[TUTORIAL] OpenWRT LXC "Forbidden Router"

[Freedbot]

Purpose

Inspired by Level1Techs, I decided to replace my old router with a single box solution that's flexible, upgradable, and efficient. That includes using Proxmox to utilize spare resources without interfering with the vital router functionality. With my current internet, my old router is a bottleneck. Good, fast routers are approaching desktop pricing and compatibility with custom software and firmware is limited. I struggled for a several days with this project, tripping on unintuitive obstacles, and following breadcrumbs of incomplete or overly technical tutorials and forum threads. I felt obligated to make a post on how I got it working. Strap in. It's not a simple process and I went heavy on the details.

Disclaimer

• I have no idea what I'm doing. This is my first time using Proxmox and the first/best justification I had as a non-homelabber...labber? Sure, non-homelabrador... for actually using VMs and Containers.
• OPN/PFsense users will find this guide helpful, but I went with OpenWRT because google tells me OPN/PFsense lacks modern integrated Wifi support, and I don't need a dedicated AP device.
• This tutorial is far from perfect. The results seem good, with few bugs, but I'm counting on the experienced people here to give me feedback so I can improve it.
• From a security/reliability standpoint, this is slightly lacking. Nothing is directly exposed to WAN except OpenWRT... which is a privileged container. If it's compromised, the whole system can be considered compromised, but at that point, your network is already having a bad day. If there's a reasonable configuration method for an unprivileged container, I'm all ears.
• While inefficient, VMs are less buggy and more secure than this container method. This mostly concerns better Wifi passthrough and the ability to run the Attended Sysupgrade package to update major OpenWRT versions. VM users may still find parts of this guide helpful.
• This is a headache and kind of a bad idea. The best/cheapest solution for the average nerd is probably still to find a deal on an actual router with good specs that's on OpenWRT's compatibility list and just do a proper "bare metal" install. I just wanted to learn something cool and maybe save some money in the future.

Requirements

• The CPU/MB "must" support virtualization.
• PCIe slot(s). A 2nd slot or mini-PCIe helps avoid hunting for a compatible USB wifi dongle.
• High speed PCIe Network Card supported by OpenWRT.
• Wifi PCIe card, or mini-PCIe, or USB supported by OpenWRT. This is tricky. Cards with Intel chips do NOT work. Also, unless you pay extra or buy 2, you can NOT broadcast multiple frequencies (2.4 and 5 Ghz etc.) at the same time like with a commercial router. Forget about high speed MLO antenna arrays you get with spider-like routers.
• Optionally look for 7th gen Intel or newer and AMD Ryzen CPUs. They will have HEVC encoding support if you want a Jellyfin LXC. Saving on electricity means running a more efficient CPU model with integrated graphics. Dedicated GPUs are power hungry.

Notes: I spent $245.48 on parts with this plan in mind. I did not get particularly good deals. These were chosen based on high compatibility, online recommendations, and reasonable pricing. I held off on Wifi 7 because I need 5 Ghz for some devices, don't care about top wifi speeds, and dual band 5 + 6 Ghz modules are currently outrageous. I needed a 4 port card. My computers have 2.5Gbe. I'll consider DAC/fiber in future.

My Parts: Used Lenovo MiniPC M720q off ebay with i5-8400T (low power), 16GB RAM, 256GB SSD. Proprietary brackets, Mediatek MT7921 mini-PCIe Wifi 6 adapter (the Lenovo included an Intel Wifi card that can't be used for AP), and antenna off Aliexpress. 4 port 2.5GbE Realtek RTL8125BG PCIe card off Amazon. I had to put electrical tape on the bottom of my PCIe network card because the miniPC's expansion bracket left it touching some metal connectors. Thankfully, I noticed this ahead of time.

Plan your Network

The crux of this guide is the network setup. The Proxmox UI's default bridging setup will leave multiple systems exposed to your WAN ethernet, bypassing OpenWRT and potentially causing your internet to disconnect if your ISP is like mine. Instead one ethernet port will be used exclusively by OpenWRT as the WAN internet access. If OpenWRT is down, the internet is down. Proxmox's networking documentation has methods to work around this problem without exposing your network systems by using forwarding, masquerading, or VLAN tags. These methods create complexity, CPU overhead, and undermine OpenWRT's job. I am prepared to face the wrath of the virtual networking experts on this opinion. The wifi will be passed directly to OpenWRT as well.

Anyway, you have 2 choices for passing the rest of the ethernet ports to OpenWRT. A: Link all other ethernet ports into a single Proxmox virtual bridge and pass that. B: Add only the slowest port (likely the PC's original) to your default Proxmox vbridge and pass the rest directly. Either method provides full network access to all machines and VMs, but both still rely on OpenWRT for DHCP. Meaning you'd still have to set a static IP on a connected computer to access Proxmox if OpenWRT breaks. Option A ensures Proxmox "access" on all ports when OpenWRT is down, but creates some CPU overhead and might bottleneck crazy fast network cards. Directly passed ports have no overhead, but also lose Proxmox access if OpenWRT is down. Non-Option: Directly pass all ports, but have to plug in a monitor and keyboard and manually edit: 'nano /etc/network/interfaces' to re-add a port to the bridge before you can even see the webUI again if OpenWRT breaks. I went with option B.

Pre-Setup

1. Clean up your system. Install the parts. Hook up internet, a screen, and keyboard. Make sure everything works.
2. Probably update the UEFI/BIOS according to the manufacturer's driver page instructions.
3. Configure your UEFI/BIOS settings. Google dedicated guides for BIOS/UEFI if you need help.
   • Ensure virtualization (VT-x/AMD-V) and IOMMU (VT-d/AMD-Vi) are enabled.
   • Boot on Power Failure set to "Last State".
   • Disable SecureBoot and TPM garbage.
   • Adjust boot order and whatever else to your preference.
4. Prep a bootable USB drive to install Proxmox. I'm gonna tell you to use Ventoy for this. Having multiple dedicated USBs in restrictive FAT32 format that need reformatting for every new version is obnoxious. With Ventoy, you format once and drag as many ISOs and unattend scripts as you like into a folder.

Install Proxmox

1. If possible, plug into your existing switch/router's ethernet using the port you want to designate as the "emergency" management port.
2. Either by using the UEFI boot option key or by messing with boot order, boot into the USB install and select Install Proxmox VE (Graphical).
3. The install target drive is fine as ext4 unless you plan on having your boot drive as part of a ZFS RAID array. Theoretically it should nuke any existing partitions on it's own. Don't pick the wrong drive.
4. Country, Time, Keyboard.
5. Pick your password. Proxmox insists on 8 characters. You can use the "passwd" command in the shell after this to freely change your password later.
6. The email is only used for emailing yourself notifications on server events, updates, and error messages. If (like me) you don't care, then don't bother with a valid email.
7. Network Configuration is the important/confusing screen.
   • Management Interface: will try to default to the interface you already have plugged in. If not, you'll have to use your best judgement. Ethernet adapters start with "en".
   • Hostname: They want a full web domain where the word before the first "." becomes the computer's (AKA node's) name. The advantage of a full web domain is that if you set up DNS for it, you can visit that in your browser rather than using the IP. I just went with "prox.box.internal". The this names the node "prox".
     • FYI, this can be changed later by editing "/etc/hosts" and "/etc/hostname", but it becomes a problem if you have a "cluster" of nodes.
   • IP Address (CIDR): 192.168.1.2 /24 was my choice. The IP address used to access this Proxmox computer. The /24 is the "CIDR" part and sets the network "size" such that only the last decimal number should be different for other computers. I'm not sure how much of a role it plays here since Proxmox won't be doing any DHCP. Easily editable later, but annoying if you get it wrong.
   • Netmask: 255.255.255.0 It serves a similar role as the /24 above in defining how IP's are handled in the network.
   • Gateway: 192.168.1.1 This is your router's IP. This number is the most common/default IP used by routers. I assume it is the IP of the box it's currently plugged into AND what you plan to use for your new router. Note the first 3 number sets match with the Proxmox IP.
   • DNS: 192.168.1.1 Same as Gateway.
8. Confirm the Summary and click install. After it completes, the computer will reboot. If you have the USB permanently set as your first boot device, you'll want to unplug it when the computer reboots or you'll boot to the installer again.
9. Pay attention to your boot process after the install. You'll see a screen it pauses on for 5 seconds to let you choose OS boot options. If the screen is a blue box (most likely), that's GRUB. If it's black, that's systemd. This varies based on your computer and the filesystem you chose. Make a note which you have while you still have a monitor hooked up.
10. Assuming you're plugged into an existing router with internet access and another computer, switch to using your other computer. Ender the IP Address you chose into your internet browser followed by :8006. That's "192.168.1.2:8006" if you copied my homework. That Proxmox port number is not easily changed btw. Welcome (I hope) to the Proxmox UI. Don't panic when you see the subscription nag popup. They use Winrar's business model.

Setup Proxmox

1. The settings that matter are found in the middle column after clicking a device from the tree on the left. The most notable menus in "Datacenter" are "Storage", "Backup", "Resource Mappings", "Directory Mappings". The Mappings menus are for passing hardware through to VMs.
2. Click Resource Mappings, then click "Add" under PCI Devices (and/or USB Devices). You aren't actually adding anything, just noting your hardware device information. If any are missing or wrong, it's up to you to install drivers and do troubleshooting. You should see all your ethernet ports and wifi adapter. In my case they're listed as "RTL8125 2.5GbE Controllers" and "MT7921 802.11ax PCI Express Wireless.....etc." My Wifi adapter's bluetooth shows up under USB Devices despite not being one. Notice the IOMMU group numbers in the second column. If a device you want to pass through has the same number as one you don't, you can't pass through that device. The moment you boot the VM/CT with a bad passthrough, everything breaks. We'll fix that in a bit.
3. While we're here. We can disable the email notification stuff if you like. Scroll down and click "Notifications", click "mail-to-root" in "Notification Targets" and click "Modify"... or just double click it. Disable it. Do the same for the listing in "Notification Matchers".
4. Under "Datacenter" is your Node, AKA the computer itself. It'll have a green check. Mine is called "prox". Right now it just has network info and probably 2 drive partitions. local-lvm stores your VM/CT data. local stores everything else.
   • Getting into how storage works is beyond this tutorial, but I will note that lvm is special in that you can give your VMs/CTs as much storage space as you like when you make them, but they will only use what they need for their existing files. This allows for over provisioning. CPU cores can also be over provisioned. Game server hosts are notorious for taking CPU over provisioning too far.
5. Click "prox" or whatever your node is, then "Repositories". Unless you're a paying subscriber, you need to disable the 2 enterprise repositories. and use the "Add" button to replace them with the "No-Subscription" and "Ceph Squid No-Subscription" repos. Now you can go to "Updates" and run "Upgrade". There's a helper script out there to automate this basic setup and more configuration/cleanup, but I'm avoiding scripts in this tutorial.

Improve Hardware Passthrough

Now we need to tinker in the "prox" "Shell". Unfortunately Proxmox's UI is lacking access to some important configuration and features, so we must resort to the command line. You may have enabled the virtualization and IOMMU in your UEFI, but it also needs enabling here. The IOMMU grouping # fix is safe for most hardware, but there is a chance of horrible network slowdown or other issues caused by bad support by the manufacturer of the device or the MB. If you're certain you don't need it, then leave out "pcie_acs_override=downstream,multifunction". the "video=..." parts help with iGPU passthrough and are also optional. Check your notes, are you running the GRUB or Systemd bootloader?

• A. Bootloader Commandline (GRUB)
  1. nano /etc/default/grub
  2. Edit a line... GRUB_CMDLINE_LINUX_DEFAULT="quiet iommu=pt pcie_acs_override=downstream,multifunction video=efifb:off video=vesafb:off"
  3. Ctrl + O, Enter, Ctrl + X
  4. update-grub
• B. Bootloader Commandline (Systemd)
  1. nano /etc/kernel/cmdline
  2. Paste as one line without quotes "quiet iommu=pt pcie_acs_override=downstream,multifunction video=efifb:off video=vesafb:off"
  3. Ctrl + O, Enter, Ctrl + X (to write Out file and eXit)
  4. proxmox-boot-tool refresh
• nano /etc/modules-load.d/vmiommu.conf (We're creating this file. Name is personal preference.)
• Enter these 3 contents but 1 entry per line: vfio vfio_iommu_type1 vfio_pci
• Ctrl + O, Enter, Ctrl + X (to write Out file and eXit)
• update-initramfs -u -k all
• apt install iw
  What's iw?: This software is for managing wifi APs. It makes Proxmox "mostly" able to pass hardware functionality through the OpenWRT LXC container which will also have iw. A VM wouldn't need this step.
• reboot now
• Optional: to check if loaded, run "lsmod | grep vfio"

 

[Freedbot]

Creating the OpenWRT LXC Container

Installing OpenWRT into a container requires downloading a special build and installing it via Shell. Sadly, we can't use the Create CT button because there's no setting for an "unmanaged" OS type, and the container won't boot without it, but pasting into the Shell is faster anyway.

1. Visit https://jenkins.linuxcontainers.org
2. Scroll, click image-openwrt, then the checkbox for the latest non-snapshot amd64 release.
3. Copy the link for rootfs.tar.xz.
4. In Proxmox/local/CT Templates, DL the URL, then rename it to "openwrt-VERSION#.tar.gz".
5. Edit the command below to the correct file name.
6. Run this command in the Proxmox shell (without quotes).
   pct create 100 /var/lib/vz/template/cache/openwrt-25.12.0-rc1-x86_64.tar.gz --arch amd64 --cores 2 --cpuunits 300 --features nesting=1 --startup order=1 --memory 256 --swap 0 --unprivileged 0 --ostype unmanaged --hostname openwrt --net4 name=vbridge,bridge=vmbr0 --rootfs local-lvm:0.5
   I'll explain some of what's going on here. All VMs/CTs have a number ID, the first available is 100, so that's what we're creating. Change it if needed. I give the CT access to 2 CPU cores, 256 Mb RAM, and 0.5 GB of storage. Remember that over provisioning is a thing. I'm also giving the CT a cpu usage weight of 300. The default is 100. This means if over provisioning causes fighting over CPU usage, OpenWRT will get 3x the default CPU priority. Startup order 1 means that OpenWRT will be the first CT/VM to boot and last to close. However, it's not currently set to auto-boot. We'll wait on that until we know it works. Unprivileged 0 means privilaged, which means file/device access on the host (proxmox) system. Otherwise, we'd have to add several permissions and (I'm told), manually configure any OpenWRT packages we install to load from a file in Proxmox.
7. This will NOT allow us to access OpenWRT yet. Don't even try to turn it on.
8. Open a text document for notes and paste in this...

lxc.net.0.type: phys
lxc.net.0.link: enx00e04c5960d0
lxc.net.0.flags: up
lxc.net.0.name: wan0
lxc.net.1.type: phys
lxc.net.1.link: enx00e04c5960cf
lxc.net.1.flags: up
lxc.net.1.name: eth0
lxc.net.2.type: phys
lxc.net.2.link: enx00e04c5960ce
lxc.net.2.flags: up
lxc.net.2.name: eth1
lxc.net.3.type: phys
lxc.net.3.link: enx00e04c5960cd
lxc.net.3.flags: up
lxc.net.3.name: eth2

1. Check "prox" "Network". Your network ports (nic#), wifi (wl***), and the default virtual bridge (vmbr0) you're using to access Proxmox are here. Again, if you're missing any, it's up to you to get drivers working. Alternative names like "enp0s31f6" are based on hardware location while "enx98fa9ba87537" includes the MAC address. You need to figure out which nic# is which.
   • Ports on the same network card will have very similar names and be in order, but I can't tell you which end of the card is the start.
   • typing "ip a" into the shell can list all network connections and extra info.
   • Test by plugging a device into one of the ports and running "ip a" again.
2. As you go, add comments to the ports in Network to help keep track. Example: 'wan' into the comment section of the port you want for internet and numbers or device names for the other ports. Tape labels on the computer/router itself if you have to.
3. While you have your chosen WAN port edit menu open, select and copy the longer alt name.
4. Edit your notes so that lxc.net.0.link: enx00e04c5960d0 shows your WAN port alt name instead.
5. If you plan to directly pass all but your slowest lan port (Network Plan option B, like me), then edit the other lxc.net.#.link:s to those ports in order of location. Add more or delete extra entries as needed. Every new port needs a line each for type, link, flags, and a unique name.
   • However, if you decided on option A, then delete all but the first three lxc.net.0 listings.
   • To enable your option A bridge, you just have to edit "vmbr0" in "prox" "Network" and add your other lan nic#s to the "Bridge ports" with spaces in between: "nic1 nic2 nic3 nic4". Make sure not to add your WAN nic.
   • If you do somehow lock yourself out of the web UI, you'll have to use a monitor and keyboard and edit "nano /etc/network/interfaces" directly.
6. DO NOT add your wifi adapter (wl***) from the network list yet. We'll do that after getting the router operating normally because the Wifi passthrough is buggy and will cause OpenWRT to not boot.
7. Open the 'prox' Shell.
8. nano /pve/nodes/prox/lxc/100.conf
9. The file contains OpenWRT's container settings from the command used to create it. Paste all of lxc.net entries under the bottom line (probably swap: 0)
10. Unless you have the same number of lxc.net.# lines as I do in that example, edit the line that starts with net4: name=vbridge so that "net" is one number higher than your last entry. It CANNOT be the same number as an lxc.net.#line.
    • Option A users would only have lxc.net.0 entries, so it would be net1
11. Ctrl + O, Enter, Ctrl + X
12. While you're still in the Shell, type lspci -v.
13. Find your Wifi adapter in this list and note the Kernel driver in use: mt7921e. Whatever driver yours uses.

Configuring OpenWRT

1. Finally, you can click your "openwrt" CT and click "Start". However, it has no access yet, either for internet or for web UI. Even if it did, the IP is probably the same as your current router that you're still hooked up to.
2. Click on "Console".
3. Hit Enter to bring up the OpenWRT logo and access the command line.
4. vi /etc/config/network
5. OpenWRT doesn't have nano. Controls for Vi: "i"=insert, "Esc"=back out from editing and go back to command mode, ":q!" = quit no save, ":wq" = save & quit
6. The end goal is below, but changing all this in vi is annoying and typos here cause problems. Most of this can be modified from the "Network"/"Interfaces" tab in OpenWRT later. The important thing is to change the ports so we can have Web UI and internet in the first place. You can refer to this again later after finishing your setup to make sure it's correct.
7. "i"
8. Edit the option device line under config interface 'wan' from saying eth0 to saying wan0 as shown below.
9. Edit the list ports line under option type bridge and to say vbridge. You can add more list ports lines for your remaining Eth# ports as shown below if you want. However, don't add ports that you don't have. These port names are from the lxc.net edits you made earlier.
10. If appropriate, change the list ipaddr '192.168.1.1 /24' in the config interface 'lan' section to a different IP address you may have chosen back when you first installed Proxmox.

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option dhcp_default_duid '***long randomly generated ID***'
        option ula_prefix '***IPv6 Prefix Thingy***'
        option packet_steering '1'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0'
        list ports 'eth1'
        list ports 'eth2'
        list ports 'vbridge'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config interface 'wan'
        option device 'wan0'
        option proto 'dhcp'

config interface 'wan6'
        option device 'wan0'
        option proto 'dhcpv6'
        option reqaddress 'try'
        option reqprefix 'auto'
        option norelease '1'

1. "Esc", ":wq:"
2. Reboot your "openwrt" container. Assuming it rebooted without error, it's time to shuffle!

Actual OpenWRT Setup!

1. Unplug your new containerized router from the old router.
2. If you're brave, you can attempt to swap the internet cable and your main computer from the old router to the new one. Otherwise consider using a different computer for testing while leaving your main computer hooked up to working internet.
3. With a computer wired to the "slow" port of the new router, attempt to load "192.168.1.1" (or whatever you set) in your browser.
   • If this fails, you can temporarily set your computer to a static IPv4 (Open Network & Internet Settings in Windows) like 192.168.1.111 and a netmask of 255.255.255.0 in order to get back to the Proxmox menu without reconnecting to the old router for DHCP.
4. Set your password as prompted. Save & Apply.
5. Configure "Network"/"Interfaces" to finish fixing up your network settings you were manually editing earlier. If you don't have/want IPv6, then don't bother. This config assumes you're ISP provides internet through basic DHCP. Make changes as appropriate.
6. Use the "Devices" tab to edit which ports are in part of your br-lan bridge if needed.
7. Be brave. Unplug and turn off your old router and use the new one to connect to the internet.
8. Open "System"/"Software".
9. Click the green "Update lists..." button. If you want to add software this way, you have to use that button once per reboot before you search.
10. Type the wifi driver name you noted earlier. mt7921e in my case.
11. Look for a package with a name like kmod-mt7921e and install it. If you need other device drivers, then use the same method to add those.
12. Back to the Proxmox webUI already!
13. Enter the "openwrt" "Console"... and hit Enter.
14. apk add wpad luci-app-dcwapd luci-app-upnp luci-app-ddns pciutils usbutils
    • This can be copy/pasted and is a faster alternative than using the Software menu when you know the package names. Feel free to google and add packages as you see fit. wpad is required. dcwapd is in case I get a dual channel wifi card in future. pciutils and usbutils are recommended for troubleshooting.
    • Attended Sysupgrade is a commonly recommended package, but can't upgrade OpenWRT inside containers. I would love to add a solution or alternate upgrade instructions if someone can help contribute.
15. apk upgrade
16. Open "prox"/"Network" and note down the Wifi device name, NOT an alt name. It'll be something like wlp8s0.
17. Enter the "prox"/"Shell".
18. nano /etc/pve/nodes/prox/lxc/100.conf
19. Now we're finally adding the Wifi passthrough.
20. Add these lines to the bottom while replacing the wifi link with the correct device name.
    

    lxc.net.5.type: phys
    lxc.net.5.link: wlp8s0
    lxc.net.5.flags: up

21. Do NOT add a name line for this one. It's not quite the same system passing this hardware through. It's jank as heck, and changing the name here doesn't work properly. You may not have my bugs and issues with your card, but there's a strong chance you will.
22. Do make sure the lxc.net.# number SKIPS one number from the line above to make room for the net4: name=vbridge... in the device list without having 2 devices with the same number.
23. Ctrl + O, Enter, Ctrl + X
24. Reboot the "openwrt" container from the proxmox Web UI and pray it loads without error. Do not reboot it multiple times if it is successful until the next steps are finished or it will error out because it's "unable to find and rename" the wifi device.
25. Once OpenWRT successfully boots with the Wifi device added, open the 192.168.1.1 web UI back up again.
26. If the "Network" tab has a "Wireless" option, rejoice and click it.
27. Don't panic if the radio is listed as "Generic MAC80211 802.11ac/ax/b/g/n" instead of the actual model. The device information is just missing from the passthrough. The correct driver you installed is being used.
28. Click the blue "Edit Button"
    • Operating Frequency: AX, 5 GHz, auto, 80 MHz (or whatever you want). Reminder that most cards can only broadcast on 1 frequency.
    • Select your Country Code
    • General Setup: ESSID is your wifi network name. If it and your password are the same as your previous Wifi, your devices should auto-connect.
    • Wireless Security: Encryption: WPA2-PSK is a compatible default. Key is your wifi password.
    • !!!IMPORTANT!!!!!! Advanced Settings: Change "Interface Name" to match your wifi device name that you noted down from "prox"/"Network" before.
      • I cannot stress this step enough. If you don't get it right, OpenWRT will fail to boot on the very next attempt (unless your wifi adapter magically cooperates better than mine).
      • In the event booting OpenWRT is an issue, remove the above wifi lines from 100.conf temporarily and reboot proxmox. If the adapter still has phy0-ap0 or whatever in the alt name slot in "prox"/"Network", then you'll have to pass that and try again, and THEN change 100.conf from step 19 yet again.
      • If anyone can fix this jank, please do help me.
29. Click "Save", then "Save & Apply".
30. Click "Enable" on your Wifi network.
31. Join your wifi. Again, if you set the ESSID and password the same as your old router, things should already be connecting.
    • You did remember to turn off your old router so the wifis don't conflict and make you think the new wifi isn't providing internet right? Right?
32. Do not use the "Reboot" button from inside OpenWRT's web UI. Use Proxmox to reboot the container instead. The wifi adapter jank has a single side effect of not being released properly by the shutdown process, causing it to fail to boot until Proxmox "finds" the adapter again in around a minute.
    • Again, I hope someone has ideas on how to improve this quirk of the final result.
33. That was stressful. You're done. Go get a drink or something.

 

[Freedbot]

3rd post reserved for updates or in case I hit the generous word limit yet again when editing.

I'm also working on writing a guide for self hosting behind CGNAT with Wireguard and PBR Split Tunneling on this OpenWRT setup. This means you can cherry pick and "port forward" any hosted service on any machine in your network through a VPS tunnel without any special setup on those systems.