7 ms·

OpenWRT is pretty great at offering features and security for consumer devices. Glad to see a release! I used it for a while, but after I've had it for a few m

OpenWRT is pretty great at offering features and security for consumer devices. Glad to see a release! I used it for a while, but after I've had it for a few months, and want to improve/diagnose something, I can't easily tell which config I've changed from defaults, and so can't easily diagnose how I might have screwed it up, or predict how changes will impact the rest of the system. I moved my router to NixOS, where I can now see the ~250 config that covers the custom setup needed for my ISP/LAN. If asked, I'd still recommend OpenWRT for most techies, since it's easier to get started.

arjvik 2y ago
What hardware do you use for your router?
- choobacker 2y ago
  I use a https://www.pcengines.ch/apu2.htm https://www.pcengines.ch/apu2.htm with a separate wifi access point. That's EOL now, so nowadays I'd look to ARM e.g. https://radxa.com/products/network-computer/e52c https://radxa.com/products/network-computer/e52c
- Piraty 2y ago
  I use ancient+cheap netgear SOHO routers (WNDR3700 v1 and v2 from ~2012) which can route 940Mbps on ethernet (with software flow offloading enabled). For wireless AP i have an Mediatek MT7621 device, they are very well supported and provide proper wifi throuput
- Firefishy 2y ago
  https://protectli.com/ https://protectli.com/ Good quality devices. Real serial consoles to allow recovery when you make a networking configuration mistake ;-)
  - LinuxBender 2y ago
    Same here. Alpine Linux on top of that + Unbound DNS, dnsmasq for DHCP, netfilter, chronyd for time. I've never been able to make them break a sweat.
    - nicolas314 2y ago
      Curious: how did you set up firewall (nftables?), IPv6 delegation both ULA and public prefix? Happy to read if you have a write-up somewhere.
      - LinuxBender 2y ago
        I disabled IPv6 as my little ISP has not yet figured out how they want to bill for or assign/segment it out for static assignment. I have multiple static IPv4 addresses. I only use static IP's but that is a requirement specific to me. The firewall is very simple and just forwards packets and uses a simple IPv4 SNAT. The only time I've had it set up more complicated was when a guest was abusing P2P so I had to block it using string matches on the unencrypted commands. My setup is honestly simple enough that a write-up would not benefit many. My Unbound setup to block many malicious sites is also fairly well documented by others. The null routing of commonly used DoH servers is straight forward. My Chrony setup would just annoy people as I only use stratum-1 servers and the options would just look like cargo-culting to some. About the only thing not commonly discussed is the combination of thc_cake and some sysctl options to keep buffer bloat low but OpenWRT has their own take on that topic already.
wryun 2y ago
On most openwrt devices you can compare /rom/etc/config to /etc/config (though this will get you a bunch of automatic changes as well).
- RGamma 2y ago
  GP missed this basic fact and then moved to NixOS for a router target? What!?
  - darkwater 2y ago
    I use NixOS, btw
    - actualwitch 2y ago
      Is nixos new arch?
      - Novosell 2y ago
        For sure. I feel like the arch joke has played itself out. I use arch, btw.
        godelski 2y ago
        As an Arch user I've always been a bit confused by the joke. I have more shit go wrong on my Macbook. Sure, on Arch I might get a bad Nvidia driver update and either have to roll back the driver, kernel, or both[0] but these are at least easily fixable. You can easily determine the problem, fix it, and you've learned how to avoid it or resolve it in 5 minutes if it happens again (thanks Nvidia ;). Other than that, the only breaking things are when I'm fucking around, and well... that seems like my own damn fault lol. But several Macbooks I've had will go to sleep and if I try too fast to wake it up I'll have a black screen that can't be recovered until I reboot. And I could go on about how weird and infuriating some shit is and how I can't even implement a fix myself and I just give up because I don't want to waste time fighting Apple and play that cat and mouse game with no good documentation. I've just come to understand that "just works" means "not as buggy as Winblows". [0] https://forum.endeavouros.com/t/only-black-screen-after-login-after-kernel-nvidia-update/61129 https://forum.endeavouros.com/t/only-black-screen-after-logi...
yjftsjthsd-h 2y ago
Yeah, it's awkward that the usecase where I really want to be able to see (or really, commit) all my configuration like that is the place where I can't fit NixOS:( There was nixwrt, but that got discontinued. Actually it looks like Liminix is a thing now; I'll have to look at that.
- choobacker 2y ago
  There's hardware that has the form factor of a router, but is powerful enough to run an ordinary Linux machine. PC Engines, various ARM64 SBCs.
xrisk 2y ago
While this sounds good, you could just dump the contents of /etc into git and it would work about the same.
stas2k 2y ago
Why not both? I also use NixOS as the main router/fw/nat, and OpenWRT in bridge mode as dumb APs. All updates except semi-recent DSA changes were seamless.
- choobacker 2y ago
  Me too. My TP Link EAP605 is an AP running OpenWRT. Works well.
p3t3 2y ago
Are there well maintained nixos based router projects?
- choobacker 2y ago
  Not that I'm aware of. systemd-networkd + kea + corerad is the software I use.
  - eptcyka 2y ago
    Will have to look at kea and corerad. What hardware do you use for the wireless links? Intel has been very hit or miss in my experience. And the misses suuuck, like after enough hosts connect, you get kernel panic on every new client connection, or all but the one device I needed a separate wlan for are compatible with the host. So, NixOS on a router that doesn’t have to be a wifi ap is extremely nice in my experience.
    - choobacker 2y ago
      For wireless I started with the PC Engines miniPCI cards, but moved to a seperate AP for wifi6, and because hostapd was not fun. https://openwrt.org/toh/tp-link/eap615-wall https://openwrt.org/toh/tp-link/eap615-wall is the device I use as an AP, which runs OpenWRT.
      - eptcyka 2y ago
        I also have a separate AP with OpenWRT (UniFi with OpenWRT).
  - tok1 2y ago
    Running a router built with systemd-networkd and kea myself, and I quite like both, even though I have not integrated them with each other. Would you be willing to share some details on how you use these components? Especially corerad as I am not familiar with it and wonder on the why+how, considering networkd does NDP. Thanks
patrakov 2y ago
> OpenWRT is pretty great at offering features and security for consumer devices That's a misconception. Nobody actually cares about security for packages that are not in the default install. For example, the initscript for sstp-client disables certificate validation unconditionally, see https://github.com/openwrt/packages/issues/25212 https://github.com/openwrt/packages/issues/25212
- choobacker 2y ago
  Good job on raising that issue. TIL SSTP. > Nobody actually cares about security for packages that are not in the default install. Probably an exaggeration, but it's clear there are some packages that are insecure out-the-box.
- TheDong 2y ago
  It at least offers more security than the usual alternative on a consumer router of the manufacturer's OS (i.e. something updated once a decade running linux 2.6 with GPL-violating unreleased patches so you can't update it yourself, all written in C by the contractor that bid the lowest).
  - FeistySkink 2y ago
    If others think this is in jest, there are recent TP-Link routers with 2.6 kernel and Broadcom.
jillyboel 2y ago
cd /etc git init git add . git commit -m 'default config' git remote add ... git push # modify your configs git diff HEAD git commit -m 'yay i changed stuff and i know what i did' git push
cesarb 2y ago
To see what was changed, I use the option to download a backup of the configuration, and compare it with an older copy I had downloaded earlier (it's a set of text files, it can be unpacked and compared with recursive diff).
1vuio0pswjnm7 2y ago
How does the size of OpenWRT compare with the size of NixOS. https://discourse.nixos.org/t/how-minimal-can-a-nixos-image-get/45268 https://discourse.nixos.org/t/how-minimal-can-a-nixos-image-... https://openwrt.org/supported_devices/432_warning https://openwrt.org/supported_devices/432_warning
- choobacker 2y ago
  Size is a limiting factor for so.e hardware and architecture too. NixOS works well for x86-64 and aarch64, but not so much armv7l, as so many consumer routers are. The PC Engines happens to be x86-64 with decent storage expansion, but for sure if you want to target armv7l, NixOS is not a good choice.
  - 1vuio0pswjnm7 2y ago
    Nice to hear PCEngines is still in business. The website for the US distributor listed on PCEngines webssite is now selling "BoingFire" products instead of PCEngines. https://manestate.com https://manestate.com

arjvik 2y ago

What hardware do you use for your router?

choobacker 2y ago
I use a https://www.pcengines.ch/apu2.htm https://www.pcengines.ch/apu2.htm with a separate wifi access point. That's EOL now, so nowadays I'd look to ARM e.g. https://radxa.com/products/network-computer/e52c https://radxa.com/products/network-computer/e52c
Piraty 2y ago
I use ancient+cheap netgear SOHO routers (WNDR3700 v1 and v2 from ~2012) which can route 940Mbps on ethernet (with software flow offloading enabled). For wireless AP i have an Mediatek MT7621 device, they are very well supported and provide proper wifi throuput
Firefishy 2y ago
https://protectli.com/ https://protectli.com/ Good quality devices. Real serial consoles to allow recovery when you make a networking configuration mistake ;-)
- LinuxBender 2y ago
  Same here. Alpine Linux on top of that + Unbound DNS, dnsmasq for DHCP, netfilter, chronyd for time. I've never been able to make them break a sweat.
  - nicolas314 2y ago
    Curious: how did you set up firewall (nftables?), IPv6 delegation both ULA and public prefix? Happy to read if you have a write-up somewhere.
    - LinuxBender 2y ago
      I disabled IPv6 as my little ISP has not yet figured out how they want to bill for or assign/segment it out for static assignment. I have multiple static IPv4 addresses. I only use static IP's but that is a requirement specific to me. The firewall is very simple and just forwards packets and uses a simple IPv4 SNAT. The only time I've had it set up more complicated was when a guest was abusing P2P so I had to block it using string matches on the unencrypted commands. My setup is honestly simple enough that a write-up would not benefit many. My Unbound setup to block many malicious sites is also fairly well documented by others. The null routing of commonly used DoH servers is straight forward. My Chrony setup would just annoy people as I only use stratum-1 servers and the options would just look like cargo-culting to some. About the only thing not commonly discussed is the combination of thc_cake and some sysctl options to keep buffer bloat low but OpenWRT has their own take on that topic already.

wryun 2y ago

On most openwrt devices you can compare /rom/etc/config to /etc/config (though this will get you a bunch of automatic changes as well).

RGamma 2y ago
GP missed this basic fact and then moved to NixOS for a router target? What!?
- darkwater 2y ago
  I use NixOS, btw
  - actualwitch 2y ago
    Is nixos new arch?
    - Novosell 2y ago
      For sure. I feel like the arch joke has played itself out. I use arch, btw.
      - godelski 2y ago
        As an Arch user I've always been a bit confused by the joke. I have more shit go wrong on my Macbook. Sure, on Arch I might get a bad Nvidia driver update and either have to roll back the driver, kernel, or both[0] but these are at least easily fixable. You can easily determine the problem, fix it, and you've learned how to avoid it or resolve it in 5 minutes if it happens again (thanks Nvidia ;). Other than that, the only breaking things are when I'm fucking around, and well... that seems like my own damn fault lol. But several Macbooks I've had will go to sleep and if I try too fast to wake it up I'll have a black screen that can't be recovered until I reboot. And I could go on about how weird and infuriating some shit is and how I can't even implement a fix myself and I just give up because I don't want to waste time fighting Apple and play that cat and mouse game with no good documentation. I've just come to understand that "just works" means "not as buggy as Winblows". [0] https://forum.endeavouros.com/t/only-black-screen-after-login-after-kernel-nvidia-update/61129 https://forum.endeavouros.com/t/only-black-screen-after-logi...

yjftsjthsd-h 2y ago

Yeah, it's awkward that the usecase where I really want to be able to see (or really, commit) all my configuration like that is the place where I can't fit NixOS:( There was nixwrt, but that got discontinued. Actually it looks like Liminix is a thing now; I'll have to look at that.

choobacker 2y ago
There's hardware that has the form factor of a router, but is powerful enough to run an ordinary Linux machine. PC Engines, various ARM64 SBCs.

xrisk 2y ago

While this sounds good, you could just dump the contents of /etc into git and it would work about the same.

stas2k 2y ago

Why not both? I also use NixOS as the main router/fw/nat, and OpenWRT in bridge mode as dumb APs. All updates except semi-recent DSA changes were seamless.

choobacker 2y ago
Me too. My TP Link EAP605 is an AP running OpenWRT. Works well.

p3t3 2y ago

Are there well maintained nixos based router projects?

choobacker 2y ago
Not that I'm aware of. systemd-networkd + kea + corerad is the software I use.
- eptcyka 2y ago
  Will have to look at kea and corerad. What hardware do you use for the wireless links? Intel has been very hit or miss in my experience. And the misses suuuck, like after enough hosts connect, you get kernel panic on every new client connection, or all but the one device I needed a separate wlan for are compatible with the host. So, NixOS on a router that doesn’t have to be a wifi ap is extremely nice in my experience.
  - choobacker 2y ago
    For wireless I started with the PC Engines miniPCI cards, but moved to a seperate AP for wifi6, and because hostapd was not fun. https://openwrt.org/toh/tp-link/eap615-wall https://openwrt.org/toh/tp-link/eap615-wall is the device I use as an AP, which runs OpenWRT.
    - eptcyka 2y ago
      I also have a separate AP with OpenWRT (UniFi with OpenWRT).
- tok1 2y ago
  Running a router built with systemd-networkd and kea myself, and I quite like both, even though I have not integrated them with each other. Would you be willing to share some details on how you use these components? Especially corerad as I am not familiar with it and wonder on the why+how, considering networkd does NDP. Thanks

patrakov 2y ago

> OpenWRT is pretty great at offering features and security for consumer devices That's a misconception. Nobody actually cares about security for packages that are not in the default install. For example, the initscript for sstp-client disables certificate validation unconditionally, see https://github.com/openwrt/packages/issues/25212 https://github.com/openwrt/packages/issues/25212

choobacker 2y ago
Good job on raising that issue. TIL SSTP. > Nobody actually cares about security for packages that are not in the default install. Probably an exaggeration, but it's clear there are some packages that are insecure out-the-box.
TheDong 2y ago
It at least offers more security than the usual alternative on a consumer router of the manufacturer's OS (i.e. something updated once a decade running linux 2.6 with GPL-violating unreleased patches so you can't update it yourself, all written in C by the contractor that bid the lowest).
- FeistySkink 2y ago
  If others think this is in jest, there are recent TP-Link routers with 2.6 kernel and Broadcom.

jillyboel 2y ago

cd /etc git init git add . git commit -m 'default config' git remote add ... git push # modify your configs git diff HEAD git commit -m 'yay i changed stuff and i know what i did' git push

cesarb 2y ago

To see what was changed, I use the option to download a backup of the configuration, and compare it with an older copy I had downloaded earlier (it's a set of text files, it can be unpacked and compared with recursive diff).

1vuio0pswjnm7 2y ago

How does the size of OpenWRT compare with the size of NixOS. https://discourse.nixos.org/t/how-minimal-can-a-nixos-image-get/45268 https://discourse.nixos.org/t/how-minimal-can-a-nixos-image-... https://openwrt.org/supported_devices/432_warning https://openwrt.org/supported_devices/432_warning

choobacker 2y ago
Size is a limiting factor for so.e hardware and architecture too. NixOS works well for x86-64 and aarch64, but not so much armv7l, as so many consumer routers are. The PC Engines happens to be x86-64 with decent storage expansion, but for sure if you want to target armv7l, NixOS is not a good choice.
- 1vuio0pswjnm7 2y ago
  Nice to hear PCEngines is still in business. The website for the US distributor listed on PCEngines webssite is now selling "BoingFire" products instead of PCEngines. https://manestate.com https://manestate.com