Seral on Julien Mérieau

Seral Project

Wed, 12 Apr 2023 00:00:00 +0000

In Roman mythology, the Lares are domestic gods who protect the home and family. The name of this project, ‘Seral,’ is an anagram of Lares!

This project was conceived with the aim of having a connected apartment to make my life easier—turning on lights, having routines for sunrise or sunset, managing my appliances, and even my electricity consumption.

Context

The problem of our digital age 🙃 is the overconnection of our devices to the internet. This exposes us to several problems:

Seral - Part. 1 - Internet & Firewall

Sat, 25 Jan 2025 00:00:00 +0000

Seral’s first pillar is simple: take back your network equipment.

The router sits at the centre of a home network’s security. Every packet goes through it. It decides which ports are open, acts as the gateway to the internet, and does (or does not) protect personal data. It is the first line of defence.

These days we have less and less control over that box. ISPs push their own routers, lock the MAC address, add custom authentication, and ship a pile of proprietary code. Hard to know what is actually running in there. And what confidence can you have in a router whose admin UI is sometimes reachable over Wi-Fi and rarely patched properly?

Seral - Part. 1a - OPNsense router 1-10 Gbps

Sat, 25 Jan 2025 00:00:00 +0000

This article covers building your own OPNsense router, based on a Lenovo m720q and a Nokia XS-010X-Q ONT, for 1 Gbps fibre, with a path up to 10 Gbps.

Hardware

Fibre connection

First job: find a rootable GPON ONT, i.e. a box you can actually take over.
hack-gpon.org has a fairly complete list, plus tutorials and datasheets. Read them. It is a goldmine.

Seral - Part. 1b - OPNsense router 25 Gbps

Sat, 25 Jan 2025 00:00:00 +0000

How to build and configure your own OPNsense router for a 25 Gbps fibre link.

Hardware

Fibre connection

My ISP (Init7) does not use GPON. You plug in a fibre NIC and you have internet. Dedicated P2P fibre.
Result: no forced ISP box, a very stable fast link… and savings (no GPON). Well. Wait until you see the final bill.

Seral - Part. 1c - Basic OPNsense configuration

Sat, 25 Jan 2025 00:00:00 +0000

Do you know what VLANs are?
No???

Never too late: quick refresher.

Network plan

Segment the LAN so uses stay isolated and blast radius stays small. Five VLANs:

VLAN_Guests — fully isolated: no talk to other VLANs, internet via VPN only. Useful when people visit.
VLAN_Admin — containers, VMs, hypervisor services. A private cloud, basically.
VLAN_Secure — same idea as guests, with extra distrust. Do not mix risky devices with the rest.
VLAN_Personal — PCs, consoles, phones.
VLAN_IOT — IoT. By default they talk neither to each other nor to the internet.

Copy this and adapt the tags if you want: