from Hacker News

Building My Perfect Router

by oneowl on 4/14/19, 3:24 PM with 4 comments

• by tya99 on 4/15/19, 8:39 AM

  I did a similar thing in order to implement network segregation via VLANs and VPN routing.

  Personally I think Alpine Linux is one of the better distributions to use for routers because it uses musl which is ultra small. https://www.etalabs.net/compare_libcs.html

  I have separate VLANs:

  • VLAN 1: Management (no tag, null route)

  • VLAN 2: Untrusted (routes direct to ISP via ppp0)

  • VLAN 3: Trusted (routes direct to ISP via ppp0)

  • VLAN 4: Trusted (routes via tun0 - VPN connection for private browsing etc)

  • VLAN 5: Null route for devices that do not require internet access of any kind, desk phones printers etc.

  (Doesn't have to be a Raspberry Pi, you can use anything that Alpine Linux runs on which is x86_64, x86, ppc64le, s390x, armhf, aarch64 (ARM8 like Raspberry Pi 3), armv7 (Raspberry Pi 2, and friends).[1]

  [0] https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a...

  [1] https://alpinelinux.org/downloads/

  The idea is that anything on VLAN2 is completely segregated at the switch and router level from the rest of my network.

• by virgakwolfw on 4/15/19, 6:36 AM

  I update the router about once a month, just to ensure all the relevant packages are kept current with upstream. So far the only breakages have been in kernel incompatibilities with the ipt-netflow module, but I think that’s only happened once so far - any Arch updates to shorewall, dnsmasq, etc. have been stable.