My x86 router journey

  • Thread starter Thread starter varkey
  • Start date Start date
  • Replies Replies 125
  • Views Views 21,816
I had recently acquired a mini pc with 4 intel NICs to be used as an x86 router / firewall. More details around the process of acquiring it is in another thread - Important - All international "Gift" packages now liable for customs duty @ 41.2% | Online Shopping

So I got the mSATA SSD module (and a keyboard 😛) and I was trying to set up things over the last 1-2 days. At first I tried OPNsense, but to be honest, I didn't find it whole thing as refined or polished as pfSense. I couldn't even get my BSNL and Kerala Vision connections up for some reason. Maybe it is bit of unique or non-supported, I do not know, but the same config works on first try in OpenWRT without issues.

The Kerala Vision and BSNL connections come over the same fiber, goes into my Huawei ONT in transparent bridge mode (well, it doesn't have any other mode 😉) and then into the router, on the same port. Then VLANs are setup for each (1830 for BSNL Voice, 702 for BSNL Internet and 140 for Kerala Vision). On OPNsense, the the voice interface came up fine cause it was just a static IP config and didn't need mac spoofing. However for BSNL and Kerala Vision, as they do mac binding, I needed to spoof the mac.

But this doesn't appear to be supported natively OPNsense, and my PPPoE interfaces never even came up. Maybe once or twice, the BSNL interface came up but got disconnected in a short time. The logs show PPPoE timeout and retrying. 🤷‍♂️
I tried what I can and gave up.

Now on pfSense, the UI is more clean and polished. The layout also seemed better than OPNsense. I did the same config on pfSense and here they were pretty direct and mac spoofing on VLAN interfaces is not supported and must be set on the parent interface (this is the feature request Feature #1337: VLANs with different MAC address than parent interface - pfSense - pfSense bugtracker). But the issue is, I need two different macs when talking to Kerala Vision and BSNL (as that's what is originally registered on their end and I didn't want to get it reset).

I anyway I found a work-around in pfSense forum (MAC address spoofing on VLAN's and impressions from a second-try user) where you need to create bridge interface with just the VLAN interface as a member, and on the bridge interface you can spoof the mac. So BSNL Internet was setup on the regular VLAN interface and Kerala Vision on the bridge interface.

Finally, I was able to get my WAN interfaces up, now the next problem. The unbound DNS resolver kept on getting restarted. Log entries like below were being logged repeatedly. I searched online but couldn't find a solution that worked for me. Every 4 seconds or so the resolver was getting restarted which breaks everything as DNS fails.

Code: 
Mar 22 13:51:25 mercury unbound: [54761:0] info: start of service (unbound 1.9.1).

Anyway I found the problem, it was the DHCP client for the BSNL IPv6 which was constantly getting a no addresses response. And for each such response, unbound gets restarted, I have no clue why 🤷‍♂️ Mostly related to this bug Bug #5413: Incorrect Handling of Unbound Resolver [service restarts, cache loss, DNS service interruption] - pfSense - pfSense bugtracker where unbound is restarted for each change rather than using unbound-control for such cases.

Code: 
Mar 22 12:55:33 mercury dhcp6c[97095]: status code for NA-0: no addresses
Mar 22 12:55:41 mercury dhcp6c[97095]: status code for NA-0: no addresses
Mar 22 12:55:47 mercury dhcp6c[97095]: status code for NA-0: no addresses
Mar 22 12:55:54 mercury dhcp6c[97095]: status code for NA-0: no addresses
Mar 22 12:56:00 mercury dhcp6c[97095]: status code for NA-0: no addresses
Mar 22 12:56:06 mercury dhcp6c[97095]: status code for NA-0: no addresses
Mar 22 12:56:13 mercury dhcp6c[97095]: status code for NA-0: no addresses
Mar 22 12:56:19 mercury dhcp6c[97095]: status code for NA-0: no addresses
Mar 22 12:56:25 mercury dhcp6c[97095]: status code for NA-0: no addresses

Setting this to true fixed the problem, as it is probably BSNL not responding.

pfsense-ipv6-dhcp.webp

So far things are working, I am still playing with how the fail over and load balancing should work. Overall, OpenWRT seems more mature for my use cases? I mean so many issues in getting something like this working which I could get it running in OpenWRT with no such challenges.

dashboard-pfsense-edited.webp


@C3PO @vishalrao @vignesh_venkatesan @achaudhary997 @JB700
 
Click to expand...
The following configuration did not work.

1. Disable VLAN100 in Huawei router

1584946091868.png


2. Specify VLAN 100 in pfSense for the NIC interface.

1584946176062.png


3. Specify PPPoe interface to this igb6.100 link,
1584946330536.png


4. Finally setup a WAN for this PPPOE interface in Interfaces/Interface Assignments

1584946412303.png


5. PPP log doesnt show anything useful

1584946494026.png


@varkey Any idea what else is needed (I did not setup an MAC spoofing)?
 
Try selecting Enable VLAN in screenshot 1, and enter your VLAN ID there. Then on the pfSense side, you don't need to create a VLAN interface. Just try setting up PPPoE on igb6 directly.
 
It is strange that pfSense doesn't get to ppp authentication. Do i need to spoof any mac address?

It would be great if you could post your pfSense config.
 
As I said, that is probably an issue on how the ONT works. I use a pure bridge ONT, it takes fiber in and gives out ethernet, there is zero config on the ONT side. In your case it wouldn't work that way cause you want only VLAN 100 to be bridged and not your voice.

You might need to try deleting all WAN profiles on the ONT, and create just one profile with type as Bridge and VLAN turned off. That might make it work as a transparent bridge, or try even without any WAN profiles.
 
"In your case it wouldn't work that way cause you want only VLAN 100 to be bridged and not your voice."

Actually no, i want both Internet and Voice VLANS to be untagged in pfSense rather than Huawei. I started with VLAN 100 for testing purposes.

Sorry to repeat it again, one thing i am not sure about is the mac address. Airtel must have registered mac address of the ONU on their end. I wonder if i need to specify it in pfSense.

In your OP you had mentioned about spoofing mac address in your pfSense configuration. Can you elaborate which device mac adddress was it and where did you specify in pfSense?
 

Then try the way I mentioned, by deleting all profiles and just having one profile in bridge mode with VLAN unchecked. Or you need to try VLAN binding like this -- VLAN Binding Configuration - Huawei EchoLife ONT V300R018C10 and V500R018C10 Web Page Reference 03 (Enterprise) - Huawei

At this point this is purely something on the ONT side, the mac binding etc comes later, you are not even able to reach the PPP AC/auth server.

I needed to spoof mac address, cause BSNL allows ppp auth only from authorised mac address. I don't think Airtel does that, even if they did, you'd get a different authorization failed error, not timeouts. Anyway it would be the Huawei's WAN side mac address, and on pfsense side, you need to spoof the parent interface (ie igb6 and not the VLAN interface igb6.100)
 
Yes, the VLAN binding did not work.

Do you have access to the web ui of Huawei HG8010H? Reason for asking is that i have an Alcatel Lucent I-240G-D which is a bridge ONT as well, but i dont have the username/password for its web ui. The Airtel guys have locked it down, and they dont even know the password (it is an old modem they used to provision).
 
I would like to setup up a basic firewall, at a budget, but don't know much about it. So some noob questions. 🙏

1. Is a dedicated firewall required for a normal home user. (One whose not hosting anything like a web service. Normal use, Smart lights, torrenting, playstation etc)

2. How much would a basic intrusion detection system cost? And which one is recommended?

3. How much functionality would an openwrt router be able to perform (compared to a dedicated firewall) Would a higher cost router with a higher processing power do better?

4. Would a Mikrotik router do well as a basic firewall.
 
varkey said:
So far things are working, I am still playing with how the fail over and load balancing should work. Overall, OpenWRT seems more mature for my use cases? I mean so many issues in getting something like this working which I could get it running in OpenWRT with no such challenges.
Click to expand...
So got Load Balancing with failover working now?
 
@eriek_halenx
1. IMHO, most of us don't require a full-fledged x86 firewall. An ARM-based solution like the Mi Router 3G would do the stuff fine(Except IDS and IPS and some advanced things which I don't have any idea 🙂 ). As a hobby project, it is awesome. In the long-run energy costs would add up(J3160 is a great chip with aes-ni support if you want to save some electricity cost).

2. Basic Snort or Suricata with the recommended basic rules will do fine on pfsense or opnsense. If you need a more advanced and new rulesets you can purchase from their respective sites. IIRC @C3PO has paid subscription to one of the either.

3. Based on @varkey's adventures we can be sure that the little Mi router 3G, a dual core 880Mhz chip could handle wireguard traffic at around 100Mbps fine. An x86 router with corresponding crypto instruction sets such as AES-NI would outperform most of the highly optimized ARM based VPN routers. Better VPN throughput is another thing that an x86 router would provide. (Above points listed considering, OpenWRT is generally run on ARM and MIPS devices)

4. Certainly. We have some people here on the forum running/ran Mikrotik devices.(To mention a few: @pothi, @varkey )

BTW @varkey, I've ordered the Router 3G again on the AliExpress 10th Anniversary. Got it for around 3.7k(I'm sad)
 
Last edited:

Similar threads

L
Unable to diagnose frequent downtime issue with my FTTH
Replies
6
Views
1,118
laboreddislodge
pingmelater
  • Article Article
Configuration BSNL FTTH VOIP GJ region. (MicroSIP, Zoiper5, Default Android Dialer, Zoiper Android)
Replies
11
Views
14,072
shashanksgupta
AARON NASH
  • Article Article
Configuration for VOIP/SIP calls( using Zoiper/GS Wave) on Huawei ONT and TP Link Router.
3 4 5 6 7
Replies
97
Views
29,644
pillaicha
M
  • Article Article
Using the Dlink 2750u as a true Ethernet WAN router
16 17 18 19 20
Replies
288
Views
327,464
kav
Top