After trying out pfSense, OPNsense and VyOS and not being entirely happy about either of them I’ve decided to install
my good old favorite GNU/Linux distribution Gentoo on my router.
The router is a PCEngine APU2C2 bought from TekLager. I’ll try to format this more as a reference than a complete guide.
1. Installation media
Insert the SD card and start the router. To get the serial port terminal working correctly you may pick the option:
Then select Standard 64bit kernel (rescue64) with more choice and SystemRescueCD with a console in 800x600 and press TAB to edit the options. From the prompt the option video=800x600 needs to be removed. And the following options need to be added:
It should now say:
Press Ctrl-X to boot.
/dev/sda gets partitioned into two pieces: 1 for /boot and 1 for rootfs. No UEFI partition needed because MBR will be used.
Set up the file systems:
And mount them:
Grab the stage 3 tarball from http://distfiles.gentoo.org/releases/amd64/autobuilds/current-stage3-amd64/ and extract it. I use the nomultilib versions because no 32 bit applications are going to be used.
My make.conf looks like this:
The kernel configuration for 4.18.5-gentoo can be found here in case anyone wants to use it.
A serial console needs to be spawned during boot. Under the SERIAL CONSOLES section there should be a line saying:
A small optimization can be made in inittab by not spawning any local TTYs. Remove or comment the lines in the TERMINALS section so it looks like this:
Create udev rules to name the interfaces properly. It will be much easier to deal with them this way.
Create a bridge
This will let the router acts as a switch on interfaces lan0 and lan1.
As the name suggests hostapd sets up an access point.
For now I only use the 2.4GHz band.
nftables + Wireguard
The following nftables config will set up will route all outgoing traffic through
with the exception of traffic marked by wg-quick (see the init scripts provided),
Make sure to set vpn_port, fileserver_ip and port_to_forward which I have
Here are the Wireguard init scripts for reference. The two most important
commands in the scripts are:
Make sure the fwmark matches on both interfaces in order to mark the
traffic for nftables.
The MTU need to match
on both interfaces or packets might be dropped when routing from wg1
(the “inbound” interface) to wg0 (the “outbound” interface).
And /etc/init.d/wg1(which is basically the same but adds the MTU and fwmark settings):