Firewall upgrade

After noting that my long serving Asus RT-AC5300 running Merlin AsusWRT had gone EoL (and had long since had its WiFi duties taken over by two UniFi WiFi 6 Lites), I decided to dip my toe into perhaps a more advanced setup, and set about configuring a small mini-server to host a containerisation and virtualisation solution for my networking needs. It's working, but it's also still a work in progress.

The mini-server I decided to go with was one I saw on "ServeTheHome". A small, fan-less*, server with an 8 core Intel Atom C3758. The mini-server was available shipped with RAM and storage, but I decided to supply my own... 64GiB (2x32GiB) of GSkill Ripjaws DDR4 SODIMMs, and a Samsung SSD 970 EVO Plus 1TB NVMe drive. Thankfully I got to do this BEFORE the AI Chipocalypse.

*After a week or two of it running, I noticed even though the whole case is a heatsink, it was getting rather toasty, and decided to hook up a cheap external USB fan which has dropped the CPU temps about 20-30C.

I decided that I didn't need a full blown computer, and wouldn't want one for the power consumption, and I also wanted something that would happily sit in my network cabinet and quietly do its work.

I could have just installed a firewall OS on the box, and that would have made it a simple, single purpose appliance. I had, however, other tasks running on different machines on my network that I felt could be better placed within a centralised host. Subsequently I thought about virtualisation features, and had heard Proxmox VE mentioned a few times, so decided to go with it. Proxmox VE is a cluster-ready hypervisor and LXC container host. Qualcomm's shenanigans with VMware licensing put me off that path completely, even the free version.

Out of the box, the mini server, a Qotom Q20332G9-S10, doesn't come with any documentation, though I've found their customer service staff to be particularly responsive to queries. The UEFI settings don't really mention virtualisation, but it does appear to support VT-d, and I've been able to enable kernel options in Proxmox VE to allow sharing of individual PCI devices directly into a hypervisor.

I decided to go with OPNsense for my firewall software, as whilst Proxmox VE does have inbuilt firewall options, these felt like a feature rather than a focus. I went for OPNsense over PFsense given some chatter I'd heard about how PFsense had been treating the open source community.

I installed OPNsense, and after some fiddling with the way the WAN interface gets mapped through to it (I went with direct PCI mapping rather than a virtual NIC + bridge like I used for LAN interface), I had a functional network again. Part of the fiddling to map the interface through to the firewall guest OS as a PCI device involved having to add additional arguments to the Proxmox VE kernel startup, so it would do things like assign unique IOMMU group IDs to each PCI device.

Now I had my internet back up and running, I could turn my focus to the services that I'd had running in other parts of my network, and services I'd been thinking about running, but not yet configured.

I have an old tower system acting as a media server, and on that, I'd had the old UniFi Network software running for a self-hosted controller. I also had a feed reader program running in the background on my desktop computer. On my mind, had also been home automation.

The mini server brought about the opportunity to bring this altogether, so now, I have the mini server running:

•  Proxmox VE
• OPNsense - Firewall router
• UniFiOS - UniFi equipment controller
• HAOS - Home Assistant home automation orchestrator
• tt-rss - News feed aggregator and reader

The standalone media server still hosts the media and a Minecraft java instance :)

I have found Claude Code immensely useful in debugging issues with my network configuration, including Proxmox, OPNsense, UniFiOS, and HAOS. It is what finally helped me get IPv6 going in my network.

I've also used it to help me properly enable Suricata in OPNsense, and to otherwise generally harden my network.