I build a Linux system with multiple NICs. It’s heavyweight for a router, and probably not very efficient, but it does the job very well and I love it. I’m using foomuuri to manage the NFTables and NAT and it was very easy (although it’s a very obscure piece of software and the documentation and community isn’t excessively comprehensive, you might have better luck with something more common but it works nicely for me). It can pull in all the adblocking lists and all that fun stuff. I find it pretty intuitive to configure, at least compared to the horrors of most networking/routing configuration nonsense.

For DHCP I tried using the ISC’s new “kea” in the hopes it would be modern and clean alternative to the venerable old isc-dhcp-server but it turned out to be a horrible mistake. They made some awful, insane, unjustifiable design decisions in that software. It gets confused about IP addresses already being claimed (by the exact same host/MAC) address because some arbitrary value changed in how it identifies itself, and then does absurd things with static leases, it just randomly decides to give it a dynamic lease instead, and then will fixate on that dynamic lease and never let it have the static lease back, I fought with it for months, it kept breaking my network for absolutely no reason and it was a nightmare.

Back to trusty old isc-dhcp-server for me. And of course bind for DNS, I’m a bit old-school but it’s very comfortable.

dnsmasq might be a lighter-weight and easier alternative you could consider, I think it does DHCP as well, convenient.

And of course, being a full Linux server means you can put all kinds of other stuff on it too. Stuff that needs to be both publicly visible and privately visible on the LAN seems like an obvious fit, but in fact it’s probably the worst place to put those services, because you run into issues with NAT hairpinning and other nonsense. For services that are strictly intended for the private LAN/VPN, or services that are strictly public facing, it can handle those just fine by restricting them to a specific interface. But you should avoid stuff that needs to listen on both sides of the connection, it can be done, but it’s tricky and annoying and not ideal.

If you need both internal and external access, port-forwarding from the outside through the NAT to another dedicated internal host is a much better solution if possible, it’s still a bit tricky (you may have to override the DNS for that domain internally to use the private IP instead of the public one) but it’s quite reliable and functional once you have it set up.

None of this is really for the faint of heart, it’ll likely require a fair bit of trial and error and physical access to the machine to resolve issues. But it’s a fun project and I think the end result is worth it.

I used to run opnsense on a Xeon blade in my old C6100. It worked well enough but was a waste. Now it’s just a stock ER605 without the Omada controller.

I have OPNsense running on a 2nd-hand Dell Optiplex SFF, which I added 2-port NIC(s) to (initially Gigabit RJ45, then later 10Gbit SFP).

Currently it’s running bridged from my ISP router, but I’m in the process of wiring the fibre directly via a SFP transceiver to the NIC. I believe you can do adblocking on OPNsense itself via Unbound, but I prefer to do that via a separate PiHole (VM).

I ran a linux box with two gigabit Intel NICs for years with iptables. Almost any device can do it.

Like others say, opnsense is prob your best bet unless you like the abstraction of iptables

I was using an N100 based mini PC and it did fine at 1gbit. But now that I have 3, and it’s realistically closer to 4 or 5 it doesn’t cut the mustard.

Proper hardware based routers are also just so much more efficient. That N100 machine was constantly hot to the touch. My new UniFi router uses less power and does 10 gig easily.

I usually just use proper network devices. OpenWRT will generally run on anything with Mediatec or Qualcomm based assuming it has support

It’s currently a N100 mini-pc running Debian, but in the past it’s been all kinds of random hardware including a busted old laptop with an expresscard-PCIe riser for the second NIC. Anything can be a router if you know what you’re doing!

https://nbailey.ca/post/router/

Router is a bunch of old PCs I frankensteined and put opnsense on.

Ended up i5-7500, 8gb mem, 500gb SSD.

Put in a dual-port SFP+ NIC and a dual port 2.5GbaseT nic.

One of the 2.5gb ports goes to my cable modem.

One of the 10gb ports takes Twinax to my dumb LAN switch, the other to my dumb server switch, which right now is really just my storage network…the link to the firewall isn’t doing anytuhing.

The dumb switches I have here, though, they’ve got some sort of weird MAC learning disability. It cannot handle macflaps, which I found out about because I had a hard time roaming between APs.

So I got a Netgear GS108T and put OpenWRT on it, and that switches between my APs.

My APs are Linksys MX4200v1’s. Also openwrt. Got four of them…one upstairs, two in the ground floor, one in the basement. Can get very close to 1Gbps anywhere in the house on wifi. Not the best platform for openwrt (ipq807x), as I’ve found out…but it was a hella cheap deal for tri-band AX APs.

When I retire my desktop PC, the old parts become my router. If you have two network ports, it can do it.

To warrant the power bill, it’s also a NAS, NVR, mail server, print server and web server.

All my Wifi APs are various home routers flashed with OpenWRT.

Got a “Dell Wyze 5070 extended”, the extended is important because it lets it have a half height PCIe card. Put a dual NIC Intel card in it. It came with 8 GB of RAM and a 64 GB SATA M.2 drive, plenty. Price out a power brick if it doesn’t come with one, which is a Dell laptop one; it refuses to turn on with a PCIe card in and if the power brick is less than 130W (DA130PE1-00 is a product # of it)!! Very annoying. Note the Intel atom processor in it lacks AVX2 instructions which makes mongoDB past v4 not work on it, so you can’t run the Unifi controller, which has vexed me. But it’s fine for internet routing! Never tested throughput but others have online.

(Note: I would not do this now!) I put proxmox on it then did opnsense (passing through the PCIe NICs) and Debian. I chose opnsense over openwrt because opnsense had an automatic update functionality, while openwrt required you to manually wipe the OS and reinstall - when they fix nasty upgrade path that I’ll come knockin. (Openwrt is like that because that’s how routers do upgrades)

I would not choose proxmox now because its upgrade path is fraught since the free level is rolling and they’ve had critical breaking update errors in the past. No good for your router setup. I want upgrades on and automatic so I don’t get kiddie script hacked.

I’m prepping to do either opnsense only and not in a VM or Debian with Incus (VM manager like promox, but not its own OS) installed and then opnsense in a VM. I’m leaning opnsense direct to just make sure my router works, but I’ve never had trouble with Debian yet so still pondering.

I run a pihole and wireguard on the current Debian VM, and opnsense can do wireguard so most of the way there. In the future I’ll switch that pihole instance (wherever it is) to adguardhome, the local rewrite rules in pihole don’t support wildcards so it’s annoying af to have to load in every local domain I set up.

This has worked well for years and I’ve never measured power but I presume it is low.

Hope this infodump helps!

i had a cheap made in china consumer router with mt7621 on it, porting openwrt was surprisingly easy and its been running well enough for the past 5 years. adguard home runs on it and handles dns adblocking

Opnsense on whatever. Plus pihole for DNS/adblock.

I bought a firewall appliance based on an Intel CPU, with 4x 2.5gbps Ethernet ports, 8gb ram. Installed opnSense on it and been super happy even since!

A bit pricey the hardware, but it’s been totally rock solid for almost two years now.

I have configured unbound with ad blocking on opnSense, and it has every single option I would ever want on it. Amazing stuff.

Not sure how “DIY” you want to go. I’ve been liking OPNSense though. Running it on an air cooled Protectli box.

Handles a symmetric 2Gbps connection just fine.

I’m running openWRT on a nanopi R5S. It’s tiny, robust, cheap, and uses very little power. It came with FriendlyElec, a fork of openWRT designed specifically for the device, but if flashed the standard version onto it so I could get more support from reading forums. I don’t know if that was the right move.

It was a bitch to get set up right, but that’s due to my lack of experience, not the device. It didn’t help that there was a major update to OpenWRT/LuCI right in the middle of my figuring out the program, that drastically changed the GUI. It also didn’t help that I was setting up a NAS, and a proxmox server at the same time, so anytime something broke I had 3 system to troubleshoot.

All that aside, it’s been working great since setup with zero maintenance. It does get hot enough that I don’t set it on any other device, but it never throttles itself or overheats.