What are we running as routers / firewalls these days?

[blood]

I’ve been rocking a Solidrun clearfog base with Armbian for ~10 years now as my home router and was very happy with it until a few months ago when the newer software updates began to break it. I think the software support is beginning to rot due to not many users and thus no push to maintain it. I figure it’s time to start looking for a replacement.

 

I have a Rock 5 ITX that could do it but I’ve been trying to keep it on the vendor kernel so it can transcode in hardware for Jellyfin - but that vendor kernel has issues reliably detecting the SATA controllers - and I don’t want to have to reboot my router multiple times to get the hardware to work after applying updates.

 

i also just got a Radxa Orion o6 which is awesome hardware but still quite raw. I don’t trust it for a router and it’d be overkill anyways.

 

And I have some stupidly powerful x64 systems that eat a bunch of power but are otherwise up to the task. But I don’t want to go that way.

 

What do you use these days for affordable, performant, and low power routers? At least two gbe ports (10g or multigig preferred), enough CPU to NAT and forward for 500m/30m cable connection, and handle wireguard at a good clip. Preferred serial console … support for Debian / Armbian. I don’t care about a GPU. What do people use these days?

[eselarm]

I have been using 64-bit x86-64 and aarch64 virtual machines as router since 2016, in combination with a simple managed switch that separates and/or combines VLANs depending on ISP and physical connection (ADSL, 4G, fiber). Currently RPi4 where the router VM is 2 cores and 768MiB and connects to 'LAN' and 'WAN' VLAN/bridges. I can still max download at 350Mbps which is my max fiberspeed.

I also have a NanoPi-R6C that can replace the RPi4 eventually, it currently serves as faster clone/backup/development, like routing everything via 4G smartphone for example.

[blood]

Thanks - that's a couple options I should keep in mind:

1. adding the router to a hyperconverged setup
2. running one-armed against a switch via VLANs

I've enjoyed having a separate WAN and LAN link for so long that I fell into looking for boxes with 2 physical links but that's totally not a requirement and you're right.

[umiddelb]

I'm running Proxmox VE on small x86-64 hardware with multiple nics and then various LXC containers / VMs. One for OpenWRT, Unifi, Adguard Home, NextCloud, HomeAssistant, Freifunk-Offloader, ...

[ag123]

I'm using OrangePi Zero 3 as a basic desktop WIfi AP hotspot.

it isn't practically 'high performance' certainly no WiFi 6 etc.

But basic single channel 5 ghz wifi is there with throughput about 130 Mbps across both ethernet and the Wifi interface.

It is ok as a 'desktop Wifi AP' (satelite), but probably underpowered as a router to the internet.

https://www.armbian.com/orange-pi-zero-3/

 

these works if what you need is wifi 'repeaters' to alleviate wifi blindspots say due to walls etc. but that likely means ethernet cabling as well. i.e. ethernet to upstream, wifi is the hotspot.

I actually liked these (OrangePi Zero 3 running Armbian as Wi-Fi hotspot) vs proprietary 'mesh' cubes as you have full control in the OS layer wifi / bridging etc, less blackboxes, less propietary limitations etc.

 

The hellhole about WiFi and sometimes ethernet is that a lot of those drivers are propietary some without any open sourced driver interface on the linux side, let alone the chip firmware.

There are a lot of good boards, cpu e.g. RK3588 and you have a Wifi chip that has *zero* (open sourced) drivers. e.g. Orange Pi 5 Ultra.

 

 

 

[blood]

Thanks for those that answered. I was hoping someone would bring up a board targeted at networking (router / firewall) that was well supported by modern software, but nothing is really jumping out. Here are some more random thoughts on the matter... since my previous experience was with SolidRun Clearfog Base (and with Armbian it was quite positive!) I am interested in their newer Clearfog CN9130 Base but it's a bit expensive and I'm hesitant to use anything not supported by Armbian due to poor experience with vendor images. But it looks cool! MACCHIATObin double shot isn't new, and doesn't have the best support either from what I can gather - but it also is attractive. And lastly, Honeycomb LX2 is pretty boss as well - but it also is a bit dated now, isn't cheap, and seems to have not caught on well so doesn't have great software support. All of those seem like nice hardware but I don't expect the software experience to warrant buying one.

 

I had an impulse to buy when I saw the new dual 2.5gbe HAT from Radxa as I have a Rock 4a that claims to support it. I've had that little box in use as a container host running simple services like DNS, DHCP, Unifi controller, etc for a long time now and it's been nothing but reliable - though I do need to evacuate it so I can try bringing it up running Bookworm (it's on Bullseye still - but it's stable!). But I just noticed that maybe its own software support is rotting... it's community supported and the last Armbian image for it is quite old, so maybe I shouldn't put any more money or effort into it and let it do its thing. Dunno. But yeah, a tiny system that is quite low power which supports 2 x 2.5gbe and 1gbe along with NVMe sounds pretty nice especially since I already own the SBC...

 

I suppose what I should really do is continue to ride my existing router until it dies. Considering I locked the kernel and firmware I expect it will work for a long while at this point, though I don't figure it to be able to upgrade to the next major Debian release once it's available. Maybe by then the support for Rock 5 ITX will be solid and I can start using it for this.

 

If anyone else runs Armbian systems as their firewall, please chime in with thoughts and experiences!