Used to run a virtualized firewall setup. And then one day discovered that somewhere along the lines I had made a change (or an update changed something) that meant proxmox admin interface was being served publicly. That's despite confirming during initial setup that it isn't.
So now I do not do any funky stuff with firewalls anymore. Separate appliance with opnsense bare metal.
My router is a 16GB n150 mini PC with dual NICs. The actual router OS is within openwrt VM managed by Incus (VM/Container hypervisor) that has both NICs passed through.
One of the NICs is connected to another OpenWrt wifi access point, and the other is connected to the ISP modem.
The n150 also has a wifi card that I setup as an additional AP I can connect to if something goes wrong with the virtualization setup.
Been running this for at least 6 months and has been working pretty well.
Both port specific firewall rules, and web-server IP permissions are important.
For example, bandwidth rate-limiting may be inhibited for admin SSH or package updates, and LAN IPv4 private ranges for your host address pool are set.
Finally, your internal DHCP should statically bind your admin computer MAC to a fixed LAN host IP to further reduce issues.
Personally, I always build my NAS from scratch, as I have lost count of the number of problems web-GUI have caused over the years. =3
Technically it's an IPv4 router once you enable net.ipv4.ip_forward in step 1, the rest is enabling a whole lot of supplementary services and operations not intrinsic to the definition of a router.
Thank you for informing me that a novel definition of the term "router" has come along since the last time I turned a Linux box into a router. The world changes in strange ways sometimes!
What is "CPE" in this context? It's probably not "Common Platform Enumeration" (my top results for "cpe linux") or "Customer-Premises Equipment." ("cpe networking")
> CPE generally refers to devices such as telephones, routers, network switches, residential gateways (RG), set-top boxes, fixed mobile convergence products, home networking adapters and Internet access gateways that enable consumers to access providers' communication services and distribute them in a residence or enterprise with a local area network (LAN).
I think a CPE could (be/include) a router, but usually it refers to the demarc between the provider's network and the customer's (no matter who owns/manages it).
For a Linux box to be a true CPE you'd likely need somewhat of a specialized card, one that can communicate directly to the next device up the line (e.g, take commercial fiber or cable in, ISDN modem, etc).
If it just shoots out ethernet into some other box next to it, it's likely not a CPE.
> CPE generally refers to devices such as telephones, routers, network switches, residential gateways (RG), set-top boxes, fixed mobile convergence products, home networking adapters and Internet access gateways that enable consumers to access providers' communication services
From my understanding any type of device that is used to extend or facilitate provider services is a CPE. So a router just acting as an extender would still be a cpe, as would a modem, as would anything that is on the customer side and facilitates provider services. Only situation a router wouldn't be a cpe is if it was just for a local lan network.
I didn't see in TFA --although I may have missed it-- where it said it was replacing the ISP's router/CPE. Anything routing traffic is a router.
At home I've got both a CPE given by my ISP and my own router that routes and bridges traffic between two LANs of mine (192. and 10.).
Moreover the lack of IPv6 inside our own LANs is, for many of us, a feature. It doesn't mean we don't have an IPv6 address: it just means we have the choice and did choose to have our own LANs on IPv4 only. And, no, I don't care that it makes some programmers at some megacorp' lives more difficult to "reach" inside my networks.
I'm the boss at my home and my router is IPv4 only.
Used to run a virtualized firewall setup. And then one day discovered that somewhere along the lines I had made a change (or an update changed something) that meant proxmox admin interface was being served publicly. That's despite confirming during initial setup that it isn't.
So now I do not do any funky stuff with firewalls anymore. Separate appliance with opnsense bare metal.
I currently do something similar.
My router is a 16GB n150 mini PC with dual NICs. The actual router OS is within openwrt VM managed by Incus (VM/Container hypervisor) that has both NICs passed through.
One of the NICs is connected to another OpenWrt wifi access point, and the other is connected to the ISP modem.
The n150 also has a wifi card that I setup as an additional AP I can connect to if something goes wrong with the virtualization setup.
Been running this for at least 6 months and has been working pretty well.
Both port specific firewall rules, and web-server IP permissions are important.
For example, bandwidth rate-limiting may be inhibited for admin SSH or package updates, and LAN IPv4 private ranges for your host address pool are set.
Finally, your internal DHCP should statically bind your admin computer MAC to a fixed LAN host IP to further reduce issues.
Personally, I always build my NAS from scratch, as I have lost count of the number of problems web-GUI have caused over the years. =3
That's not a router, that's a CPE, and one without IPv6 support.
Technically it's an IPv4 router once you enable net.ipv4.ip_forward in step 1, the rest is enabling a whole lot of supplementary services and operations not intrinsic to the definition of a router.
Thank you for informing me that a novel definition of the term "router" has come along since the last time I turned a Linux box into a router. The world changes in strange ways sometimes!
What is "CPE" in this context? It's probably not "Common Platform Enumeration" (my top results for "cpe linux") or "Customer-Premises Equipment." ("cpe networking")
Googling "cpe vs router" shows websites comparing "Customer Premises Equipment" with routers. I don't think it fits though.
I think it's your second one (used to be called the "modem" in the modem→router→ pc setups of yore).
> CPE generally refers to devices such as telephones, routers, network switches, residential gateways (RG), set-top boxes, fixed mobile convergence products, home networking adapters and Internet access gateways that enable consumers to access providers' communication services and distribute them in a residence or enterprise with a local area network (LAN).
https://en.wikipedia.org/wiki/Customer-premises_equipment
Given that the Wikipedia definition of CPE includes routers, I don't see how calling it CPE precludes it being a router, as the poster claimed:
> That's not a router, that's a CPE, and one without IPv6 support
I think a CPE could (be/include) a router, but usually it refers to the demarc between the provider's network and the customer's (no matter who owns/manages it).
For a Linux box to be a true CPE you'd likely need somewhat of a specialized card, one that can communicate directly to the next device up the line (e.g, take commercial fiber or cable in, ISDN modem, etc).
If it just shoots out ethernet into some other box next to it, it's likely not a CPE.
I mean the wikipedia literally states:
> CPE generally refers to devices such as telephones, routers, network switches, residential gateways (RG), set-top boxes, fixed mobile convergence products, home networking adapters and Internet access gateways that enable consumers to access providers' communication services
From my understanding any type of device that is used to extend or facilitate provider services is a CPE. So a router just acting as an extender would still be a cpe, as would a modem, as would anything that is on the customer side and facilitates provider services. Only situation a router wouldn't be a cpe is if it was just for a local lan network.
I didn't see in TFA --although I may have missed it-- where it said it was replacing the ISP's router/CPE. Anything routing traffic is a router.
At home I've got both a CPE given by my ISP and my own router that routes and bridges traffic between two LANs of mine (192. and 10.).
Moreover the lack of IPv6 inside our own LANs is, for many of us, a feature. It doesn't mean we don't have an IPv6 address: it just means we have the choice and did choose to have our own LANs on IPv4 only. And, no, I don't care that it makes some programmers at some megacorp' lives more difficult to "reach" inside my networks.
I'm the boss at my home and my router is IPv4 only.
And I've got that in addition to my ISP's CPE.