Heya, so I’ve got a spare computer from a neighbor recently, (i7-9700, 32GB DDR4 - Dell XPS 8930) and at first I thought homelab, Proxmox/XCP-NG, etc and discovered it can do IOMMU things. So then I thought, “virtualize the router.” Given the locked down abomination that was thrust upon me by my ISP recently, among other things, I figure now is a good time to figure this out and more advanced networking topics.
I have no networking equipment whatsoever, and this is really my first foray into actually engaging with this rather than just reading about it (I have used DD-WRT in the past, and done some things with networking, but I’m still very naive). I have some experience with KVM via desktop Linux (VirtualBox too, of course), so I’m not terrified of VMs, CLI or containers for that matter. I had a box set up before with openmediavault, a 2x1TB RAID0, managed some docker containers (and built a container of my own) and shoehorned a Debian VM for pihole onto it; just to give a very shallow overview of what I’ve already done here.
My basic goals here are “simple”, I hope; clear at the very least. I’d like to end up with a virtualized router with a PCI NIC passed through to it and some VLANs. The rest of the small lab will follow with VM/containers. Posting here however, I’d like advice, opinion and some direction; like should I even bother at all and just get a standalone router and use this spare computer for VM/etc, for example. I’m torn between Proxmox and XCP-NG, pfSense and OPNsense, then the ball is in the air in regards to the hardware. I know I’ll need a PCI NIC, switch (managed or not is questionable, but for experience maybe managed?), and a wireless AP. I’ve found some opinion already regarding updates and methodology of the software, and while I would like opinion on that I have to say the networking hardware is where I’m really out of my field. All that said: I’ll also take flat recommendation for an “AIO” router for the “not bother” case or the “in case shit happens” case, which it plainly will.
Thanks for your time
(Didn’t know where else to put this since it involves a couple of topics, hope the DIY Corner is ok)
I don’t personally like virtualizing the the router, especially on the same box as everything else. You will need an update, new driver, the configuration will be messed up, and you will need internet access to fix it, but the router VM is down unless you fix it. Then you are trying to do some type of network bridge with your phone. It turns into a pain.
https://mikrotik.com/ makes some really nice routers with every option under the sun. Warning, there is almost no hand holding with it’s software, so expect a big learning curve.
Proxmox has the most community support right now and what I would go with. I am retiring my last XCP-NG box in a few weeks.
Yep, first thought I had as well. A homelab proxmox machine is nice for screwing around, screwing around will inevitably break things, and all the easiest fixes usually require the internet to look something up or redownload whatever you broke. Separate the internet box from the fiddling box, you want them to break independently from each other, not together.
The forbidden router is forbidden for a reason, it’s a fun idea but best avoided imho 99% of the time
To add to your options for hypervisor setups - Alpine, Debian - is more learning involved, or at least used to be before we had pretend intelligence.
If you want to step into networking I’d start with a discrete router and maybe a discrete switch depending on the router and network. Dumb switch is a fine start, they’re very cheap and useful to have around even if/when you buy a managed switch.
I can definitely see how that could be an issue. It’s part of the reason for the last sentence I wrote as I don’t have a backup if things were to go wrong. Seems as though everyone else agrees. It does beg the question though, virtualize the router on a separate machine? I’m only stuck on virtualizing for potentially simpler disk backups. It would also mean I’d go for a thin-client or something more specialized; I don’t have any low-power computers lying around unfortunately.
Regarding MikroTik, I’ve heard of them before, but it’s not a exactly household name for me so I’m a little iffy; unjustifiably probably lol. How are they affected by the FCC shenanigans though? Current hardware can continue being sold, but software updates have a limit for current hardware (I did just read that it was extended until 2029 from March 2026). These shenanigans are partly why I was leaning into the “build it myself” idea here. That said, I do like the look of what’s offered with their hAP be lineup. The lite doesn’t break the bank and the Media offers some niceties at a surface level. Their RouterOS seems to be closed source, or their parts of it at least; I know the kernel is available. Not a hard requirement to be open source, but in current times it’s a boon at least. As far as the learning curve, well I am green. I might be learning after each config change like MazeFrame mentioned lol. I’m not sure where I could go beyond VLANs currently, but if I can restore to a functioning state in an easy way then I’m game to hit the find out portion often.
Is it strictly community support that’s causing you to switch away from XCP-NG? The biggest hurdle I’ve read regarding XCP-NG was learning their tools. I’d rather not end up fighting their system while working with the underlying Linux, assuming that’s a possible issue here.
Worth noting FCC ban affects only US sellers, you are free to buy whatever you want from overseas sellers. If you want some china special Tenda router or questionable managed switches with funny names, or anything else, you can still buy it.
Should not be necessary for any of the usual suspects (pfsense, opnsense, openwrt).
Any self-respecting router os supports config backup and is mostly static. Similar to a router box you buy.
If the disk dies you can just re image a new disk, restore config and you are up and running in 10 minutes.
My God, this. Virtualizing your router guarantees your entire network gets automatically Stone Aged if something happens to that machine. Sure, hyperscalers do it, but hyperscalers have redunancy and instant failover.
If you’re looking for a router, my recommendation is an Ubiquiti UniFi Cloud Gateway Fiber, which is what I use. The stability and performance are top class for gear you can easily deploy at home and what it lacks in features it more than makes up for in reliability.
More manual, but more choice/flexibility/minimalism and much more learning. For instance my setup is exclusively PVH and dom0 has no IP and is managed over serial, my desire is to hopefully reduce exploitable surface area. I’m not sure how much of that I could do with xcp-ng, PVH support last I heard was coming..
Not sure. I avoid the regular proprietary or consumer level software choices. I went with OpenBSD as an Internet facing router and OpenWRT for wifi router. Recently got a Flint 2 which has been much more impressive than my old wifi router, it has a switch built in - you can see the block diagram here. I think that’s a reasonable candidate - has a sizable (for a consumer router) amount of CPU/memory/disk/ports for you to work with.
I think you should do the Forbidden Router. Yes, you’re always under threat of everything going down if you decide to change hardware or fiddle with it. But that is a good thing!
There is nothing that can train you like when all of a sudden nothing works and you have to think your way through it.
Because one day you will have some sort of rug pull and you’ll have to think yourself out of it – and guess what – The Forbidden Router will have prepared you for that moment.
There is no single project I have undertaken that has trained me in the art of hardware/networking/software amalgamation as hard as the Forbidden Router.
So if ya wanna take the path of least resistance get a Protectli, put pfsense on it, and have Network Chuck guide you through it like a coward, fine. That’s likely the prudent choice.
But if you wanna be a Network Marine — The Forbidden Path awaits.
I don’t like virtualization for nas / data storage for a couple of reasons.
it’s a vm and it depends on 1 or 2 extra software layers that just make it that more complicated and easier in my mind to mess up your data or loose all access to it.
I don’t like it shared with other running applications. if one of those applications goes sideways / compromised then there goes your your data.
