What changes when you turn a Linux box into a router

https://patrickmccanna.net/7-configuration-changes-that-turn-a-multi-homed-host-into-a-switch-router/

229 46 4 months ago

Havoc• 4 months ago

Used to run a virtualized firewall setup. And then one day discovered that somewhere along the lines I had made a change (or an update changed something) that meant proxmox admin interface was being served publicly. That's despite confirming during initial setup that it isn't.

So now I do not do any funky stuff with firewalls anymore. Separate appliance with opnsense bare metal.

tarruda• 4 months ago

I currently do something similar.

My router is a 16GB n150 mini PC with dual NICs. The actual router OS is within openwrt VM managed by Incus (VM/Container hypervisor) that has both NICs passed through.

One of the NICs is connected to another OpenWrt wifi access point, and the other is connected to the ISP modem.

The n150 also has a wifi card that I setup as an additional AP I can connect to if something goes wrong with the virtualization setup.

Been running this for at least 6 months and has been working pretty well.

Joel_Mckay4• 4 months ago

Both port specific firewall rules, and web-server IP permissions are important.

For example, bandwidth rate-limiting may be inhibited for admin SSH or package updates, and LAN IPv4 private ranges for your host address pool are set.

Finally, your internal DHCP should statically bind your admin computer MAC to a fixed LAN host IP to further reduce issues.

Personally, I always build my NAS from scratch, as I have lost count of the number of problems web-GUI have caused over the years. =3

gerdesj• 4 months ago

Fair enough and I think you have done the right thing - opnsense is pretty decent - and the clear delineation between collision domains helps avoid showing too much ankle to the internet 8)

I think your initial setup was perfectly valid. Then you diagnosed a fault and fixed it with aplomb, in a way that you could verify. The key point is: "in a way you could verify" and you failed safe. Well played.

Proxmox itself has a useful firewall implementation too, although it takes a bit of getting used to because you can set it at the cluster, host and VM levels. I personally love it because it is easier to manage than individual host based firewalls, which I also do, but I'm a masochist! For smaller systems I generally use the cluster level to keep all the rules in one place.

drnick1• 4 months ago

I don't bother with virtualization, and use the machine at the edge of my network as router, email server, Web server, DNS server, and countless or other things such as hostapd.

An x86 mini PC can run all this without breaking a sweat; using separate appliances seems very wasteful. That being said, I configure everything in DIY mode, and don't rely on GUIs or other similar things that increase the attack surface considerably.

ziml772• 4 months ago

I used to try to combine everything, but now I don't. Separate appliances isolates issues to a subset of services. If everything is on a single PC and that one dies or even just needs a reboot, everything goes down.

ziml772• 4 months ago

Dedicated appliances are the way to go for the most important parts of your setup. I've always had my router as an appliance because I don't like the idea of my network failing due to something going wrong with the server that runs a bunch of other things that are less important. I also have Home Assistant running on a dedicated machine because that's also important.

Btw you do also need to be careful with opnsense. I was years behind on updates for mine because every time I updated I assumed that it would bring me up to date with the latest version. But opnsense has to install the upgrades in order. After you reboot you need to check again for updates and repeat until there's no more to install.

UltraSane• 4 months ago

Using VMs as routers and firewalls gets very confusing very fast.

ValdikSS4• 4 months ago

The Linux box instantly turns into a router as soon as you run `sysctl net.ipv4.ip_forward=1`, because the default policy for FORWARD table is ACCEPT.

You need to explicitly reconfigure the iptables/nftables to prevent that from happening.

Some software, say LXD/Incus, enable forwarding automatically upon installation/startup, and do not configure firewall to block non-their traffic, making the machine an open router. I've reported that, the developers said that's by design (despite other virtualization/containerization systems block forwarding if they happen to enable the sysctl).

3abiton• 4 months ago

A stupid question, what's the risk?

tremon• 4 months ago

The risk is minimal if you control or trust both networks. A network boundary is a natural choke point for access control, so that's where it's usually implemented. For an ipv4 boundary router (as is the topic of the post) you almost certainly need to configure Network Address Translation because your internal network addresses are non-routable on the Internet (at uni my dorm had public IP addresses for each student computer, fun times).

As for the GP's example, running VM's or containers* on your own machine? I'd say the default ACCEPT policy is fine. However, silently changing such a setting on software installation is a problem because if the machine is multi-homed (i.e. has more than one network interface), you've now created a network route outside of the network admin's control.

* The default for docker and podman is to use a private network, not a bridge anyway.

Dibby053• 4 months ago

Basically you're introducing a hole. For example, if you have some devices in your network (like a dodgy TV box) that are not supposed to reach the internet or other parts of the network, the computer with net.ipv4.ip_forward=1 could be used as a pivot. Depending on the routing tables you probably would also need to enable IP masquerading (NAT) to allow bidirectional communication.

Joel_Mckay4• 4 months ago

In almost all Linux based router setups: folks end up using 6to4 tunnels, packet marking, and interface routing priority.

Setting that up with safe/fair bandwidth-sharing requires intermediate IT skill level. Still a great hobby project =3

markhahn• 4 months ago

that you'll get it wrong, I suppose.

after all, most routers/WAP/gateways that you buy today will have linux on the inside, configured similarly.

ValdikSS4• 4 months ago

https://news.ycombinator.com/item?id=47648289

0o_MrPatrick_o03• 4 months ago

Respectfully- I don’t think this statement applies to the scenario I presented.

“The Linux box instantly turns into a router as soon as you run `sysctl net.ipv4.ip_forward=1`, because the default policy for FORWARD table is ACCEPT.”

In the setup I presented, we are bridging an Ethernet and a WiFi network. This would be desirable if you wanted to use an upstream dhcp server for your WiFi clients- or if you wanted to avoid double nat’ing.

In 802.11 infrastructure mode, a station can only send frames with its own MAC address. The AP won’t accept or forward frames from unknown MACs. So you can’t transparently bridge Ethernet devices’ MAC addresses through a WiFi client interface. This is why we need hostapd.

In every other circumstance- I think your statement holds.

I tried to do some weird alerting on new MAC addresses and ran into this weirdness. Bridging WiFi and Ethernet gets weird.

iam-TJ• 4 months ago

"So you can’t transparently bridge Ethernet devices’ MAC addresses through a WiFi client interface. This is why we need hostapd."

I think that is incorrect. hostapd handles the authentication side of things, but 4addr tuples are controlled by 'struct wireless_dev.use_4addr', and can be set by 'ip link set type bridge_slave ... proxy_arp_wifi on', `iw dev ... 4addr on', and if using systemd-networkd, with slave interface's

  [Bridge]
  ProxyARPWiFi=yes

(and networkd doesn't need hostapd's bridge= option since networkd handles that aspect.)

Kernel then uses NL80211_IFTYPE_AP_VLAN and handles the proxy operation.

tssva• 4 months ago

Respectfully the scenario you want to present seems to change. The title you submitted this under doesn’t have any mention of switching, firewalls, dhcp server or WiFi access point.

Then the actual title of the article mentions routing and switching but not a firewall, dhcp server or WiFi access point. Then at the end you seem to change the goal to being a WiFi router but really you have presented more steps than required for that. You have also setup switching, a firewall and a dhcp server which are not required to be a router with WiFi access point.

rahimnathwani• 4 months ago

When regular people say 'router', they assume this one box will be all three of these things:

- router

- NAT gateway

- DHCP server

In a typical scenario, turning IP forwarding on will do nothing unless:

- DHCP has given the devices on the 'inside' IP addresses and told them the gateway address, and

- the router is set up to do IP masquerading

wafflemaker• 4 months ago

You forgot the -WIFI access point

wofo2• 4 months ago

Could you share more details about this? Do you mean that e.g., if I run LXD/Incus on a machine with a public IP address, anyone on the internet could route traffic through it?

ValdikSS4• 4 months ago

Anyone in "your lan" (L2 of the interface, sometimes L3 like VPN). Your containers/VMs will be fully accessible from other machines in "LAN" (hosting provider infrastructure, or ISP infrastructure), despite no port forwarding/publishing configured.

Your IP could also be used to run DoS attacks on the internet, although in this case (compared to containers/VM access) the attacker won't be able to receive replies (one-way communication only, like the address spoofing). But if you also happen to configure NAT (MASQUERADE) without additional limits, anyone in "LAN" could use your machine as a router (use your IP address to access websites).

Such misconfiguration is rarely told about in the how-tos and guides, and it's pretty common to have "additional free IPs" on your VPS/dedicated this way :D

This is also true in case of manually crafted home routers (such as in this article, and misconfigured advanced routers like Mikrotik, OpenWrt, Cisco, etc): if you happen to unconditionally enable forwarding without firewall, and think that NAT will somehow block the access to your home LAN, that's not true. Your neighbor, connected to the same ISP switch, could just add the routing record to 192.168.0.0/24 via your router's MAC address and access your 192.168.0.0/24 LAN devices without restrictions (unless ISP specifically blocks such access).

gxs2• 4 months ago

My very first exposure to Linux was in 2000, my school was about to throw away an old gateway computer and I took it home and turned it into router

As a kid with no AI, no google, it was quite a feat and I’m still very proud of it

Was my introduction into how the internet works and I’ll never forget working with ipchains

I remember enduring a lot of people in forums calling me a noob, but only after spending collective hours answering my dumb questions

I credit a big part of my moderate success in tech, to being familiar with stuff at just a tad bit lower of a level than the average bear

To my friend Sam who I haven’t talked to in 20 years, thanks for the idea

vaylian• 4 months ago

Stories like these make me sad when I think about chat control and age verification. Kids in the future may no longer be allowed to talk to random helpful strangers on the internet about computers and other technical topics, because apparently the internet is too dangerous for children.

pphysch• 4 months ago

Suppose the age verification checks stopped. Where exactly are these kids supposed to find "random helpful strangers" on the Internet that isn't also a major vector for predation or nonsensical AI spam?

The open friendly ~safe Internet died long ago.

s0rce• 4 months ago

Around the same time I set up an old pentium 80 that booted linux off a floppy to be a router. It ran for a few years later until Linksys wifi routers got cheaper.

freetime2• 4 months ago

Are there any preconfigured images/installers available for a major Linux distro to turn them a router with safe and sensible defaults?

I know there is OpenWrt, but my experience is that is more geared toward running on embedded wifi hardware than an x86 machine. The x86 install comes with a tiny root partition that's actually pretty difficult to resize, for example, and upgrades are quite brittle compared to standard Linux distros.

And there's also pfSense and OPNsense, but these run on FreeBSD which seems to lag behind Linux for hardware support. There's no support for the Aquantia AQC113 NIC, for example (although it looks like this may finally have been added in the last month or so).

Something like an Ubuntu Appliance [1] would be quite nice.

[1] https://ubuntu.com/appliance

ask2sk• 4 months ago

Ipfire and Untangle seems suitable for your use case

Joel_Mckay4• 4 months ago

Those look pretty cool too. =3

Joel_Mckay4• 4 months ago

Modified Ubuntu LTS server image will work, and a minimal Debian kernel will have far less bloat. Note pfSense/FreeBSD is fairly robust, and a mature project.

Keep in mind most network appliances have dedicated hardware hand-off adapters, and so the CPU isn't involved in routing once the connection is setup. It is why people can use a $30 SoC, and still be able to saturate several 10Gb/100Gb ports. =3

assimpleaspossi• 4 months ago

FreeBSD probably supports the hardware you have. If not, just buy the hardware that supports FreeBSD.

erinnh• 4 months ago

The best is likely Vyos. It acts quite similarly to routers from the likes of Arista/Cisco/Juniper.

https://vyos.io/

chatmasta• 4 months ago

This is an excellent post and great reference material. I’ve done this a few times before and the information was scattered all over the place. I appreciate the clear and concise writing here. I even added it to my HN favorites - a rare accolade!

One thing I’d add, is that the best explanation I’ve ever seen for this, is the famous diagram [0] on Wikipedia of the netfilter API — I remember when I saw that, everything clicked into place. I’m not sure how up to date it is now, but it’s really good.

[0] https://commons.wikimedia.org/wiki/File:Netfilter-packet-flo...

functional_dev• 4 months ago

The wiki diagram helped me too, thanks!

One thing I did not understand before: why SNAT must happen at POSTROUTING?

Because the exit interface is only known after the routing decision... before that kernel does not know which source IP to write

this visual schematic made it click for me - https://vectree.io/c/linux-netfilter-packet-flow-tables-chai...

sorz• 4 months ago

I feels wrong to not mention IPv6 in 2026.

- net.ipv6.conf.all.forwarding=1

- nftables is default to `ip` family which only applies to IPv4. Setting it to `inet` will allow rules to apply to both IPv4 & 6; or `ip6` for IPv6 only. You can skip NAT rules, usually.

- dnsmasq: in addition to DNS and DHCP, turns on router advertisement with SLAAC. Some devices can get IPv6 address from stateful DHCPv6 server, others (e.g. Android) only work with SLAAC.

binkHN• 4 months ago

While I run Linux on my production workstation, I use OpenBSD as my router and firewall at home. I find the configuration of OpenBSD for this a lot more simple and everything that's needed, even for IPv6, is in the base install.

jcalvinowens• 4 months ago

People saying "the FOWARD chain defaults to ACCEPT" are missing the deeper point: with the kconfig most distros use, the filtering code doesn't even exist at all until you load the kernel modules!

At the lowest level, it is impossible to have a default DROP for forwarding, because nftables is an optional piece of the kernel that often isn't loaded.

ValdikSS4• 4 months ago

Well it's kind of possible to block it with routing tables+rules only, but you're right. This is also painful if iptables/nftables binaries are not installed.

rkagerer• 4 months ago

This is a great article.

It explains steps I used to fumble through stabbing in the dark following piecemeal examples trying to bring up quick and dirty networking on an oddball Linux device (like a BPI-R4 or router VM).

evanjrowley• 4 months ago

  Set Linux as router in one command. Support Internet sharing, redsocks, Wifi hotspot, IPv6. Can also be used for routing VM/containers

https://github.com/garywill/linux-router

What changes when you turn a Linux box into a router

Related Stories