerized (Podman) on my router/firewall. It doubles as an all-purpose home server with plenty of headroom to spare. It's just a computer that sits at the edge of my network, and running services meant to be exposed to the Internet on it is natural.

> You also said that Linux has much better performance vs BSD, which seems rather far fetched. Got any data for that?

I should have worded this more carefully. What tends to happen is that BSD has worse (or no) drivers, that's when BSD's performance can noticeably degrade vs. Linux. From memory, people online were reporting issues with Realtek chips. With Intel NICs, the routing performance should be broadly equivalent .

Ah, I see. Well, that does make more sense now. I guess just have a surplus of mini PCs so for me it makes more sense to run one routing box and one server box, but I know how much use cases vary.

I agree about Intel vs Realtek to some extent. My Lenovo M73 OPNsense actually has a 2.5G Realtek mPCIe NIC on the LAN side and it has actually been pretty great and reliable so far! Transmit maxes out early at 2.28Gbps-ish but receive is 2.47Gbps (Jumbo). However, the other week it glitched out and reported UP but was actually unresponsive. I'm still looking for an mPCI Intel i226-V version of the same thing...

The only downside to your solution is that most people (me included) would rather have auto generated configs so that you don't accidentally expose everything to Internet or break everything with an iptables rule, but that's down to experience I'm sure.

Some people want a webinterface tho.

Thats more or less what I did, and nix just made sense for the job. For 99% of people I'd say no its not worth it to tinker, just go with opnsense virtualized so you get at least some the benefits of the better linux drivers. By that I mean NBASE-T on various intel chips and while intel's igb is fairly solid on unixes many other vendors' drivers are less so. However if you're willing to figure out configuring per your needs you definitely can get a lower latency router with all the same capabilities and more, with it's components more sanely isolated via containers.

I agree on the upgrade story, though supposedly the recent move to apk will help in that regard.

I moved from pfSense to OpenWRT due to the really poor IPv6 support in pfSense. I don't use the AP capability either. How are things in OPNSense these days?

Particular pain points from pfSense was that it published global IP as DNS address to LAN clients and no way around it, so connectivity broke every time prefix changed, and no real support for specifying prefix-less firewall rules or similar, so couldn't really expose anything via IPv6 without pain.

Reply on news.ycombinator.com