nicholas/web-log
1
0
Fork 0
Code Pull Requests Actions Packages Activity

finish post (closes #14)

Browse Source
This commit is contained in:
nicholas
2025-08-27 18:43:02 -05:00
parent 04a24e8535
commit 708de2fa44
1 changed files with 120 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
container/site/content/posts/router-build/index.md
+120 -26
View File
@@ -1,7 +1,7 @@
+++
categories = ["software"]
tags = ["router","opnsense"]
date = 2025-08-27T08:00:00-05:00
date = 2025-08-27T18:30:00-05:00
description = ""
draft = false
slug = "router-build"
@@ -9,7 +9,7 @@ title = "🔀 Router Build"
author = "nicholas"
+++
My router (Netgear R6400v2) lacks many of the features I would like to use and become familiar with:
My router (**Netgear R6400v2**) lacks many of the features I would like to use and become familiar with:
- VLANs
- Advanced routing, firewall
- Monitoring, logging, alerts
@@ -26,31 +26,35 @@ I have a few options from here:
2. ❌ **Buy new hardware**
- ➕ Very easy setup
- ➖ Boring
- 💲 Could require expensive/high-end router hardware
3. ✅ **Repurpose existing hardware**
- ➕ Fun
- ➕ Makes use of an out-of-work mini PC (Dell OptiPlex 5050 Micro)
- ➕ Can run proper router OS
- ➕ Use old router as WAP
- ➕ Makes use of an unused **Dell OptiPlex 5050 Micro**
- ➕ Can run proper router OS **OPNsense**
- ➕ Repurpose router as wireless access point
---
## 🪵 Router-on-a-stick (ROAS)
My VM host (where I will build my router) has only a single NIC, with only one physical port. That means I cannot replicate the behavior of ordinary consumer routers, which are typically configured with a dedicated WAN port, and several dedicated LAN ports. The router simply routes between the two. Very simple. I need to find a way to replicate the *function* of such a router without the same hardware.
My VM host (where I will build my router) has only a single NIC, with only one physical port. That means I cannot replicate the exact behavior of ordinary consumer routers, which are typically configured with a dedicated WAN port, and several dedicated LAN ports. The router simply routes between the two. Very simple. I need to find a way to replicate the *function* of such a router without the same *hardware*.
I have a couple of options:
1. ❌ Configure the **virtual switch** to perform 802.1Q VLAN tagging for router VM.
1. ❌ Configure the **virtual switch** on my VM host to perform 802.1Q VLAN tagging for router VM.
- ➕ Free, no additional hardware required
2. ✅ Configure a **managed physical switch** to handle 802.1Q VLAN tagging and trunking to the router
- ➕ Gain additional physical ports
- 💲 Addtional hardware required
I want the extra ports!
I want the extra ports! I got a **Netgear GS108E-400NAS**. For no other reason than it was available at my local *Best Buy*.
---
## 🖧 Logical Network Topology
This diagram describes approxmiately what I my network will look like:
```mermaid
graph TD
@@ -58,7 +62,7 @@ graph TD
modem["📡Modem"]
switch["🔀Switch"]
subgraph vm-host["VM Host"]
router["🛡️Router (OPNSense)"]
router["🛡️Router (OPNsense)"]
end
wap["🛜WAP"]
nas["🗄️NAS"]
@@ -75,12 +79,19 @@ graph TD
switch --- wap
switch --- nas
switch --- workstation
wap -.- wireless
```
## 🔀 Switch Port VLAN Assignment Table
---
## 🔀 Switch Setup & Port VLAN Assignment Table
- First, I need to choose a subnet for my network and assign my switch an IP accordingly. I chose 10.0.0.0/8 subnet. It just looks good.
- Next I cofigure my switch with a **trunk port**. This port will link to the router and carry multiple VLANs: **VLAN 10** (LAN), **VLAN 100** (WAN). This allows my router to distinguish between WAN and LAN with just one physical port. Instead of a phyiscal port to ditinguish WAN and LAN, the distinction is made virtually using VLAN tags.
- This means I will also need to configure a separate port for VLAN 100 (modem/ISP uplink), so that all traffic on that port is tagged and forwarded as WAN traffic.
| Port | Device | VLAN Mode | PVID | Tagged VLANs |
|-|-|-|-|-|
| 1 | Router | Trunk | 10 | 10,100 |
@@ -92,22 +103,105 @@ graph TD
| 7 | - | Management | 1 | - |
| 8 | Modem | Access | 100 | - |
---
**Switch VLAN tagging**
```mermaid
flowchart TD
lan["🏠LAN"]
modem["🌐Modem/ISP"]
switch[🔀Switch]
subgraph router["🛡️Router"]
wan_interface["🌐WAN Interface"]
lan_interface["🏠LAN Interface"]
end
lan -- "`
*🗅untagged*
🔵access port **VLAN 10**
`" --> switch
modem -- "`
*🗅untagged*
🔵access port **VLAN 100**`" --> switch
switch -- "*🏷️tagged* VLAN 10" --> lan_interface
switch -- "*🏷️tagged* VLAN 100" --> wan_interface
```
✅ Done. Now I configure a VM for the router.
---
## 🖥️ VM Configuration
- 3 GB RAM
- 1 vCPU
- Static MAC address (Spoof NETGEAR router MAC)
- Enable router VM network adapter to carry VLANs ID 10,100
I need to configure a VM to serve as a router:
- COnfigure VM specs:
- 20 GB vdisk
- 3 GB RAM
- 1 vCPU
- Install OPNsense OS
- Configure VM network adapter with static MAC address (spoof old netgear router MAC, keep current DHCP IP)
- Configure host OS network adapter to carry VLAN ID 10 only
- Configure VM network adapter to carry VLANs ID 10,100
## ⏺️ OPNSense
### Interfaces - VLAN 10,100
LAN = VLAN 10
WAN = VLAN 20
### Unbound DNS
### Query Forwarding
- forward to pi-hole -> network-wide ad-blocking
### Overrides
### DHCP
### Firewall - GeoIP
[Block countries](https://AccountID:AccountKey@download.maxmind.com/geoip/databases/GeoLite2-Country-CSV/download?suffix=zip)
✅ Done. Now I can configure OPNsense.
---
## 🛡️ OPNsense
{{< image
src="images/OPNsense-dashboard.png"
caption="OPNsense Dashboard" >}}
##### Interfaces
According to the plan, I need to configure OPNsense with an interface for each VLAN I configured:
- VLAN **10** for **LAN**
- VLAN **100** for **WAN**
##### DNSMasq DHCP
Since I want most of my devices to be assigned IPs dynamically, I enable DHCP on the LAN interface.
- Start address: 10.0.10.3
- End address: 10.0.10.100
- 10.0.10.100 - 10.0.10.200 are reserved for static / wired devices.
##### Unbound DNS
I also want to use my router as a DNS server for local DNS resolution, so I enable **Unbound DNS**. This is where I can configure A records (host override), and CNAME records (alias).
**For example:**
| Record Type | Name | Value |
|-|-|-|
| A | proxy.internal.domain.com | 10.0.10.100 |
| CNAME | git.domain.com | proxy.internal.domain.com |
##### Query Forwarding
Now that I have given my wired devices static IPs, I can do query forwarding to Pi-Hole. This will enable network-wide ad blocking.
```mermaid
flowchart LR
client[💻Client] --> router-dns["`
🛡️Router
(Local DNS)
`"]
router-dns --> pihole[🕳️Pi-hole]
pihole --> upstream["`
☁️ Upstream DNS
(e.g. 8.8.8.8)`"
]
```
##### Firewall - GeoIP
I use [MaxMind GeoIP database](https://AccountID:LicenseKey@download.maxmind.com/geoip/databases/GeoLite2-Country-CSV/download?suffix=zip) to create a firewall alias. Then I configured a firewall rule on WAN interface which blocks any IP that matches those configured in the alias. I am blocking IPs from most countries.
This nearly eliminates unwanted traffic from annoying and/or malicious bots scanning and scraping my network
**MaxMind GeoIP database**:`https://AccountID:LicenseKey@download.maxmind.com/geoip/databases/GeoLite2-Country-CSV/download?suffix=zip`
🎉 It works!
{{< video
src="videos/router-traffic-graph-live.mp4"
width="100%"
>}}
✅ Done.