[binarybanana]

For anyone who wants to go a similar route I can highly recommend OpenWrt as the OS. Not only does it run on cheap routers, but also on big x86 machines and even in VMs and/or containers. For example, I run OpenWrt on my desktop in a LXC container to manage networking (Wifi, bridging firewall for bridging VMs into the network, general firewall, etc.) through the nice webui. It gets direct to access the WiFi adapter and the host gets access through a bridge connected to the container via a VETH interface.

It comes with nice addon packages for stuff like Wireguard, all kinds of tunnels/VPN, adblockers, runs containers and a ton more. I even run it on a VPS as container with it having exclusive access to the "physical" NIC. The parent OS isn't directly accessible at all. Makes firewalling a breeze. The only open ports are for the Tor relay and Wireguard, through Wich I connect to the webui/ssh and do everything else.

Of course, my router also runs OpenWrt...

[eric__cartman]

I always found it baffling how a community maintained project like OpenWrt can not only keep routers updated for many years (unlike the manufacturer that gives you an update once in a blue moon for the first 2 years) but make these cheap routers so useful and so stable you just forget the thing is there in the first place. I can't remember the last time I had to reboot a router running OpenWrt because it started behaving erratically.

You can do a lot with these commodity ARM CPUs, 64-128MB of ram and a few tens of megabytes of flash storage.

[maerF0x0]

i literally have my comcast router on a 24 hour time and it shutsdown for an hour each night from 3-4am . Communism style brownouts of internet over night

[lillecarl]

How is the OpenWrt CLI? Say I want to deploy it with Ansible.

How does it stack up against VyOS (which just recently got VRF-lite support)

[dtx1]

> How is the OpenWrt CLI

You SSH into it. Then do whatever you need to. There's nothing in the UI that can't be done via CLI as far as I know. Some plugins might not be 100% CLI compliant but at least the Base UI (luci) is completely transparent to the CLI via uci.

[HighPlainsDrftr]

Do you have any recommended hardware for OpenWRT? I've been wanting to put in a low powered router/firewall on my home network that isn't controlled by a big vendor.

I haven't done a ton of research in this area, but I'd certainly like to use OpenWRT or OPNSense on my home routers/firewalls.

Side note: I've been trying to figure out a decent way to get rid of Android on my Galaxy S9+, but it appears to be locked.

At the end of the day, I just want to be in control of my bandwidth, my data, and know whats going on. Big companies are making this very complicated with all the tracking.

I recently re-enabled my pi-hole on a virtual machine, and it never ceases to amaze me what is talking to the internet without my permission. After digging into DoH a bit, I'm about to the point where I think I need to put in an outbound proxy, deny all outbound access except via the proxy, and iterate again and again.

I just don't want to have $200 a month in power bills to support my home network to save bandwidth and know what is traversing the net.

[dtx1]

WRT3200ACM is what I use. It's one of the most powerful consumer devices with wifi supported by openwrt. It's powerful enough for a router with a little firewalling, VPN (wireguard only if you want speed), DoH and some Ad Filtering but thats pushing it's limits from my experience. If you want more power https://openbsdrouterguide.net/ is your friend.

That being said there is no hardcore prosumer hardware out there for this purpose. The moment you go beyond home user router hardware like the WRT3200acm you are in either CISCO Buisness stuff or custom server builds. Potentially a Raspberry Pi 4 with a PCIE ethernet card is closest to prosumer hardware out there and there's a lot of hacking involved to get that running to the same degree as a openwrt router

[HighPlainsDrftr]

This is interesting. I'm going to research it further. I really appreciate the feedback. I'm really starting to hate DoH - and I may just not put any IoT thing on my network that uses it. Maybe that's the way to go.

But I doubt most consumers really care. It's complicated.

[neilv]

For techie home use of OpenWrt, I'm currently using Netgear R7800.

The R7800 is well supported by OpenWrt, has the hardware features I need, some room to gro, and it's affordable used. I paid about $90 for my first one, and about $70 for my backup unit.

For OpenWrt for smaller purposes, for which an R7800 is both overkill and physically bulky, I understand there are a bunch of near options now. I just keep some old WNDR3700 and WNDR3800 units on hand, which used to be my main routers, and actually still could be. (Sometimes they might be a simple WiFi bridge or print server. Other times, they might be an experimental LAN that needs different properties than I have set up for my main router, and with which I don't want to complicate my main router setup.)

[HighPlainsDrftr]

Thanks. I'm going to look into this further.

[m01]

I don't know if they specifically fit your bill, but the Turris devices are worth checking out [1]. They come out of the box with TurrisOS, which is an OpenWRT fork with some extra features (e.g. automatic updates, config snapshots) and some changes (e.g. knot resolver for dns). Turris are a bit opinionated about using DNSSEC, and I think historically it was a bit tricky to configure a custom DNS resolver, but it looks like that's now possible through their new UI [2]. By the way, they offer 3 UIs: Foris, reForis and OpenWRT's LuCI, and of course ssh is also available.

If you don't like the fork, at least with the Turris Omnia it looks like you can put on vanilla OpenWRT [3], but as always check the OpenWRT table of hardware for details before buying.

I think the PSU of the Turris Omnia is rated at 40W max, but I don't know what sort of real-world power draw you'd get with your specific use-case. I guess it depends on whether you use WiFi, the SFP port etc.

[1] https://www.turris.com/en

[2] https://docs.turris.cz/basics/reforis/dns/reforis-dns/

[3] https://openwrt.org/toh/turris/turris_omnia

[rhn_mk1]

OpenWRT doesn't pack Python out of the box, so you need to install it, and have enough space for it, if you want to use Ansible. It uses a custom stack for configuration (like VyOS), so builtin ansible tasks won't always be so helpful. Configuration is not stored in a single place, but in several files, and it's easy to lock yourself out while testing changes: there's no commit-timeout, and there's no committing of changes, nor rollback. It's just editing random files, and restarting services.

I think there's a special configuration command that might fix some of the above issues, but I've been using the web interface (which actually does support committing and, to some extent, validation).

[3np]

You know, I used to do this and give the same advice as well but after a lot of time spent on it, I am not anymore.

The way OpenWRT handles routing and firewall rules is particular and they apply their own terminology for some things. They have their own distro-specific packages for things like DHCP (odhcp(c)d) and firewall (fw3).

For very simple networks, it's very smooth to get to where you want. Add on dual-stack v4/v6, vlans, multiple firewall zones, routing policies etc and things start becoming very unpredictable.

Oh, and that adblock package? Turns out a single invalid line in a blocklist will completely break DNS (at least on the version I was running from last year).

Not to mention that (AFAIK) there's no good way to keep up to date with security patches and bugfixes while keeping the system stable.

After all the countless hours I poured into OpenWRT configuration, I finally realized that it's so much less pain and confusion with vanilla Debian with systemd-networkd (which BTW natively supports setting up Wireguard interfaces now) and firewalld+nftables, everything configured via ansible playbooks.

For someone diving into this today, it's a lot easier and more future-proof with nftables than iptables - and OpenWRT will be married to iptables for the foreseeable future.

It's great that it works for you, but if you like I did have some imposter syndrome over not perfectly understanding Linux networking and are happy that OpenWRT takes care of those confusing iptables rules and routing policies and what-not - you may just discover that learning how it actually works will take less work than abusing OpenWRT into doing what you want.

Sure, you have to give up the WebUI and some of the custom add-ons.

I am sure BSD or Rocky Linux are fine choices as well; Debian just happens to be what I mostly use for servers otherwise.

I don't want to hate too much on OpenWRT as it's great for novices with trivial needs and there are many devices where it or dd-wrt are the only readily available options. But if you run Linux anyway and have an x86/amd64/arm device you're going to use as a main router, I'd recommend choosing a "normal" distro and setting things up from scratch.

[123pie123]

for home I can recommend openwrt running on a BT Home Hub 5A

you can buy them in the uk/ ebay for 15-20 pounds already with openwrt installed (you can do it yourself, but it includes a bit of soldering) - I have two in case the main one fails - talks to most if not all ISPs

I love openwrt now, it does take a bit of getting used to if you havent used it before.

I mainly use to lock my wifi down between hours for the kids. whilst keeping another wifi/ SSID open.

for security all my NAS's are wired and locked down to key wired computers - I keep meaning to create a Nextcloud gateway on docker

[OrvalWintermute]

I thought about which OS for some of the same things and I realized that I would rather go with a lab version of a full enterprise firewall.

A Palo Alto VM gets you pretty much most of the sweet PA features without the cost, and a better approach than an outdated strategy like VLAN as Access Control, or zone firewalling, permitting the use of permit/deny by protocol, and overall better privilege tiering by network area.

[todd8]

I’m curious about PA firewalls. The product descriptions claim “Machine Learning” based routing/firewalls. What does that even mean? I’m a bit skeptical about AI being used in a firewall. Can someone help me understand why I should consider this instead of running pfsense on a Netgate appliance?

[EvanAnderson]

> A Palo Alto VM ... without the cost ...

Does Palo Alto have some kind of no-cost offering in their VM line?

[OrvalWintermute]

> A Palo Alto VM ... without the cost ...

This isn't free, but $50-200 is alot less than $2-4k

[EvanAnderson]

Yikes! I didn't realize PA had anything available for less than a 4 digit price point. I'll check it out. Thanks!

[stjohnswarts]

I have dd-wrt on a tp-link router and it works great and has been for about 3 years now. No issues. I just have to check the site about once a month and see if there's an update. I wish that was automated or had a notice in the web gui a new one is available. Very configurable and stable.