Hacker News Reader

Comment by nly | Hacker News Reader

It's times like this i'm glad my home router is a x86 mini PC running Arch Linux + iptables + Unifi (Complete with DNS MITM forcing all DNS out of my apartment over TLS)

View on HN

How high-touch is this kind of setup? I have a separate access point and I am using a consumer-grade "wireless router" for DHCP. (and other things?)

I'm more of an app developer that does DevOps stuff when I have to. Is this something I can get done in a day or so? Is a Raspberry Pi enough, or do I need something more powerful?

If you want a less touchy solution (not completely plug and play though!) I can't recommend Ubiquiti products enough. I run an EdgeRouter X and Unifi AP at home. Not big enterprise gear but way more enterprisey than whatever you'll find on the shelf at Best Buy. Updates are released regularly and once you get your initial configuration done they just chug along, no random 'internet is down, need to reboot something' issues that (used to?) plague mass consumer designed gear.

Cheaper and older alternative is the Ubiquity Unifi Security Gateway + 8 port switch + UAC AP-PRO if you don't want the Edgerouter X cost. Less customizeable but if you're buying an EdgeRouter you know what you want.

how does power consumption compare with a setup like this vs some consumer all-in-one thing?

to be honest, most routers like this have very low power usage. I think an edgerouter X has a power consumption of something like 5W under load.

Isn't the EdgeRouter X cheaper than the USG?

What WAN throughput can you get on an Edgerouter X with moderate Firewall and some basic QoS rules enabled?

Low touch once it's working, but took me forever to get right. I recently added wireguard + policy based routing + a second route table + a VLAN so that all devices connected to a secondary wireless SSID are NAT'd to the Internet over a VPN. I don't know how you'd accomplish this with anything consumer, or even anything semi-Enterprise.

The primary motivation for that one is that native wireguard (UDP) is blocked by several wireless networks I use on the move. So on those networks I have to use a shitty OpenVPN configuration over tcp port 443. OpenVPN on Android is buggy and prone to crash all the god damn time. Now, at home at least, I don't have to suffer it.

The device I use has a metal case, is fanless/noiseless, the size of an AP, has 4 gigabit ports, 4 x86-64 Bay Trail cores, 8GB of RAM, runs standard Linux, and cost me like $150. Honestly I'm done with plastic off-the-shelf crap.

It depends, and it's certainly not a consumer solution. I use Ansible manage my devices so it takes a bit more up front time to setup but it pays off in the long run. It's very low maintenance overall but you do need some technical knowledge.

I recently switched from OpenBSD to Linux and it was mostly painless. nftables is almost as usable as pf.

If you get a decent WiFi card you can just use hostapd and manage your wireless networks on the gateway; slicing it up however you want without needing vlan capable switches on your network.

How to make a PC talk over a DSL cable? I assume a specialised chip would need to be plugged in at which point the potential for vulnerabilities of that PCB need to be considered...

Back when I had an ISP-provided cable modem I just put it into "modem mode" (disables NAT and all the builtin firewall and parental crap) and connected it via Ethernet

I do something similar. Fanless PC (but I do have a heppa filter pointed at it for hot days) running CentOS 7 and El-Repo 5.2.x kernel. I enable power management on everything except for the network cards and disable most other devices on it. On UPS it can run about 3 hours.

I have unbound DNS and iptables to intercept all DNS requests destin for the internet, so I can block some ads. I null route the DoH servers and some hostile countries. Works great.

>I have unbound DNS and iptables to intercept all DNS requests destin for the internet

dnsmasq (caching) + stubby for me

Reply on news.ycombinator.com