Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #231432 > unrolled thread

Linux router AP with reserved IPs on wlan0?

Back to article view | Back to linux.debian.user

Contents

  Linux router AP with reserved IPs on wlan0? conover@rahul.net (John Conover) - 2021-02-06 11:30 +0100
    Re: Linux router AP with reserved IPs on wlan0? <tomas@tuxteam.de> - 2021-02-06 11:50 +0100
    Re: Linux router AP with reserved IPs on wlan0? Dan Ritter <dsr@randomstring.org> - 2021-02-06 13:10 +0100
    Re: Linux router AP with reserved IPs on wlan0? Stefan Monnier <monnier@iro.umontreal.ca> - 2021-02-06 16:20 +0100
      Re: Linux router AP with reserved IPs on wlan0? conover@rahul.net (John Conover) - 2021-02-06 20:10 +0100
        Re: Linux router AP with reserved IPs on wlan0? Tixy <tixy@yxit.co.uk> - 2021-02-07 10:10 +0100
          Re: Linux router AP with reserved IPs on wlan0? conover@rahul.net (John Conover) - 2021-02-07 10:40 +0100
    Re: Linux router AP with reserved IPs on wlan0? Gregory Seidman <gsslist+debian@anthropohedron.net> - 2021-02-08 03:30 +0100
      Re: Linux router AP with reserved IPs on wlan0? Dan Ritter <dsr@randomstring.org> - 2021-02-08 12:50 +0100
        Security: OpenWRT vs. Debian [Was:] Re: Linux router AP with  reserved IPs on wlan0? Celejar <celejar@gmail.com> - 2021-02-08 14:10 +0100
          Re: Security: OpenWRT vs. Debian [Was:] Re: Linux router AP with  reserved IPs on wlan0? Dan Ritter <dsr@randomstring.org> - 2021-02-08 14:40 +0100
            Re: Security: OpenWRT vs. Debian [Was:] Re: Linux router AP with  reserved IPs on wlan0? Celejar <celejar@gmail.com> - 2021-02-08 15:40 +0100
              Re: Security: OpenWRT vs. Debian [Was:] Re: Linux router AP with  reserved IPs on wlan0? Dan Ritter <dsr@randomstring.org> - 2021-02-08 16:00 +0100
                Re: Security: OpenWRT vs. Debian [Was:] Re: Linux router AP with  reserved IPs on wlan0? Celejar <celejar@gmail.com> - 2021-02-08 16:30 +0100
                  Re: Security: OpenWRT vs. Debian [Was:] Re: Linux router AP with  reserved IPs on wlan0? Dan Ritter <dsr@randomstring.org> - 2021-02-08 17:10 +0100
                    Re: Security: OpenWRT vs. Debian [Was:] Re: Linux router AP with  reserved IPs on wlan0? Celejar <celejar@gmail.com> - 2021-02-08 21:40 +0100
                      Re: Security: OpenWRT vs. Debian [Was:] Re: Linux router AP with  reserved IPs on wlan0? Dan Ritter <dsr@randomstring.org> - 2021-02-08 22:50 +0100
                        Re: Security: OpenWRT vs. Debian [Was:] Re: Linux router AP with  reserved IPs on wlan0? Celejar <celejar@gmail.com> - 2021-02-09 00:30 +0100
                          RE: Security: OpenWRT vs. Debian [Was:] Re: Linux router AP  withreserved IPs on wlan0? Michael Grant <mgrant@grant.org> - 2021-02-09 13:00 +0100
                  Re: Security: OpenWRT vs. Debian [Was:] Re: Linux router AP with reserved IPs on wlan0? Stefan Monnier <monnier@iro.umontreal.ca> - 2021-02-08 17:30 +0100

#231432 — Linux router AP with reserved IPs on wlan0?

A wireless router made with hostapd/dnsmasq/dhcpcd is fairly easy, and
works well with iptables, with one shortcoming.

After antagonizing the Google for hours, I can not find any way to add
reserved IPs based on the the MAC address of devices connected on
wlan0, (presumably in dhcpcd.conf.) Seems kind of a simple oversight
for a wireless AP.

Am I correct in my assumption?

    Thanks,

    John

-- 

John Conover, conover@rahul.net, http://www.johncon.com/

[toc] | [next] | [standalone]

#231433

[Multipart message — attachments visible in raw view] — view raw

On Sat, Feb 06, 2021 at 02:29:08AM -0800, John Conover wrote:
> 
> A wireless router made with hostapd/dnsmasq/dhcpcd is fairly easy, and
> works well with iptables, with one shortcoming.
> 
> After antagonizing the Google for hours, I can not find any way to add
> reserved IPs based on the the MAC address of devices connected on
> wlan0, (presumably in dhcpcd.conf.) Seems kind of a simple oversight
> for a wireless AP.
> 
> Am I correct in my assumption?

I think the jargon is "DHCP reservation" or thereabouts. Do these ([1],
[2]) fit your quest?

And oh, BTW. Don't antagonize Google. They don't love you (besides, they
don't make for good neighbours, but I disgress). My search provider just
gave me those results in exchange for a moderate amount of effort (~15
min).

Cheers :)

[1] https://servercomputing.blogspot.com/2012/02/reserve-ip-address-in-dhcp-server-linux.html
[2] https://askubuntu.com/questions/392599/how-to-reserve-ip-address-in-dhcp-server

 - t

[toc] | [prev] | [next] | [standalone]

#231436

John Conover wrote: 
> 
> A wireless router made with hostapd/dnsmasq/dhcpcd is fairly easy, and
> works well with iptables, with one shortcoming.
> 
> After antagonizing the Google for hours, I can not find any way to add
> reserved IPs based on the the MAC address of devices connected on
> wlan0, (presumably in dhcpcd.conf.) Seems kind of a simple oversight
> for a wireless AP.


host conoverlaptop {
 hardware ethernet 00:14:d3:11:22:32;
 fixed-address 192.168.0.20;
}

[toc] | [prev] | [next] | [standalone]

#231440

> A wireless router made with hostapd/dnsmasq/dhcpcd is fairly easy, and
> works well with iptables, with one shortcoming.
>
> After antagonizing the Google for hours, I can not find any way to add
> reserved IPs based on the the MAC address of devices connected on
> wlan0, (presumably in dhcpcd.conf.) Seems kind of a simple oversight
> for a wireless AP.

I'm not familiar with dhcpd, but dnsmasq's built-in DHCP server has been
perfectly sufficient so far and it lets you specify fixed IPs based on
MACs by simply putting those in the `/etc/ethers` file.


        Stefan

[toc] | [prev] | [next] | [standalone]

#231442

Stefan Monnier writes:
> > A wireless router made with hostapd/dnsmasq/dhcpcd is fairly easy, and
> > works well with iptables, with one shortcoming.
> >
> > After antagonizing the Google for hours, I can not find any way to add
> > reserved IPs based on the the MAC address of devices connected on
> > wlan0, (presumably in dhcpcd.conf.) Seems kind of a simple oversight
> > for a wireless AP.
> 
> I'm not familiar with dhcpd, but dnsmasq's built-in DHCP server has been
> perfectly sufficient so far and it lets you specify fixed IPs based on
> MACs by simply putting those in the `/etc/ethers` file.
>

Thank you, Stefan.

Works like a charm. The syntax of /etc/ethers is ':' delimited MAC
address, followed by a space delimiter, followed by the IPv4 IP
address, per IP reservation. That IP address must also be in
/etc/hosts.

    John

-- 

John Conover, conover@rahul.net, http://www.johncon.com/

[toc] | [prev] | [next] | [standalone]

#231449

On Sat, 2021-02-06 at 11:00 -0800, John Conover wrote:
> Stefan Monnier writes:
> > > A wireless router made with hostapd/dnsmasq/dhcpcd is fairly easy, and
> > > works well with iptables, with one shortcoming.
> > > 
> > > After antagonizing the Google for hours, I can not find any way to add
> > > reserved IPs based on the the MAC address of devices connected on
> > > wlan0, (presumably in dhcpcd.conf.) Seems kind of a simple oversight
> > > for a wireless AP.
> > 
> > I'm not familiar with dhcpd, but dnsmasq's built-in DHCP server has been
> > perfectly sufficient so far and it lets you specify fixed IPs based on
> > MACs by simply putting those in the `/etc/ethers` file.
> > 
> 
> Thank you, Stefan.
> 
> Works like a charm. The syntax of /etc/ethers is ':' delimited MAC
> address, followed by a space delimiter, followed by the IPv4 IP
> address, per IP reservation. That IP address must also be in
> /etc/hosts.

I didn't know about /etc/ethers, on my system I allocate fixed IP
addresses and hostnames by adding a lines to dnsmasq.conf like

dhcp-host=MAC-Address,IP-Address,Hostname,Lease-Time

I guess there's more than one way to skin this cat.

-- 
Tixy

[toc] | [prev] | [next] | [standalone]

#231450

Tixy writes:
> On Sat, 2021-02-06 at 11:00 -0800, John Conover wrote:
> > Stefan Monnier writes:
> > > > A wireless router made with hostapd/dnsmasq/dhcpcd is fairly easy, and
> > > > works well with iptables, with one shortcoming.
> > > > 
> > > > After antagonizing the Google for hours, I can not find any way to add
> > > > reserved IPs based on the the MAC address of devices connected on
> > > > wlan0, (presumably in dhcpcd.conf.) Seems kind of a simple oversight
> > > > for a wireless AP.
> > > 
> > > I'm not familiar with dhcpd, but dnsmasq's built-in DHCP server has been
> > > perfectly sufficient so far and it lets you specify fixed IPs based on
> > > MACs by simply putting those in the `/etc/ethers` file.
> > > 
> > 
> > Thank you, Stefan.
> > 
> > Works like a charm. The syntax of /etc/ethers is ':' delimited MAC
> > address, followed by a space delimiter, followed by the IPv4 IP
> > address, per IP reservation. That IP address must also be in
> > /etc/hosts.
> 
> I didn't know about /etc/ethers, on my system I allocate fixed IP
> addresses and hostnames by adding a lines to dnsmasq.conf like
> 
> dhcp-host=MAC-Address,IP-Address,Hostname,Lease-Time
> 
> I guess there's more than one way to skin this cat.
>

Hi Tixy.

For the archives, the documentation to configuration of dnsmasq(1) is
in /etc/dnsmasq.conf, the dnsmasq configuration file. It is verbose,
and there are many options. Read thoroughly.

It is a very impressive accomplishment, and works well, and is fairly
easy to get working, (once familiar with the configuration file.)

As a closing note, the DHCP/DNS services, (for wlan0,) are configured
in the /etc/dnsmasq.conf file, *_NOT_* /etc/dhcpcd.conf, which is the
usual alternative.

(This is where I went astray-I mean the name is dnsmasq, probably
meaning it is something to do with dns, duh.)

    Thanks to all,

    John

-- 

John Conover, conover@rahul.net, http://www.johncon.com/

[toc] | [prev] | [next] | [standalone]

#231474

If you want a Linux router/AP, I recommend OpenWRT over Debian. It runs on
a variety of router hardware, but also PCs: https://openwrt.org/docs/guide-user/installation/openwrt_x86

Importantly, it uses UCI
<https://openwrt.org/docs/guide-user/base-system/uci> for configuration of
switches, networks, 802.11 (wifi) radios, SSIDs, firewalls, etc. which
substantially simplifies handling the issues you are encountering. Its web
interface (luci) works directly with the UCI config files, so it's easy to
switch between editing a file and working in the web UI.

--Gregory

On Sat, Feb 06, 2021 at 02:29:08AM -0800, John Conover wrote:
> 
> A wireless router made with hostapd/dnsmasq/dhcpcd is fairly easy, and
> works well with iptables, with one shortcoming.
> 
> After antagonizing the Google for hours, I can not find any way to add
> reserved IPs based on the the MAC address of devices connected on
> wlan0, (presumably in dhcpcd.conf.) Seems kind of a simple oversight
> for a wireless AP.
> 
> Am I correct in my assumption?
> 
>     Thanks,
> 
>     John
> 
> -- 
> 
> John Conover, conover@rahul.net, http://www.johncon.com/
> 
> 

[toc] | [prev] | [next] | [standalone]

#231501

Gregory Seidman wrote: 
> If you want a Linux router/AP, I recommend OpenWRT over Debian. It runs on
> a variety of router hardware, but also PCs: https://openwrt.org/docs/guide-user/installation/openwrt_x86
> 
> Importantly, it uses UCI
> <https://openwrt.org/docs/guide-user/base-system/uci> for configuration of
> switches, networks, 802.11 (wifi) radios, SSIDs, firewalls, etc. which
> substantially simplifies handling the issues you are encountering. Its web
> interface (luci) works directly with the UCI config files, so it's easy to
> switch between editing a file and working in the web UI.

Debian gets security updates in a timely manner (for stable).

How's OpenWRT's security team?

-dsr-

[toc] | [prev] | [next] | [standalone]

#231506 — Security: OpenWRT vs. Debian [Was:] Re: Linux router AP with reserved IPs on wlan0?

On Mon, 8 Feb 2021 06:41:23 -0500
Dan Ritter <dsr@randomstring.org> wrote:

> Gregory Seidman wrote: 
> > If you want a Linux router/AP, I recommend OpenWRT over Debian. It runs on

...

> Debian gets security updates in a timely manner (for stable).
> 
> How's OpenWRT's security team?

I'm not sure if this is a genuine question or a rhetorical one (sorry -
tone doesn't always come across well in email), but OpenWRT does have a
security process, with advisories, bug fixes, etc.:

https://openwrt.org/docs/guide-developer/security

I suspect the process may not be as good as Debian's, but they do fix
at least some serious bugs fairly quickly. E.g., if I'm reading the
following pages correctly, the Debian DSAs for the recent serious set of
dnsmasq vulnerabilities went out on Feb. 4, whereas OpenWRT issued its
Security Advisory on Jan. 19:

https://www.debian.org/security/2021/dsa-4844
https://lists.debian.org/debian-security-announce/2021/msg00026.html

https://openwrt.org/advisory/2021-01-19-1

Celejar

[toc] | [prev] | [next] | [standalone]

#231511 — Re: Security: OpenWRT vs. Debian [Was:] Re: Linux router AP with reserved IPs on wlan0?

Celejar wrote: 
> On Mon, 8 Feb 2021 06:41:23 -0500
> Dan Ritter <dsr@randomstring.org> wrote:
> 
> > Gregory Seidman wrote: 
> > > If you want a Linux router/AP, I recommend OpenWRT over Debian. It runs on
> 
> ...
> 
> > Debian gets security updates in a timely manner (for stable).
> > 
> > How's OpenWRT's security team?
> 
> I'm not sure if this is a genuine question or a rhetorical one (sorry -
> tone doesn't always come across well in email), but OpenWRT does have a
> security process, with advisories, bug fixes, etc.:

Semi-rhetorical: my experience with OpenWRT and ddWRT is that
once a device is installed, it never gets an upgrade. I'd be
happy to learn otherwise.

> https://openwrt.org/docs/guide-developer/security
> 
> I suspect the process may not be as good as Debian's, but they do fix
> at least some serious bugs fairly quickly. E.g., if I'm reading the
> following pages correctly, the Debian DSAs for the recent serious set of
> dnsmasq vulnerabilities went out on Feb. 4, whereas OpenWRT issued its
> Security Advisory on Jan. 19:

That page lists 15 advisories over the last 3 years -- let's say
2 years, since this year is just beginning. Four of those
advisories are for OpenWRT-only problems.

In the 2 months of 2021, so far, Debian's security team has issued 28 notices.
Let's discount the desktop software -- that's 8 of them, by my
count -- because nobody runs desktop software on a router.

OpenWRT's security process doesn't look as terrible as it used
to be, but it doesn't really look good right now, just trying to
be better.

This probably doesn't matter much if you just want a WAP inside
your house, but I feel confirmed that Debian is still a much
better choice for an Internet-facing router/firewall.

-dsr-

[toc] | [prev] | [next] | [standalone]

#231515 — Re: Security: OpenWRT vs. Debian [Was:] Re: Linux router AP with reserved IPs on wlan0?

On Mon, 8 Feb 2021 08:36:34 -0500
Dan Ritter <dsr@randomstring.org> wrote:

> Celejar wrote: 
> > On Mon, 8 Feb 2021 06:41:23 -0500
> > Dan Ritter <dsr@randomstring.org> wrote:
> > 
> > > Gregory Seidman wrote: 
> > > > If you want a Linux router/AP, I recommend OpenWRT over Debian. It runs on
> > 
> > ...
> > 
> > > Debian gets security updates in a timely manner (for stable).
> > > 
> > > How's OpenWRT's security team?
> > 
> > I'm not sure if this is a genuine question or a rhetorical one (sorry -
> > tone doesn't always come across well in email), but OpenWRT does have a
> > security process, with advisories, bug fixes, etc.:
> 
> Semi-rhetorical: my experience with OpenWRT and ddWRT is that
> once a device is installed, it never gets an upgrade. I'd be
> happy to learn otherwise.

Rejoice, then! If you choose never to upgrade, that's your choice, but
the project releases point releases every couple of months or so, and
new major versions every year or two:

https://downloads.openwrt.org/releases/

> > https://openwrt.org/docs/guide-developer/security
> > 
> > I suspect the process may not be as good as Debian's, but they do fix
> > at least some serious bugs fairly quickly. E.g., if I'm reading the
> > following pages correctly, the Debian DSAs for the recent serious set of
> > dnsmasq vulnerabilities went out on Feb. 4, whereas OpenWRT issued its
> > Security Advisory on Jan. 19:
> 
> That page lists 15 advisories over the last 3 years -- let's say
> 2 years, since this year is just beginning. Four of those
> advisories are for OpenWRT-only problems.
> 
> In the 2 months of 2021, so far, Debian's security team has issued 28 notices.
> Let's discount the desktop software -- that's 8 of them, by my
> count -- because nobody runs desktop software on a router.

I think this is a misleading comparison. It's not just a question
of desktop software - Debian includes vastly more software in general,
for which the security team is responsible, than OpenWRT does. Debian
proudly announces that it comes with "more than 59000 packages":

https://www.debian.org/intro/about

OpenWRT includes merely "several thousand packages" (I can't find an
exact number):

https://openwrt.org/packages/start

So of course Debian is going to have more SAs.

> OpenWRT's security process doesn't look as terrible as it used
> to be, but it doesn't really look good right now, just trying to
> be better.

Again, let's look at specific examples of vulnerabilities present in
both OpenWRT and Debian, and compare the projects' responses. I gave
you one timely example: OpenWRT's SA for the dnsmasq vulnerabilities
was issued about two weeks before Debian's.

You feel that OpenWRT's security process "doesn't look good." Based on
what? Can you provide a vulnerability that affects their software that
they dropped the ball on?

> This probably doesn't matter much if you just want a WAP inside
> your house, but I feel confirmed that Debian is still a much
> better choice for an Internet-facing router/firewall.

Celejar

[toc] | [prev] | [next] | [standalone]

#231516 — Re: Security: OpenWRT vs. Debian [Was:] Re: Linux router AP with reserved IPs on wlan0?

Celejar wrote: 
> On Mon, 8 Feb 2021 08:36:34 -0500
> Dan Ritter <dsr@randomstring.org> wrote:
> 
> > OpenWRT's security process doesn't look as terrible as it used
> > to be, but it doesn't really look good right now, just trying to
> > be better.
> 
> Again, let's look at specific examples of vulnerabilities present in
> both OpenWRT and Debian, and compare the projects' responses. I gave
> you one timely example: OpenWRT's SA for the dnsmasq vulnerabilities
> was issued about two weeks before Debian's.
> 
> You feel that OpenWRT's security process "doesn't look good." Based on
> what? Can you provide a vulnerability that affects their software that
> they dropped the ball on?

No, thanks. I don't need to poke at OpenWRT any further.

I already have a Debian firewall that has had good security
support from Debian since 2014; I see no reason not to continue
using it until the hardware fails. At that point, I will buy
another relatively small fully supported Debian box, and carry
on. Among other benefits, it means that all the machines at home
have the same procedures and can be used as testbeds for each
other. E.g. the music-playing machine in the living room is now
testing out Bullseye.

I can be glad that OpenWRT has improved their security practices
and simultaneously not be interested in using it.

-dsr-

[toc] | [prev] | [next] | [standalone]

#231518 — Re: Security: OpenWRT vs. Debian [Was:] Re: Linux router AP with reserved IPs on wlan0?

On Mon, 8 Feb 2021 09:57:13 -0500
Dan Ritter <dsr@randomstring.org> wrote:

> Celejar wrote: 
> > On Mon, 8 Feb 2021 08:36:34 -0500
> > Dan Ritter <dsr@randomstring.org> wrote:
> > 
> > > OpenWRT's security process doesn't look as terrible as it used
> > > to be, but it doesn't really look good right now, just trying to
> > > be better.
> > 
> > Again, let's look at specific examples of vulnerabilities present in
> > both OpenWRT and Debian, and compare the projects' responses. I gave
> > you one timely example: OpenWRT's SA for the dnsmasq vulnerabilities
> > was issued about two weeks before Debian's.
> > 
> > You feel that OpenWRT's security process "doesn't look good." Based on
> > what? Can you provide a vulnerability that affects their software that
> > they dropped the ball on?
> 
> No, thanks. I don't need to poke at OpenWRT any further.
> 
> I already have a Debian firewall that has had good security
> support from Debian since 2014; I see no reason not to continue
> using it until the hardware fails. At that point, I will buy
> another relatively small fully supported Debian box, and carry
> on. Among other benefits, it means that all the machines at home
> have the same procedures and can be used as testbeds for each
> other. E.g. the music-playing machine in the living room is now
> testing out Bullseye.
> 
> I can be glad that OpenWRT has improved their security practices
> and simultaneously not be interested in using it.

I think we are really in basic agreement. The reason I use OpenWRT is
that I use a residential all-in-one WAP / switch / router, which Debian
is unsuitable for. If I ever go the separate WAP / switch / router
route, I'll probably use Debian on the router for the reasons you
give: good support, a system I'm familiar with, etc.

Celejar

[toc] | [prev] | [next] | [standalone]

#231520 — Re: Security: OpenWRT vs. Debian [Was:] Re: Linux router AP with reserved IPs on wlan0?

Celejar wrote: 
> > I can be glad that OpenWRT has improved their security practices
> > and simultaneously not be interested in using it.
> 
> I think we are really in basic agreement. The reason I use OpenWRT is
> that I use a residential all-in-one WAP / switch / router, which Debian
> is unsuitable for. If I ever go the separate WAP / switch / router
> route, I'll probably use Debian on the router for the reasons you
> give: good support, a system I'm familiar with, etc.

Debian works well in this situation. You just need to arrange
for enough NIC ports to meet your needs.

If you are OK buying used equipment, Intel-based gigabit NICs, 4 ports
to a PCIe slot, cost about $35 (or $70 new). If you've got a 5 year old
desktop sitting around with 2GB or more RAM and 3 available PCIe slots,
you can use it as a WAP and have nine switched/routed gigabit ports,
counting one on the motherboard.  If you only need 5 ports, you only
need 2 PCIe slots -- one for a WiFI NIC and one for the ethernet NIC.

Debian has hostapd and dnsmasq packages.

-dsr-

[toc] | [prev] | [next] | [standalone]

#231528 — Re: Security: OpenWRT vs. Debian [Was:] Re: Linux router AP with reserved IPs on wlan0?

On Mon, 8 Feb 2021 11:03:35 -0500
Dan Ritter <dsr@randomstring.org> wrote:

> Celejar wrote: 
> > > I can be glad that OpenWRT has improved their security practices
> > > and simultaneously not be interested in using it.
> > 
> > I think we are really in basic agreement. The reason I use OpenWRT is
> > that I use a residential all-in-one WAP / switch / router, which Debian
> > is unsuitable for. If I ever go the separate WAP / switch / router
> > route, I'll probably use Debian on the router for the reasons you
> > give: good support, a system I'm familiar with, etc.
> 
> Debian works well in this situation. You just need to arrange
> for enough NIC ports to meet your needs.
> 
> If you are OK buying used equipment, Intel-based gigabit NICs, 4 ports
> to a PCIe slot, cost about $35 (or $70 new). If you've got a 5 year old

My understanding - please correct me if I'm wrong - is that with those
types of cards, the ports are distinct and aren't actually switched in
hardware, so switching occurrs at the OS / kernel level. I don't know
how much of a load this puts on the system in practice, but my
understanding is that it's certainly not an ideal way to design a
switch.

> desktop sitting around with 2GB or more RAM and 3 available PCIe slots,
> you can use it as a WAP and have nine switched/routed gigabit ports,
> counting one on the motherboard.  If you only need 5 ports, you only
> need 2 PCIe slots -- one for a WiFI NIC and one for the ethernet NIC.

My understanding, although I could not find solid documentation of this,
is that consumer wireless chipsets designed for client use don't make
particularly performant APs. They'll work, but purpose built APs will
perform much better, especially with their AP optimized antennas. I
don't really know if this is true, though, and to what extent it's an
issue, if it really is one.

And the power usage on a five year old desktop (which I don't actually
have) will be much higher than a purpose-built AIO AP / switch / router.

> Debian has hostapd and dnsmasq packages.

But again, I don't really disagree. If I had the hardware lying around,
and I determined that the power consumption wasn't a factor, it would
certainly be tempting to consider this route.

Celejar

[toc] | [prev] | [next] | [standalone]

#231530 — Re: Security: OpenWRT vs. Debian [Was:] Re: Linux router AP with reserved IPs on wlan0?

Celejar wrote: 
> > If you are OK buying used equipment, Intel-based gigabit NICs, 4 ports
> > to a PCIe slot, cost about $35 (or $70 new). If you've got a 5 year old
> 
> My understanding - please correct me if I'm wrong - is that with those
> types of cards, the ports are distinct and aren't actually switched in
> hardware, so switching occurrs at the OS / kernel level. I don't know
> how much of a load this puts on the system in practice, but my
> understanding is that it's certainly not an ideal way to design a
> switch.

Modern processors -- even the ones 5 years old -- are really
fast.

Linux bridging (switching) is very efficient.

Is it "ideal"? No. But given that you want one device which acts
as a WAP, router, firewall and switch, it should perform quite 
well. If you hate the idea of doing that, though, an 8-port
gigabit switch is about the same price as a used 4-port gigabit
NIC. Not as flexible, though.

> > desktop sitting around with 2GB or more RAM and 3 available PCIe slots,
> > you can use it as a WAP and have nine switched/routed gigabit ports,
> > counting one on the motherboard.  If you only need 5 ports, you only
> > need 2 PCIe slots -- one for a WiFI NIC and one for the ethernet NIC.
> 
> My understanding, although I could not find solid documentation of this,
> is that consumer wireless chipsets designed for client use don't make
> particularly performant APs. They'll work, but purpose built APs will
> perform much better, especially with their AP optimized antennas. I
> don't really know if this is true, though, and to what extent it's an
> issue, if it really is one.

Oh, no, this is a myth. The $20-150 consumer wifi routers use
the same wifi interface chips as good PCIe cards, for the most
part. OpenWRT is actually a great source of information on
these.

Assuming you're comparing a 3 antenna MIMO on a PCIe card to a 3
antenna MIMO on a consumer router, you should get equivalent
range and performance.

> And the power usage on a five year old desktop (which I don't actually
> have) will be much higher than a purpose-built AIO AP / switch / router.

That can be true. But then, the desktop can also be your server
for a bunch of other things that, perhaps, you were going to
run.

> But again, I don't really disagree. If I had the hardware lying around,
> and I determined that the power consumption wasn't a factor, it would
> certainly be tempting to consider this route.

Everything is a tradeoff.

-dsr-

[toc] | [prev] | [next] | [standalone]

#231532 — Re: Security: OpenWRT vs. Debian [Was:] Re: Linux router AP with reserved IPs on wlan0?

On Mon, 8 Feb 2021 16:42:40 -0500
Dan Ritter <dsr@randomstring.org> wrote:

> Celejar wrote: 
> > > If you are OK buying used equipment, Intel-based gigabit NICs, 4 ports
> > > to a PCIe slot, cost about $35 (or $70 new). If you've got a 5 year old
> > 
> > My understanding - please correct me if I'm wrong - is that with those
> > types of cards, the ports are distinct and aren't actually switched in
> > hardware, so switching occurrs at the OS / kernel level. I don't know
> > how much of a load this puts on the system in practice, but my
> > understanding is that it's certainly not an ideal way to design a
> > switch.
> 
> Modern processors -- even the ones 5 years old -- are really
> fast.
> 
> Linux bridging (switching) is very efficient.

Fair enough.

> Is it "ideal"? No. But given that you want one device which acts
> as a WAP, router, firewall and switch, it should perform quite 
> well. If you hate the idea of doing that, though, an 8-port
> gigabit switch is about the same price as a used 4-port gigabit
> NIC. Not as flexible, though.
> 
> > > desktop sitting around with 2GB or more RAM and 3 available PCIe slots,
> > > you can use it as a WAP and have nine switched/routed gigabit ports,
> > > counting one on the motherboard.  If you only need 5 ports, you only
> > > need 2 PCIe slots -- one for a WiFI NIC and one for the ethernet NIC.
> > 
> > My understanding, although I could not find solid documentation of this,
> > is that consumer wireless chipsets designed for client use don't make
> > particularly performant APs. They'll work, but purpose built APs will
> > perform much better, especially with their AP optimized antennas. I
> > don't really know if this is true, though, and to what extent it's an
> > issue, if it really is one.
> 
> Oh, no, this is a myth. The $20-150 consumer wifi routers use
> the same wifi interface chips as good PCIe cards, for the most
> part. OpenWRT is actually a great source of information on
> these.
> 
> Assuming you're comparing a 3 antenna MIMO on a PCIe card to a 3
> antenna MIMO on a consumer router, you should get equivalent
> range and performance.

Thanks. I'd love to see actual tests comparing performance of wireless
APs (consumer, enterprise, and DIY ones like we're discussing), but
they seem very hard to come by.

> > And the power usage on a five year old desktop (which I don't actually
> > have) will be much higher than a purpose-built AIO AP / switch / router.
> 
> That can be true. But then, the desktop can also be your server
> for a bunch of other things that, perhaps, you were going to
> run.

Fair enough. I'm currently using an old R210 ii as my server, so I'm
not one to talk ;) I suppose it might be fun to see if I can fit a
modern AX200 based PCIe (perhaps a low profile one) into it and see how
it performs as an AP / router ...

> > But again, I don't really disagree. If I had the hardware lying around,
> > and I determined that the power consumption wasn't a factor, it would
> > certainly be tempting to consider this route.
> 
> Everything is a tradeoff.

Yes.

Celejar

[toc] | [prev] | [next] | [standalone]

#231544 — RE: Security: OpenWRT vs. Debian [Was:] Re: Linux router AP withreserved IPs on wlan0?

[Multipart message — attachments visible in raw view] — view raw

I have used openwrt, but not recent version of it.  I have been using Ubiquiti EdgeRouters running the stock EdgeOS.  Very solid routers.  I even have one sitting up in a tree in a Tupperware container in the snowy mountains!

I recently discovered that EdgeOS is based on Debian and you can install Debian packages on them.

Michael Grant

[toc] | [prev] | [next] | [standalone]

#231522 — Re: Security: OpenWRT vs. Debian [Was:] Re: Linux router AP with reserved IPs on wlan0?

> I think we are really in basic agreement. The reason I use OpenWRT is
> that I use a residential all-in-one WAP / switch / router, which Debian
> is unsuitable for. If I ever go the separate WAP / switch / router
> route, I'll probably use Debian on the router for the reasons you
> give: good support, a system I'm familiar with, etc.

Here's a related datapoint:

For a couple years, I have used a <foo>Pi box as router+WAP, running
Debian (after having used "home routers" running OpenWRT for many years
before that).

I was quite happy with it software side (a bit less convenient to
configure than OpenWRT for the WAP part, but largely makes up for it for
the ease with which I could add auxiliary services and the convenience
of using the same OS as I use on all my other machines), but I was
unable to make it provide a good enough wireless signal to cover
my apartment.

So I switched to a box dedicated to WAP+router (BT HomeHub, in my case
https://openwrt.org/toh/bt/homehub_v5a), whose hardware is too limited
to run Debian.  IOW the problem for me was to find hardware which is
low-power enough to have it "always on" yet whose wifi interface is good
enough to cover my apartment: these thingies seem to be much more often
able to run OpenWRT than to run Debian :-(

W.r.t security, an important advantage of Debian is that upgrades are
much easier and smoother (so much so that they can be fully automatic)
than in OpenWRT.  But I'm a very happy user of OpenWRT (and have been
for many many years).


        Stefan


PS: Another reason I went with the BT HomeHub is that it includes the
modem (and that this modem is supported by OpenWRT, tho with
a proprietary firmware), so it saves me having to have yet another box
in that corner (I still have the <foo>Pi there since the HomeHub is not
well suited to provide some of those services, which require a largish
storage which I'd rather not connect via USB).

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web