Running an Open Source Home Area Network

https://xn--gckvb8fzb.com/running-an-open-source-home-area-network/

by bpierre • 4 years ago

170 87 4 years ago

pvinis• 4 years ago

off-topic, but are we ever going to get to a place where urls like that one appear not as xn—* but as the actual unicode?

mulmen• 4 years ago

If course we will. Why would that be in doubt?

When I open the link in iOS Safari I see the unicode characters.

deadbunny• 4 years ago

Same in Firefox on Android.

iso1631• 4 years ago

I think the point was we don't on HN

walrus012• 4 years ago

firefox on macos shows the unicode in the address bar properly.

I do kind of like that HN retains the xn-whatever as it's actually formatted in an authoritative DNS zonefile, because this is hacker news. As I do not read the language in question the unicode original and the xn-whatever are equally incomprehensible to me.

SquareWheel• 4 years ago

It will show in browsers correctly now, except in cases where there's mixed character sets. This is to avoid phishing attacks abusing unicode with look-alike characters.

layer8• 4 years ago

That should be the default: https://datatracker.ietf.org/doc/html/rfc5894#section-4.2

josephcsible• 4 years ago

I'd prefer that we didn't make phishing even easier.

bla3• 4 years ago

Fishing with punycode is a mostly solved problem: Show the Unicode characters only if there are no homoglyphs in it. That's why browsers can show them. See "client side mitigations" on https://en.m.wikipedia.org/wiki/IDN_homograph_attack

walrus012• 4 years ago

on the topic of the original post I would encourage people who really want an open source home area network router to run something like pfsense on a very small x86-64 system with four gigabit ethernet ports, rather than the linksys in the example.

BLKNSLVR• 4 years ago

cough OPNSense[0] cough

[0] https://opnsense.org/

evulhotdog• 4 years ago

Or better yet, OPNsense, as the NetGate team has time and time again shown that they are incredibly petty, and do not want to support the community in the most basic of ways.

slickdork• 4 years ago

+1 on OPNsense. I switched from pfsense to opnsense a few months ago without issues.

zeroflow2• 4 years ago

The only thing holding me back from switching to OPNsense is the lack of pfblockerNG. To the best of my knowledge, there is no competing package available at the time.

Shank• 4 years ago

x86-64 system with four gigabit ethernet ports

Do you have any suggestions / personal experience with systems like this? I'm really concerned about getting something that isn't powerful enough to process stuff at gigabit+ rates, and most of the "routers" I've seen get pricey to do that.

RL_Quine• 4 years ago

The pcengines APU2 will do gigabit happily on four interfaces with passive cooling and ECC memory, there’s nothing but actual servers which will do more realistically speaking.

notemaker• 4 years ago

+1 for APU2. I've written about my experience with it (+ NixOS) here: https://skogsbrus.xyz/blog/2022/06/12/router

As the other commenter said though - max speed is 1gbps. And approx 200mbit/s over wifi with 5ghz and the same network card I used.

wolczek• 4 years ago

You can get a Supermicro X10SLH-LN6TF, 6 10GBbit ports, for less then $100 on ebay.

colordrops7• 4 years ago

+1 OPNSense. Extremely capable and stable. Been running a complex setup for a year and a half without a single hitch.

zionic• 4 years ago

I have an old 4790k running OPNSense. Old gaming rigs make amazing 40gig routers.

hammyhavoc3• 4 years ago

What's your power consumption on it?

digitallyfree• 4 years ago

Used rack server is also an option if you want room to grow, Sandy Bridge and newer models have decent power consumption. My dl360e idles around 40W with five disks. Four gigabit ports, BMC, ECC, and you can virtualize pfsense and run additional containers and VMs on top.

loxias• 4 years ago

x86-64 system with four gigabit ethernet ports

This is an annoyingly unfilled product space. I keep on wanting and the market keeps failing to provide something small, cheap, and with 2 gige ports. Heck, I don't even need x86_64, as long as there's a well supported Debian port.

Anyone have suggestions for even two gigabit ports and the lowest possible price?

Also, I'm curious if anyone has concrete examples of advantages of anything other than Debian for my router. I want to know if I'm missing out on cool features or some such :)

zeroflow2• 4 years ago

Lowest seems to be Protectli (https://eu.protectli.com/vault-2-port/) or any of the chinese 4-port devices (Topton, Qotom, KingNovy, ...) in a barebones config where you add your own RAM & SSD.

ARM-based devices are not supported by pfSense / opnSense so you should stay with x86_64 based devices.

kbob• 4 years ago

Earlier this week I bought a COOFUN GK41 with two Gbit Ethernet ports for $160. That included 8 GB ram and 120 GB SSD. It arrived yesterday, and I haven't installed OPNsense on it yet. So I can't report how well it works, or even whether it works.

I was considering a QOTOM Q355G4 until I decided I didn't need 4 NICs. They're $300-400ish, depending on configuration.

So the hardware is there, it's just from companies I'd never heard of.

spacemanmatt• 4 years ago

1. that is awesome 2. i'm exhausted just reading about all those builds

entropie• 4 years ago

This is fascinating. Very well documented and informative. Nerds heaven.

I have seen similar sites (like https://vuxu.org/vuxi/boxes by Leah Neukirchen) years ago, but none was that well documented and verbose.

Great stuff.

sgtnoodle2• 4 years ago

I run wireguard on an even lower end Linksys router, and it seems to work just fine. I suppose my internet connection isn't the fastest, though.

It's interesting to see someone using a single board computer as their main computer, and preferring a Linux distro that compiles everything from source.

Why bother with docker for a home server other than for the fun of it?

I've been embracing systemd recently, and using it to manage processes in an embedded system. Once you wrap your head around how services work, it seems pretty convenient compared to init scripts. Notably, systemd works with legacy init scripts, so you could still go that route if you wanted to. Maybe throwing docker into the mix makes it clunkier, though?

colordrops7• 4 years ago

NixOS uses systemd to manage containers. Works great and is hassle free IMO.

na852• 4 years ago

NixOS seems to make needless complexity a point of pride.

metadat2• 4 years ago

Does nix use underneath, or something else?

cantagi• 4 years ago

Why bother with docker for a home server other than for the fun of it?

I do this. Over time you forget how each service was configured, or simply don't care. Adding more and more stuff to a home server increases the complexity and the attack surface more than linearly in the number of services.

I run nearly all my home services in docker, and I have a cookie-cutter approach for generating SSL certs and nginx config for SSL termination (not dockerized). Provisioning is automated through ansible, so my machines can be cattle not pets, as far as is possible on 3 raspberry pis.

dicknuckle• 4 years ago

Same, but I haven't started with anything like Ansible yet, only beginning to learn it at work.

Running all my services in Docker keeps it all clean because I'm a very messy person when it comes to Linux. Change, change, change, it works, forget about it, it breaks, find something I did years ago tripping me up now, change, change, change, it works, forget about it.

With docker every service is contained and nearly separated. I can rip something out and replace it like stacking a new network switch in the rack. Delete the container, delete the image(s) and delete the volume if I want to start over with something completely fresh.

I can move everything to a new server by moving bulk hard drives over, restoring docker volumes from backup and cloning docker-compose configs from git. Haven't tried any distributed volume storage yet.

Karunamon• 4 years ago

Why bother with docker for a home server other than for the fun of it?

Because it legitimately makes things easier. Your source of truth for how an app was set up is the compose file, and as a result you only need to care about the storage each app uses for its state. This makes upgrades and back ups almost entirely painless and drama free.

Deploying the average app the old way feels downright medieval.

goodpoint• 4 years ago

Maybe throwing docker into the mix makes it clunkier, though?

Correct. It increases the attack surface without adding benefits over light containers like systemd-nspawn or just systemd unit files.

sgarland7• 4 years ago

Why bother with docker for a home server other than for the fun of it?

As others have alluded to, mostly for having everything in code. I went from Docker --> Docker-Compose --> Kubernetes. The latter is 100% overkill, and was mostly done to assist learning. Still, it's very nice to have as close to HA home services as possible (with the exception of a dedicated failover WAN connection, and me needing to manually fire up a generator for power - UPS will last ~15-20 minutes).

Scheduling aside, though, yes you could accomplish all of that with systemd and something like keepalived.

equityloan• 4 years ago

What are some advantages of Gentoo Linux? I've never tried it or heard much about it. (I'm familiar with many others though: Ubuntu, Debian, CentOS, Fedora, Arch, NixOS, etc.)

hackernudes• 4 years ago

Builds everything from source and most packages have flags ("USE flags") that control in which way the source packages are built (e.g. remove unneeded package dependencies). The other potential benefit is to compile with better optimization than generic packages.

ies7• 4 years ago

Also rolling release/upgrade instead of the usual scheduled release.

sgtnoodle2• 4 years ago

Mainly that you can tweak the compiler options to your liking, and have the full userspace built with it. For example, you can target your exact CPU with all its particular extensions. There are also hundreds of compile time feature flags, so you can omit functionality you don't need.

Gordonjcp3• 4 years ago

The advantage of Gentoo Linux is you get to see lots of compiler output scrolling past instead of being able to do real work on it, so you look like a l33t h4xx0r.

The disadvantage is that everything is built from source, so it takes forever to install anything and it's very fragile, and it's a rolling release distro so you're installing stuff every single day and it's very fragile.

dirkc• 4 years ago

I've used it for a long time before switching to Arch and then Ubuntu. When using Gentoo I used to know more about the different subsystems running - it was a function of seeing what needs to recompile when you update and also having to sort out issues when certain hardware stopped working.

I stopped using Gentoo and Arch because it was just easier to be on the same OS as other devs and it didn't feel like I lost much switching to Ubuntu. Every now and again I'm tempted to go back to Arch, but honestly, there are other things I'd like to play with rather than my OS

xiwenc• 4 years ago

Run Gentoo if you have lots of time to spare. I did when I was in college.

na852• 4 years ago

Even though the Linksys WRT3200ACM was released back in 2016, it’s still a solid and well-supported option for OpenWrt – unless WiFi is your primary requirement.
Since the Panda PAU09 N600 works out of the box, the only thing needed to enable the WiFi access point is a working hostapd configuration: [75+ lines of config for something that "works out of the box"]
One pitfall here is that Docker likes to mess around with iptables, leading to WiFi clients being unable to communicate with the internal network. In order to fix this, another drop-in configuration is needed:
Update: Because I simply couldn’t get it working with this rule, that was suggested in the Docker docs in first place, I eventually gave up and used a jackhammer to fix it: [...]

I see wifi is still a shitshow in the libre world. Running entirely free software is a laudable goal but the above sums up why it's never going to be mainstream. All that fuckery for previous generation .11ac?

No thanks, I have a zillion other more important things to do with my time.

LukeShu• 4 years ago

Libre WiFi is a shitshow, but half the things you cited aren't about WiFi. The "Docker/WiFi" problem that two of your quotes are about isn't about WiFi, it's about "Docker insists on messing with the firewall, and that's a problem because I'm trying to use the box as a router." Docker messing with the firewall would be a problem on any router, wired or wireless; and it's just coincidental that OP's setup happens to be wireless.

adament• 4 years ago

None of the configuration was about the wifi interface not working out of the box, but about setting up an access point and a network bridge. If OP had just wanted to use the interface as a normal wifi client I suspect installing NetworkManager was all he had to do(installed and started by default on most user-friendly distros) and the experience would have been equivalent to Windows, Android or iOS. At least that has been my experience the last 5-10 years.

thedougd2• 4 years ago

And this is why I went separate AP from router. You can easily get a commercial grade Wifi AP that doesn't do anything else other than WiFi. They're stable and include the latest standards.

Meanwhile, I run my own Linux router on a Raspberry Pi. It covers all the wacky edge case needs I have such as Wireguard, VRFs, VLAN, etc.

hammyhavoc3• 4 years ago

Pi still only have a single ethernet port, right? What kind of performance do you see?

lelag• 4 years ago

Scroll down if you wonder where the content is...

I was confused and starting navigating away from the page as the start of the article was below my viewport on my macbook with default resolution.

dolmen2• 4 years ago

What about Turris products as router?

https://www.turris.com/en/

(this is not supposed to be an advertisement, just a question as those are on my radar if I ever buy a router to plug on my ISP cable modem)

alias_neo• 4 years ago

I used to use the crappy mainstream stuff like the Linksys, in fact I have probably over £1k of WiFi routers in my router graveyard at home.

I switched to a Ubiquiti Edge Router and went the "discrete devices" route, one device for one purpose.

The edge router lasted 5 years or so before some power component blew, and with the sorry state of updates from Ubiquiti these days, I decided to move on. When I was looking around Turris came up a lot but it goes against my "discrete devices" approach so I bought a Protectli i5 box and run pfSense.

Ideally I'd like to get to the point where my Ubiquiti Unifi APs can be replaced with generic but capable hardware running Linux or BSD too for WiFi 6 speeds (not sure that's currently possible/available) and Switches are likely a way off.

sgarland7• 4 years ago

This entire website reads like the biggest caricature of a nerd that I have ever seen. Every opinion is that of gatekeeping and purity über alles.

Signal's creator has reasonable concerns about Web3 and NFTs? Better drop it, since "[Moxie has] very disturbing opinions on decentralization, [and] cryptocurrency..."

6+ paragraphs written about the print quality on various deskmats.

Tables of every material possession they own, seemingly lacking only the UPC.

netr0ute• 4 years ago

reads like the biggest caricature of a nerd that I have ever seen.

The site never claimed to be otherwise, so there's that.

hammyhavoc3• 4 years ago

Some of the content is interesting on the rest of the site, but this post definitely screamed "out of touch", perhaps surprisingly so if you've followed the content for a while. Being on the ball with tech is an ever-moving target, and this feels very 2015.

the-anarchist• 4 years ago

This comment made me click the shady af looking link. If a person that (judging from their keybase avatar and their website's "about" page) appears to be a total caricature of a nerd accuses another nerd person of being "the biggest caricature of a nerd" it must be good.

Sadly I was disappointed. It's just another of these "digital gardens" or whatever the term for the type of sites is, that one can find across various platforms like neocities these days.

Not sure what the described homelab has to do with crypto or decentralization, though.

sgarland7• 4 years ago

The homelab has nothing to do with those things, it's the other pages on the site, wherein the author discusses things like why they've eschewed Signal for XMPP due to Signal's author's feelings on crypto.

teejmya• 4 years ago

A while back I came across a site on HN with a very similar style, which went into similar detail on living "off the grid" on a sailboat. https://100r.co/site/about_us.html

The posted website is the second time I've seen this, but I have to imagine it is a specific style or practice.

Running an Open Source Home Area Network

Related Stories