Own Everything & Be Happy, Ep. 1 | DIY Router Guide

We’ve put together this story as part of our series on how to take back control of your devices and your services to get things into your own hands. This huge guide will also help get you out from under prying ISPs and third-party router companies which have repeatedly had major vulnerabilities.

It’s time to build your own router to take control of your internet activity, reduce the amount of spying from third parties, and get out of the future rental lock-ins that are brewing. It’s also not that difficult to do.

This is our other router -- it’s a retail router whose firmware we’ve overwritten with something we have more control over so that we know it’s not doing sketchy things in the background.

Aside from both of these being more private from prying eyes of huge corporations trying to sell data and constantly losing control over their security, doing this is also important for another reason: It’s just fun. If you’ve been sad at the state of DIY PCs and enthusiast hardware, this is another avenue to point that technical interest -- taking ownership of privacy and services. It’s the same exact spirit that got us all into DIY PC building, and a lot of the physical hardware steps are the same.

When we've mentioned routers lately, it hasn't been for positive reasons. Most recently, it's been the FCC's shortsighted, possibly corrupt router ban, followed by enthusiastic "lobbyist" Netgear getting an exemption. 

Related to this, the US government is pulling the old ZTE/Huawei shakedown maneuver on TP-Link, which seems like it's working. 

Before all that, we took a look back at ASUS security issues, including a router botnet.

But for as much as purpose-built routers have become worse, the good news is that routers are relatively simple devices and can be replaced with a retired computer, even if it’s old. An old DDR3 system would work for this.

If we're going to replace our router by building our own, we need to start by doing a better job than the FCC of identifying what exactly a router is, which it defines as a device that can send and receive packets.

We spoke with Wendell from Level1Techs to get his input. He responded, “That's basically anything. Anything that plugs into a network.”

When we asked him to define routers more specifically, he replied, “I think for the context of the [story] and the audience, it's the thing that sits between your network and your ISP. Whatever, however that takes… oh, you got a wireless ISP, you got fiber optic, you got AT&T, cable modem, whatever. Maybe you've got more than one, you've got a cable modem with a cellular modem backup, or whatever. Your router is the thing that's managing that. And your router maybe optionally is also managing your wireless network, or maybe not, maybe you do that differently.”

It's easy to slap together your own router with regular old PC parts. To prove it, in combination with the X79 LGA-2011 era parts from that Taipei sidewalk, we also grabbed our smallest and oldest SSDs, then built our own router.

So in terms of our build, it consists of some pretty simple parts. In addition to our aforementioned CPU and motherboard, we've got a network card. That's probably the nicest thing in the system. There's an older, but not that old Intel A380 card. It's not good for a whole lot of other stuff other than what we're using it for here, which is for display-out. It’s also got 32 GB of DDR3 memory. We also have a fan for the card because it gets pretty hot. We also have a USB 3 drive. In addition to those parts, for our SSD solutions, we've pulled basically all of our old retired various size drives that have just been sitting on a shelf. They are as low as 128 GB or 256 GB and are near end of life in terms of endurance, but are still great for something as simple as this. And then we just pulled the cheapest power supply that we had sitting around, but was still kind of modern and safe. That's our router. You can make it fancy and put it in a case if you want.

There are a lot of reasons to DIY a router. Wendell explained, “I've seen concerning reports from ISPs treating the customer equipment behind the router, their router, as a place to datamine. MAC addresses, what kind of devices, how expensive was this TV that you bought? Let's use that as a demographic. And so there are credible reports that ISPs are using that to build their subscriber advertising profile. It's also really important for ISPs to be able to separate traffic. Consider a family like a husband and wife and a couple of kids. ‘Which device is the traffic coming from?’ That also helps for building profiles, because it's not just a household profile that you want to build, it's individual profiles you want to build. And those MAC addresses, the usage patterns, time of day, those are all pieces of telemetry that your ISP doesn't have when you have a router that's fully under your control."

ISPs mandating their hardware has become more common and a lot of them are trying to move towards a forced subscription to that hardware, which they control. 

AT&T Fiber is one example: the all-in-one box has an "IP Passthrough" mode, but it's always there, able to see your packets with greater resolution than necessary for even an ISP.

We're covering plain old direct-to-disk installs, and we're doing it from the perspective of a user who just wants a drop-in router replacement. Wendell has a series of Forbidden Router videos where he installs pfSense on a virtual machine, which has advantages for more advanced use cases. If you're interested in stuff like LanCache or Pi-hole, check his series out. 

Overview

A typical home internet setup consists of something we call a modem even if it technically isn't, something we call a router even if it technically does more than that, or a combination of the two. With enough dedication, you can get rid of all of it and substitute your own.

Why Bother

We’ll start with “why bother.” Privacy is a concern, but there are a few other reasons to take this project on. Wendell stated, “In almost all scenarios, it will be faster. You will be able to take better advantage of your connection from the ISP. Now, it might take some tweaks, you might have to jump through some hoops, but generally there are scenarios where your ISP-provided equipment falls short, or it was the cheapest possible thing that they could give you, so your connection suffers a little bit because of that, one. Two, in a world where we contemplate maybe moving away from subscriptions, and [to] self hosting things, having your own custom router makes it a lot easier for you to use your internet-connected stuff at home, remotely. And I'm not necessarily talking about like making holes in the firewall, that's actually like kinda old-school thinking, there's new stuff like Tailscale and Pangolin that will give you easy remote access to stuff."

There are all kinds of extra features and plugins you can stack onto a custom router too, like VPN functions or ad blocking. Wendell continues, “And also monitoring and logging, so if someone's attacking your thing, maybe your ISP modem isn't as good, or your ISP router isn't as good at dealing with those kinds of things. So you have really surgical control of ingress and egress from your network, and that can be really fun.”

Some ISPs already charge equipment rental fees, but remember, it can always get worse. Wendell reminisced, “You remember the olden days, when cable companies would charge you per TV? It's like ‘Oh, this is a five-TV house!’”

Also, we don't want to lose sight of this part: it's fun. Buying secondhand hardware, throwing it together with spare parts, and installing open-source networking software is right up there with starting a Plex server and buying a 3D printer.

Parts List

We’ll get into the parts list and how-to now. A quick disclaimer: This is our first time delving into DIY router content, so we’re not experts in this yet. We’ve done a lot of research, but there are people in the audience who will have more experience with this stuff than us. If you’re one of those, we’d welcome your insight as to other things we should look into or be aware of in this space. You all are on this journey to learn with us.

For our parts:

Most motherboards from this century have built-in NICs, but we want two ethernet ports, and an add-in card with two RJ45s is a simple way to accomplish this. Gigabit NICs are basically e-waste, and if you have access to a recycling center, you should check there first. 

The Kramden Institute near us has tons of this stuff. 

We have a spare two-port 10Gbps NIC here, so we'll use that in our demo system and reassign the onboard NIC to be a secondary LAN.

Any old motherboard and CPU will work, but single-threaded CPU performance is key. We’re using an old X79 platform that we picked up for cheap.

A GPU isn’t strictly necessary aside from display out. We used an Intel A380 we had. An integrated GPU would make things even simpler. There's no need for graphics at all after initial setup because all the variants we're covering have web interfaces that can be accessed over the network from another computer.

Some storage is required for a permanent install. This should ideally be a small SSD, but removable storage like a 32GB flash drive can work. A mechanical hard drive isn't a good choice for latency-sensitive applications. 

For home router purposes we're comfortable using an old SSD, because if it dies, we can just start over and reapply our settings. If you plan to run servers or do backups over your network, your tolerance for risk may be lower.

Two other things are very helpful to have: a wireless access point and a network switch.

A router chooses where data goes, a wireless access point broadcasts a WiFi network, and a network switch lets you plug more things in. If you're replacing an off-the-shelf router, it can keep filling some of those roles. 

For example, we went to Best Buy and bought the government’s most-hated router brand: TP-Link, and we bought the cheapest router we could find. 

After plugging it in, we connected to one of the LAN ports, visited 192.168.0.1 in a browser, and were immediately greeted by a "Change Mode" button. Switching to Access Point Mode broadcasts a WiFi network without handling any routing, and we can still use the built-in network switch to connect via ethernet. 

There are purpose-built access points, too, but it's easier to find an old router.

Motherboards with wireless cards may also be able to use them to broadcast WiFi, but we've seen warnings from basically every router software provider that this is janky and might not work well.

Main Options

Let’s get into the router software options.

Finding and installing router software is easy. Some are called firewalls and some are called routers, but the ones we're covering are capable of both: basically, routers route packets and firewalls inspect them.

There are a ton of options: pfSense, OPNsense, OpenWRT, IPFire, RouterOS, DD-WRT, Tomato64, and plenty more.

And like any enthusiast community, each of these has varying reasons people absolutely hate them. We’ll start with the most-hated: pfSense.

Everyone Hates pfSense

pfSense may be the biggest name in this space. Its independent history dates back to 2004 as a fork of m0n0wall, and it's closely related to the other major FreeBSD-based router software, OPNsense. In Wendell's words, "They're ill-tempered but do good work. Like the dwarves of Middle Earth."

Netgate is the sponsor of the pfSense project, but it hasn't endeared itself to the community.

Netgate was founded in 2004 and sold hardware running m0n0wall initially. Netgate didn't take leadership of the pfSense project until 2012. It forked a pfSense version for Netgate hardware that was later renamed pfSense Plus and sold for non-Netgate hardware, but still maintains a free Community Edition, or CE. The CE has been open source in the past, but that may be over.

Wendell explains, “pfSense really had completely taken over the universe, and a lot of the work that those folks do, they contribute upstream, and they do a lot of programming for the underlying BSD subsystem, and they've really done a lot of hard work, so they really want people to subscribe, even home users. So they're looking at the numbers on the dashboard that's like millions, and like I kinda get it, because they're not wealthy beyond the dreams of avarice, but they are holding up a significant portion of internet infrastructure.”

OPNsense is allegedly a banned word on the pfSense subreddit. More significantly, Netgate notoriously got in trouble with the United Nations back in 2017 for camping the opnsense.com domain, which we understand to be illegal, and hosting a site with lighthearted parody like...

 "When your users start complaining, it's probably the firewall! Tell those whiny bitches to shut it. You're LEADING TECHNOLOGY!" and "Everything we do, from our 'product' to our 'documentation' was copied, ripped off, or otherwise 'borrowed' from someone who had the idea before us." 

Also, this clip where OPNsense lead dev Franco Fichtner, who was born in former East Germany, is depicted as Hitler, and Jim Thompson of Netgate is his unstoppable foe.

Yikes. We can’t imagine why people hate them. Truly a great and unsolvable mystery.

With the random caps lock, generous use of bold text, and strict adherence to Godwin’s Law of the Internet, the only thing missing from pfSense’s website is random blue and red letters. Maybe the “p” stands for “psychopaths.”

But let’s say you can look past them possibly calling an open source alternative Hitlerian and ignore the obsession with, as they say, being ripped off.

You’re ready to install pfSense.

pfSense (Install)

To start, click download on https://www.pfsense.org/download/ and select "AMD64 Memstick USB," add it to cart for $0, and now you have the disc image of the Netgate Installer, NOT an image of pfSense. Checking out will then force the creation of a Netgate account, including billing information.

Of all the options we're discussing here, pfSense is the only one that requires an account including name, address, and phone number to download the free version, which unfortunately flies in the face of strict privacy -- although you could just lie about these details. 

Moreover, this download is just the "Netgate Installer," which then requires an active internet connection to download and install the Community Edition. There is no longer an offline installer.

For pfSense and every other option on our list, we used Rufus to flash an .img or .iso file to a USB drive and then booted from it. For non-Windows platforms, other options like balenaEtcher exist. 

With Rufus, plug in a flash drive that you're okay with wiping, open the UI, select the target flash drive under "Device," select "Disk or ISO image" under "Boot Selection" and SELECT to find the ISO, leave everything else alone, and click START. At the end, you'll have a bootable flash drive.

Stick the flash drive in the PC that’ll become your router, then select the USB device as a temporary boot device or alter the boot order as you would with a normal OS install. 

Since this specific installation requires an internet connection, start out by plugging in your internet line to the port where you want it to stay. This will be the WAN port for internet. It's also possible to have a wireless WAN connection, but we're not covering that here.

Once pfSense finishes booting up, it pops-up a short copyright notice -- because of course it does -- and the install can begin. Netgate hosts a full walkthrough of all the options, but we'll cover them here. 

The advanced options can be left alone: ‘CE repositories’ is for installing the free version on pfSense-Plus-eligible hardware, Export Network Config (enabled) sets up a config file with the options specified during setup, CE Low Capacity System is for less than 4GB of storage, Swap Size is disk space for memory operations and is set automatically, Console Serial is for accessing the console through a serial port, Console Type should be fine set to EFI on any remotely modern hardware, and ZFS Pool Name can be set to anything.

Next, select the WAN interface, which will be the one marked active. If using a two-port NIC, note the letter of the interface: our WAN will be ix1, so the other port on the card must be ix0 and em0 must be the onboard NIC. DHCP (client) is the easiest option to try, but if your ISP requires you to log in to access the internet, you'll need to select PPPoE and enter credentials. 

Virtual LANs are logically separate networks that can operate over shared wires, but in order to be useful, they need more expensive managed network switches (as opposed to regular dumb switches). Data packets are tagged with which VLAN they belong to, and the managed switch understands which packets belong to which connections. We're going to avoid VLANs in this guide, but it's a clear next step once you're ready to invest more money and time.

‘Use Local Resolver’ only needs to be enabled in order to use a local DNS resolver, which we're not, so that stays off too.

For the LAN interface, we'll select the other port on our card (ix0) to keep things simple. It's possible to finish the installation without setting up a LAN, but don't. 

This is similar to the WAN setup: STATIC is fine for the default Interface Mode, because you always want to know what your router's IP address is within your LAN. The DHCPD (dynamic host configuration protocol daemon) should be left running unless you know that something else is handling DHCP or you really want to assign static IPs to everything, and the default range is fine.

The odd one out (em0) is our onboard motherboard NIC, so we'll assign that as an optional interface later.

Continue and the installer will try to connect to Netgate's servers, so it's not possible to proceed past here without an active internet connection. Select "Install CE" for the free Community Edition.

If you don't already have an opinion on BSD filesystems, stick with ZFS as the default. The older UFS is the other option: it's generally agreed to be less demanding (uses less memory, for example), and the features it lacks aren't necessary for our purposes. However, Netgate points out that UFS "can be fragile when it comes to sudden interruptions such as power loss.” For the partition scheme, MBR is only necessary for ARM or extremely ancient hardware. Otherwise, the default option of GPT should be fine.

UFS can't do software RAID, so you just select a disk and that's it. If ZFS is the selected file system, "stripe" (AKA RAID 0) is the correct choice for a single disk. With stripe selected, you can then pick a disk. The advanced options are Wipe Disks, which is unnecessary if you're working with a single disk, and pSLC (pseudo SLC) mode, which is irreversible and should only be enabled if you know what you're doing. This mode increases endurance on drives that support it, but the installer can't check for support, and pSLC halves capacity on MLC disks and cuts two-thirds on TLC. In most instances, you should not use this feature.

Next, pick a version of the Community Edition to install: probably the latest stable release. Installation should take care of itself at this point and will prompt for a reboot; this is a good time to reenter BIOS and remove the installation flash drive or change the boot order.

The next step is setup, which is easiest to do from the web UI rather than directly typing into the pfSense console. With the router running, connect a PC to the LAN port and go to 192.168.1.1 (assuming you kept the default IP) in a web browser. If you get a security prompt, skip past it. The default username and password are admin and pfsense.

For the hostname, enter whatever name you want. For normal home use, leave the domain name as home.arpa or add something to the front (like gn.home.arpa). "Override DNS" is somewhat confusing because it means that it allows the DNS server list to be overridden by the ISP, but it's simplest to leave this checked.

Leave the time server settings alone and select the appropriate time zone.

The WAN settings were already established during installation, so no changes should be necessary. 

The LAN settings were also already set.

Changing the default password is vital, and strength is a higher priority than memorization. If you want to protect against attackers that are physically present, you could put a password on the console as well. We’d recommend it.

We have a spare interface on the motherboard itself that we could use for many different purposes, but we'll set it up as a physically separate LAN for untrusted devices. Netgate hosts an extremely detailed step-by-step guide for doing this, with two separate paths for "Open" to create a normal LAN or "Isolated" to create a fully separate but internet-connected LAN where the devices aren't allowed to talk to your other networks or mess with your router. 

We followed that second path to the letter, with the exception of naming our interface "UNTRUSTED" and switching from ISC DHCP to Kea DHCP because pfSense prompted us to.

At this point any switches and/or access points can be connected into the LAN port to start building the network. Keep in mind that router updates are now fully your responsibility. It's possible to set up a cron job to do it automatically, but the whole point of building a router is to reclaim control.

If it’s been a while, you may need to relearn how to do manual port forwarding, which comes up less often these days as many consumer routers have Universal Plug and Play (UPnP). UPnP lets programs handle port forwarding without your input, which kind of sucks for security (manual port forwarding can also suck for security). Netgate notes: "There are many popular programs and platforms which support UPnP IGD & PCP, such as Steam/Steam Deck, Nintendo consoles, PlayStation consoles, Xbox consoles, video conferencing apps, torrent clients, and more." If you run into trouble with any of those, or with self-hosted servers like Plex, that may be why. We think you should leave it off, but the controls are in Services > UPnP IGD & PCP.

OPNsense (Background)

Let’s move on to OPNsense, which is the one pfSense says ripped them off, among other pleasant things.

Wendell stated, “Then there's OPNsense, which is the fork of pfSense to try to peel away some of the more, let's call it ‘greybeard opinion.’ Like there are well-reasoned reasons for why they're doing things, but they may be suboptimal from a usability standpoint, or suboptimal from a ‘I can vibe a better thing than this’ standpoint, because that is probably not untrue at this point. And so the OPNsense people have forked that and tried to provide a better experience, but at the same time it doesn't appear to me that the OPNsense people have put in the same infrastructure to support the underlying BSD ecosystem in terms of upstream patches, and contributions of code and that kind of thing, and so like there are good arguments here for both things. And so it's like, ehhhhh.” 

When we asked him if he had a preference or if it was a case of different tools for different jobs, he responded, “It's a little bit different tools, different jobs.”

Deciso is the steward of OPNsense, which is a fork of pfSense dating back to 2015. Deciso says that little of the unaltered pre-split code remains, but both OPNsense and pfSense are based on FreeBSD upstream.

Contributors to both projects that work on FreeBSD have to pretend like they aren't at each others' throats, with mixed success. Franco of OPNsense announced that he officially retired from contributing to FreeBSD in December 2025 after getting suspended from the FreeBSD bug tracker. 

Reading through the threads in question, it's a wonder any work gets done at all, with great quotes like “once upon a time, common sense was used.” 

FreeBSD is what the PlayStation OS is based on, by the way. Underneath every piece of polished corporate software, there are a bunch of unpaid nerds treating a messageboard like it's Game of Thrones with comments like, “Who, exactly, do you think you are in relation to Gordon and Kristof and the other people actually doing the work here, and why do you think your tone and behavior are appropriate in this situation?”

OPNsense is arguably more homelab-friendly than pfSense since it doesn't funnel towards a subscription model.

It also doesn't require an account and doesn't require internet access to set up, and there's less concern that the free version will disappear. Its marketing also has, as far as we can find, 100% fewer references to Hitler than pfSense’s marketing.

But on the other hand, we found pfSense's documentation more helpful.

OPNsense (Install)

Here’s how to set up OPNsense:

Download the amd64 vga image from the site (it doesn’t need to be on an AMD computer), flash it to a USB drive with Rufus, and boot from it. Unlike pfSense, OPNsense defaults to fully configuring itself, which could be good or bad.

Once it's finished booting, OPNsense should already be functional but read-only, so we want to put it on permanent storage. Log in with the username “installer” and the password “opnsense” and select a keyboard layout.

We recommend sticking to "Install (ZFS)" for the same reasons as with pfSense. The "Hybrid" referenced in the menu "means that you can turn UEFI on and off and the boot won't fail." Pick stripe for the RAID type again like pfSense, select the target disk, and let the installation proceed. There's an option to change the root password, which you should eventually do, but we'll skip that for a moment.

Once the system has rebooted, we can log in with the username “root” and the password “opnsense.” The next setting we want to change from the console is "Assign Interfaces." We can skip VLAN setup and LAGG (link aggregation).

With our 1Gb hardware, it might be worth bundling our unused interface into a link aggregation group, but it's unnecessary for a first-time setup and would ideally involve a managed network switch. Our understanding is that LAGs only help with bandwidth when multiple devices on the network are saturating their connections at the same time.

Assigning the interfaces requires more trial and error than on pfSense: our labels are still ix0 and ix1, but we don't have a clear indicator of which is already connected, and auto-detection doesn't always help. We have a 50/50 shot, so we'll just arbitrarily assign ix0 and ix1 to be LAN and WAN and swap the cables if that's wrong, while em0 definitely gets assigned as an optional interface.

We can now plug a PC into the LAN and go to 192.168.1.1 in a browser to finish the setup; the credentials should still be root and opnsense. Hostname can be set to whatever, as can the domain, so we'll leave those alone. 

Like pfSense, OPNsense includes Unbound DNS. It has some nice optional features like blocklists for ads and security, so we'll leave it on. The DNSSEC options are good for security but the ISP's DNS servers need to support it, so it's easier to leave unchecked for now and experiment later.

WAN and LAN settings are preconfigured but, on the Deployment type step, "Optimize for Multiwan" should be unchecked since this is intended for multiple separate internet connections. We don't want to mess with any DNS settings, so automatic DHCP/DNS registration stays checked, and optimizing for IPsec is unnecessary unless you plan to set up VPNs, which is a whole other subject.

This is where we would normally set up an isolated guest LAN on the optional interface, but out of all the software we tried, we had the most trouble doing this on OPNsense. There are plenty of guides to setting up VLANs (Home Network Guy's are popular), as well as an official guide to setting up a guest network on a separate physical interface, but the documentation seems to predate OPNsense's switch to Dnsmasq. Switching to Kea DHCP may make things easier, but we're not comfortable trial-and-erroring our way into providing instructions on something we aren't sure about.

Like pfSense, OPNsense requires manually logging in and checking for updates once in a while. UPnP can be configured by installing the os-upnp plugin (System > Firmware > Plugins) and accessing the controls in Services > UPnP IGD & PCP.

OpenWrt (Background)

OpenWrt takes its name from the legendary Linksys WRT54G, an extremely widespread and long-lived router family that became a popular host for third-party firmware.

Shortly after Cisco acquired Linksys in 2003, the community dug up that Linksys was using GPL code including the Linux kernel, and was therefore obligated to release code under the GPL. Cisco bought Linksys, Linksys bought chips from Broadcom, and Broadcom got firmware from who knows where. Under threat of legal action, Linksys released the source code in what became a historic victory for open source.

As a result, multiple projects spawned for the purpose of allowing users to do whatever the hell they wanted with WRT54G hardware, several of which have grown into general-purpose router firmware that can run on many devices, up to and including x86 computers.

OpenWrt (Install)

Let’s install it.

This is the only distro we tried without a dedicated installer: we just used Rufus to directly flash the SSD. Hitting Alt+F in Rufus allows it to detect all drives that are attached as removable storage (not just flash drives).

It's unlikely the interfaces will be assigned correctly by default. Try plugging your PC into each of the ports until you can access 192.168.1.1 in a browser, then log in with the username root and leave the password field blank. Set those as soon as you have the option. OpenWrt will ask about automatically checking for updates but, regardless of the choice, it won't actually apply those updates until manually approved.

Once we've gotten everything plugged in, we can go to Network, Interfaces, and then Devices. We know we have our WAN and LAN cables connected, and eth0 and eth1 are marked as having cables plugged in, so eth2 must be the port on our network card that's currently unused. That lets us open the br-lan device, switch it to eth2, save and apply, and then move the LAN cable over to the other port.

For the easiest possible setup of an untrusted LAN, we went to Devices and created a new bridge called br-untrusted with eth0 (which is now unused) and otherwise default settings. 

Then we went to “Firewall” and created a new zone called “UntrustedZone,” set input to accept, output to accept, and intra-zone forward to reject, and set "allow forward to destination zones" to only WAN. 

Then we created a new interface, set the device to br-untrusted, the IP to 192.168.2.1, the mask to 255.255.255.0, set the firewall zone to UntrustedZone, and set up a DHCP server with default settings.

OpenWrt is extremely compact and stripped down with minimal drivers, so putting it on full-blown PC hardware rather than a prefab router is kind of weird. If you don't care about installing extra packages or doing anything beyond basic routing, OpenWrt is fully capable, but the Senses have more room to grow. 

On the other hand, OpenWrt seems to have better support for integrated wireless functionality than the FreeBSD-based options (as long as the right drivers are installed).

IPFire (Background)

IPFire is next. It bills itself as "a professional-grade open-source firewall and security platform." It's a fork of IPCop, which is itself a fork of Smoothwall, but IPCop hasn't had a new release since 2015 and Smoothwall is now going by its new name: paywalled. IPFire is Linux, like everything else that isn't pfSense or OPNsense.

IPFire (Install)

Here’s the walkthrough of IPFire: 

As usual, download the IPFire image and use Rufus to put it on a USB drive, then boot from it. Pick a language, pick a disk, pick a filesystem (ext4 is fine).

Host and domain names can be anything, so we kept the defaults. Keep in mind that there are separate passwords for root user (commandline) and admin (web interface).

IPFire is organized around four color-coded networks: Red and Green are WAN and LAN, the most basic setup, while Orange and Blue are optional DMZ and WLAN networks. We'll pick Red + Green + Blue as our network config. Blue doesn't literally need to be wireless, but it's set up with more restrictive settings than the safe Green network, which is ideal for setting up our separate IoT or guest network.

For drivers and card assignments, we need some trial and error. We know we want the gigabit NIC to be Blue, so we'll assign the two 10 Gigabit options to Red and Green arbitrarily and switch the cables later if they don't work.

Following IPFire's guide, we'll set the Green IP to 192.168.10.1, set Blue to 192.168.11.1, and set Red to DHCP.

Continuing with the guide, we'll enable the DHCP server with a start address of 192.168.10.100 and end of 192.168.10.200.

That's it for the console setup, and we can then access the web UI by plugging into the Green interface and visiting https://192.168.10.1:444 in a browser (IPFire won't let you skip the HTTPS or port number). 

Going to Network > Domain Name System showed that DNS was broken, which probably has something to do with running behind a bunch of other networking hardware here in the office. Our quick and dirty solution was to go add Cloudflare's 1.1.1.1 DNS server, then uncheck "Use ISP-assigned DNS Servers."

The Blue network has MAC address filtering on by default, which makes sense for an untrusted network, so we'll leave that on. For each device, we enter the MAC address (not IP), check "Enabled," and save. In order to get the Blue network online, we had to go to Network > DHCP Server and copy the Red network settings over to Blue (substituting our Blue IP of 192.168.11.X instead) and enable it, then go to Firewall > Blue Access and add the MAC address of our laptop. We still had DNS issues because it seems like the settings on the DNS page only applied to the Red network, so we also had to go back to the DHCP Server page and manually set 1.1.1.1 as the DNS server for the Blue network.

The default settings for the Blue network is to block access to Green, so this gives us some isolation. 

IPFire also describes how to block access to the web interface on the Blue network by adding two lines to the config file; just copy the code from that guide and substitute in the correct Blue network IP (again, 192.168.11.X for us).

IPFire has a lot of easily-accessible graphs and logs for CPU and memory sensors, as well as a tab that lists known vulnerabilities associated with the hardware installed in the system. We think that’s pretty cool.

Although IPFire exposes plenty of settings, it's built with a very clear network structure in mind. This may be freeing for beginners who don't want to do anything except get a router up and running, but it may also be limiting in the long run. We also get the impression that the two Senses completely dominate the DIY router space by marketshare, so community support for smaller distros like IPFire isn't as comprehensive.

IPFire doesn't support UPnP at all, so manual port forwarding is a necessity. The settings are under Firewall > Firewall Rules, and the process is described in IPFire's documentation.

AT&T ONT

Now we’re getting into replacing ISP-specific devices.

If you want to replace your router for security and privacy reasons, it's understandable that you might not trust it as an access point either. We asked Wendell about this, and he pointed out that it's generally possible to configure the self-hosted homebrew router to report suspicious traffic and block it through a GUI, but he wasn't overly worried about it.

We brought up ISPs, like AT&T, and how it forces users to rent their routing equipment and Wendell stated, “AT&T, with their fiber, really want to control the endpoint. And even if you use your own custom router, the options in like, the BGW gateways for example, the passthrough router option there is still really limited. Like a couple power users in a household can saturate everything that that piece of equipment can handle [...] it's like ‘augh, I can't replace this piece of equipment.’ And it's true, like, AT&T has an encryption certificate on that device and if you want to bypass it you have to get a special piece of equipment, and you have to emulate the serial number from your gateway, and you have to peel off the encryption certificate from the AT&T gateway and stuff it onto a new piece of equipment that's not, y'know, braindead, and then you have a reasonable internet experience.”

Before we get into this, sometimes this isn't necessary at all with some ISPs: for example, GFiber will let you run a cable from the "Fiber Jack" to your own router without any bullshit.

If you do have one of the cursed ISPs, you should start by taking the easy route before replacing anything. Look up the device's name to check how to place it in bridge mode or IP passthrough mode, which would allow you to install your own router behind the ISP router. 

For example, on the BGW320-505, we can access the web interface at 192.168.1.254, go to the Firewall > IP Passthrough, set the allocation mode to Passthrough, turn the gateway's WiFi broadcast off, and then plug our own router in. The steps will vary by ISP and device.

AT&T isn’t our focus today, but it’s a good example. 

To fully replace an AT&T fiber box, you need your own ONT (Optical Network Terminal, where the fiber meets the copper) that can pretend to be the original, most commonly by using the 8311 community firmware. 

PON dot WIKI is an excellent resource for this, starting with its risk/reward summary. As it says, most users can make do with bridge/passthrough mode on ISP equipment. 

It's preferable to buy a pre-flashed ONT, but we don't have any value-added resellers we can vouch for. The ONTs are generally more than $100. 

It's worth mapping out all the network hardware beforehand to plan for additional costs, since at the absolute minimum the router will need an SFP port to connect the ONT, which likely means some SFP cables, switches, and adapters too. Involving fiber in your local network will make things more expensive.

Also, the ONTs tend to get extremely hot, to the extent that some sellers will include additional stick-on heatsinks. There are a bunch of bespoke 3D-printable 25mm and 40mm fan brackets out there for each individual ONT. We’ve printed a few.

This is a separate topic from today’s goals of a more general-purpose DIY router and is a complicated and specific process for one ISP, but the point is that there are options to migrate onto entirely self-owned hardware even in situations where an ISP mandates their device.

For example, we want to go to guides on the wiki, then the AT&T BGW320-505 to match our provider and equipment, open that specific guide, follow the steps for the X-ONU-SFPP that we bought, check the AT&T fiber status page to confirm our wavelength is 1270 nm, install an OS and an SFP+ card on our router, spoof the AT&T gateway's MAC address on the WAN port of the router, set up SNAT to access the LCT of the ONT BEFORE hooking up the fiber, use the web configuration tool on the ONT to clone the equipment ID, software version, and other identifying information from the original gateway, hotswap the fiber to the new router, and check whether any of that worked or if we get a time-out from AT&T.

Hopefully we're getting the point across that this is an all-day project. The reward, though, is that you’re free of their bullshit. 

The wiki is helpful, but it's full of jargon and abbreviations. We aren't associated with the 8311 community, but it may be helpful to join the Discord server and speak to other users before committing.

Other Options

Our list of “other options” hit our radar, but we didn’t explore them individually. We still wanted to list them.

RouterOS

RouterOS is one of those.

MicroTik's software predates its hardware, going back to the foundation of the company in 1996, and the first release of the creatively named RouterOS was in 1999.

Installing RouterOS doesn't require any accounts or registration to start, but a license key must be registered after 24 hours of uptime. You can get a free trial license by making an account with MicroTik, but the comparison table makes it clear that the free license is heavily limited when it comes to advanced features.

The UI for RouterOS is handled through a standalone utility called WinBox, unlike the rest of the browser-accessible distros we're covering here. It can run on Linux and macOS despite the name.

RouterOS on non-MicroTik hardware requires some setup before it'll provide an internet connection, which the documentation covers as "Router without Default Configuration (advanced users only)."

DD-WRT

The next one is DD-WRT, which is part of the same explosion of Linux router firmwares as OpenWrt. It supports a ton of prefab routers and x86 hardware, but it feels like even less of an intended use case than x86 OpenWrt. If you want to try anyway, the image can be found at Downloads > betas > latest > x86-64 > raw > dd-wrt_x64_public_vga.image. Every DD-WRT build since 2008 has been a beta, so don't worry about that part. The m0n0wall website hosts a tool that can be used to write the image file to a disk.

Tomato (Tomato64)

Tomato is yet another Linux-based router firmware that owes its existence to the WRT54G (via the HyperWRT firmware project). 

FreshTomato is the current fork, although it sounds like the developer is struggling to keep it financially viable. 

Like the rest of the WRT-related projects, Tomato is intended for embedded hardware, but there's an active port called Tomato64 specifically intended for x86_64 and arm64 hardware (in other words, regular computers). Tomato64's status as a port of a fork of a fork doesn't give it the firmest foundation, so it’s not in our top recommendations.

Conclusion

Dig up some old hardware, build a router, and hook it up to your existing network before replacing anything. It's a fun project and there are zero stakes, at least at the beginning. If you're one of the lucky ones with an ISP that still allows using your own equipment without tricking them, swapping between routers is just a matter of moving cables around. Given how frequent the updates are for each of these projects, we have more confidence in their security than we do with mass-produced routers.

We know there are other options out there. Once the hardware is set up, it's pretty easy to swap between software.

The two FreeBSD options (OPNsense and pfSense) are the most interesting to us, because we've spent too much time around Wendell and it's easy to come up with a million side projects to do and extensions to try. 

We also recognize that they're massive overkill for most home networks, though, in which case OpenWrt may make more sense. If you've ever messed with regular router firmware from companies like Netgear and Linksys, OpenWrt feels like that, just with more control. 

IPFire is interesting, but its guidelines about how it expects the network to be set up feel like they'd become overbearing if we left the beaten path.

Our best advice for safety is to go through the first-time setup for any of these options slowly and look up each individual option with your old setup on standby. Even if you don't change a single option from the defaults, it's good to know why those defaults exist. Also, always check for updates.