libretech

Tl;dr

Very new to home networking, but planning to get some hardware to run OPNsense bare metal to replace my ISP all-in-one.

Requirements: AES-NI support, Intel NICs, supports coreboot, can handle Wireguard both to connect out to my VPN provider and also to allow me to connect back to services at home

Nice to haves: 2.5+ Gbps NICs, resources to support an IPS like Snort or Suricata.

Questions:

• Are people still using cheap AliExpress hardware despite potential security risks?
• If so, do you reflash your firmware? Are you comfortable counting on a script like Flashli, or do you use something like SPI?
• Would you still reflash your firmware even from a more trusted vendor, like Protectli or Deciso?
• What is a reasonable amount to spend on reasonable router hardware?

Some Options I’ve Seen Recommended/Am Considering:

• Protectli Vault Pro VP2420-4 (but open to other Protectli suggestions)
• AliExpress N100/N305 machines (though of course with the aforementioned security concerns)
• Used Thinkcenter M720q (though not sure how the power efficiency compares)

Thanks so much to anyone who takes the time to post your thoughts, I’m extremely grateful!

Hi everyone,

Thanks so much again to those of you who left your thoughts on my thread a month or so ago. Progress on my NAS still continues at a glacial pace (mostly because I want ECC support and an iGPU that supports AV1 decoding on the same machine, but building around the W680 is a little pricey; in fact, might end up considering adding an A380 for AV1 support instead to open up some other options, but that’s a story for a different thread). But I am reaching out now because in the interim I’ve been trying to make progress on some more fundamental network infrastructure while I am figuring out plans for the bigger systems. Of course, even that turned into a bigger project than planned, which is why I am back to get some of your insights.

Just for folks who didn’t see my other thread, I am definitely a home networking noob generally, but am trying to build out my whole home network. In terms of the router hardware I am hoping to get, at minimum it would need AES-NI support and Intel NICs vs. Realtek, as well as support for coreboot for peace of mind (in an ideal world, even libreboot, but my understanding is basically no hardware released within a decade or more would allow that to run). At least 2.5 Gbps throughput would be nice, but not essential. Likely will be paired with a switch, so I’m also not overly concerned about port count (though maybe just for starting out 4 ports would be ideal and I can add in a PoE switch later).

In terms of planned use, I want to use Wireguard both to connect out to my VPN provider and also to allow me to connect back to services at home, as well as a few VLANs. Support for IPS like Snort or Suricata would be a plus, but it seems they can be resource intensive and I’m not currently thinking of them as a necessity.

A lot of resources I’ve seen suggested just grabbing a cheap machine off Amazon or AliExpress is the most cost-effective way to go, but it seems like there are some legitimate security concerns going that route. Are people still buying some of the cheaper AliExpress (e.g. Qotom, Topton, Cwwk) N100/N305 machines for their routers, even with concerns about backdoors (like Horse Shell in TP-Link firmware)? Are you reflashing firmware if you do so (and if you are, are you doing it through SPI vs. a script like Flashli)?

I’m the furthest thing from an expert, but just from a bit of poking around it seemed like if one wanted to reflash firmware in a 0 trust way, it looks like you’d need to either use SPI or JTAG vs. trying to do it through a script (and of course you’d need to take into account whether Boot Guard is enabled).

Would you reserve this treatment just for no-name router brands or would you reflash firmware the same way if you bought from a more trustworthy source like Protectli or even Deciso? Personally, my threat model (just trying to take back some privacy and control over my tech and not trying to stand single-handedly against the NSA) and current (low) skill level make me think I should just opt for a Protectli box that I know will work with coreboot (like the VP2420-4) and then move on with my life, but spending $300-$400 on a router seems like a lot (and perhaps I am robbing myself of the joy of having to figure out how SPI works).

Thanks so much for your thoughts! I remain extremely grateful to have the opportunity to tap into all of your collective wisdom (and hopefully at least save myself a few lessons learned the hard way). As long as its not obnoxious, I am also happy to share my progress and learning as I go in case it can save some time for other folks just starting out. Thanks again!

Tl;dr

I have no idea what I’m doing, and the desire for a NAS and local LLM has spun me down a rabbit hole. Pls send help.

Failed Attempt at a Tl;dr

Sorry for the long post! Brand new to home servers, but am thinking about building out the setup below (Machine 1 to be on 24/7, Machine 2 to be spun up only when needed for energy efficiency); target budget cap ~ USD 4,000; would appreciate any tips, suggestions, pitfalls, flags for where I’m being a total idiot and have missed something basic:

Machine 1: TrueNAS Scale with Jellyfin, Syncthing/Nextcloud + Immich, Collabora Office, SearXNG if possible, and potentially the *arr apps

On the drive front, I’m considering 6x Seagate Ironwolf 8TB in RAIDz2 for 32TB usable space (waaay more than I think I’ll need, but I know it’s a PITA to upgrade a vdev so trying to future-proof), and I am thinking also want to add in an L2ARC cache (which I think should be something like 500GB-1TB m.2 NVMe SSD); I’d read somewhere that back of the envelope RAM requirements were 1GB RAM to 1TB storage (though the TrueNAS Scale hardware guide definitely does not say this, but with the L2ARC cache and all of the other things I’m trying to run I probably get to the same number), so I’d be looking for around 48GB (though I am under the impression that using an odd number of DIMMs isn’t great for performance, so that might bump up to 64GB across 4x16GB?); I’m ambivalent on DDR4 vs. 5 (and unless there’s a good reason not to, would be inclined to just use DDR4 for cost), but am leaning ECC, even though it may not be strictly necessary

Machine 2: Proxmox with LXC for Llama 3.3, Stable Diffusion, Whisper, OpenWebUI; I’d also like to be able to host a heavily modded Minecraft server (something like All The Mods 9 for 4 to 5 players) likely using Pterodactyl

I am struggling with what to do about GPUs here; I’d love to be able to run the 70b Llama 3.3, it seems like that will require something like 40-50GB VRAM to run comfortably at a minimum, but I’m not sure the best way to get there; I’ve seen some folks suggest 2x3090s is the right balance of value and performance, but plenty of other folks seem to advocate for sticking with the newer 4000 architecture (especially with the 5000 series around the corner and the expectation prices might finally come down); on the other end of the spectrum, I’ve also seen people advocate for going back to P40s

Am I overcomplicating this? Making any dumb rookie mistakes? Does 2 machines seems right for my use cases vs. 1 (or more than 2?)? Any glaring issues with the hardware I mentioned or suggestions for a better setup? Ways to better prioritize energy efficiency (even at the risk of more cost up front)? I was targeting something like USD 4,000 as a soft price cap across both machines, but does that seem reasonable? How much of a headache is all of this going to be to manage? Is there a light at the end of the tunnel?

Very grateful for any advice or tips you all have!

Hi all,

So sorry again for the long post. Just including a little bit of extra context here in case it’s useful about what I am trying to do (I feel like this is the annoying part of an online recipe where you get a life story instead of the actual ingredient list; I at least tried to put that first in this post.) Essentially I am a total noob, but have spent the past several months lurking on forums, old Reddit and Lemmy threads, and have watched many hours of YouTube videos just to wrap my head around some of the basics of home networking, and I still feel like I know basically nothing. But I felt like I finally got to the point where I felt that I could try to articulate what I am trying to do with enough specificity to not be completely wasting all of your time (I’m very cognizant of Help Vampires and definitely do not want to be one!)

Basically my motivation is to move away from non-privacy respecting services and bring as much in-house as possible, but (as is frequently the case), my ambition has far outpaced my skill. So I am hopeful that I can tap into all of your collective knowledge to make sure I can avoid any catastrophic mistakes I am likely to blithely walk myself into.

Here are the basic things I am trying to accomplish with this setup:

• A NAS with a built in media server and associated apps
• Phone backups (including photos) 
• Collaborative document editing
• A local ChatGPT 4 replacement 
• Locally hosted metasearch
• A place to run a modded Minecraft server for myself and a few friends

The list in the tl;dr represent my best guesses for the write software and (partial) hardware to get all of these done. Based on some of my reading, it seemed that a number of folks recommend running TrueNAS baremetal as opposed to in ProxMox for when there is an inevitable stability issue, and that got me thinking more about how it might be valuable to split out these functions across two machines, one to hand heavier workloads when needed but to be turned off when not (e.g. game server, all local AI), and a second machine to function as a NAS with all the associated apps that would hopefully be more power efficient and run 24/7.

There are two things that I think would be very helpful to me at this point:

1. High level feedback on whether this strategy sounds right given what I am trying to accomplish. I feel like I am breaking the fundamental Keep It Simple Stupid rule and will likely come to regret it.
2. Any specific feedback on the right hardware for this setup.
3. Any thoughts about how to best select hardware to maximize energy efficiency/minimize ongoing costs while still accomplishing these goals.

Also, above I mentioned that I am targeted around USD 4,000, but I am willing to be flexible on that if spending more up front will help keep ongoing costs down, or if spending a bit more will lead to markedly better performance.

Ultimately, I feel like I just need to get my hands on something and start screwing things up to learn, but I’d love to avoid any major costly screw ups before I just start ordering parts, thus writing up this post as a reality check before I do just that.

Thanks so much if you read this far down the post, and for all of you who share any thoughts you might have. I don’t really have folks IRL I can talk to about these sorts of things, so I am extremely grateful to be able to reach out to this community. -------

Edit: Just wanted to say a huge thank you to everyone who shared their thoughts! I posted this fully expecting to get no responses and figured it was still worth doing just to write out my plan as it stood. I am so grateful for all of your thoughtful and generous responses sharing your experience and advice. I have to hop offline now, but look forward to responding to any comments I haven’t had a chance to turn to tomorrow. Thanks again! :)