Document new home router

1 files changed, 239 insertions, 0 deletions

diff --git a/blog/route.md b/blog/route.md
new file mode 100644
index 0000000..3f6d0cb
--- /dev/null
+++ b/blog/route.md
@@ -0,0 +1,239 @@
++++
+rss = "How to set up an Ubuntu system as a router"
+date = Date(2024, 8, 3)
+tags = ["fun", "recipe", "net"]
++++
+
+# GNU as a Router, the Canonical Way
+
+A while ago I noticed that my ISP leases IPv4 addresses out indefinitely.
+It was everything I'd ever wanted and I gotta seize it to truly _self_-host.
+As an experiment, I started on something cheaper, like a single-board compooter.
+In 2024, support for general-purpose RISC-V chips began to ripen, so naturally
+due to FOMO, I bought a board with JH-7110.  Boy, was that a mistake!
+While the bootloaders' support had been well [upstreamed],
+certain essential features like PCIe (for NVMe) has yet to reached
+a mainline Linux release, even worse so on the BSDs.  I ended up flashing
+the _only_ distribution with official support [at the time][goatse], Ubuntu.
+
+Funny enough, after over a decade of daily driving GNU, twas the first time
+I installed Ubuntu on a machine of my own.  At the time of writing,
+the reason for the was more apparent than ever: Canonical had been
+forcing Snap[^snap] down the users' throat, even on the _server_ edition.
+Thankfully Snap was still managed by APT and twas easy enough to remove
+prevent it from coming back.  Another annoyance was the lack of manual pages
+in the minimized installation _and_ that the official way to enable them
+is through a script that also install other bloats SMFH (the script
+is quite short and the actually necessary commands can be trivially found,
+I'd rather they're documented instead).
+
+That being said, not everything Ubuntu includes due to NIH is bad.
+Unity (not the game engine that's proprietary like Snap server)
+was loved by many; and this article is basically an appreciation post
+for some others: [Netplan] and [ufw].  Before diving in,
+lemme finish the story to give you the full context of this setup.
+The SBC is the VisionFive 2 which is blessed with plenty of IO:
+
+* 8 GB of memory
+* 4 USB 3.0 type-A ports
+* 2 RJ45 ports (1 Gb and 100/10 Mb)
+* 1 M.2 slot (I used this as an excuse to buy a larger SSD
+  and put the old 256 GB one here)
+* 1 eMMC slot[^mmc] (eMMC are cheap, got one also with 256 GB)
+* 1 TF slot
+* 40 pin GP(and predefined-purpose)IO
+* Other stuff for interfacing with humen like HDMI, audio jack, etc.
+
+Initially, my plan for the SBC was to host services unlisted
+on the [loang network].  Official services were not considered
+because my home network has no IPv6 and sometimes I'll like
+to have most of the bandwidth for meself.  Shortly afterwards,
+I also purchased a somewhat beefy desktop compooter with even more I/O,
+especially a bunch of SATA, which are a lot more attractive
+than connecting hard di\*ks via USB.  On the other hand, the SBC barely
+consume any electricity, well under 10 W with the NVMe drive, a Wi-Fi dongle
+and a fan connected.  Since it cost virtually nothing to keep it up 24/7,
+I decided to hand it the following two tasks:
+
+* Reverse proxying services running on more powerful machines
+  in the local network.
+* Acting as a virtual router between nodes I manage.
+  This is particularly useful for tunneling to my work network
+  and accessing the servers, allowing me to work remotely with low latency.
+
+Setting up the VPN with Wireguard was relatively easy, so I assumed swapping
+the SBC for the home router couldn't be too hard.  Once again, I [chose poorly],
+this little project'd costed me so many sleepless nights so I figured
+I should note down what I learned here in case it can save someone else
+from the same pain.  **Do not take inspiration from this!**
+
+\toc
+
+## Connecting to the Internet
+
+My landlord handles the contract with the ISP so I don't know the details
+of the subscription, but there's certainly no IPv6 nor any static IPv4 address.
+Bandwidth to datacenters in the region is approximately 100 Mb/s
+and the wall socket connects to a Cat 5e cable.  I know about the latter
+because whatever dumb ass did the last maintenance wired that to another
+short one dangling from the wall socket[^futa], and after getting stabbed
+in the eyes for months I finally to open it up and made the socket
+a proper socket.
+
+It would not make the slightest of a difference but I connect
+the SBC's 1 Gb port (identified in Ubuntu as end0) to the Internet
+and the slower one (end1) to my desktop on the local network.
+Thankfully no [special setup][router freedom] was needed
+and here is the entire Netplan configuration to connect to the outside world:
+
+```yaml
+network:
+  ethernets:
+    end0:
+      dhcp4: true
+  renderer: networkd
+  version: 2
+```
+
+## Local Networking
+
+For simplicity's sake, I decided to use the same subnet for both Ethernet
+and Wi-Fi under a bridge br0, where addressing and routing is configured:
+
+```yaml
+network:
+  bridges:
+    br0:
+      addresses:
+        - 192.168.147.254/25
+      interfaces:
+        - end1
+      routes:
+        - from: 192.168.147.128/25
+          on-link: true
+          to: 0.0.0.0/0
+          type: nat
+          via: 192.168.147.254
+  ethernets:
+    end1:
+      dhcp4: false
+```
+
+As Netplan doesn't configure any DHCP server,
+that's done separately by udhcpd from busybox:
+
+```plaintext
+interface br0
+start 192.168.147.128
+end 192.168.147.253
+max_leases 126
+option subnet 255.255.255.128
+option router 192.168.147.254
+```
+
+I couldn't seem to get a concrete information on the ports used by DHCP
+so I open the firewall for UDP on both 67 and 68 (I swear
+this isn't an engagement bait to test out the new mailing list):
+
+```plaintext
+ufw allow in on br0 to any port 67 proto udp
+ufw allow in on br0 to any port 68 proto udp
+```
+
+## Wireless Access Point
+
+Thanks to systemd, the Wi-Fi dongle is recognized as wlx600dd0g8b33f.
+Yes, that abomination of a name includes the chip's full MAC address.
+That being said, I'd like to stick to the basis of a systemd/Linux distro.
+Even though Netplan doesn't support Wi-Fi hotspot with systemd-networkd
+but NetworkManager, so the interface had thus to be declared as Ethernet:
+
+```yaml
+network:
+  bridges:
+    br0:
+      interfaces:
+        - wlx600dd0g8b33f
+  ethernets:
+    wlx600dd0g8b33f:
+      dhcp4: false
+```
+
+Actual wireless connectivity is handled by hostapd:
+
+```ini
+interface=wlx600dd0g8b33f
+bridge=br0
+
+ssid=YΦ
+utf8_ssid=1
+country_code=KR
+channel=6
+ieee80211d=1
+ieee80211h=1
+ieee80211n=1
+hw_mode=g
+wmm_enabled=1
+
+wpa=2
+wpa_pairwise=TKIP
+wpa_passphrase=just enter random characters
+```
+
+## Name Resolution
+
+My ISP is [known to be evil][KT malware] so I'd rather rely on more reputable
+resolvers like [OpenNIC] (plus free-of-charge domain names!).  Most of their
+[tier 2] are located on the other side of the globe (200 to 300 ms RTT),
+so a local cache is almost required.  SmartDNS seems to be the best fit
+for this purpose, as it queries upstream servers simultaneously
+and also check for the IP with the lowest RTT among the results.
+Since I don't trust my ISP, connections to the upstream servers are encrypted:
+
+```plaintext
+bind :53@br0
+server-tls 51.254.162.59 -host-name ns1-dot.iriseden.fr
+server-tls 202.61.197.122 -host-name dns.furrydns.de
+server-tls 80.152.203.134 -host-name dot.kekew.info
+server-tls 178.201.248.159 -host-name dot.kekew.info
+server-tls 178.201.248.160 -host-name dot.kekew.info
+server-tls 95.216.99.249 -host-name dns.froth.zone
+```
+
+For the router itself, the nameserver is set in /etc/resolv.conf
+and Netplan is told not to change it:
+
+```yaml
+network:
+  ethernets:
+    end0:
+      dhcp4-use-dns: false
+```
+
+After ufw is configured to allow UDP traffic in port 53 on br0,
+udhcpd is instructed to advertise this local DNS server:
+
+```plaintext
+option dns 192.168.147.254
+```
+
+I might consider blocking ads at the domain-name level someday, but for now
+uBlock Origin is working well enough on my systems and I rarely have
+people over, especially not for looking at _their_ electronic devices.
+
+[^snap]: Not [the good one][snap].
+[^mmc]: Innovation's gone full circle, _eMMC_ is short for _embedded MMC_.
+[^futa]: Basically a futanari of the RJ45 world.
+
+[upstreamed]: https://rvspace.org/en/project/JH7110_Upstream_Plan
+[goatse]: https://loa.loang.net/chung/D16T24MXDP3T.3BR1X04I90CGT@guix/t
+[Netplan]: https://netplan.io
+[ufw]: https://launchpad.net/ufw
+[loang network]: https://loang.net
+[chose poorly]: https://antifandom.com/how-i-met-your-mother/wiki/Knight_Vision
+[snap]: http://snap.berkeley.edu
+[router freedom]: https://docs.fsfe.org/en/teams/router-freedom-tech-wiki
+[KT malware]: https://www.tomshardware.com/tech-industry/cyber-security/south-korean-telecom-company-attacks-torrent-users-with-malware-over-600000-people-report-missing-files-strange-folders-and-disabled-pcs
+[OpenNIC]: https://opennic.org
+[tier 2]: https://servers.opennic.org
+[SmartDNS]: https://pymumu.github.io/smartdns/en