Thank you that's EXTREMELY helpful! I agree that maxing out at 65w and pulling maybe 30 the rest of the time isn't so bad, but I really wasn't sure what to expect.

That also means if I find I actually hate it and in a year I'm like "fuck it I'm done tinkering" I didn't spend a ton of extra money on equipment.

Why wouldn't you recommend pfsense anymore? Also what's an NTS server for?

Running an email server sounds super super difficult

Lol so real. Thank you.

Lol thanks for that, it's nice to talk to someone else who also just dove right in instead of the usual online experts who've been at it for forever 😅

I was using an N100 based mini PC and it did fine at 1gbit. But now that I have 3, and it’s realistically closer to 4 or 5 it doesn’t cut the mustard.

Proper hardware based routers are also just so much more efficient. That N100 machine was constantly hot to the touch. My new UniFi router uses less power and does 10 gig easily.

Router is a bunch of old PCs I frankensteined and put opnsense on.

Ended up i5-7500, 8gb mem, 500gb SSD.

Put in a dual-port SFP+ NIC and a dual port 2.5GbaseT nic.

One of the 2.5gb ports goes to my cable modem.

One of the 10gb ports takes Twinax to my dumb LAN switch, the other to my dumb server switch, which right now is really just my storage network...the link to the firewall isn't doing anytuhing.

The dumb switches I have here, though, they've got some sort of weird MAC learning disability. It cannot handle macflaps, which I found out about because I had a hard time roaming between APs.

So I got a Netgear GS108T and put OpenWRT on it, and that switches between my APs.

My APs are Linksys MX4200v1's. Also openwrt. Got four of them...one upstairs, two in the ground floor, one in the basement. Can get very close to 1Gbps anywhere in the house on wifi. Not the best platform for openwrt (ipq807x), as I've found out...but it was a hella cheap deal for tri-band AX APs.

I do this at work. If you don’t do pass through for the NICs I’d highly suggest it. When it’s a router it’s insane how much the overhead can be.

We have a 4 gig connection and with the virtual nics got maybe just over 1gbit on a Xeon silver based R640. But after pass through solid 3.5ish. Not sure where the bottleneck is currently, but our other servers do >4 just fine.

This is protectli: https://protectli.com/

If you're especially looking for good power consumption, I'd look into some embedded system with OpenWRT. I was especially looking for something that could handle high bandwidth and manage some higher level features that OPNSense has.

There are a number of issues with pfSense. The updates for the community edition are slow. They are trying to push everyone to the paid version. You can't even download an ISO to install it offline anymore. You have to make a Netgate account to download an installer that needs an internet connection to run.

NTP is network time protocol. It's used to get the time over the network. Using a GPS receiver as the clock source makes it more accurate and allows it to work without an internet connection.

Guest Network in OpenWRT prevents inter-device communication on the LAN. So the thing can talk to its cloud service or whatever but can't see my phone/laptop/PCs.

This means that untrusted devices which get pw0ned (or are surveillance-by-design) can't then get into your more important machines. Most people use guest networks for IoT devices like Ring cams and smart washing machines but I don't even own shit like that.

I ran a linux box with two gigabit Intel NICs for years with iptables. Almost any device can do it.

Like others say, opnsense is prob your best bet unless you like the abstraction of iptables

In my head, it’s more of a server with router functions glued on
That was also how I thought of your machine in my head by the time I got to this part of your comment

It really did, thank you :) No one else mentioned updating as far as I know, and that wasn't something I really thought about at all, coming from a commercial router. Plus I just enjoyed your journey. I think I'll need wireguard to safely access my NAS remotely so that's good to know too.

I only got into privacy stuff like a year ago, but I was really focused on thinking about my phone and not as much my home network (unless we're talking like, cloud services that are also accessed on desktop, I was already worried about those). That's a spooky but totally valid thought imo. Agree, would be a good new rabbit hole to explore.

someone else suggested openwrt on my current EOL router, i might just try that! like, i think eventually I might still want something more robust, but it sounds like a pretty good starting point

It's a big rabbit hole for sure, with how many household devices are internet connected and the concerning capabilities they offer. And an expensive one if you seek to replace devices at home.

I’ve been running mine for over 20 years. It’s certainly got more difficult, especially to be able to reliably communicate with Gmail-hosted servers and outlook.com addresses, but SPF, DMARC, and DKIM are all pretty straightforward to set up. Tightening the encryption/hash algorithms you accept and “anonymizing” your server greetings takes some finesse as well, but I definitely prefer it this way.

I avoid the entire webmail and spam filtering aspects, smtp(s) and imap(s) only.

I used to run opnsense on a Xeon blade in my old C6100. It worked well enough but was a waste. Now it’s just a stock ER605 without the Omada controller.

thank you, this is a great post! I like your blog!

returns after some googling
oh my LOL i see

Can I ask what the 10 gig is for?

I don't think this is what I'm gonna end up doing, but I LOVE STORIES LIKE THIS. Frankensteining a bunch of shit together just makes me feel so nostalgic for how I got into PCs in the first place. MAC learning disability also made me laugh.

Thank you!

Someone suggested seeing if I could install openWRT on my current router, I might start there instead of buying anything right away, I can always grow more later as I find I'm ready to start doing x, y. or z if I find I need to.

But I'd never heard of protectli. I have a feeling that, since I was just browsing youtube to start, I mostly only learned about companies that are doing youtube sponsorships lol

Ooooo that's really good to know. See, I think starting my journey on youtube, I was kind of getting some slightly biased perspectives, like, a lot more exposure to firms that are more likely to do youtube sponsorships, for example.

Thank you!

Someone suggested seeing if I could install openWRT on my current router, I might start there instead of buying anything right away, I can always grow more later as I find I'm ready to start doing x, y. or z if I find I need to.

I like the spirit! That's an excellent place to start. If you find you need more later, there's plenty of options to grow.

Lol I also passed up on ring cameras, i'd like to have a camera someday but I don't want to go through Amazon.

I wonder if I should set up a guest network for my mother-in-law. 🤔 My husband is very on-board with my privacy-focused desires and cautious about what we invite into the home but my MIL, well, is old.

I don't know for sure what I like or don't like, but I am pretty sure I do not want to start with iptables. Thank you :)

I have OPNsense running on a 2nd-hand Dell Optiplex SFF, which I added 2-port NIC(s) to (initially Gigabit RJ45, then later 10Gbit SFP).

Currently it's running bridged from my ISP router, but I'm in the process of wiring the fibre directly via a SFP transceiver to the NIC. I believe you can do adblocking on OPNsense itself via Unbound, but I prefer to do that via a separate PiHole (VM).

Gotta go fast. My WiFi can achieve > 1gbit, my internal network is already 10 gig. Why not support faster everywhere?

I build a Linux system with multiple NICs. It's heavyweight for a router, and probably not very efficient, but it does the job very well and I love it. I'm using foomuuri to manage the NFTables and NAT and it was very easy (although it's a very obscure piece of software and the documentation and community isn't excessively comprehensive, you might have better luck with something more common but it works nicely for me). It can pull in all the adblocking lists and all that fun stuff. I find it pretty intuitive to configure, at least compared to the horrors of most networking/routing configuration nonsense.

For DHCP I tried using the ISC's new "kea" in the hopes it would be modern and clean alternative to the venerable old isc-dhcp-server but it turned out to be a horrible mistake. They made some awful, insane, unjustifiable design decisions in that software. It gets confused about IP addresses already being claimed (by the exact same host/MAC) address because some arbitrary value changed in how it identifies itself, and then does absurd things with static leases, it just randomly decides to give it a dynamic lease instead, and then will fixate on that dynamic lease and never let it have the static lease back, I fought with it for months, it kept breaking my network for absolutely no reason and it was a nightmare.

Back to trusty old isc-dhcp-server for me. And of course bind for DNS, I'm a bit old-school but it's very comfortable.

dnsmasq might be a lighter-weight and easier alternative you could consider, I think it does DHCP as well, convenient.

And of course, being a full Linux server means you can put all kinds of other stuff on it too. Stuff that needs to be both publicly visible and privately visible on the LAN seems like an obvious fit, but in fact it's probably the worst place to put those services, because you run into issues with NAT hairpinning and other nonsense. For services that are strictly intended for the private LAN/VPN, or services that are strictly public facing, it can handle those just fine by restricting them to a specific interface. But you should avoid stuff that needs to listen on both sides of the connection, it can be done, but it's tricky and annoying and not ideal.

If you need both internal and external access, port-forwarding from the outside through the NAT to another dedicated internal host is a much better solution if possible, it's still a bit tricky (you may have to override the DNS for that domain internally to use the private IP instead of the public one) but it's quite reliable and functional once you have it set up.

None of this is really for the faint of heart, it'll likely require a fair bit of trial and error and physical access to the machine to resolve issues. But it's a fun project and I think the end result is worth it.

Thanks!

I bought it new, but of course you can repurpose old hardware!

Feel free to ask any Qs if any come up, there is ?likely? better value than the Wyze 5070 extended now a days, I looked and bozos still want like $100 for it. Getting AVX2 would be a solid W for software in the future and worth a minor increase in cost. An ARM board (as long as it has UEFI and can boot regular Debian - not a custom distro for the board) would be a solid move too, but you’ll not get Opnsense then - it’s openwrt only for ARM.

This of course is me thinking of pricing when it wasn’t AI bro “lemme order all your RAM on an IOU” stupid, good luck there!! Just opnsense does not need much RAM - like 3 GB is easily safe (mine is given 2GB right now; uses 600 MB right now but I’ve seen it go past 1.5 GB sometimes). Straight Debian will add a gig or so. So even 4 GB would be fine. Proxmox is needy so it’s not fine there, but cutting it out of the equation would make 4 work if you want to save. And you’d prob get away with a $5 16 GB optane M.2 drive from China (aliexpress) with just opnsense - it’s using 3.2 GB of the 16 I’ve given it. And the Optane drive will never wear out as a bonus.

Edit: I’d estimate stock Debian at ~6 GB used. I think both can fit in 16 GB, even with Debian loaded with Incus to run the Opnsense in a VM.

Another vote for openwrt

it’s worth mentioning mine is over 10 years old and was that cheap when I bought it. If you can find a fanless design, these will last ages since there’s a few simple non-moving components that do the same kind of work all day every day and don’t take a ton of abuse. Even after all these years, the CPU on mine sits mostly idle even with heavy traffic. Modern software is just very efficient.

Another reason the router/firewall lasts is because I use a dedicated WiFi antenna. This is another part that gets the same work every day. I’ve upgraded mine twice, but it was almost double the speed each time, and I didn’t have to spend extra money on routing hardware that was still plenty powerful.

I have 2.5G N100 and it works wonderfully at that rate. I think higher might be tough, but it still pushes that throughput even with IPS enabled in OPNsense.

The complained about heat is right though. I stuck a noctua fan on the top and it's been happy since. It lives my closet, so noise isn't a facto anyways

No idea, I'm not monitoring power consumption at all.

I'm just assuming that the Intel CPU based system will idle at X Watts, peak as Y Watts, and that an ARM based appliance would idle at X and peak lower than X.

If any thing, I noticed that my UPS batter didn't last as long during an extended ded outage once I deploy the SFF PC.

Also, TCO, if I save $100 on the price of the device (that draws more power) that is a lot of power savings required to break even.

Not difficult with amazing software like mailcow

even cheap consumer router these days are actually surprisingly capable. mine's from 2015! what model do you have? might be hard if it's a realtek/brcm chipset.. mediatek(ralink) and qualcomm(atheros) are mostly well supported

I'm running pfsense with wireguard site to site connection between 2 locations. Vlan for my mqtt for my meshtastic. I did have an ad blocker on it but I found it wasn't very good. It was blocking too many things.

Switched to Adguard on my Proxmox instead.

Oh, you can tear it down as soon as you get the certification.

Mine still runs decades later though.

Okay cool, thank you

I run some china box with 5 integrated 2.5GBe NICs, 48GB RAM and 2x 500GB SSD/NVMe. CPU is Celeron(R) 6305 @ 1.80GHz, two cores or HT, who knows....

On this I run Proxmox. I didn't like Proxmox integrated firewall, so I rolled my own.

all containers unprivileged

one container is the firewall. it has all up+down stream NICs mapped via bridges, cable internet, backup 5g internet on dedicated ports. one port to the switch with a few VLANs, and one bridge that is local to the Proxmox for the local VLANs.

Every service I operate sits in its own network/segment, usually with a /30 netmask. VMs/containers have a eth0 device in this and the firewall defined as default gw. On the firewall the VLAN interfaces are named as the container/service. So the interfaces are not eth0 but wan, wan5g, frigate etc. Great for readability.

Some networks like "family" or "guest" or the one with the APs/WLAN-controller are /24. Bit big, but what ever.

I have a structured netfilter firewall script, fw.sh calling it's parts under fw.d/*fw. Each service is managed individually, sometimes widely open (iptables -A FORWARD -i frigate -o wan* -j ACCEPT) but usually down to the required ports. Database, reverse proxy etc all on separate containers.

There is also like 30 VPN configs from 2 VPN providers. I have a home assistant dashboard where I can direct specific devices to use specifig VPNs. My webradio is routed via UK so I can enjoy BBC2.

root@mercury:~# ip rule show
0:      from all lookup local
20:     from all lookup main suppress_prefixlength 1
300:    from XXX lookup wan_table
310:    from XXX lookup wan5g_table
1000:   from all fwmark 0x1 lookup bbc-ss-lon
1001:   from all fwmark 0x1 lookup bbc-ss-man
3000:   from XXX lookup pm-gb
4000:   from all lookup wan_table
5000:   from all lookup wan_table
5100:   from all lookup wan5g_table
32766:  from all lookup main
32767:  from all lookup default

ip rule also does the fail over to wan5g if required. There are some rules where I tried to auto-filter BBC traffic with marked connections via dnsmasq, but BBC knows all my VPNs (not BBC radio it seems).

IPSec VPNs and other OpenVPNs (dialup, site2site) are handled via a dedicated LXC. There is a tor entry node container, for a few services and one of the public WLANs. Firewall makes sure certain traffic can only exit via certain upstream interfaces, vpn*, wan, wan*... very helpful

I didn't like opensense... don't know why. Work a lot with firewalls in my job (mainly check point, fortigate) so have some professional background.

Also: client isolated WiFi for all iot shit. No internet for TV (jellyfin), PV controllers and most others.

Nice. I recently migrated from bind/isc-dhcp to dnsmasq, which has a cleaner 1-line per reservation syntax. PowerDNS is what I manage my domains with, but not in my home-homelab.

HP Prodesk with some i5 8th gen running proxmox and with a 4x 1gb pcie nic on which a opnsense vm runs.

My DNS was done through pihole. Transitioned now to technitium-dns.

My personal blocklist(s):
https://github.com/Appoxo/Ad-Spam-Blocklist
Contains a list for opnsense (IPs) and technitium-dns (but pihole should be compatible).
Anything else should be mentioned in the readme.

In case of questions, feel free to ask.

A fanless thin client with Opnsense and a four-port Intel NIC.

A used Lenovo ThinkCentre Tiny M720q mini PC, with the PCIe riser and an Intel chipset (Huawei) dual-10 Gbit NIC, running a pretty basic install of OpenWrt. Has no issue with 10 Gbit throughput, maxes out at about maybe 12 Gbit if you do a full duplex test, which I think may be a limitation of the limited PCIe lanes in the riser.

I got 10 Gbit internet at home, looked at the prices of 10 Gbit routers and noted right out! Built this for maybe $100 in stuff off of auctions.

This is the way!

Sometimes it's really that simple 🥰