[gentoo-user] new linux router

[gentoo-user] new linux router

[James]

Hello,

It's time to build a new router. Surely, I would just like to
purchase hardware and run a minimized or embedded gentoo on it
along with iptables and a few other packages. But, I got to reading
and well it seems much has changed. Dansguardian is deprecated?
If I add protection above layer 3, what is the best route (pun intended)
to protect some winblows systems? And I need the ability to dynamically
block some gaming sites (kids playing too many hours of video).....

Then I read about NFtables....... [1]
And there is more. So, being a bit busy what would folks recommend
for purchase (I really do not need another project at this time)?
I've used routers with ebtables in the past too.


I'd like to be  able to download some open source linux to the router
hardware if updates and pathces are not maintained by the vendor?
That way I do not purchase something that is to be abandoned in
a few years by the vendor.

It's just a small home/office so 3x100Mb E would be fine, but GigE
ports would be better. I'm flexible on the CPU/arch of the hardware,
so all discussion and suggestions are welcome. In an idealized world
I'd pay extra for a gentoo_derivative based router; but all I find
is the WRT, devil_linux and such, nothing really cool and interesting.

Anyone used lilblue or pentoo as the basis for a firewalled_router?

A purchase is what I really want, but some hacking, if absolutely
necessary, would be ok too. Ideas?

curiously,
James

[1] http://netfilter.org/projects/nftables/

Re: [gentoo-user] new linux router

[whytlze]

[-- Attachment #1: Type: text/plain, Size: 94 bytes --]

[OT] openwrt? 

—<br>Sent from phone <a href="https://www.dropbox.com/mailbox">Mailbox</a>

[-- Attachment #2: Type: text/html, Size: 281 bytes --]

[gentoo-user] Re: new linux router

[James]

 <whytlze <at> gmail.com> writes:

> [OT] openwrt?

http://wiki.openwrt.org/toh/buyerguide


yes still munging through the suggestions.
I do not need wireless (actually prefer no wireless ports
on the router).

I was kinda looking for direct hardware recommendations,
if you have a make/model you are aware of, or have
been looking at lately?


James

Re: [gentoo-user] new linux router

[Bruce Schultz]

On 5 March 2015 1:10:40 AM AEST, James <wireless@tampabay.rr.com> wrote:
>Hello,
>
>It's time to build a new router. Surely, I would just like to
>purchase hardware and run a minimized or embedded gentoo on it
>along with iptables and a few other packages. But, I got to reading
>and well it seems much has changed. Dansguardian is deprecated?
>If I add protection above layer 3, what is the best route (pun
>intended)
>to protect some winblows systems? And I need the ability to dynamically
>block some gaming sites (kids playing too many hours of video).....
>
>Then I read about NFtables....... [1]
>And there is more. So, being a bit busy what would folks recommend
>for purchase (I really do not need another project at this time)?
>I've used routers with ebtables in the past too.
>
>
>I'd like to be  able to download some open source linux to the router
>hardware if updates and pathces are not maintained by the vendor?
>That way I do not purchase something that is to be abandoned in
>a few years by the vendor.
>
>It's just a small home/office so 3x100Mb E would be fine, but GigE
>ports would be better. I'm flexible on the CPU/arch of the hardware,
>so all discussion and suggestions are welcome. In an idealized world
>I'd pay extra for a gentoo_derivative based router; but all I find
>is the WRT, devil_linux and such, nothing really cool and interesting.

Maybe this would meet your needs?
https://www.ubnt.com/edgemax/edgerouter-lite/

There's also this link if you want to run gentoo, although you lose the networking performance of the original firmware
http://wiki.gentoo.org/wiki/MIPS/ERLite-3


>
>Anyone used lilblue or pentoo as the basis for a firewalled_router?
>
>A purchase is what I really want, but some hacking, if absolutely
>necessary, would be ok too. Ideas?
>
>curiously,
>James
>
>[1] http://netfilter.org/projects/nftables/

-- 
:b

[gentoo-user] Re: new linux router

[James]

Bruce Schultz <brulzki <at> gmail.com> writes:

> 
> 
> On 5 March 2015 1:10:40 AM AEST, James <wireless <at> tampabay.rr.com> wrote:

>> I'd like to be  able to download some open source linux to the router
>> hardware if updates and pathces are not maintained by the vendor?
>> That way I do not purchase something that is to be abandoned in
>> a few years by the vendor.

> Maybe this would meet your needs?
> https://www.ubnt.com/edgemax/edgerouter-lite/
> 
> There's also this link if you want to run gentoo, although you lose 
> the networking performance of the original firmware
> http://wiki.gentoo.org/wiki/MIPS/ERLite-3


Now this is exactly what I'm looking for; a vendor light weight router
and I can put linux on (preferable gentoo) in case the vendor does
not offer updated images or stay up with patches and such.

Very, Very cool! Do you own one? Have you or another tried it?
Have you put gentoo on it?  

Do you know which dev rooted this hardware and/or wrote the 
howto web page you reference above?


James

Re: [gentoo-user] Re: new linux router

[Bruce Schultz]

On 5 March 2015 7:24:04 AM AEST, James <wireless@tampabay.rr.com> wrote:
>Bruce Schultz <brulzki <at> gmail.com> writes:
>
>> 
>> 
>> On 5 March 2015 1:10:40 AM AEST, James <wireless <at>
>tampabay.rr.com> wrote:
>
>>> I'd like to be  able to download some open source linux to the
>router
>>> hardware if updates and pathces are not maintained by the vendor?
>>> That way I do not purchase something that is to be abandoned in
>>> a few years by the vendor.
>
>> Maybe this would meet your needs?
>> https://www.ubnt.com/edgemax/edgerouter-lite/
>> 
>> There's also this link if you want to run gentoo, although you lose 
>> the networking performance of the original firmware
>> http://wiki.gentoo.org/wiki/MIPS/ERLite-3
>
>
>Now this is exactly what I'm looking for; a vendor light weight router
>and I can put linux on (preferable gentoo) in case the vendor does
>not offer updated images or stay up with patches and such.
>
>Very, Very cool! Do you own one? 

Yes. Sadly it is still in its box in the cupboard for the past few weeks.

>Have you or another tried it?
>Have you put gentoo on it?  

I did plan to, but, you know... time...

There's some more info here if you scroll down a few comments
https://news.ycombinator.com/item?id=7281991

>
>Do you know which dev rooted this hardware and/or wrote the 
>howto web page you reference above?

I thought a wiki should keep page edit history, but I can't find it....

Bruce



-- 
:B

[gentoo-user] Re: new linux router

[James]

Bruce Schultz <brulzki <at> gmail.com> writes:

> Yes. Sadly it is still in its box in the cupboard for the past few weeks.

Precisely why I need to purchase something functional and easy to
set up, for now.

>> Have you or another tried it?
>> Have you put gentoo on it?  
> I did plan to, but, you know... time...
> There's some more info here if you scroll down a few comments
> https://news.ycombinator.com/item?id=7281991

Very interesting thread, as I have not been hacking on routers
for a few years, since my consulting gig ended.....

I am going to get back to some router hacking, as soon as some of the 
multi_core Arm64 bit SOC chips are affordable with some very
fast ram (ddr 3,4,5).   It's taking forever for those chips
to become available at reasonable street pricing. I'm tired
of the run of the mill embedded micros running embedded linux.

Besides, my home office network is meager on the bandwidth needs
at this time.

>> Do you know which dev rooted this hardware and/or wrote the 
>> howto web page you reference above?
> I thought a wiki should keep page edit history, but I can't find it....

Yep. I'm too lazy to expend the energy to figure it out, but,
there's only a few folks hacking on mips 64 these days who 
would bother to post to the gentoo_wiki. Not a big deal.

> Bruce

thx,
James

[gentoo-user] Re: new linux router

[Nicolas Sebrecht]

On Wed, Mar 04, 2015 at 03:10:40PM +0000, James wrote:

> I'd like to be  able to download some open source linux to the router
> hardware if updates and pathces are not maintained by the vendor?
> That way I do not purchase something that is to be abandoned in
> a few years by the vendor.
> 
> It's just a small home/office so 3x100Mb E would be fine, but GigE
> ports would be better. I'm flexible on the CPU/arch of the hardware,
> so all discussion and suggestions are welcome. In an idealized world
> I'd pay extra for a gentoo_derivative based router; but all I find
> is the WRT, devil_linux and such, nothing really cool and interesting.

For the hardware, you could get a alix2d3:
  http://www.pcengines.ch/alix2d3.htm

For the distribution, I'd recommend Alpine:
  http://www.alpinelinux.org/about

That's the combo I used in a recent past and it worked quiet fine
(802.1q VLAN, traffic shaping with tc, advanced firewall with scripted
iptables rules, ethernet cards controlled with ethtool (I could fix
speed/duplex for incompatible network hardware), ssh, etc).

While there is no wifi I found this MUCH better than WRT54GL, for
example.

-- 
Nicolas Sebrecht

[gentoo-user] Re: new linux router

[James]

Nicolas Sebrecht <nicolas.s-dev <at> laposte.net> writes:

> 
> On Wed, Mar 04, 2015 at 03:10:40PM +0000, James wrote:
> 
> > I'd like to be  able to download some open source linux to the router
> > hardware if updates and pathces are not maintained by the vendor?
> > That way I do not purchase something that is to be abandoned in
> > a few years by the vendor.
> > 
> > It's just a small home/office so 3x100Mb E would be fine, but GigE
> > ports would be better. I'm flexible on the CPU/arch of the hardware,
> > so all discussion and suggestions are welcome. In an idealized world
> > I'd pay extra for a gentoo_derivative based router; but all I find
> > is the WRT, devil_linux and such, nothing really cool and interesting.
> 
> For the hardware, you could get a alix2d3:
>   http://www.pcengines.ch/alix2d3.htm

I actually recently acquired one of these from a friend.

> For the distribution, I'd recommend Alpine:
>   http://www.alpinelinux.org/about

Why would that be better than putting lilblue (gentoo) on 
the board. Maybe somebody who has success with booting off
of usb (and that definitely is not me) could test lilblue
on an alix2d3 board?


http://wiki.gentoo.org/wiki/Install_Gentoo_on_a_bootable_USB_stick

https://wiki.gentoo.org/wiki/Project:Hardened_uClibc/Lilblue


I'm not sure the arch of a 500 MHz AMD Geode LX800;
isn't that compatible with i686 binaries? I found this:

" When it comes to compiling, just compile with -march=geode. That option is
defined on any i386/x86-64 gcc, so no real need to cross-compile. If you
want to run the binary on your compiler host as well (without a recompile),
try something like -march=i486 -mtune=geode. "

How did you have your make.conf files (or similar under Alpine) set up?
If I go this route, I'd really rather run gentoo or something
quite similar, rather than a distro I not familiar with.

> That's the combo I used in a recent past and it worked quiet fine
> (802.1q VLAN, traffic shaping with tc, advanced firewall with scripted
> iptables rules, ethernet cards controlled with ethtool (I could fix
> speed/duplex for incompatible network hardware), ssh, etc).

I'm not familiar with Alpine linux. How many of your scripts would be
useful on gentoo? If what you did is sensitive, just drop to me privately.....


> While there is no wifi I found this MUCH better than WRT54GL, for
> example.

Yep, not in love with any of the wrt54 codes/systems/hardwares.....
I do not need or want a wireless interface on this device.


thx,
James

Re: [gentoo-user] Re: new linux router

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 867 bytes --]

On Fri, 6 Mar 2015 02:03:48 +0000 (UTC), James wrote:

> I'm not sure the arch of a 500 MHz AMD Geode LX800;
> isn't that compatible with i686 binaries? I found this:
> 
> " When it comes to compiling, just compile with -march=geode. That
> option is defined on any i386/x86-64 gcc, so no real need to
> cross-compile. If you want to run the binary on your compiler host as
> well (without a recompile), try something like -march=i486
> -mtune=geode. "

The Geode LX800 is more like an i486. I used to use a box based on one
(not as a router) in the days before the Raspberry Pi. I used to build
packages in a chroot on my i7 box, using these settings

CFLAGS="-O2 -march=geode -pipe -fomit-frame-pointer"
CXXFLAGS="${CFLAGS}"
CHOST="i486-pc-linux-gnu" 
MAKEOPTS="-j16 -l10"


-- 
Neil Bothwick

I backed up my hard drive and ran into a bus.

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]

[gentoo-user] Re: new linux router

[James]

Neil Bothwick <neil <at> digimed.co.uk> writes:


> > I'm not sure the arch of a 500 MHz AMD Geode LX800;
> > isn't that compatible with i686 binaries? I found this:

> The Geode LX800 is more like an i486. I used to use a box based on one
> (not as a router) in the days before the Raspberry Pi. I used to build
> packages in a chroot on my i7 box, using these settings

Yes, this processor is a bit of a chameleon. Several companies
manufactured it and under several different versions with slightly
different instruction sets inside. You really have look at
the part id number and the silicon vendors data sheets or
test out some of the options to be for sure. They all mask (label
print) the chips to look the same....... Some are full i686
and some are crappy i486 and some are in between. They are intended
for embedded products, so the firmware folks developing the codes
get the accurate data from the chip vendors directly. It's 
kinda like buying drugs in south america, you better know
your connection, really well (aha ha ha ha). Sorry, but the old,
jaded embedded engineer in me never really gets too quiet.....


> CFLAGS="-O2 -march=geode -pipe -fomit-frame-pointer"
> CXXFLAGS="${CFLAGS}"
> CHOST="i486-pc-linux-gnu" 
> MAKEOPTS="-j16 -l10"

This would be a keen starting point combined 
with  /proc probing....


> MAKEOPTS="-j16 -l10"

Might not be the best settings? [1] 
Look for these lines in the reference thread and translate 
to a makeopts syntax? Interesting discussion.

MAKE -j $nthreads -l $((nthreads-1)).8
EMERGE –jobs $((nthreads+1) –load-average ${nthreads}.4


thx,
James


[1] https://blogs.gentoo.org/ago/2013/01/14/makeopts-jcore-1-is-
not-the-best-optimization/

Re: [gentoo-user] Re: new linux router

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 462 bytes --]

On Fri, 6 Mar 2015 17:37:38 +0000 (UTC), James wrote:

> > MAKEOPTS="-j16 -l10"  
> 
> Might not be the best settings? [1] 
> Look for these lines in the reference thread and translate 
> to a makeopts syntax? Interesting discussion.

There was also a discussion on this list a year or two ago, where Michael
Mol conducted some extensive tests. My settings came out of that
discussion.


-- 
Neil Bothwick

Engineers do it with less resistance.

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]

[gentoo-user] Re: new linux router

[James]

Neil Bothwick <neil <at> digimed.co.uk> writes:


> > > MAKEOPTS="-j16 -l10"  
 
> There was also a discussion on this list a year or two ago, where Michael
> Mol conducted some extensive tests. My settings came out of that
> discussion.

I cannot seem to find that thread. I tried all sorts of keywords
search via gmane and brute force on the archives, to no avail.
I also could not figure out how to perform search in the recently
open gentoo archive for the gentoo-user group. All I could do is
manually parse a given month....?

Any help finding that thread would be keen, as I do vaguely remember
a discussion....

All I found was this:

From: Michael Mol <mikemol <at> gmail.com>
Subject: Just a heads-up, I think =sys-libs/glibc-2.14.1-r3 is a stinker.
Newsgroups: gmane.linux.gentoo.user
Date: 2012-04-26 03:09:58 GMT (2 years, 45 weeks, 2 hours and 18 minutes ago)



James

Re: [gentoo-user] Re: new linux router

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 570 bytes --]

On Sat, 7 Mar 2015 17:31:32 +0000 (UTC), James wrote:

> I cannot seem to find that thread. I tried all sorts of keywords
> search via gmane and brute force on the archives, to no avail.
> I also could not figure out how to perform search in the recently
> open gentoo archive for the gentoo

I generally find Google gives better results than many sites' own search
facilities. Add "site:archives.gentoo.org/gentoo-user" to your search
string.


-- 
Neil Bothwick

If Microsoft made cars:
"The airbag system would ask "are you sure?" before deploying."

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]

[gentoo-user] Re: new linux router

[Nicolas Sebrecht]

On Fri, Mar 06, 2015 at 02:03:48AM +0000, James wrote:

> > For the distribution, I'd recommend Alpine:
> >   http://www.alpinelinux.org/about
> 
> Why would that be better than putting lilblue (gentoo) on 
> the board. Maybe somebody who has success with booting off
> of usb (and that definitely is not me) could test lilblue
> on an alix2d3 board?

I don't know much Lilblue but it looks like a somewhat recent project.

Alpine started back in 2005. It's based on portage to build the
distribution but uses the apk-tools that fit better for embedded
systems, IMHO.

Also, Alpine comes with a very lightweight minimal installation,
reliable toolchain to build the distribution and uses openrc. The well
known debian-like configuration files allow new maintainers to quickly
be comfortable with the device.

The recent move to musl over uClibc is a good thing too, FMPOV.

I expect Alpine to have a wider community than Lilblue.

> How did you have your make.conf files (or similar under Alpine) set up?

You don't have make.conf on the target. Embedded devices are bad at
compiling. With Alpine, you cross-compile the target from your
desktop/server/VM.

> If I go this route, I'd really rather run gentoo or something
> quite similar, rather than a distro I not familiar with.

On the target device, apk-tools are very easy to use and requires MUCH
less time/ressources than emerge.

Quiet frankly, Alpine doesn't require specific skills. I've started with
the binary provided by the maintainers and never had to compile any
package myself.

> > That's the combo I used in a recent past and it worked quiet fine
> > (802.1q VLAN, traffic shaping with tc, advanced firewall with scripted
> > iptables rules, ethernet cards controlled with ethtool (I could fix
> > speed/duplex for incompatible network hardware), ssh, etc).
> 
> I'm not familiar with Alpine linux. How many of your scripts would be
> useful on gentoo? If what you did is sensitive, just drop to me privately.....

Sorry, I can't. I don't have them anymore while I'm sure they are still
used in production.

It's something easy to do, though. The scripts themselves are
distribution agnostic. E.g. my ipfilter service only used $IPTABLES. The
only thing to update are the service files for openrc, systemd, upstart,
whatever.

-- 
Nicolas Sebrecht

[gentoo-user] Re: new linux router

[James]

Nicolas Sebrecht <nicolas.s-dev <at> laposte.net> writes:


> > > For the distribution, I'd recommend Alpine:
> > >   http://www.alpinelinux.org/about

> Sorry, I can't. I don't have them anymore while I'm sure they are still
> used in production.  It's something easy to do, though. The scripts  
> themselves are distribution agnostic. E.g. my ipfilter service only 
> used $IPTABLES. The only thing to update are the service files for 
> openrc, systemd, upstart,  whatever.

I've gone this route before. Sooner or later, I need something else
and then adding/customizing it is often very arduous.... Still Alpine is
interesting. Building a minimize Gentoo or embedded Gentoo is not
difficult either. Musl will be in the final mix, regardless of which
direction I go. Thanks for providing additional information for me to 
ponder  before choosing  a new router.


Thanks,
James

Re: [gentoo-user] Re: new linux router

[lee]

James <wireless@tampabay.rr.com> writes:

> Nicolas Sebrecht <nicolas.s-dev <at> laposte.net> writes:
>
>
>> > > For the distribution, I'd recommend Alpine:
>> > >   http://www.alpinelinux.org/about
>
>> Sorry, I can't. I don't have them anymore while I'm sure they are still
>> used in production.  It's something easy to do, though. The scripts  
>> themselves are distribution agnostic. E.g. my ipfilter service only 
>> used $IPTABLES. The only thing to update are the service files for 
>> openrc, systemd, upstart,  whatever.
>
> I've gone this route before. Sooner or later, I need something else
> and then adding/customizing it is often very arduous.... Still Alpine is
> interesting. Building a minimize Gentoo or embedded Gentoo is not
> difficult either. Musl will be in the final mix, regardless of which
> direction I go. Thanks for providing additional information for me to 
> ponder  before choosing  a new router.

Why not use an HP Microserver?  The black-box style embedded stuff
doesn't seem to be accessible at all to begin with.


-- 
Again we must be afraid of speaking of daemons for fear that daemons
might swallow us.  Finally, this fear has become reasonable.

Re: [gentoo-user] new linux router

[thegeezer]

On 04/03/15 15:10, James wrote:
> Hello,
>
> It's time to build a new router. Surely, I would just like to
> purchase hardware and run a minimized or embedded gentoo on it
> along with iptables and a few other packages. But, I got to reading
> and well it seems much has changed. Dansguardian is deprecated?
> If I add protection above layer 3, what is the best route (pun intended)
> to protect some winblows systems? And I need the ability to dynamically
> block some gaming sites (kids playing too many hours of video).....
>
> Then I read about NFtables....... [1]
> And there is more. So, being a bit busy what would folks recommend
> for purchase (I really do not need another project at this time)?
> I've used routers with ebtables in the past too.
>
>
> I'd like to be  able to download some open source linux to the router
> hardware if updates and pathces are not maintained by the vendor?
> That way I do not purchase something that is to be abandoned in
> a few years by the vendor.
>
> It's just a small home/office so 3x100Mb E would be fine, but GigE
> ports would be better. I'm flexible on the CPU/arch of the hardware,
> so all discussion and suggestions are welcome. In an idealized world
> I'd pay extra for a gentoo_derivative based router; but all I find
> is the WRT, devil_linux and such, nothing really cool and interesting.
>
> Anyone used lilblue or pentoo as the basis for a firewalled_router?
>
> A purchase is what I really want, but some hacking, if absolutely
> necessary, would be ok too. Ideas?
>
> curiously,
> James
>
> [1] http://netfilter.org/projects/nftables/
>
>

howdy
to get you started i'd really look at something dd-wrt.  there's a lot
of features in there that is quite amazing.
for a lot of features like site blocking etc you might even consider a
sonicwall - at around €300 you can get something that will do what you
want including the site blocking.
however, i believe gentoo is the way forward for internet facing devices
because you can fully control every aspect of it and i am regularly
deploying gentoo routers.
you can go for something arm based, but i tend to favour jetway mini-atx
motherboards - they have daughter cards that clip into the main board
and are screwed down.
the main board will give you 2x gigabit nic, and the daughtercard will
give you an additional 3.
all in, 4GB memory, extra nics and a small disk, case and power you can
get for ~€400
it's intel atom and reasonalby quick - you can compile on it for example
and not have to wait a week for even small packages

nftables is going to be a beasty, but the netfilter crowd have already
released an iptables to nftables munger.  i can see their point of
changing things - evolution just got too clunky

really consider going the gentoo-hardened route especially if you are
having ports open on the internet facing side

regarding software to install:

0. fail2ban for any internet facing ports
1. squid + squidGuard + downloaded lists + username/password allows you
to filter a great deal.  really with kids though you want to consider
have whitelist acces only. i.e. you put in duolingo, wikipedia etc, it's
a pain to begin but then after you have all the requiremetns you know
they aren't accessign anything else.  also consider distributing
wpad.dat for autoconfiguration of devices.
2. consider putting in freeradiusd as you can then go WPA2 enterprise  -
sound like overkill but let s you do great things like limit kids _wifi_
access to an hour a day
3. munin + vnstat +sarg/awstats + other fun for graphing
4. you can even then use the device as a NAS and put snaps on there, let
the kids have readonly access to stuff and adults can make changes
5. can then start looking at vpn like services

for other things you might like to look at synology apps for DSM - they
have a NAS that is essentially a linux server with drop in apps --
mariadb, drupal all kinds of fun stuff and all (relatively) easy to do
in gentoo
happy hacking!

Re: [gentoo-user] new linux router

[Marc Stuermer]

Am 04.03.2015 um 16:10 schrieb James:

> I'd like to be  able to download some open source linux to the router
> hardware if updates and pathces are not maintained by the vendor?
> That way I do not purchase something that is to be abandoned in
> a few years by the vendor.

Take a look at Microtik: http://www.mikrotik.com/

[gentoo-user] Re: new linux router

[Hans]

On 05/03/15 01:10, James wrote:
> Hello,
>
> It's time to build a new router. Surely, I would just like to
> purchase hardware and run a minimized or embedded gentoo on it
> along with iptables and a few other packages. But, I got to reading
> and well it seems much has changed. Dansguardian is deprecated?
> If I add protection above layer 3, what is the best route (pun intended)
> to protect some winblows systems? And I need the ability to dynamically
> block some gaming sites (kids playing too many hours of video).....
>
> Then I read about NFtables....... [1]
> And there is more. So, being a bit busy what would folks recommend
> for purchase (I really do not need another project at this time)?
> I've used routers with ebtables in the past too.
>
>
> I'd like to be  able to download some open source linux to the router
> hardware if updates and pathces are not maintained by the vendor?
> That way I do not purchase something that is to be abandoned in
> a few years by the vendor.
>
> It's just a small home/office so 3x100Mb E would be fine, but GigE
> ports would be better. I'm flexible on the CPU/arch of the hardware,
> so all discussion and suggestions are welcome. In an idealized world
> I'd pay extra for a gentoo_derivative based router; but all I find
> is the WRT, devil_linux and such, nothing really cool and interesting.
>
> Anyone used lilblue or pentoo as the basis for a firewalled_router?
>
> A purchase is what I really want, but some hacking, if absolutely
> necessary, would be ok too. Ideas?
>
> curiously,
> James
>
> [1] http://netfilter.org/projects/nftables/
>
>
>
I use a TP-Link TD-VG3631 ADSL Modem-Router. Has dynamic site blocking 
etc. GPL Source is available from:
  www.tp-link.com/resources/gpl/TD-VG3631V1_GPL.tar.gz