Hacker News Reader

Comment by LaurensBER | Hacker News Reader

I would go one step further and recommend a router with a customizable, Linux, firmware (OpenWRT, Tomato, DDWRT, etc).

Your TV is probably just one of the many devices that sends a scary amount of requests to a bunch of shady servers. With a firewall + DNS server that you control and a decent blocklist you should be able to block most requests and you won't be exposed if a new device connects to your network (for whatever reason).

View on HN

> I would go one step further and recommend a router with a customizable, Linux, firmware (OpenWRT, Tomato, DDWRT, etc).

Yes, those are good options, but in true HN spirit, my suggestion is a plain Linux distro. The firewall/router is just a few iptables lines, which AI can now provide in a few seconds.

Is there any good GUI for a vanilla Linux networking stack, to your knowledge?

IIRC, IPFire is more or less that. I control my Debian router/home server using SSH and have no GUI at all. It's largely set and forget, and don't recall last time I touched the firewall.

OpenWRT is a Linux distro. Just one optimized for embedded devices. If don't like the very utilitarian web UI can connect over ssh and use iptables or whatever else you want.

But that means custom per-device firmware builds, that in my experience with every router I tried it on means they lag months/years behind security patches. Is there some way to stay patched without building from source and reflashing every time a patch to something upstream happens? (almost daily, now, I guess that means?)

If something urgent appears, a point release will be made asap. If worry that isn't soon enough, can use the daily snapshot builds. That said, imo an essential device like a router should be as solid as possible and only upgraded if important rather for minor bug fixes.

That would be great if it were true for a larger range of devices, but they seem to drop older hardware pretty aggressively. My current wifi device hasn't had a new build published since Dec 2025, despite there being dot releases of the same version well past that.

Reply on news.ycombinator.com