Trace: Router Hardware

Router Hardware

This is an old revision of the document!


(Jan 2023) For my router, including DNS (BIND9) and DHCP (ISC DHCP) I am using a Supermicro SYS-E200-9B that comes with a Supermicro motherboard X11SBA-LN4F. I purchased this in 2016 and got functional in 2017, whilst waiting for NFTables to run all required features on Ubuntu. The X11SBA-LN4F has an Intel Pentium N3700 system with 4 x Intel i210-AT GbE LAN. I got with maximum 8GB RAM and 120GB mSata HD. Sadly the mSata HD was a Chinese branded unit that failed after 3 years operation. I replaced it with an old Samsung 256GB 860 SSD that I had on hand. I also took the opportunity to change the router from Ubuntu to Debian at this time. The N3700 CPU had reasonable performance at the time and includes AES instruction, which a number of common lower priced options at the time did not, e.g. J1900 CPU. The AES CPU instruction helps improve encryption performance significantly, handy for SSL / VPN. The unit is still performing well now. including the 10 year old Samsung SSD. I run the following software on it, all bare metal:

  • NFtables for firewall and routing
  • Bind9 for DNS
  • ISC DHCP for DHCP
  • Wireguard for remote access to my network

I would consider to try setting up a VM and Docker on this machine, however I suspect it maybe under powered for this. I would want Docker to be on a VM as I do not like the amount of IPtables configuration it does on its host. This would interfere with my NFTables router firewall configuration, if on the same host.

I looked at the various options for the router hardware, written in 2016.

tldr;

VM / Docker on Router

Progress

As of 2023/01 I setup a VM manager (Libvirt/qemu/KVM) on the router and loaded Docker on it. It is slow but does seem to work. Next: *ISC Kea DHCP in Docker (currently ISC DHCP in bare metal) *ISC Bind 9 in Docker (currently ISC Bind 9 in bare metal) *Wireguard VPN in Docker (currently Wireguard VPN in bare metal)

Router key features:

  1. Operate reliably 24 hours per day, 7 days a week
  2. Low power operation, power cost money
  3. Headless Remote access, with separate BMC NIC (this could be integrated or external KVM, e.g. PiKVM)
  4. Hardware suitable for purpose:
    1. At least 2 NICs (1 WAN plus 1 or more LAN, quality native type NICs, not USB based), 4+ NICs preferable.
    2. NICs to be 1 GB/s type minimum, although as of 2023 2.5GB/s NIC would now be minimum specification
    3. Sufficient CPU power not to limit primary performance
    4. Correct CPU options, e.g. AES, virtualization (VT-x, and as of 2023 VT-d).
  5. No graphical user interface environment install (although individual applications could have web interface)
  6. Connectivity to upstream IPS provided internet
  7. Firewall
  8. DNS
  9. DCHP
  10. VPN for use as secure gateway to allow private access from public internet

The following key services define the router:

  • network services (bare metal)
  • ISP Internet connectivity (bare metal)
  • main firewall (bare metal)
  • DNS
  • DHCP
  • VPN (for secure public access to LAN)

Assumptions and Limitations

  • Low power means low CPU resources, hence care with applications that require significant or otherwise unnecessary resources.
  • Some services on bare metal to ensure reliable performance
  • This machine is much slower than usual hardware, and this is noticeable on interface usage, even no graphical.
  • The network and related services performance must NOT limit performance on upstream IP connectivity to greater than 100Mb/s and preferably only limit as speed get close to NIC's 1 Gb/s hardware speed. (At the moment my internet connection is via VSDL and is limited to about 65Mb/s down and 16MB/s up and this hardware and setup seem to be performing well.)

Docker really does some work on the firewall using iptables. For this reason I decided to setup a virtual machine (VM) environment, Linux QEMU/KVM/Libvirt based. VM's seem to impact the firewall / network setup less adversely than Docker. The use of the VM isolates the Docker firewall machinations from the bare metal.

Comments on Proxmox;

tldr;

Specific issues with use of headless X11SBA-LN4F hardware

IPMI KVM Display Problems

Forcing Display option at boot in Ubuntu

Controlling BMC Terminal Resolution in Ubuntu

Router Ethernet Hardware Consideration

/app/www/public/data/attic/linux_router/hardware.1681609413.txt.gz · Last modified: 2023-04-30 Sun wk17 17:44
CC Attribution-Share Alike 4.0 International Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International