Let's talk about free/FOSS routing platforms for the homelab

Submitted ⁨⁨4⁩ ⁨months⁩ ago⁩ by ⁨MigratingtoLemmy@lemmy.world⁩ to ⁨selfhosted@lemmy.world⁩

I am going to intentionally exclude Unifi along with the vendors like Cisco, Juniper, Aruba etc from this discussion as I don’t think they are relevant (especially since you can’t run them on your hardware).

OPNsense: Considered the superior alternative to PFSense. Great firewall, routing capabilities, IDS and certificate authority, advanced features, can be a DNS server etc. Best option all around for x86, but BSD based - take note of available drivers. Don’t even think about running random WiFi antennas unless you confirm good support for them (use a distinct WAP).
OpenWRT: built for consumer router + switch + WAP boxes on embedded hardware. Great OS and uses very little resources with many features, but doesn’t compete in features with OPNsense if you have x86.
VyOS: Debian based router + firewall. Linux makes it easier for people to pick up the CLI but I’ve heard complaints about it being difficult to follow. Currently CLI only, at least without third-party solutions, but is powerful and competes directly with OPNsense for features for the most part. Seems to be just as stable.
Debian + FRRouting + nftables + heavy SELinux for the paranoid/analogous alternatives on OpenBSD (the latter is considered more secure but YMMV, configuration plays a big part here).
Freemium: Sophos free version for home use.

Which one of these do you run, and why? What have been your issues with one or the other, and what have you settled on? Any niche customisations that you might have made? I’m very interested to know!

Cheers

source

Comments

Sort:hotnew top

Oha@lemmy.ohaa.xyz ⁨4⁩ ⁨months⁩ ago
Been running virtualised Opnsense for a while and its really awesome. Haven’t had any major issues

source
nbailey@lemmy.ca ⁨4⁩ ⁨months⁩ ago
IPtables on Debian because I like my life to be boring and unchanging.

source
- MigratingtoLemmy@lemmy.world ⁨4⁩ ⁨months⁩ ago
  Is that your firewall? I admit it’s a great idea but do you use something else for routing?
  
  source
  - nbailey@lemmy.ca ⁨4⁩ ⁨months⁩ ago
    Yep. Firewall, routing, dhcp, dns, everything you’d expect from a gateway device. Plain Debian (or really any distro) can do it all. With a 1gbps bi-directional connection fully saturated it will run at about 10% cpu on my very crappy low power Celeron CPU.
    
    Plus, there’s no web UI full of janky and insecure CGI scripts to exploit, and software updates are forever (well, until x64 is deprecated, so basically forever).
    
    source
    -> View More Comments
- Bakkoda@sh.itjust.works ⁨4⁩ ⁨months⁩ ago
  Does VyOS count?
  
  source
mlaga97@lemmy.mlaga97.space ⁨4⁩ ⁨months⁩ ago
OpenWRT, because it has a nice interface, runs on half a toaster, and I’ve yet to find something that I need it do that it couldn’t do but OPNSense could.

I did try PFSense many years back and it just seemed overly complicated and generally flaky. I had trouble setting it up as tinc vpn client despite that being a trivial task in OpenWRT, so I switched back.

source
MangoPenguin@lemmy.blahaj.zone ⁨4⁩ ⁨months⁩ ago
I run Opnsense.

I’d like to try OpenWRT and move to a nice low power router, but figuring out what hardware is supported is hard, as just “it runs openwrt” isn’t good enough when hardware acceleration often doesn’t work and stuff like that. Overall just too confusing for me to bother with finding hardware that will handle at least 3 Gbps throughput.

VyOS looks interesting but CLI only sounds super rough.

source
- possiblylinux127@lemmy.zip ⁨4⁩ ⁨months⁩ ago
  Honestly you can go buy some random device and it will probability be supported. For instance I bought a Linksys router from Walmart and it runs Openwrt fine.
  
  source
  - MangoPenguin@lemmy.blahaj.zone ⁨4⁩ ⁨months⁩ ago
    Finding throughput data is difficult though, basically anything will support like 500Mbps, but hitting 1-2Gbps consistently with internet downloads or transfers crossing VLANs seems a lot tougher.
    
    source
h3ndrik@feddit.de ⁨4⁩ ⁨months⁩ ago
What kind of extensive network setups are you running at home? I just have a few Wifi-routers with OpenWRT and one server / NAS.

source
- MigratingtoLemmy@lemmy.world ⁨4⁩ ⁨months⁩ ago
  Most home setups will likely work fine with just one firewall, but I am planning for 2 at the very least for my network. Also, sometimes it might be better to run a separate router in a VM and have a distinct network behind it if you want to segment said network more thoroughly/want to emulate an enterprise environment etc. I personally see good use for running 2 or more routers (software/hardware) in a lab, but YMMV
  
  source
  - h3ndrik@feddit.de ⁨4⁩ ⁨months⁩ ago
    Thanks. I was going a bit more for the “what do you need that for” aspect. Emulating an enterprise environment sounds more like tinkering or learning? I mean I get network segmenting if you want to seperate for example an home-office from the entertainment devices in the livingroom from the cheap unpatched IoT devices… And also have a seperate network to experiment in the basement lab… Doing firewalling to keep the TV from transmitting behaviour tracking data to the manufacturer… Stop the kids from accessing the network share…
    
    But are that hypothetical use-cases? Or what do people actually use the 2 consecutive firewalls and different network segments for?
    
    source
    -> View More Comments
TheButtonJustSpins@infosec.pub ⁨4⁩ ⁨months⁩ ago
I’m on pfSense+, but I’ll be switching to opnSense eventually.

source
TheHolm@aussie.zone ⁨4⁩ ⁨months⁩ ago

VyOS: Debian based router + firewall. Linux makes it easier for people to pick up the CLI but I’ve heard complaints about it being difficult to follow. Currently CLI only, at least without third-party solutions, but is powerful and competes directly with OPNsense for features for the most part. Seems to be just as stable. my mistake, FOSS version is not LTS but a rolling release and needs to be compiled.

Very misleading statement. Both rolling and LTS are FOSS, they just do not provide LTS binaries for free. Want LTS? build it yourself , all tools and guides(bit outdated) is out there. It will took 30 min you your time to setup.

source
- MigratingtoLemmy@lemmy.world ⁨4⁩ ⁨months⁩ ago
  My apologies, I didn’t realise the LTS version’s source was free. I’ll edit the post, thanks for pointing it out. Could you tell me more about your VyOS setup?
  
  source
  - TheHolm@aussie.zone ⁨4⁩ ⁨months⁩ ago
    Sorry, what do yo want to know? IT just a linux based router pretended to be a juniper FW. NAT/IPv6/PPPoE/VRFs are working as expected.
    
    source
    -> View More Comments
possiblylinux127@lemmy.zip ⁨4⁩ ⁨months⁩ ago
No one can beat the portability and flexibility of openwrt

source
Decronym@lemmy.decronym.xyz ⁨4⁩ ⁨months⁩ ago
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

Fewer Letters More Letters

AP WiFi Access Point

DNS Domain Name Service/System

IP Internet Protocol

Unifi Ubiquiti WiFi hardware brand

[Thread #514 for this sub, first seen 14th Feb 2024, 22:35] [FAQ] [Full list] [Contact] [Source code]

source
CarbonatedPastaSauce@lemmy.world ⁨4⁩ ⁨months⁩ ago
OPNsense all the way. I run it in a VM. I ran PFsense for years then finally went through the pain of migrating. It was worth it for the UI improvements alone. PFsense also corrupted itself twice in about 4-5 years of running it, requiring restores from VM snapshots. OPNsense has been rock solid but it’s only been 2 years since I migrated.

I have used openwrt but only for a WiFi AP, not as a real router. I’ve since moved to a Unifi AP which works fine, but I won’t by their stuff again for other reasons.

source
farcaller@fstab.sh ⁨4⁩ ⁨months⁩ ago
I tried opn/ pfsense, VyOS (the rolling one. Stable is paid only), and a couple commercial options. Surprisingly not a single free/foss option can do IPv6 properly (I was looking specifically for prefix delegation for downstream routers). Cashed out for a single RouterOS CHR license and never bothered since.

But otherwise I tend to like VyOS. the rolling releases as the only free option make it somewhat questionable for something more serious though.

source
- TheHolm@aussie.zone ⁨4⁩ ⁨months⁩ ago
  Stable is not “pay only” . Just build it yourself, all tools are available. it will take 30 minutes of your time if you have docker environment ready.
  
  source
  - farcaller@fstab.sh ⁨4⁩ ⁨months⁩ ago
    oh, that’s actually a fair point! You’re correct.
    
    DHCPv6-PD is still effectively broken, though.
    
    source
Big_Boss_77@kbin.social ⁨4⁩ ⁨months⁩ ago
Has anyone tried running these on a raspberry pi? What's the verdict?

source
- MigratingtoLemmy@lemmy.world ⁨4⁩ ⁨months⁩ ago
  AFAIK options 2 and 4 only. I can’t trust a USB to ethernet adapter for stability either
  
  source

Fewer Letters	More Letters
AP	WiFi Access Point
DNS	Domain Name Service/System
IP	Internet Protocol
Unifi	Ubiquiti WiFi hardware brand