Hacker News Reader

Comment by denkmoon | Hacker News Reader

Just use linux! Why use someone else's non FOSS, locked down linux, when you could truly own your router?

It's a great educational experience I would recommend to anyone interested in networking. Grab debian, grab a system with 2 NICs, make it your router/firewall/gateway.

View on HN

> Grab debian, grab a system with 2 NICs, make it your router/firewall/gateway.

The problem with this (assuming you meant a generic (x86?) system) is that you won't get wire speed processing (no hardware offloading), so network performance will suffer. Unless you buy a dedicated router board (which is typically ARM), like say something like the Banana Pi BPI-R4. But installing/configuring a standard distro line Debian for such a board would be a PITA (if you want to do it right and set it up optimally), so you're better off using a dedicated router distro like OpenWRT.

I’ve not tried with 10gbps or faster links, but since we’re talking home use my success with 2.5 gbps links on standard amd64 hardware would suggest you’re wrong.

Modern CPUs are quite capable. The problem isn’t performance, but power use.

That's bogus unless you're talking above 10G, in which case the only things typically doing wire level performance are expensive and sold by vendors like Cisco, Juniper or Arista (and maybe it's higher than 10G now). Frankly, the vast majority of ARM based routers, unless you go out of your way, are garbage. Any x86 built in the last 15+ years with a NIC that's also not trash _will_ push at least 1G routed with a non-trivial firewall on a modern Linux kernel no problem. I've still got half a dozen PC Engines APU2 boards that unequivocally will get right at 1G on Debian Trixie; newer ewaste like Dell Wyse thin clients or Optiplexes would absolutely smoke those boards on performance.

Setting up a router with Debian is really kind of overstated in terms of difficulty, and frankly half of everything wraps Debian anyways (looking at you Ubiquiti/Vyatta), so why learn someone else's half cooked configuration language when you can just do the real thing.

from my brief search:

real-world OPNsense (yea, that's not Debian) benchmarks show that even low-power Xeon-D (Skylake-D SoC) with 10G SFP+ NICs:

pushed 9.40 Gbps in plain router mode

7 Gbps with packet filtering and no rules

7 Gbps in NAT mode

5.5 Gbps with a default ruleset

Using a Xeon for a router just because you want to use linux is a wild choice.

I’ve been running a Supermicro X10SLH-LN6TF as my router, and it’s very well suited for the job. Power use is very high for a home router, but reasonable for a 1U router - especially considering the era it’s from and its capabilities (routing 5-8Gbps per stream depending on firewall config, able to handle a couple active streams, and line rate routing with no firewall).

I wouldn’t suggest anyone buy something like this today for home use, but 6 years ago when I purchased it there were not many 10GbE routers to be had period, let alone for the price ($300 roughly if I remember correctly ). Even considering the cost of power over the last 6 years, I still come out much cheaper than if I’d bought something more power efficient new at the time.

FWIW, I got 10 Gbit at home 2 years ago and built my router for $100 using a ThinkCentre M720q Tiny running on a Core i3-8100T (a mini-PC from 2019).

It draws around 15W idle, going up to 30W at full bore. For comparison, the 10G rental router from the ISP drew 15W no matter what (idle or full bore routing). This is with a 10GBase-T SFP+ which probably influences the power draw vs using a DAC.

It has no issues maxing out at 9.4 Gbit routing with a single or multiple streams of iperf3 with your basic IPv4 NAT+some port forwards config.

Is this a problem with home networks? I have pfsense installed on some mini PC I bought off Amazon.

Setting up Debian as a router might take some effort but it's certainly not difficult. Enabling routing is a single line config change, install dhcpd and you're almost there. I'd certainly recommend the router OS.

Also, power consumption.

Any remotely recent generic office PC should be able to handle line rate 10 Gbit routing as long as it has the PCIe lanes for it.

I route my home 10G internet on a ThinkCentre Tiny with a 2018 Core i3-8100T.

A 15 year old 1ghz quad core (apu2) can route gigabit just fine, passively cooled. An N150 can do 2.5gbit, probably 10gbit but i haven’t personally tried.

Using Openwrt is fine but doesn’t quite match the educational experience of starting from a scratch Debian.

Please link a SFF box or SoC with:

- 1x10GB SFP+

- 1x2.5GB Ethernet w/ PoE In

- 7x1GB Ethernet w/ PoE In/Out

- powered by DC jack, 2 pin, or PoE

- Similarly sized to 220 × 125 × 22 mm (approx 8.66 × 4.92 × 0.86 inches)

- Max power consumption 150W

- Silent

- ~$300

And I can replace my RB5009Upr+S+IN.

Looks like OpenWrt supports that model, so going that route would be an option of not having locked down software.

Super interesting, I wouldn’t have thought to check that compatibility

Yeah, I will concede the hardware is nice and they offer things nobody else really does. Which makes it even more of a shame that I can’t install my own OS properly on it.

Fwiw I like protectli’s boxes. Not quite as featureful nor as cheap but it’s great kit.

Bingo. I use Mikrotik for my switches. They were the first I found that had 10Gb uplinks, inexpensively and with low power usage. L2 configuration is janky (like every other switch) but workable. I use both SwOS and ROS, but moving towards ROS for dot1x (unfortunately inescapable to have that functionality on the switch).

But the actual router? That lives on NixOS in a virtual machine on a generic amd64 machine that also runs NixOS. I'd rather design / perfect my config once in terms of iproute2/nftables and know I can swap in any hardware. I've got a full policy routing setup that let's me define for each device what Internet horizon it can see (along with what other local devices it can access).

I also find the sibling comment mentioning routing speed to be funny. I've found that unencrypted gigabit WAN is easily handled by most amd64 computers. 10Gb LAN->LAN hairpin routing seems fine. But the big thing is doing gigabit OpenVPN/wireguard, which off the shelf hardware-accelerated routers just don't really do unless you spend a lot. (coupled with the above policy routing, I can configure things like this particular web browsing VM goes out a data center IP that rotates every day).

Wireless APs are similarly handled by hostapd on NixOS, driving (mostly) Mikrotik MiniPCIe Wifi cards. I don't really need the latest and greatest wifi gen, rather I just need them to work and be as maintenance-free as possible.

>Why use someone else's non FOSS, locked down linux, when you could

All my life I have had to make do with junk I could get at Walmart or Best Buy. Got tired of it. Cheap plastic shit that would inevitably shit the bed just a month or two after the warranty expired. I'm not making the IT helpdesk wages I was making 30 years ago... fuck that. While I couldn't spend ten grand on home networking, I could finally spend a little something on hardware that's not total shit.

Got the CCR2004-16G-2S+. No stupid ONTs, either, just the SFP+ modules. Plenty of backup 1gig ports if I get a third WAN (thinking about getting Starlink on standby). Actual proper fucking APs that do seamless handoff (hell, one of them probably covers the footprint of my house, if I'm honest). And no more shitty GUI configuration pages. I just shell in and band out commands on the command line (at least three times til I get the syntax right, but who gives a fuck).

Wish they made something with 3 or 4 SFP+ ports that I didn't need a rack for.

Buying nice hardware is orthogonal to using debian as your router's OS.

Reply on news.ycombinator.com