Skip to content
Search

Router:CreateRouter

lastmod 2026-03-31created 2026-03-314 edits

How to turn anything into a router

About

  • Step-by-step summary of the procedure for building a complete router from an ordinary computer or mini PC
  • Builds wired and wireless networks on Debian or Alpine Linux with minimal packages such as hostapd, dnsmasq, and bridge-utils
  • Any device, whether desktop, laptop, or SBC, can be turned into a router as long as it has two Ethernet interfaces
  • Implements commercial-router-level features through a firewall (nftables), DHCP/DNS services, and IP forwarding settings
  • A stable and flexible network infrastructure can be built with nothing but discarded hardware and open source

How to turn any device into a router

  • Following the US government's ban on imports of consumer routers, introduces how to build your own router from existing hardware
  • Based on years of experience running a router reliably on a Linux-based mini PC, summarizes the required configuration and setup procedure step by step
  • A router is essentially the same structure as an ordinary computer, so it can be implemented on a variety of devices such as desktops, laptops, and SBCs
  • Built on Debian or Alpine Linux with minimal packages such as hostapd, dnsmasq, and bridge-utils
  • The goal is not to respond to the policy but to reuse existing hardware and improve understanding of networking

Choosing hardware

  • A passively cooled mini PC is ideal, but any device works as long as it has two Ethernet interfaces
    • Can be supplemented with a USB-Ethernet dongle; somewhat less reliable, but works well enough
  • For example, a Celeron 3205U dual-core (1.5GHz) device can handle 820–850Mbps wired and about 300Mbps wireless
  • In the past, built from discarded parts such as a ThinkPad T60, an ExpressCard-PCIe bridge, a Cisco 2960 switch, and a D-Link router (AP only)
    • Crude in appearance, but works as a complete router

Network configuration

  • Interface configuration
    • eth0: WAN
    • eth1: LAN (wired)
    • wlan0: LAN (wireless)
  • Wired and wireless LAN are joined with a bridge and operate as the same network
  • If more LAN ports are needed, add a USB-Ethernet dongle and attach it to the bridge
  • The operating system is Debian Linux; the essential components are as follows
    • hostapd: creates the Wi-Fi network
    • dnsmasq: DNS and DHCP services
    • bridge-utils: port bridging

Installation and initial setup

  • BIOS/UEFI settings
    • Disable PXE network boot
    • Disable USB/PCI power management
    • Enable the “boot automatically after AC power is restored” option
    • Use an HDMI dummy dongle to fix boot problems when no display is connected
  • Some hardware requires enabling the non-free-firmware repository
  • Install firmware for the wireless chipset
    • Intel: firmware-iwlwifi
    • Realtek: firmware-ath9k-htc
    • Older Atheros: firmware-atheros

Installing required packages

Install the main utilities with the following command: 

sudo apt install bridge-utils hostapd dnsmasq

About 250 packages for the whole system

Pinning network interface names

Modern Linux uses names like enp0s31f6, but they can be pinned to the traditional ethX format

Create the file /etc/systemd/network/10-persistent-ethX.link 

[Match]
MACAddress=AA:BB:CC:DD:00:11

[Link]
Name=ethX

Creating the wireless network

Configure a USB Wi-Fi dongle as an access point (AP)

Example /etc/hostapd/hostapd.conf: 

interface=wlan0
bridge=br0
hw_mode=g
channel=11
ssid=My Cool and Creative Wi-Fi Name
wpa_passphrase=mysecurepassword

Enable the hostapd service: 

sudo systemctl unmask hostapd
sudo systemctl enable --now hostapd

Interface settings

Configure /etc/network/interfaces 

allow-hotplug eth0
allow-hotplug eth1
auto wlan0
auto br0
iface eth0 inet dhcp
iface br0 inet static
bridge_ports eth1 wlan0
address 192.168.1.1/24

After rebooting, check the bridge status with the brctl show br0 command

Enabling IP forwarding

Add to the file /etc/sysctl.d/10-forward.conf 

net.ipv4.ip_forward=1

Apply: 

sudo systemctl restart systemd-sysctl.service

Firewall and NAT settings

nftables-based configuration (/etc/nftables.conf)

  • Block external traffic
  • Allow internal DNS, DHCP, SSH
  • Perform NAT

Enable the service: 

sudo systemctl enable nftables.service

DHCP and DNS settings

Use dnsmasq (/etc/dnsmasq.conf) 

interface=br0
dhcp-range=192.168.1.50,192.168.1.250,255.255.255.0,6h
dhcp-option=option:router,192.168.1.1
dhcp-option=option:dns-server,192.168.1.1
cache-size=10000

Enable the service 

sudo systemctl enable dnsmasq

Serial port management

If the device has a serial console port, it can be managed without a monitor

Edit /etc/default/grub 

GRUB_CMDLINE_LINUX='console=tty0 console=ttyS0,115200n8'
GRUB_TERMINAL=serial
GRUB_SERIAL_COMMAND="serial --speed=115200 --unit=0 --word=8 --parity=no --stop=1"

Run systemctl enable [email protected], then sudo update-grub

Verifying operation

  • After rebooting, check the firewall status with sudo nft list ruleset
  • Validate the configuration with sudo nft -c -f /etc/nftables.conf
  • Rules can be updated without downtime with sudo systemctl reload nftables.service
  • Check the DHCP logs 
sudo less /var/lib/misc/dnsmasq.leases
sudo journalctl -eu dnsmasq.service

Additional features

  • Can be extended with logging and traffic analysis, VLAN separation, IPv6 support, VPN tunneling, dynamic routing (BGP, IGP), and more
  • Prometheus-based monitoring, DMZ port forwarding, and intrusion detection and prevention can be added
  • However, it is best to avoid installing too much software on the router itself and to separate traffic with a DMZ or VLANs

Conclusion

  • A complete router can be built with nothing but free software and discarded hardware
  • A router is ultimately just an ordinary computer, and anyone can build one
  • Unneeded equipment can be reused to build a stable and flexible network infrastructure

See also

Favorite site

References

  1. How_to_turn_anything_into_a_router.pdf ↩

author Zer0 sitemap