alt Hacker NewsJust use linux! Why use someone else's non FOSS, locked down linux, when you could truly own your router?
It's a great educational experience I would recommend to anyone interested in networking. Grab debian, grab a system with 2 NICs, make it your router/firewall/gateway.
Replies
Please link a SFF box or SoC with:
- 1x10GB SFP+
- 1x2.5GB Ethernet w/ PoE In
- 7x1GB Ethernet w/ PoE In/Out
- powered by DC jack, 2 pin, or PoE
- Similarly sized to 220 × 125 × 22 mm (approx 8.66 × 4.92 × 0.86 inches)
- Max power consumption 150W
- Silent
- ~$300
And I can replace my RB5009Upr+S+IN.
Bingo. I use Mikrotik for my switches. They were the first I found that had 10Gb uplinks, inexpensively and with low power usage. L2 configuration is janky (like every other switch) but workable. I use both SwOS and ROS, but moving towards ROS for dot1x (unfortunately inescapable to have that functionality on the switch).
But the actual router? That lives on NixOS in a virtual machine on a generic amd64 machine that also runs NixOS. I'd rather design / perfect my config once in terms of iproute2/nftables and know I can swap in any hardware. I've got a full policy routing setup that let's me define for each device what Internet horizon it can see (along with what other local devices it can access).
I also find the sibling comment mentioning routing speed to be funny. I've found that unencrypted gigabit WAN is easily handled by most amd64 computers. 10Gb LAN->LAN hairpin routing seems fine. But the big thing is doing gigabit OpenVPN/wireguard, which off the shelf hardware-accelerated routers just don't really do unless you spend a lot. (coupled with the above policy routing, I can configure things like this particular web browsing VM goes out a data center IP that rotates every day).
Wireless APs are similarly handled by hostapd on NixOS, driving (mostly) Mikrotik MiniPCIe Wifi cards. I don't really need the latest and greatest wifi gen, rather I just need them to work and be as maintenance-free as possible.
>Why use someone else's non FOSS, locked down linux, when you could
All my life I have had to make do with junk I could get at Walmart or Best Buy. Got tired of it. Cheap plastic shit that would inevitably shit the bed just a month or two after the warranty expired. I'm not making the IT helpdesk wages I was making 30 years ago... fuck that. While I couldn't spend ten grand on home networking, I could finally spend a little something on hardware that's not total shit.
Got the CCR2004-16G-2S+. No stupid ONTs, either, just the SFP+ modules. Plenty of backup 1gig ports if I get a third WAN (thinking about getting Starlink on standby). Actual proper fucking APs that do seamless handoff (hell, one of them probably covers the footprint of my house, if I'm honest). And no more shitty GUI configuration pages. I just shell in and band out commands on the command line (at least three times til I get the syntax right, but who gives a fuck).
Wish they made something with 3 or 4 SFP+ ports that I didn't need a rack for.
> Grab debian, grab a system with 2 NICs, make it your router/firewall/gateway.
The problem with this (assuming you meant a generic (x86?) system) is that you won't get wire speed processing (no hardware offloading), so network performance will suffer. Unless you buy a dedicated router board (which is typically ARM), like say something like the Banana Pi BPI-R4. But installing/configuring a standard distro line Debian for such a board would be a PITA (if you want to do it right and set it up optimally), so you're better off using a dedicated router distro like OpenWRT.