7 ms·

Welp. I recently completed an Arch-linux and PCEngines-based DIY router build and stumbled upon Shorewall as an alternative to straight-up IP tables... I'm not

Welp. I recently completed an Arch-linux and PCEngines-based DIY router build and stumbled upon Shorewall as an alternative to straight-up IP tables... I'm not looking forward to changing this setup.

pard68 8y ago
I stumbled across a blog post that used Arch and Shorewall to roll a diy router. Any chance you used a blog post for inspiration and if so do you have the link still? I have been trying to find it ever since...
- albeec13 8y ago
  High likelihood it was this: https://wiki.archlinux.org/index.php/Router https://wiki.archlinux.org/index.php/Router The Arch Wiki is pretty awesome, generally, and I used this pretty heavily as a reference. I will say, this was not 100% perfect and I had to use some other outside sources, but most of the info is here. I did consider writing my own step-by-step post (if for no other reason than for me to not have to remember it), but haven't gotten around to it yet.
  - noir_lord 8y ago
    I've never installed Arch and know virtually nothing about it but often the first link I click after googling is the arch one, their documentation is fabulous and pretty often bang up to date (Since I track Fedora N/N-1 the package versions are usually close enough).
    - albeec13 8y ago
      I've been running Arch as my main home server for going on 11 years now. I love it. In that time span, the biggest hurdles have been the sysvinit/systemd transition and a handful of issues with mongodb feature deprecations that required manual intervention. My original impetus for using it was to "re-learn Linux" after a hiatus out of college, and because it's not as bloated as something like a full Ubuntu install, but doesn't require the full compiling of packages like Gentoo, it seemed like a good choice. Unless I want a GUI right out of the box, I don't use anything else. As you noted, the wiki is fantastic as well.
      - noir_lord 8y ago
        Yeah I know a bunch of programmers who love it, I use Fedora out of inertia, when I got the Ryzen at work it was very soon after they launched and they had better out of the box support so I switched to it from Xubuntu and liked it enough it stuck.
- tylerjl 8y ago
  Was it my blog post? https://blog.tjll.net/building-my-perfect-router/ https://blog.tjll.net/building-my-perfect-router/
  - pard68 8y ago
    that's the one! much thanks
  - albeec13 8y ago
    Nice write-up. I have a very similar setup, only I didn't delve into the netflow montioring/traffic shaping because it seemed a bit overkill for my needs. Have you given any thought about what you might do with respect to Shorewall, given the this news?
    - tylerjl 8y ago
      Even assuming the worst - that is, that Shorewall development completely stalls - the firewall is fully functional for me and I haven't hit any show-stopping bugs, so my plan is to continue using it until it breaks somewhere down the line. After the many years of development that've gone into Shorewall, the dividends it pays now are the years and years of hardening that have let it age into a solid, reliable tool. My needs aren't really pushing the envelope of what Shorewall can do (just a home network gateway), so my hope is that I won't bump into anything esoteric in the meantime.
      - albeec13 8y ago
        That's a good point. I suppose as long as I'm careful with updates, I should be able to leave it alone until there's a long-lost security bug found.
  - srmatto 8y ago
    I used your post, thanks for your hard work!
craftyguy 8y ago
I've been running basically this setup since 2015, and I don't think I'm any closer than you are to looking forward to changing this setup.

Welp. I recently completed an Arch-linux and PCEngines-based DIY router build and stumbled upon Shorewall as an alternative to straight-up IP tables... I'm not looking forward to changing this setup.

pard68 8y ago

I stumbled across a blog post that used Arch and Shorewall to roll a diy router. Any chance you used a blog post for inspiration and if so do you have the link still? I have been trying to find it ever since...

albeec13 8y ago
High likelihood it was this: https://wiki.archlinux.org/index.php/Router https://wiki.archlinux.org/index.php/Router The Arch Wiki is pretty awesome, generally, and I used this pretty heavily as a reference. I will say, this was not 100% perfect and I had to use some other outside sources, but most of the info is here. I did consider writing my own step-by-step post (if for no other reason than for me to not have to remember it), but haven't gotten around to it yet.
- noir_lord 8y ago
  I've never installed Arch and know virtually nothing about it but often the first link I click after googling is the arch one, their documentation is fabulous and pretty often bang up to date (Since I track Fedora N/N-1 the package versions are usually close enough).
  - albeec13 8y ago
    I've been running Arch as my main home server for going on 11 years now. I love it. In that time span, the biggest hurdles have been the sysvinit/systemd transition and a handful of issues with mongodb feature deprecations that required manual intervention. My original impetus for using it was to "re-learn Linux" after a hiatus out of college, and because it's not as bloated as something like a full Ubuntu install, but doesn't require the full compiling of packages like Gentoo, it seemed like a good choice. Unless I want a GUI right out of the box, I don't use anything else. As you noted, the wiki is fantastic as well.
    - noir_lord 8y ago
      Yeah I know a bunch of programmers who love it, I use Fedora out of inertia, when I got the Ryzen at work it was very soon after they launched and they had better out of the box support so I switched to it from Xubuntu and liked it enough it stuck.
tylerjl 8y ago
Was it my blog post? https://blog.tjll.net/building-my-perfect-router/ https://blog.tjll.net/building-my-perfect-router/
- pard68 8y ago
  that's the one! much thanks
- albeec13 8y ago
  Nice write-up. I have a very similar setup, only I didn't delve into the netflow montioring/traffic shaping because it seemed a bit overkill for my needs. Have you given any thought about what you might do with respect to Shorewall, given the this news?
  - tylerjl 8y ago
    Even assuming the worst - that is, that Shorewall development completely stalls - the firewall is fully functional for me and I haven't hit any show-stopping bugs, so my plan is to continue using it until it breaks somewhere down the line. After the many years of development that've gone into Shorewall, the dividends it pays now are the years and years of hardening that have let it age into a solid, reliable tool. My needs aren't really pushing the envelope of what Shorewall can do (just a home network gateway), so my hope is that I won't bump into anything esoteric in the meantime.
    - albeec13 8y ago
      That's a good point. I suppose as long as I'm careful with updates, I should be able to leave it alone until there's a long-lost security bug found.
- srmatto 8y ago
  I used your post, thanks for your hard work!

craftyguy 8y ago

I've been running basically this setup since 2015, and I don't think I'm any closer than you are to looking forward to changing this setup.