Maybe run a bandwidth speed test, and enable/set qos to 95% of that value... I found that's an easy way to kill the buffer bloat (way better latency).
this post was submitted on 22 Mar 2025
26 points (100.0% liked)
Selfhosted
44902 readers
993 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 2 years ago
MODERATORS
Building on the advice others gave:
- Make a list of the precise goals you want to achieve. Even if you don't know precisely what you're trying to do, if you can describe the intent well, someone who does know can point you in the right direction.
- Networking is not super hard, but it is not super easy, either. You should take note of every configuration change from stock, and you should optimally have an understanding of what a majority of those do. Ticking boxes at random will have results varying from "nothing happens" to "nothing happened... yet" to "the network is suddenly down" to "my switch is on but I can't even ping it anymore."
- My advice is that routers, switches, and WiFi APs should remain as just routers, switches, and APs. I would not put services like networked storage on them, as that will significantly increase the complexity involved when you inevitably have to replace or maintenance them down the road.
Going off your response to foggy:
achieve better security through segmentation by isolating cloud-connected devices, guest devices from trusted devices.
You're describing VLANs. VLANs are something that the OWRT documentation (last I used it) was simply very shit at. I'll make the assumption you understand or are capable of learning about how VLANs work. (TLDR is that devices on different VLANs can not talk to one another without going through a router or a layer-3 switch, which I don't think OWRT handles anyway. Once you know what tagged/untagged means, then you're good to proceed.)
The way you access VLANs in modern OWRT is: Network > Interfaces > Devices (tab). From here, you may see different things depending on your hardware. In my case (I use consumer routers), I have several "network devices" which map to a physical port, and a single bridge device. From there, I can click on "configure" for the bridge device and select the "Bridge VLAN Filtering" tab to configure the vlans on the various ports.
Note that VLANs if incorrectly configured can easily make it impossible for you to access your device, requiring you reset it.
Being able to “pin” a Mac address to an IP, and being able to use internal network name resolution to reach those devices.
To my knowledge, OWRT lacks the ability to pin MACs to specific ports, at least in the web UI. It may be possible to do this manually in the configuration files, but I have never attempted to do so myself.
a blocklist for known ad-domains / malicious domains.
You generally do this on your (core) router, not the switch. (Unless your switch is doing some really funky behavior, in which case you're not here asking questions.) Most devices OWRT runs on, however, have very little flash and not much RAM. While you can probably get Pi-Hole or Adguard Home to run on them, I do it differently.
I run Adguard Home on a device separate from my router, and on the router, I have set the AGH device as the first DNS sever (OWRT: Network > DHCP and DNS > Forwards (tab)), then I enable Strict Order ("Resolv & Hosts Files" tab).****___
a high level monitoring capability to seen what devices are communicating with what domains / IPs
I would do this on the router level, not switch level. That said you can actually just follow this tutorial here https://grafana.com/blog/2021/02/09/how-i-monitor-my-openwrt-router-with-grafana-cloud-and-prometheus/
An IDS capability of some sort to be able to detect anomalies in my LAN.
This is not something I've ever attempted or done, so I'm interested in hearing what you come up with when/if you ever get there.
Thank you for taking the time to answer throughly! I noted your advice and chunked up my goals into "mini-projects", once I have all the configurations set and all devices connected to the new router. I did check what I bought is a router, not a switch (I find the naming of the device acting as the gateway between the LAN and WAN to be a bit ambigous: switch, router, gateway...).
As for the IDS capability, this is something that would be done by a raspberry pi being fed packets from the router. I don't know if I will ever undertake that task, but I keep it in mind if I'll feel adventorous 🙃
(for those wondering: Linux Magazine #279 has a guide on how to accomplish this with a Fritz!Box 7583).
For all intents and purposes, "gateway" just means "router," especially in consumer/home networking. Routers act as a gateway, routing traffic from one network to another network. On one end of the router is your WAN (ISP / internet at large / etc.), and on the other end if your LAN.
Switches on the other hand are "dumb" and only act to expand a network. They basically act like a power strip does: What was one port is now more. (This example will probably upset someone for reasons, but they'll also understand that it works well enough.)
Thought exercise: What happens if you plug the WAN cable from your ISP into a dumb switch (like https://www.amazon.com/dp/B00A128S24), and from there you plug in several devices (PC, printer, etc)? I am not answering that question because just about anything can actually happen. It depends on how your ISP is configured and will almost certainly not work 100% correctly.
Now onto the actual response: For the most part, every consumer router is a router/switch/wifi AP combo box, and are capable of being used for all or any combination of those features.
If you're not planning to use your device as a router, then we'll ignore the routing functionality. All prior points where I say "this happens at the router, not the switch" still apply. (Your device can still be called a router, as that's what it's sold as, but you'd be using it with the all routing functionality disabled, only using the switch and possible WiFi features)
If you do plan to use your device as a router, then the prior points where I say that now apply.
Anyway, you're in luck since the switch built into your device is almost certainly VLAN-capable (it's quite rare, but some devices are not capable of it). If you're not using the device as a router, that's where things probably end, since (at the switch level) VLAN support is pretty much the only thing of note.
I spent so long writing this I actually forgot what I was trying to say initially. I'll likely draw a diagram to explain some things for you.
The important thing is that "switches" (or your device if you're not using the routing functionality) are "dumb devices" that only do very simple tasks and generally aren't capable of much in terms of advanced security features. "Routers" are smarter devices where the task they do is a bit more complex, and are where the advanced security features can actually be applied.
So, this question is very difficult to answer. I don't want you to be discouraged though.
I can't answer you because I don't know your goals. Since we're in /c/selfhosted, I assume you're experimenting with some self-hosted setups, which is awesome! But what exactly are you hoping to do with OpenWRT? And what’s the plan for the switch? Are you aiming for better network control, VLANs, firewall rules, or are you just looking to have network area storage?
If you can share more about what you’re trying to accomplish, folks here will be much better equipped to help you figure out your next steps.
Thank you for all the questions to help me clarify my use case 🙂
At the very basic, I'd like to:
- achieve better security through segmentation by isolating cloud-connected devices, guest devices from trusted devices.
- Being able to "pin" a Mac address to an IP, and being able to use internal network name resolution to reach those devices.
- a blocklist for known ad-domains / malicious domains.
Once the basics are in place, I'd like to elevate my netsec game and implement:
- a high level monitoring capability to seen what devices are communicating with what domains / IPs
- An IDS capability of some sort to be able to detect anomalies in my LAN.
The NAS part is just for convince, it would be nice to have a samba / NFS with my files available when I need them.
What should my first configurations and preparations
Write on paper your goals. Write on paper a list of your systems and what needs to speak with what.
Then pick the most important or simplest device and get it connected the way you want.
should I do
Read. For example the tutorials in the openwrt wiki. I found them quite helpful.
before flashing Openwrt
Nothing... except the exact prerequisites for the flashing itself.
Your network config comes afterwards.
Be prepared for your router to not work until you figure out how to set stuff up. So hopefully this isn't your only router. I converted a router to OpenWRT and my knowledge of networking was super basic. It was very confusing but I did get it working in a few days. However, I couldn't get some things working like a VPN or updating without wiping all my settings. OpenWRT is router firmware, not NAS software. You'll need to run something like CasaOS, OpenMediaVault, TrueNAS, etc for that.
This website is a great starting point for router configurations: https://routersecurity.org/#StartHere