This is an old revision of the document!
Router Hardware
(Jan 2023) For my router, including DNS (BIND9) and DHCP (ISC DHCP) I am using a Supermicro SYS-E200-9B that comes with a Supermicro motherboard X11SBA-LN4F. I purchased this in 2016 and got functional in 2017, whilst waiting for NFTables to run all required features on Ubuntu. The X11SBA-LN4F has an Intel Pentium N3700 system with 4 x Intel i210-AT GbE LAN. I got with maximum 8GB RAM and 120GB mSata HD. Sadly the mSata HD was a Chinese branded unit that failed after 3 years operation. I replaced it with an old Samsung 256GB 860 SSD that I had on hand. I also took the opportunity to change the router from Ubuntu to Debian at this time. The N3700 CPU had reasonable performance at the time and includes AES instruction, which a number of common lower priced options at the time did not, e.g. J1900 CPU. The AES CPU instruction helps improve encryption performance significantly, handy for SSL / VPN. The unit is still performing well now. including the 10 year old Samsung SSD. I run the following software on it, all bare metal:
- NFtables for firewall and routing
- Bind9 for DNS
- ISC DHCP for DHCP
- Wireguard for remote access to my network
I would consider to try setting up a VM and Docker on this machine, however I suspect it maybe under powered for this. I would want Docker to be on a VM as I do not like the amount of IPtables configuration it does on its host. This would interfere with my NFTables router firewall configuration, if on the same host.
I looked at the various options for the router hardware, written in 2016.
VM / Docker on Router
Progress
As of 2023/01 I setup a VM manager (Libvirt/qemu/KVM) on the router and loaded Docker on it. It is slow but does seem to work. Next: *ISC Kea DHCP in Docker (currently ISC DHCP in bare metal) *ISC Bind 9 in Docker (currently ISC Bind 9 in bare metal) *Wireguard VPN in Docker (currently Wireguard VPN in bare metal)
Router key features:
- Operate reliably 24 hours per day, 7 days a week
- Low power operation, power cost money
- Headless Remote access, with separate BMC NIC (this could be integrated or external KVM, e.g. PiKVM)
- Hardware suitable for purpose:
- At least 2 NICs (1 WAN plus 1 or more LAN, quality native type NICs, not USB based), 4+ NICs preferable.
- NICs to be 1 GB/s type minimum, although as of 2023 2.5GB/s NIC would now be minimum specification
- Sufficient CPU power not to limit primary performance
- Correct CPU options, e.g. AES, virtualization (VT-x, and as of 2023 VT-d).
- No graphical user interface environment install (although individual applications could have web interface)
- Connectivity to upstream IPS provided internet
- Firewall
- DNS
- DCHP
- VPN for use as secure gateway to allow private access from public internet
The following key services define the router:
- network services (bare metal)
- ISP Internet connectivity (bare metal)
- main firewall (bare metal)
- DNS
- DHCP
- VPN (for secure public access to LAN)
Assumptions and Limitations
- Low power means low CPU resources, hence care with applications that require significant or otherwise unnecessary resources.
- Some services on bare metal to ensure reliable performance
- This machine is much slower than usual hardware, and this is noticeable on interface usage, even no graphical.
- The network and related services performance must NOT limit performance on upstream IP connectivity to greater than 100Mb/s and preferably only limit as speed get close to NIC's 1 Gb/s hardware speed. (At the moment my internet connection is via VSDL and is limited to about 65Mb/s down and 16MB/s up and this hardware and setup seem to be performing well.)
Docker really does some work on the firewall using iptables. For this reason I decided to setup a virtual machine (VM) environment, Linux QEMU/KVM/Libvirt based. VM's seem to impact the firewall / network setup less adversely than Docker. The use of the VM isolates the Docker firewall machinations from the bare metal.
Comments on Proxmox;