alt Hacker NewsWhat changes when you turn a Linux box into a router
Comments
Used to run a virtualized firewall setup. And then one day discovered that somewhere along the lines I had made a change (or an update changed something) that meant proxmox admin interface was being served publicly. That's despite confirming during initial setup that it isn't.
So now I do not do any funky stuff with firewalls anymore. Separate appliance with opnsense bare metal.
Are there any preconfigured images/installers available for a major Linux distro to turn them a router with safe and sensible defaults?
I know there is OpenWrt, but my experience is that is more geared toward running on embedded wifi hardware than an x86 machine. The x86 install comes with a tiny root partition that's actually pretty difficult to resize, for example, and upgrades are quite brittle compared to standard Linux distros.
And there's also pfSense and OPNsense, but these run on FreeBSD which seems to lag behind Linux for hardware support. There's no support for the Aquantia AQC113 NIC, for example (although it looks like this may finally have been added in the last month or so).
Something like an Ubuntu Appliance [1] would be quite nice.
This is an excellent post and great reference material. I’ve done this a few times before and the information was scattered all over the place. I appreciate the clear and concise writing here. I even added it to my HN favorites - a rare accolade!
One thing I’d add, is that the best explanation I’ve ever seen for this, is the famous diagram [0] on Wikipedia of the netfilter API — I remember when I saw that, everything clicked into place. I’m not sure how up to date it is now, but it’s really good.
[0] https://commons.wikimedia.org/wiki/File:Netfilter-packet-flo...
I feels wrong to not mention IPv6 in 2026.
- net.ipv6.conf.all.forwarding=1
- nftables is default to `ip` family which only applies to IPv4. Setting it to `inet` will allow rules to apply to both IPv4 & 6; or `ip6` for IPv6 only. You can skip NAT rules, usually.
- dnsmasq: in addition to DNS and DHCP, turns on router advertisement with SLAAC. Some devices can get IPv6 address from stateful DHCPv6 server, others (e.g. Android) only work with SLAAC.
This is a great article.
It explains steps I used to fumble through stabbing in the dark following piecemeal examples trying to bring up quick and dirty networking on an oddball Linux device (like a BPI-R4 or router VM).
While I run Linux on my production workstation, I use OpenBSD as my router and firewall at home. I find the configuration of OpenBSD for this a lot more simple and everything that's needed, even for IPv6, is in the base install.
The FORWARD chain defaulting to ACCEPT is one of those things that bites people hard in incident investigations. A compromised host with ip_forward enabled silently becomes a pivot point — the attacker can route through it to reach internal networks that were never meant to be reachable from that segment.
Worth adding to any hardening checklist: if you don't explicitly need forwarding, set the default FORWARD policy to DROP and only whitelist the routes you actually want.
My very first exposure to Linux was in 2000, my school was about to throw away an old gateway computer and I took it home and turned it into router
As a kid with no AI, no google, it was quite a feat and I’m still very proud of it
Was my introduction into how the internet works and I’ll never forget working with ipchains
I remember enduring a lot of people in forums calling me a noob, but only after spending collective hours answering my dumb questions
I credit a big part of my moderate success in tech, to being familiar with stuff at just a tad bit lower of a level than the average bear
To my friend Sam who I haven’t talked to in 20 years, thanks for the idea
People saying "the FOWARD chain defaults to ACCEPT" are missing the deeper point: with the kconfig most distros use, the filtering code doesn't even exist at all until you load the kernel modules!
At the lowest level, it is impossible to have a default DROP for forwarding, because nftables is an optional piece of the kernel that often isn't loaded.
[dead]
The Linux box instantly turns into a router as soon as you run `sysctl net.ipv4.ip_forward=1`, because the default policy for FORWARD table is ACCEPT.
You need to explicitly reconfigure the iptables/nftables to prevent that from happening.
Some software, say LXD/Incus, enable forwarding automatically upon installation/startup, and do not configure firewall to block non-their traffic, making the machine an open router. I've reported that, the developers said that's by design (despite other virtualization/containerization systems block forwarding if they happen to enable the sysctl).