Build your own router

[Snowreap]

I've finally decided to build some new routers (one for Arsilon, one for my mother, and one for me).

my current router is an old Dell OptiPlex GX1 (a 400MHz Pentium II model) with some extra network cards installed. it has worked reliably, but hardware doesn't last forever and at some point I'm going to run out of spare parts. also, I'd like to have a better VPN setup between my house, my brother's, and my mom's, so I'd like to have a router installed at each location. this means the routers need to be small -- while using a full-size PC as a router works for me I don't expect others to be happy with it.

For hardware, I'm using the Soekris net-6501-50 with 4GB SSD storage. A lot of people run 'packaged' firewall software on such a device, such as pfSense or m0n0wall but I'll just be using OpenBSD.

I use OpenVPN on my current router to provide client-to-router VPN connections. I'll continue to use OpenVPN on the new routers for that kind of thing, but I'll be using IPsec VPN tunnels for always-up router-to-router VPN connections. I haven't used IPsec before so this will be a learning experience for me. IPsec is built into OpenBSD (and a lot of other systems too). OpenVPN is a third-party add-on. both can handle client-to-router connections, but OpenVPN has better support for tunneling VPN traffic through web proxy servers and firewalls, which is why I've been using that.

anyway, everything is ordered and I'm just waiting for it all to arrive. if I'm lucky I can have it all put together by Thanksgiving. we'll see how it goes.

-ken

[Jakensama]

Whats the advantage of a $416 homemade router over a cheaper store version that you could flash with what you want?

[Snowreap]

there would be very little, if I could flash it with what I want. unfortunately, getting what I want in flash form doesn't seem possible.

I have several WRT54GL routers, and putting tomato on them is usually the first thing I do after unboxing them and plugging them in for the first time. but tomato (and most other ready-made flash images) don't include OpenVPN (or don't readily allow the OpenVPN features I need without recompiling everything myself), don't provide authoritative DNS service (only DNS forwarding to upstream servers) and don't support having more than one WAN port.

also, a lot of the consumer-grade routers don't have enough CPU power to handle high-bandwidth encryption. some of them do have hardware accelerators, but it can be tricky figuring out which ones, and driver support isn't universal.

-ken