It's networking day at the new office. I started off just with this Linksys router since I had it
on hand the day the Charter came to install my internet. I also set up this little internet
crash cart so I could roll it out of the way during construction. But this router is only
a gigabit, and it's pretty barebones. It works, but: I'm a homelabber. I love overkill! Even
though I don't work here yet, I want 2.5 gig networking, and remote access, and beefier
security, and a better Wi-Fi access point. And I just can't stand not having Pi-hole
and internet monitoring, so I'll be setting that up too, but probably that'll be in another video.
So for today, I'm going to walk through how I set up this 2.5 gig network, how I set up
OPNsense on this little DIY router box, how I upgraded my Wi-Fi AP, and how I'm running a
private WireGuard VPN for remote access.
And you might be wondering, "Why did Jeff put on a shark costume to install this switch?"
Well, have you ever heard of Surfshark?
They're today's sponsor.
And just because I have a WireGuard VPN for my office doesn't mean a Surfshark VPN isn't
also useful.
My VPN is located here, in St. Louis, Missouri.
Surfshark has over 3200 servers in 100 countries all around the world.
Why is that important?
Well, media companies love playing this dumb game of restricting their content to certain
areas.
With Surfshark, I can watch sports, movies, or TV shows that I otherwise couldn't.
It really came in handy when I was in the UK last month.
I could still watch all the shows I'm used to.
Surfshark also lets me mask my IP address for better privacy.
And even though you have to trust them too—because you're routing your internet traffic
through them whenever you're connected—I trust them enough that I've been a customer
for a while now.
Use code REDSHIRTJEFF to get 3 extra months free, and sign up using the link in the description.
Now back to networking.
The first task was getting OPNsense going for a router and firewall.
I asked on Twitter, Mastodon, and Discord, and people were split between mostly pfSense
and OPNsense.
But seeing that OPNsense seems to have a lot more frequent releases and supports newer
hardware, I went with that.
Then Patrick from ServeTheHome sent me this little guy.
It's a 4-port 2.5 gigabit fanless mini PC that has a little low-power Intel chip inside.
I'll link to his video on it, but basically, this is a perfect little box for a fast DIY
router.
It'll give me speeds way better than 1 gig, and it has just enough processing power to
run a VPN at pretty good speeds too.
Patrick suggested I install Proxmox and virtualize my router, and I actually tried that.
But I was having a little trouble getting all the ports passed through and decided I
just needed this thing in service, so I installed OPNsense baremetal.
I just popped the install image on a USB flash drive, plugged that in, and installed it directly
onto the SSD.
For remote access, I decided to use WireGuard, since I'm already using it at home thanks
to PiVPN.
I actually have a video on the exact details of setting that up, and there's a link down
there.
But setting up WireGuard inside OpenSense was actually a bit more difficult than I thought
it would be.
I should point out I found this article by Home Network Guy to be the most up-to-date
and helpful.
The first hurdle was figuring out whether to install os-wireguard or os-wireguard-go.
After a little research I found the os-wireguard plugin was the one to go with for new installs,
so I installed that one.
I was reading through the official [OPNsense] WireGuard setup docs, but some of the docs were a little
too generic, and for the first time I set something new up, I liked to have my hand
held more as I walked through it.
So especially once it was time to add the firewall rules for WireGuard, I leaned heavily
on the Home Network Guy's article.
It went through in pretty explicit detail on the whole process, so I won't go through
it all here, but check out the link below if you want to do the same thing on your OPNsense.
I set up my office network to use the subnet 10.0.2.0 to differentiate it from my homelab,
which uses 10.0.100.0.
Why not 200?
Not sure, I just decided to drop off those extra zeros.
But I also want to use DNS names for easy reference, and OPNsense ships with Unbound
DNS, which is pretty easy to use.
So I created an entry for router.mmoffice.net so I could get to OPNsense more easily.
I actually buy a real domain name for every site I manage, that way it's easier for me
to see what LAN I'm touching when I visit different device configurations.
At home, I use geerli.net.
At this office, I'm using mmoffice.net.
You don't have to do any of that, I just like doing it since it makes getting free valid
SSL certs easier.
I installed iperf3 on the router, which was a bit of an adventure, but I went home and
got on the VPN and I could get a little under 400 megabits connecting from my home to the
office.
Now, one super annoying thing about the way iperf3 is set up in the UI is you have to
start it every time you want to do another performance test.
I found out I could just start it from the console so it would run continuously, but
I did want to point that out.
Now testing bi-directional from the office to home, that's a bit sad because Spectrum's
upload speed is so terrible at the office.
I could only get like 10 megabits in that direction.
Internally on the LAN, I could get about 750 megabits through WireGuard, so not quite maxing
out the network, but it's pretty good for a tiny fanless PC.
The last thing I wanted to do for the network was set up this Netgear access point.
I have a video about it when I installed it at my house, but I actually upgraded to a
massive Enterprise Wi-Fi 6E access point, so this one will live at the office for now.
I went ahead and installed a wood backer board next to the door.
That way I can mount my security system control panel and also have a good spot for the AP
to live, at least temporarily.
Except after I got ready to install it, I realized I don't have the PoE here, and I
didn't have a power supply for this AP.
So for this access point, it's PoE powered.
Or you can plug in a 12 volt adapter.
I don't have an extra 12 volt adapter for it, and I don't have PoE here right now, so
I can't get that set up, so I'm actually still running that little Linksys thing, but I put
it in bridge mode.
So now the network connection goes through it to Wi-Fi, so the SimpliSafe system is going
through that, and I can connect to Wi-Fi if I need to.
It's actually not bad, and I could get a few hundred megabits through it.
But now I have an AC adapter for the Netgear, and I also have this 2.5 gig switch, so it's
time to set those up.
This little QNAP switch has two 10 gig SFP+ ports and four 2.5 gig ports, so it's kinda
perfect for a little install like this.
It's expensive at $130, but it's silent and seems to handle whatever traffic I've thrown
at it.
The Netgear AP thankfully still allows local management.
I don't want to have to subscribe to their service just to use their gear.
I set up two WiFi networks for now: a 2.4 and 5GHz network.
One thing I did to speed up the 5G network is set a channel width of 80MHz.
That allows more bandwidth for the newer devices that'll use it.
For any older devices or IoT stuff like the SimpliSafe, they can use the slower 2.4G network
without slowing down my fast network.
After updating the firmware, I marked the spot and hung the AP on the wood board I had
installed on the wall earlier.
Cable management is good enough to stay in place for now.
I'll make things more tidy once we get past construction.
With Wi-Fi 6 and 80 MHz channel width, my MacBook Air could get over a gigabit download
speeds over the internet, though upload is still stuck at 40 megabits.
Wired is where performance is best though.
Internally between the router and my computer, I get 2.35 gigabits.
But did the router upgrade actually help my internet speed?
Yes, in fact it did!
Spectrum actually over allocates their 1 gig service—at least for download bandwidth.
So when I run a speed test while I'm jacked into the 2.5 gig network, I can get speeds
just over a gigabit.
With that old 1 gig Linksys router, that was impossible.
And even with the overhead of my WireGuard VPN, I can hit speeds over 750 megabits, so
it's not that much a bottleneck, at least for my current internet connection.
I think if I ever upgrade a fiber here—and I don't know if I will because that's crazy
expensive—I'll also upgrade the router.
For normal traffic it seems fine, but with WireGuard's encryption, it does top out below
a gigabit.
And I want to monitor the internet connection over time, so I'll install an internet monitor
and Pi-hole using this little Raspberry Pi.
I'm also going to set up that Raspberry Pi NVR soon, so subscribe if you want to see
that.
Outside of networking, just trying to get the build started has been an adventure.
I've done odd jobs like installing that wood on the back wall to hang things, adding this
fancy restroom sign, mounting the fire extinguisher on the wall, and I decided to throw this fancy
glow in the dark sticker up there too.
I mean, how cool is that?
I don't even need it.
I just thought my kids would love seeing it when they visit.
I also hung up the ladder and my cleaning supplies so the entire floor can be clear.
That'll come in handy once construction actually starts.
And speaking of construction, I'm about to have what will hopefully be the last pre-construction
meeting with the architect and builder.
We'll see.
We had some issues with budget.
Mostly that the drywall companies are asking for a third of the entire budget!
Apparently drywall install prices are going up way faster than inflation.
So we'll see.
Thanks so much to everyone who supports this channel on Patreon, GitHub, or YouTube.
Please consider subscribing or even sponsoring the channel so your name can be up here too.
Until the next moving vlog, I'm Jeff Geerling.
[jeff geerling kickboxing computers]