From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail2.tohojo.dk (mail2.tohojo.dk [144.76.141.112]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by huchra.bufferbloat.net (Postfix) with ESMTPS id 3DD0B21F35F for ; Fri, 11 Jul 2014 02:33:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at mail2.tohojo.dk Received: by alrua-x1.borgediget.toke.dk (Postfix, from userid 1000) id 754C927C2C; Fri, 11 Jul 2014 11:33:38 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=toke.dk; s=201310; t=1405071219; bh=NNYf2I++fmpB9RZdSwW4OaZgxOKl9lKSM3C+cn+25MA=; h=From:To:Cc:Subject:References:Date:In-Reply-To; b=fHqbuvtTKPCUxuXKGrsn6gBH2AOOXswwn0Ropvn3/rIySotklqhWstl2hrSrRRQen J//nAb7bLZ0qIzKNUK9Olvp/zY6WVxiGq84sEw3JXJmmdvV1VOTHElx3rM16y47cNd 1sw56ToSvliILgOewjxpxJMndbc6CDNG5bf0gyhM= From: =?utf-8?Q?Toke_H=C3=B8iland-J=C3=B8rgensen?= To: William Katsak References: <53BEA813.8000108@gmail.com> <53BEAF05.8000601@gmail.com> Date: Fri, 11 Jul 2014 11:33:36 +0200 In-Reply-To: <53BEAF05.8000601@gmail.com> (William Katsak's message of "Thu, 10 Jul 2014 11:19:33 -0400") Message-ID: <87pphc8cjz.fsf@toke.dk> Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha256; protocol="application/pgp-signature" Cc: "cerowrt-devel@lists.bufferbloat.net" Subject: Re: [Cerowrt-devel] Upper routing throughput limit X-BeenThere: cerowrt-devel@lists.bufferbloat.net X-Mailman-Version: 2.1.13 Precedence: list List-Id: Development issues regarding the cerowrt test router project List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 11 Jul 2014 09:33:49 -0000 --=-=-= Content-Type: text/plain William Katsak writes: > I was considering the possibility of using PfSense on an x86 box as my > main router/firewall for better throughput, and hanging Cero off of > that for wifi. Anyone doing something similar? If so, how do you > organize the subnets? I have a similar setup with a dual-ethernet x86 box acting as router for my 100/100 Mbps connection. The plan was originally to stick a minipci wifi card in there to also act as access point, but for now I've settled on using a cerowrt box as a relatively dumb wifi box. The setup is something like this +------------+ +----------+ +------------+ | | | | | | | Internet +-----------+ Router +-----------+ WNDR3800 | | | | | | | +------------+ +----------+ +------------+ The router downstream ethernet port is plugged into the wan port on the WNDR3800 and I've configured three 802.1Q VLANs on the link between the router and the cerowrt box, which are bridged to the LAN switch, the private wifi interfaces and the guest wifi interfaces respectively. This allows me to run dnsmasq etc on the router, and have the cerowrt box simply provide wifi connectivity, but without bridging the wifi directly to the ethernet LAN. I got lazy and only did one VLAN for each type of wifi, rather than having one per frequency as in stock cerowrt, but see no reason why adding additional VLANs for each frequency should pose any problems. The only daemons running on the cerowrt box are dropbear, radsecproxy (for 802.11i authentication on the private wifi), ntpd, netifd and hostapd. The router box runs a stock Arch Linux installation, with dnsmasq serving up a /27 and a /64 (from he.net) on each of the virtual vlan interfaces, most of the network setup managed through systemd-networkd, and a couple of scripts to set up the he.net tunnel and an SQM-derived shaper, as well as a manual firewall setup. The router box also runs BIND as a local resolver, a TOR node, minidlna and various other daemons. The VLAN setup on the cerowrt box took a couple of attempts to get right, but now that it is running it seems to work well. I'll be happy to share the config if you're interested. :) -Toke --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAEBCAAGBQJTv69wAAoJEENeEGz1+utPEaQIAKph2n9iYCU8ZnbJCXwOeSSH fZ125kUoU03x2GNL1drbfsZdIbPMushwgPi+GRWNxvbc9zwbD4+4p0Rr/2YqkR8z LfEQ+VGsobfHWhp55r+QHOMcjcASWA85x3Rzbkq74xg7Kf/AYX+doCZEdUkvExLs tbTgF2KQSQPfpLUiyPD5ei3Aj6bMs5P8I0aWDS6YtXJnSqissin1GWUbU4csxHkV ooh6UwpNd4V5aPfmvzQT55cLuJJ7n/eF3vqugNkqfIVfLkZaSdQs6v9WdBrKq0Zc EcB9VLSpFMurEqaGTCG7sbjaIonNI678xXFVa4I+R6YqlBxAzGvI5EFXKS4m9PM= =5Mhb -----END PGP SIGNATURE----- --=-=-=--