Gamers Nexus Builds DIY x86 Routers to Evade ISP Gateway Telemetry

Gamers Nexus

Mandatory ISP gateway hardware harvests household telemetry and caps bandwidth via constrained state tables, making repurposed x86 hardware and open-source firewalls necessary to secure home networks.

AI-assisted summary of Your Router Spies On You. It's Time to Build Your Own | DIY Router Guide — original source. Check the original for full context.

Source published: 2026-10-26

Key ideas

• Gamers Nexus initiated a series on self-hosting and digital ownership, demonstrating how repurposed desktop PC hardware paired with dedicated network interface cards can outperform consumer routers and eliminate commercial telemetry. (0:00)
• Proprietary ISP fiber gateways, such as AT&T's BGW320-505, monitor connected device MAC addresses and usage habits even when configured in IP passthrough mode, driving advanced users toward complete hardware bypasses via SFP+ optical network terminals. (8:15)
• The guide benchmarked and evaluated major DIY router distributions—including pfSense, OPNsense, OpenWrt, and IPFire—identifying differences in installation models, feature flexibility, and privacy policies such as pfSense requiring personal contact data before downloading. (20:21)
• Universal Plug and Play (UPnP) presents persistent network vulnerabilities by enabling local software to map ports through firewalls without admin oversight, leading the team to advise keeping UPnP globally disabled unless required for specific gaming consoles or services. (28:20)

Detailed notes

## Background Published by Gamers Nexus on YouTube on October 26, 2026, this guide initiates a new series focused on device self-ownership, homelabs, and digital privacy. According to the video description, the team explores building custom DIY routers using open-source platforms like OPNsense, OpenWrt, pfSense, and IPFire to help users break free from untrustworthy ISP hardware and invasive telemetry.

## TL;DR Gamers Nexus demonstrates how to repurpose retired x86 PC hardware—such as an older Intel Core i7 desktop—into a high-performance network router and edge firewall. The guide provides step-by-step walkthroughs for configuring prominent routing platforms, including pfSense, OPNsense, OpenWrt, and IPFire, while evaluating their security, interface assignment, and hardware isolation features. Additionally, the video details techniques for circumventing mandatory ISP equipment like AT&T fiber gateways using IP passthrough or SFP-based optical network terminals, offering alternatives such as RouterOS, DD-WRT, and FreshTomato to help users reclaim total control over their network traffic.

## Atmosphere & style The presentation blends serious consumer advocacy with the enthusiastic, hands-on spirit of traditional PC building. Steve Burke delivers his signature incisive commentary, cutting through corporate telemetry practices and regulatory blunders with sharp, sardonic humor alongside technical insights from Level1Techs' Wendell. Watching the guide feels like participating in an empowering, pragmatic masterclass that demystifies networking complexities and equips the viewer to take back ownership of their digital life.

## Bulletin - [00:00](https://www.youtube.com/watch?v=sJidlu3pPb4&t=0s) Gamers Nexus initiated a series on self-hosting and digital ownership, demonstrating how repurposed desktop PC hardware paired with dedicated network interface cards can outperform consumer routers and eliminate commercial telemetry. - [08:15](https://www.youtube.com/watch?v=sJidlu3pPb4&t=495s) Proprietary ISP fiber gateways, such as AT&T's BGW320-505, monitor connected device MAC addresses and usage habits even when configured in IP passthrough mode, driving advanced users toward complete hardware bypasses via SFP+ optical network terminals. - [20:21](https://www.youtube.com/watch?v=sJidlu3pPb4&t=1221s) The guide benchmarked and evaluated major DIY router distributions—including pfSense, OPNsense, OpenWrt, and IPFire—identifying differences in installation models, feature flexibility, and privacy policies such as pfSense requiring personal contact data before downloading. - [28:20](https://www.youtube.com/watch?v=sJidlu3pPb4&t=1700s) Universal Plug and Play (UPnP) presents persistent network vulnerabilities by enabling local software to map ports through firewalls without admin oversight, leading the team to advise keeping UPnP globally disabled unless required for specific gaming consoles or services.

## Key takeaways - [00:00](https://www.youtube.com/watch?v=sJidlu3pPb4&t=0s) Building an x86 custom router lets users reclaim device ownership, eliminate ISP rental hardware, and block third-party telemetry from mining home network data. - [04:37](https://www.youtube.com/watch?v=sJidlu3pPb4&t=277s) Broad regulatory router definitions from the FCC and persistent firmware vulnerabilities in consumer equipment highlight the necessity of an owner-controlled perimeter firewall. - [06:33](https://www.youtube.com/watch?v=sJidlu3pPb4&t=393s) Repurposed enterprise PCIe network cards in standard desktop chassis run hot and necessitate dedicated active cooling solutions to avoid thermal throttling or instability. - [08:15](https://www.youtube.com/watch?v=sJidlu3pPb4&t=495s) ISPs leverage integrated residential gateways to profile household demographics and internal device topologies, retaining packet inspection capabilities even under passthrough settings. - [13:45](https://www.youtube.com/watch?v=sJidlu3pPb4&t=825s) x86 routing software benefits more from strong single-threaded CPU performance than high core counts, requiring a minimum of two separate physical interfaces for WAN and LAN. - [20:21](https://www.youtube.com/watch?v=sJidlu3pPb4&t=1221s) Netgate requires users to complete a zero-dollar checkout demanding personal contact information to download pfSense Community Edition, diverging from typical open-source privacy standards. - [24:20](https://www.youtube.com/watch?v=sJidlu3pPb4&t=1460s) Deploying the ZFS file system on FreeBSD-based firewalls provides essential protection against file corruption caused by sudden power cuts, unlike the fragile UFS file system. - [28:20](https://www.youtube.com/watch?v=sJidlu3pPb4&t=1700s) UPnP poses substantial security risks by permitting internal devices to open public WAN ports automatically, making manual port forwarding the preferred method for home security. - [29:03](https://www.youtube.com/watch?v=sJidlu3pPb4&t=1743s) OPNsense offers a community-centric, offline-installable alternative to pfSense that avoids registration hurdles, though its documentation can lag behind rapid architectural updates like the shift to DNSmasq. - [35:35](https://www.youtube.com/watch?v=sJidlu3pPb4&t=2135s) OpenWrt originated from legal pressure that forced Cisco to open-source the Linksys WRT54G firmware under the GPL, establishing a durable open-source networking foundation with robust Wi-Fi compatibility. - [38:55](https://www.youtube.com/watch?v=sJidlu3pPb4&t=2335s) IPFire enforces a strict, color-coded four-zone security architecture (Red, Green, Blue, Orange) and intentionally leaves out UPnP support to ensure rigorous boundary control. - [43:22](https://www.youtube.com/watch?v=sJidlu3pPb4&t=2602s) AT&T enforces mandatory gateway hardware through certificate-based authentication, creating hardware bottlenecks that can saturate state tables under heavy network loads. - [45:24](https://www.youtube.com/watch?v=sJidlu3pPb4&t=2724s) Enthusiasts can fully bypass ISP fiber gateways by employing SFP/SFP+ ONTs running community firmware from 8311 to clone official MAC addresses, serial numbers, and equipment IDs. - [51:26](https://www.youtube.com/watch?v=sJidlu3pPb4&t=3086s) The safest deployment approach is staging the DIY router on a secondary PC alongside the operational network, allowing instant rollback by swapping patch cables if setup difficulties occur. - [55:21](https://www.youtube.com/watch?v=sJidlu3pPb4&t=3321s) OpenWrt serves as a lightweight, familiar option for basic home routing, whereas pfSense and OPNsense provide enterprise-grade toolsets that may prove overly complex for standard consumer needs.

## Detailed walkthrough ### [00:00](https://www.youtube.com/watch?v=sJidlu3pPb4&t=0s) Taking Ownership Back from "You'll Own Nothing and Be Happy"

Gamers Nexus introduces their new DIY router project, which is built from an old Intel Core i7-4930K CPU and an X79 motherboard bought off a sidewalk in Taipei for pennies on the dollar. While functional X79 motherboards are notoriously difficult to track down, this scavenged enterprise-class desktop platform still outperforms many modern pre-built consumer routers—especially when paired with upgraded network cards and modified cooling. This project forms part of an ongoing series focused on reclaiming ownership over personal hardware and services, kicking out unnecessary subscriptions, and cutting off corporate data harvesting from vendors that fail to secure their own products.

Steve Burke highlights that with modern DIY PC components reaching prohibitively expensive price tiers, repurposing retired enthusiast gear into home infrastructure is the ideal outlet for the PC building spirit. Users can achieve greater privacy, bypass rental hardware lock-in fees, and stop third-party surveillance. Alongside the custom PC build, the team also demonstrates a commercial retail router that has had its factory firmware wiped and replaced with an open-source alternative to prevent sketchy background telemetry. Steve frames this movement directly against modern corporate overreach:

> “So, if you've felt like you've heard the phrase ‘You'll own nothing and be happy’ enough, this is the how do you do something about that and take back ownership of as much as you can using the scrappiest, most fun PC hardware enthusiast driven approach possible where you're taking old parts, breathing new life into them, and you're kicking out some of the companies that have otherwise tried to displace your ownership.”

[02:11](https://www.youtube.com/watch?v=sJidlu3pPb4&t=131s) Reclaiming the DIY Spirit and Sponsoring Consumer Rights

Beyond security and financial independence, building your own router taps back into the joy of tinkering and technical exploration that defined early PC hobbyism. Steve notes that the passion enthusiasts poured into chipmakers and memory brands for decades has been undermined by hostile industry practices. Channeling that frustration into learning open networking allows users to acquire genuine skills while insulating their home networks from tracking.

The video is sponsored by Louis Rossmann's FULU Foundation and their campaign targeting Section 1201 of the Digital Millennium Copyright Act (DMCA). Under DMCA 1201, bypassing digital locks—even on devices consumers legally purchased and own, such as the PlayStation 5—is treated as a criminal act. FULU funds bounties for cybersecurity researchers who defeat these artificial locks and is organizing a grassroots coalition of hardware enthusiasts to lobby lawmakers. The foundation maintains a Zulip chat server to organize outreach to government representatives and operates the Consumer Rights Wiki to document anti-consumer hardware practices with verifiable evidence.

[04:37](https://www.youtube.com/watch?v=sJidlu3pPb4&t=277s) Regulatory Overreach: The FCC Router Ban and Defining a Router

Consumer networking hardware has been plagued by vendor neglect, unpatched vulnerabilities, and massive botnet exploits (such as those previously documented on ASUS routers). On top of these security failures, government policy has created further dysfunction: the Federal Communications Commission (FCC) pursued a broad, short-sighted router ban that ended up granting exemptions to Netgear after heavy lobbying, alongside aggressive actions taken against TP-Link mirroring earlier bans on ZTE and Huawei.

The team points out that the FCC's official definition of a router is comically overbroad, classifying virtually anything capable of sending and receiving network packets as a router—a criteria that applies equally to smart TVs and internet-connected refrigerators. Wendell from Level1Techs joins to provide a practical, functional definition for home networking:

```mermaid flowchart LR accTitle: Practical Router Architecture accDescr: Diagram showing the router managing connections between ISP uplinks and the internal local network.

subgraph WAN ["Internet Access (WAN)"] ISP1["Primary ISP (Fiber / Cable)"] ISP2["Backup Uplink (Cellular)"] end

Router["DIY Router (Custom OS / Firewall)"]

subgraph LAN ["Local Network (LAN)"] WIFI["Wireless AP / Network"] Clients["Home Devices / Clients"] end

ISP1 --> Router ISP2 -.-> Router Router --> WIFI Router --> Clients ```

> “I think for the context of the of the video and the audience, it's the thing that sits between your network and your ISP.”

As Wendell explains, the router manages whatever uplinks exist—be it fiber, cable, a wireless ISP, or a multi-WAN failover setup using a cellular modem backup—and controls local routing, optionally managing Wi-Fi access points or offloading them to dedicated hardware.

[06:33](https://www.youtube.com/watch?v=sJidlu3pPb4&t=393s) Scrapping Together the DIY Router Hardware

To prove that specialized enterprise gear is unnecessary, Gamers Nexus builds a router out of spare, low-value components lying around the studio:

- **CPU & Platform:** Intel Core i7-4930K on an Intel X79 LGA 2011 motherboard (sourced from a Taipei street market). - **Memory:** 32 GB of DDR3 RAM. - **Add-in Network Card:** A dedicated PCIe network interface card (NIC), which serves as the most capable, modern component in the build to ensure high network throughput. - **Dedicated Cooling:** An auxiliary fan zip-tied or positioned over the NIC, as high-throughput network cards generate substantial heat without rack-chassis airflow. - **GPU:** An Intel Arc A380 graphics card, utilized strictly for display output during installation and troubleshooting. - **Storage:** Retired, low-capacity solid-state drives (128 GB and 256 GB) that are near the end of their write endurance but offer more than enough capacity and reliability for a lightweight network operating system. - **Boot Drive:** A thumb drive humorously labeled as an "unreliable USB 3" drive. - **Power Supply:** A standard, budget Corsair CX550M power supply pulled from storage.

This rough test-bench assembly shows that any decommissioned corporate desktop, retired DDR3-era PC, or e-waste recycling find can instantly become a router by adding a multi-port PCIe NIC.

[08:15](https://www.youtube.com/watch?v=sJidlu3pPb4&t=495s) ISP Telemetry, Device Profiling, and Mandatory Hardware

The urgency behind replacing ISP equipment stems from aggressive data harvesting. Wendell details how Internet Service Providers exploit their managed gateways to monitor traffic inside the local home network, logging private internal metadata that has no bearing on delivering internet service:

> “I've seen concerning reports from ISPs treating the customer equipment behind the the the router, their router, as a place to data mine. MAC addresses, what kind of devices, how expensive was this TV that you bought? Let's use that as a demographic. So there are credible reports that ISPs are using that to build their subscriber advertising profile. It's also really important for ISPs to be able to separate traffic. Consider a family, like a husband and wife, couple of kids, which device is the traffic coming from? That also helps for building profiles because it's not just a household profile that you want to build, it's individual profiles you want to build. And those MAC addresses, the usage patterns, time of day, those are all pieces of telemetry that your ISP doesn't have when you have a router that's fully under your control.”

To guarantee access to this telemetry stream, many providers mandate customer use of proprietary, locked-down hardware, often bundled into mandatory monthly rental fees. On services like AT&T Fiber, customers are forced to use an all-in-one optical network terminal (ONT) and gateway combination. Even when configured in "IP passthrough" mode, the ISP's gateway remains physically inline on the connection, retaining the technical capability to inspect packets and inventory household devices with far higher fidelity than raw internet routing demands. Placing a user-owned DIY router at the network perimeter strips away internal MAC addresses, isolates internal device topologies, and denies the ISP visibility into individual household habits.

[09:30](https://www.youtube.com/watch?v=sJidlu3pPb4&t=570s) Taking Control: Why Build a DIY Router?

Gamers Nexus approaches this guide strictly from the perspective of an end user who wants a simple, drop-in replacement for their existing router using direct-to-disk installations. While Wendell from Level1Techs runs pfSense inside virtual machines for advanced setups like LAN cache or Pi-hole, this guide targets the physical fundamentals. Standard home setups rely on an ISP-provided modem, a router, or a combination gateway unit. With enough dedication, users can replace every piece of that hardware.

The rationale goes well beyond basic privacy concerns. As Wendell explains, custom hardware almost always delivers better throughput: “In almost all scenarios, it will be faster. You will be able to take better advantage of your connection from the ISP.” ISP-supplied hardware is universally engineered down to the lowest possible cost, directly degrading the user's connection. Furthermore, building a custom router simplifies secure remote access to home hardware without relying on cloud subscriptions or archaic firewall pinholes, using modern tooling like Tailscale and Pangolin. A DIY router allows users to deploy granular ad-blocking, identify smart TVs hardcoded to bypass local DNS filters like Pi-hole, and run comprehensive traffic logging. Wendell emphasizes that having surgical control over ingress and egress empowers users to defend against network attacks that weak ISP-provided routers simply fail to handle.

- ISPs frequently charge monthly equipment rental fees, reviving older anti-consumer cable practices where providers billed customers per connected TV or attempted to charge separate subscriptions for multiple household computers. - Gamers Nexus views repurposing hardware into routers as the same enthusiast pursuit as hosting a local Plex media server or buying a 3D printer to solve niche problems. - Gamers Nexus frames this initiative as a collective community effort: taking ownership back from corporations requires enthusiasts to discard corporate fanboyism and share technical knowledge openly.

[13:45](https://www.youtube.com/watch?v=sJidlu3pPb4&t=825s) DIY Hardware Selection: Turning E-Waste into Network Gear

```mermaid flowchart TD accTitle: DIY Router Physical Setup Architecture accDescr: Diagram illustrating incoming WAN routing through a DIY x86 PC to an access point and local clients.

subgraph WAN ["Internet Source"] ISP["ISP Connection / ONT / Modem"] end

subgraph RouterPC ["DIY Router (x86 Hardware)"] NIC_WAN["NIC Port 1 (WAN In)"] CPU_Engine["Single-Threaded CPU & RAM\n(pfSense / OPNsense / OpenWrt)"] NIC_LAN["NIC Port 2 (LAN Out)"] SSD["Local Storage\n(Small SSD / Flash Drive)"]

NIC_WAN --> CPU_Engine CPU_Engine --- SSD CPU_Engine --> NIC_LAN end

subgraph LocalNet ["Local Network Distribution"] AP["Access Point / Repurposed Router\n(Switched to AP Mode)"] Switch["Network Switch\n(Optional Expansion)"] Clients["Wired & Wireless Clients"] end

ISP --> NIC_WAN NIC_LAN --> AP AP --> Switch Switch --> Clients AP -.->|"Wi-Fi Broadcast"| Clients ```

Building an x86 router does not demand high-end components; nearly any legacy motherboard from this century will suffice. Gamers Nexus built their demonstration rig using an old, inexpensive Intel X79 platform. Single-threaded processor performance is the primary metric to optimize for basic routing, while high core counts are unnecessary. Display output is only needed for the initial boot and setup; a low-end discrete GPU like an Intel Arc A380 or simple integrated graphics handles the initial video out, after which the machine runs headless via web management interfaces.

The most critical requirement is physical networking ports. The host machine requires at least two separate Ethernet connections—one for the wide area network (WAN) and one for the local area network (LAN). Gigabit network interface cards (NICs) are abundant at electronics recycling facilities like the Kramden Institute, where they can often be acquired for pocket change. For faster networks, adding a dual-port 10 Gigabit PCI Express NIC allows high-speed uplinks directly to a network switch. Storage needs are similarly modest: an older, lower-end SSD is preferred for quick responsiveness, though a 32 GB USB flash drive can suffice in non-critical environments where drive endurance and write latencies are not concerns.

- Dedicated Wi-Fi access points and standalone network switches cleanly separate router duties from distribution: the router directs packet traffic, the access point broadcasts wireless signals, and the switch expands physical ports. - Repurposing cheap, store-bought consumer routers (such as a budget TP-Link model) into dedicated access points requires navigating to its default gateway (such as `192.168.0.1`), toggling on "Access Point Mode" to disable internal routing, and using its onboard switch ports for local expansion. - Motherboard Wi-Fi cards should not be used as software-defined access points; virtually all router operating system developers warn that broadcasting Wi-Fi directly off x86 desktop boards is notoriously unstable and janky.

[16:33](https://www.youtube.com/watch?v=sJidlu3pPb4&t=993s) Software Choices and the Drama of pfSense

Router software distributions function simultaneously as packet routers and stateful firewalls, inspecting data as it moves through the network. The ecosystem includes numerous options: pfSense, OPNsense, OpenWrt, IPFire, RouterOS, DD-WRT, and Tomato64. Like many open-source ecosystems, deep tribalism and bitter history divide these projects.

The largest and most contentious name in the space is pfSense. Emerging in 2004 as an independent fork of m0n0wall, pfSense is a FreeBSD-based platform that shares common ancestry with its primary modern rival, OPNsense. Describing the team behind pfSense, Wendell quipped: “They're ill-tempered, but do good work, like the dwarves of Middle-earth.” Netgate, founded in 2004 as an appliance hardware vendor selling m0n0wall-powered units, assumed official leadership over the pfSense project in 2012.

Tensions mounted when Netgate created a proprietary fork designed exclusively for their own hardware, which eventually morphed into "pfSense Plus" and was made available for third-party hardware under paid subscriptions. Although Netgate maintained a free "Community Edition" (CE), its historical status as fully open-source software has eroded. Wendell explains Netgate's commercial push, noting that the developers contribute immense amounts of code directly upstream to the FreeBSD subsystem: “pfSense really had completely taken over the universe, and a lot of the the work that those folks do, they contribute upstream, and they do a lot of programming for the underlying BSD subsystem, and like they've really done a lot of hard work. So, they really want people to subscribe, even home users.” Confronted with millions of users on their dashboards, Netgate pushed to aggressively monetize their dominant footprint.

[18:13](https://www.youtube.com/watch?v=sJidlu3pPb4&t=1093s) Netgate's Feud with OPNsense and the UN Dispute

The history surrounding pfSense and its parent company, Netgate, carries an astonishing amount of internet drama and bad blood. Beyond rumors that "OPNsense" is a banned word on the pfSense subreddit, Netgate notoriously ran into legal trouble with the United Nations' World Intellectual Property Organization (WIPO) back in 2017 for cybersquatting the opnsense.com domain. Rather than merely parking the address, Netgate hosted a brazen parody site disguised to look like their competitor. The site featured abrasive slogans such as, “When your users start complaining, it's probably the firewall. Tell those whiny [ __ ] to shut it. You're leading technology.” It also mocked the project’s open-source lineage by declaring, “Everything we do, from our product to our documentation, was bold copied, ripped off, or otherwise borrowed from someone who had the idea before us.”

The feud escalated into bizarre, personal territory on the domain Netgate established. In one notable clip, OPNsense lead developer Franco Fichtner—who was born in the former East Germany—was explicitly depicted as Adolf Hitler, with Netgate's Jim Thompson cast as his unstoppable nemesis. Steve Burke reacts with dry sarcasm to the sheer pettiness and hostility of the incident, joking about the site's aggressive formatting and early-web aesthetic. Remarking on the absurdity of a networking company stooping to such depths, Steve quipped: “They would be guessing the P stands for psychopaths.”

- Netgate lost the opnsense.com domain following a 2017 WIPO dispute after engaging in domain squatting and hostile parody. - The squatted site targeted OPNsense founder Franco Fichtner with personal attacks, casting him as Hitler in video parodies. - The antagonistic campaign centered on accusations that OPNsense had stolen and copied pfSense's documentation and codebase.

[20:21](https://www.youtube.com/watch?v=sJidlu3pPb4&t=1221s) pfSense Acquisition, Account Requirements, and USB Creation

Setting aside the controversial community relations, users wanting to deploy pfSense must navigate Netgate’s increasingly walled distribution system. To obtain the software, users must go to pfSense.org/download, select the `amd64` architecture, and proceed through an online store checkout to purchase the installer for zero dollars. Crucially, this download provides only an installer stub rather than a standalone disk image of pfSense itself. Completing the order forces users to register a Netgate account, entering their full name, physical address, and telephone number before being granted access to the file. As Steve points out: “Of all the options here, pfSense is the only one that requires an account with your name, address, and phone number, which flies in the face of privacy, which is a lot of the reason we're doing this.” While users can easily provide fake details, the requirement itself is contrary to the ethos of self-hosting.

Furthermore, Netgate has deprecated the traditional offline installation media. The image retrieved from the site is merely a base Netgate installer that requires an active internet connection during the actual hardware setup process to pull down the free Community Edition (CE). Flashing the downloaded image to installation media follows standard PC procedures: Rufus is the recommended utility for Windows users, while alternatives like BalenaEtcher serve macOS and Linux platforms. The user selects a sacrificial USB flash drive, targets the downloaded disk or ISO image, leaves the default settings intact, and writes the boot drive. The flash drive is then inserted into the target router machine, and the system is booted via a one-time boot menu or BIOS boot priority change.

```mermaid flowchart TD accTitle: pfSense Media Acquisition and Preparation accDescr: Flow showing the steps from website checkout to creating a bootable installer flash drive.

subgraph Download ["Netgate Portal"] A["Visit pfsense.org/download"] --> B["Select amd64 Architecture"] B --> C["$0 Checkout & Mandatory Account Creation"] C --> D["Download Netgate Installer Stub"] end

subgraph Flash ["Drive Preparation"] D --> E["Insert Flash Drive"] E --> F["Open Rufus / BalenaEtcher"] F --> G["Flash Stub ISO to USB"] G --> H["Boot Target Router Hardware via USB"] end ```

[21:43](https://www.youtube.com/watch?v=sJidlu3pPb4&t=1303s) Hardware Interfaces and Initial Network Configuration

Because the installer requires an active network connection to fetch packages, the physical WAN Ethernet cable must be connected to its designated port before powering on the machine. Once pfSense finishes booting, a brief copyright splash screen appears before presenting the configuration menu. For most users, the advanced installer options can be left untouched: `CE repositories` allows installing the open-source version on pfSense Plus hardware, `Export network config enabled` creates an exportable setup profile, `Swap size` handles memory paging automatically, and setting `Console type` to EFI works reliably on any modern platform.

When configuring network cards, port mapping requires careful attention. In an installation utilizing a discrete two-port network interface card (NIC) alongside an onboard motherboard jack, pfSense assigns device identifiers by controller driver (such as `ix` for 10Gb Intel interfaces or `em` for 1Gb Intel interfaces). In this build, `ix1` serves as the active WAN port, `ix0` serves as the primary LAN interface, and the onboard controller `em0` is reserved for future expansion. WAN connectivity defaults to DHCP client mode, though users behind ISPs that mandate point-to-point authentication will need to choose PPPoE and supply their credentials. The LAN interface is set to a static IP so the gateway address remains predictable, and the built-in DHCP daemon (DHCPD) remains enabled to dispense IP addresses to client machines.

- **WAN Port Identification:** Selected as `ix1` (active link); configured as a DHCP client (or PPPoE if credentials are required by the ISP). - **LAN Port Identification:** Assigned to `ix0`; configured with a static local gateway address and an active DHCPD pool. - **Onboard NIC (`em0`):** Left unassigned during initial setup to be used later as an isolated physical network. - **VLANs & DNS:** VLANs are avoided in this entry-level build to eliminate the need for expensive managed network switches, and local DNS resolver overrides remain toggled off.

[24:20](https://www.youtube.com/watch?v=sJidlu3pPb4&t=1460s) File System Selection, Storage Setup, and Installation

With network interfaces mapped, the installer contacts Netgate's servers to present installation options for Community Edition. Storage configuration centers on selecting between the ZFS and UFS file systems. While UFS is an older, lightweight option with lower RAM utilization, Netgate warns that UFS “can be fragile when it comes to sudden interruptions such as power loss.” Consequently, ZFS is the strongly recommended default for reliability. For partition layouts on modern systems, GPT is the standard, whereas MBR is relegated strictly to legacy hardware and select ARM platforms.

```mermaid flowchart LR accTitle: Storage and File System Selection accDescr: Decision pathway for selecting the file system and drive mode in the pfSense installer.

A["Target Drive"] --> B{"File System Choice"} B -->|"Recommended Default"| C["ZFS"] B -->|"Legacy / Low Resource"| D["UFS"] C --> E["Stripe Mode (RAID 0)"] E --> F["Select Target Disk"] F --> G{"pSLC Cache Mode?"} G -->|"Default: Disabled"| H["Install CE System"] G -->|"Warning: Irreversible"| I["Halves MLC / Cuts 2/3 TLC Capacity"] ```

When provisioning a single storage drive under ZFS, the correct pool topology is "stripe" (RAID 0). Within the advanced disk menu, users are cautioned against enabling pseudo-SLC (pSLC) mode. Although pSLC improves write endurance on compatible flash controllers, it is completely irreversible, cannot be verified automatically by the installer, and drastically shrinks usable capacity—cutting MLC drive space in half and reducing TLC drive space by two-thirds. Unless a user understands the specific industrial endurance requirements of their storage hardware, this feature must be avoided. After choosing the latest stable CE release, the installer writes the system files and prompts for a system restart, at which point the USB drive should be pulled from the machine.

[26:12](https://www.youtube.com/watch?v=sJidlu3pPb4&t=1572s) Web UI Setup and Configuring an Isolated Network

Once the router completes its reboot, the rest of the configuration moves off the serial/display console and into the web browser interface. Plugging an administrative PC directly into the router’s LAN port (`ix0`) and navigating to `192.168.1.1` brings up the pfSense management UI. Bypassing the self-signed HTTPS certificate warning presents the factory credentials: username `admin` and password `pfsense`. Initial setup walks through setting the device hostname, leaving the default domain as `home.arpa` (or a subdomain like `gn.home.arpa`), configuring the local timezone, and entering a strong administrator password. Console security is also emphasized: users are urged to set a password on physical console access to protect against anyone with physical access to the chassis.

```mermaid flowchart TD accTitle: Physical Port Topology on the Custom Router accDescr: Diagram illustrating the three physical network ports and what connects to each.

subgraph Router ["Custom DIY Router Hardware"] WAN["Port ix1 (WAN)"] LAN["Port ix0 (LAN)"] OPT["Port em0 (Untrusted)"] end

WAN <-->|"Upstream Internet"| ISP["Modem / Fiber ONT"] LAN <-->|"Trusted Traffic"| MainNet["Managed/Unmanaged Switches & Trusted APs"] OPT <-->|"Isolated Traffic"| GuestNet["Untrusted / IoT Device Network (Kea DHCP)"] ```

Taking advantage of the third, unused onboard motherboard port (`em0`), the guide details isolating untrusted hardware. By following Netgate's isolation documentation, `em0` is configured as a dedicated physical network labeled "untrusted," running Kea DHCP rather than the deprecated ISC DHCP daemon. This isolated segment allows untrusted or smart home devices to access the open internet without granting them the ability to communicate with devices on the primary LAN or access the router's management portal. Finally, after attaching switches and access points to the LAN side, ongoing maintenance becomes the user's personal duty. As Steve emphasizes regarding software maintenance: “It's possible to set up a cron job to do that automatically, but the whole point of building a router is to reclaim control of it.”

- **Default Web UI Address:** `192.168.1.1` - **Default Credentials:** Username: `admin` | Password: `pfsense` - **Default Local Domain:** `home.arpa` - **DHCP Engine:** Migrated to Kea DHCP per pfSense's modern interface prompts. - **Port Isolation:** Motherboard NIC `em0` designated as an isolated network to firewall off suspicious or IoT devices from the primary trusted LAN.

[28:20](https://www.youtube.com/watch?v=sJidlu3pPb4&t=1700s) Port Forwarding and UPnP Considerations

Port forwarding comes up far less frequently for modern users because consumer networking hardware heavily relies on Universal Plug and Play (UPnP). UPnP enables local applications to configure their own port forwarding rules automatically without user intervention, though this convenience introduces significant security vulnerabilities. While manual port forwarding carries its own security risks, Netgate observes that many mainstream software suites depend on protocol helpers:

> "There are many popular programs and platforms which support UPnP IGD and PCP such as Steam or Steam Deck, Nintendo consoles, PlayStation consoles, Xbox consoles, video conferencing apps, torrent clients, and more."

Gamers Nexus strongly advises keeping UPnP disabled by default. However, if connectivity issues arise on gaming hardware, video conferencing tools, or self-hosted media servers such as Plex, administrators can find the configuration toggles under **Services > UPnP & NAT-PMP** (or **IGD & PCP**).

---

[29:03](https://www.youtube.com/watch?v=sJidlu3pPb4&t=1743s) OPNsense: History, Upstream Drama, and Homelab Appeal

The guide transitions to OPNsense, the well-known pfSense fork that emerged under contentious circumstances, with pfSense historically alleging that OPNsense plagiarized their work. Guest expert Wendell from Level1Techs explains the philosophy behind the split:

> "Then there's OPNsense, which is the fork of pfSense to try to peel away some of the more, let's call it graybeard opinion. Like there are well-reasoned reasons for why they're doing things, but they may be suboptimal from a usability standpoint or suboptimal from a 'I can vibe code a better thing than this' standpoint, cuz that is probably not untrue at this point. And so the OPNsense people have forked that and try to provide a better experience. But at the same time, it doesn't appear to me that the OPNsense people have put in the same infrastructure to support the underlying pfSense ecosystem in terms of upstream patches and contributions of code and that kind of thing. And so like there are good arguments here for both things."

When asked whether he has a favorite between the two distributions, Wendell frames it strictly as “different tools, different jobs.”

The steward behind OPNsense is Deciso, which executed the fork in 2015. While Deciso maintains that minimal original, pre-fork code remains in modern OPNsense builds, both platforms trace their core upstream lineage to FreeBSD. This shared dependency has generated friction, as developers from both rival camps must interact within the FreeBSD ecosystem:

> "Franco of OPNsense announced that he officially retired from contributing to FreeBSD in December 2025 after getting suspended from the FreeBSD bug tracker. Reading through the threads in question, it's a wonder any work gets done at all by anybody with great quotes like quote, 'Once upon a time, common sense was used.' Free BSD is what the PlayStation OS is based on, by the way. Underneath every piece of polished corporate software, there are a bunch of unpaid nerds treating a message board like it's Game of Thrones."

From an end-user and homelab perspective, OPNsense offers clear advantages over pfSense: it requires no account creation, avoids funnels into paid subscription models, operates entirely offline during setup, and carries far less risk of having its free edition suddenly deprecated. Steve also notes wryly:

> "Its marketing also has, as far as we can tell, 100% fewer Hitlerian references as compared to pfSense. That is not normally something we review, but seems like an improvement, I guess."

On the flip side, pfSense's community documentation was found to be notably more organized and helpful.

---

[31:44](https://www.youtube.com/watch?v=sJidlu3pPb4&t=1904s) OPNsense Setup: Step-by-Step Installation

```mermaid flowchart TD accTitle: OPNsense Installation Workflow accDescr: Step-by-step process of installing and configuring OPNsense from bootable media to web interface.

subgraph Boot["Boot & Media Prep"] A["Download AMD64 VGA Image"] --> B["Flash to USB via Rufus"] B --> C["Boot Target Hardware"] C --> D["Auto-boots to Live Read-Only Mode"] end

subgraph Install["Local Drive Installation"] D --> E["Log in as 'installer' / 'opnsense'"] E --> F["Select Keymap & 'Install ZFS'"] F --> G["Pick 'Stripe' RAID & Target Disk"] G --> H["Reboot into Permanent System"] end

subgraph Config["Console Configuration"] H --> I["Console Login: 'root' / 'opnsense'"] I --> J["Assign Interfaces (ix0, ix1, em0)"] end

subgraph WebGUI["Browser Onboarding"] J --> K["Access Web GUI at 192.168.1.1"] K --> L["Keep Unbound DNS Enabled"] L --> M["Uncheck 'Optimize for Multi-WAN'"] M --> N["Leave DNSsec & IPsec Off for Initial Run"] end ```

The installation process begins by pulling down the AMD64 VGA image from the official OPNsense website (which runs on standard x86-64 hardware regardless of CPU brand) and writing it to a flash drive using Rufus. Upon booting the machine, OPNsense automatically configures an ephemeral live session in read-only mode.

- **Storage Setup:** To install permanently, log in through the console using username `installer` and password `opnsense` (all lowercase). Select the keyboard layout and choose **Install ZFS**. The installer uses a hybrid boot partition scheme:

> "The hybrid referenced in the menu means that, quote, you can turn UEFI on and off and the boot won't fail."

- **Partition Layout:** Select **Stripe** for single-disk layouts, designate the target storage volume, and execute the installation. The installer prompts for a root password change, which can be deferred until initial setup completes. - **Console Interface Mapping:** After rebooting, log in to the system console with user `root` and password `opnsense`. Select the option to assign interfaces. VLAN configurations and Link Aggregation (LAG / LAGG) can be bypassed:

> "Our understanding is that lags only help with bandwidth when multiple devices on the network are saturating their connections at the same time. Our understanding is also that they are less reliable in a lot of cases. We don't have a ton of experience with link aggregation, so we'll move along."

Interface identification requires trial and error. The hardware ports populate under FreeBSD labels like `ix0` and `ix1` without connection status indicators. If the 50/50 guess between WAN and LAN proves incorrect, physical Ethernet patch cables can simply be swapped afterward. The auxiliary port (`em0`) is designated as an optional interface.

- **Web GUI Setup Wizard:** Connect an administration PC to the assigned LAN port and open `192.168.1.1` in a browser. Authenticate with `root` and `opnsense`. Hostname and domain defaults can remain unmodified. - **DNS & Routing Rules:** Unbound DNS remains enabled to take advantage of integrated security and ad-blocking lists. DNSSEC should remain unchecked during baseline setup because upstream ISP resolvers must explicitly support it. On the deployment screen, disable **Optimize for multi-WAN** unless configuring redundant internet connections, leave automatic DHCP and DNS registration active, and leave IPsec disabled unless building IPsec VPN tunnels. - **Guest Network Friction:** Configuring an isolated guest subnet on the spare physical NIC proved unusually difficult in OPNsense compared to every other platform tested. Documentation has lagged behind architectural changes:

> "There are plenty of guides to setting up VLANs. Home network guides are popular, as well as an official guide to setting up a guest network on a separate physical interface, but the documentation seems to predate OPNsense's switch to DNSmasq. Switching to Kea DHCP may make things easier, but we're not comfortable trialing and erroring our way through providing instructions to lots of people on the internet for something that we're just not sure about and don't have a lot of experience with."

Maintenance requires periodically logging into the administrative UI to review updates. For users needing UPnP, install the `os-upnp` plugin via **System > Firmware > Plugins**, then manage its policies under **Services > Universal Plug and Play**.

---

[35:35](https://www.youtube.com/watch?v=sJidlu3pPb4&t=2135s) OpenWrt: Origins in the Linksys WRT54G GPL Controversy

OpenWrt draws its heritage from the iconic blue-and-black Linksys WRT54G home router. Following Cisco's acquisition of Linksys in 2003, developers discovered that Linksys had built the device firmware using code governed by the GNU General Public License (GPL), including the Linux kernel.

Because Cisco had used GPL-licensed software, Linksys was legally compelled to publish the firmware source code. This was a messy supply chain: Cisco owned Linksys, Linksys bought silicon from Broadcom, and Broadcom acquired upstream firmware components from third parties. Threatened with legal enforcement, Cisco published the source code, creating a major legal precedent for open-source licensing.

This disclosure enabled enthusiasts to write custom distributions directly targeting the WRT54G platform. Over the subsequent two decades, those experimental forks evolved into modern OpenWrt: an enterprise-grade, general-purpose Linux distribution capable of running on dedicated embedded network gear, smart home appliances, and full x86 desktop platforms.

---

[36:38](https://www.youtube.com/watch?v=sJidlu3pPb4&t=2198s) OpenWrt Setup: Direct SSD Flashing and Firewall Zones

Unlike standard operating systems, OpenWrt does not utilize a dedicated installer utility for bare-metal x86 hardware. Instead, the storage drive itself must be flashed directly with the raw image using a secondary computer.

```mermaid flowchart TD accTitle: OpenWrt Untrusted Network Isolation accDescr: Firewall zoning architecture used in OpenWrt to isolate an untrusted network segment while routing traffic out to the internet.

subgraph Hardware["Hardware Interface"] P0["Physical Port: eth0"] --> B0["Bridge: br-untrusted"] end

subgraph ZoneConfig["Firewall Routing: 'untrusted_zone'"] B0 --> Z["Zone Policy"] Z -->|"Input"| AC1["Accept"] Z -->|"Output"| AC2["Accept"] Z -->|"Intra-zone Forward"| RJ["Reject"] Z -->|"Forward Out"| WAN["Destination: WAN Zone Only"] end ```

- **Imaging Storage:** Connect the target SSD to a workstation and run Rufus. Pressing `Alt + F` inside Rufus enables non-removable drive detection, allowing users to flash the target SSD directly. - **Console and Port Mapping:** Connect an Ethernet patch cable between the management PC and the target system's ports until `192.168.1.1` responds in a web browser. Log in using `root` with no password entered, and assign an administrative password immediately. While OpenWrt prompts to search for software updates automatically, it will never apply changes without explicit user approval. - **Interface Reassignment:** Under **Network > Interfaces > Devices**, identify ports by cable link status. With two active cables connected, `eth0` and `eth1` flag as live links, revealing `eth2` as the unpopulated physical port. Edit the default bridge device (`br-lan`), rebind its physical member to `eth2`, click **Save & Apply**, and migrate the administrative LAN cable to the newly designated port. - **Configuring an Untrusted Network:** Creating an isolated network segment on OpenWrt is straightforward: 1. Under **Devices**, create a bridge named `br-untrusted` bound to `eth0` with default parameters. 2. Under **Network > Firewall**, create a dedicated zone labeled `untrusted_zone`. 3. Set **Input** to `accept`, **Output** to `accept`, and **Intra-zone forward** to `reject`. 4. Restrict forwarding destinations strictly to `WAN`, preventing untrusted traffic from crossing into private LAN subnets while still preserving outbound internet access. 5. Bind the newly configured firewall zone to an isolated network interface.

[38:12](https://www.youtube.com/watch?v=sJidlu3pPb4&t=2292s) OpenWrt Wrap-Up and Comparison to the Senses

The configuration of the untrusted network interface wraps up by assigning the device to `br-untrusted`, setting the IP address to `192.168.2.1` with a subnet mask of `255.255.255.0`, setting the firewall zone to the untrusted zone, and launching a DHCP server with default settings.

Reflecting on the platform as a whole, OpenWrt is noted for being extremely compact and stripped down, featuring minimal drivers out of the box. Because of this footprint, deploying it onto a full-blown x86 PC rather than a prefab consumer router feels somewhat out of place. It remains an entirely viable choice if the objective is pure routing without extra packages, but platforms like pfSense and OPNsense provide far more headroom to grow. Conversely, OpenWrt holds a distinct advantage in integrated wireless support compared to FreeBSD-based alternatives, provided the necessary wireless drivers are installed.

[38:55](https://www.youtube.com/watch?v=sJidlu3pPb4&t=2335s) Introduction to IPFire Architecture and Setup

IPFire markets itself as “a professional-grade open-source firewall and security platform.” In terms of its lineage, IPFire is a Linux distribution forked from IPCop, which was itself derived from Smoothwall (a project that hasn't seen an IPCop release since 2015, while Smoothwall transitioned toward pfWall).

```mermaid flowchart TD accTitle: IPFire Color Coded Network Layout accDescr: Diagram showing how IPFire organizes WAN LAN DMZ and WLAN using four color coded zones. subgraph WANZone["WAN Interface"] RED["Red Network<br/>(External / WAN - DHCP)"] end

subgraph InternalZones["Internal Networks"] GREEN["Green Network<br/>(LAN: 192.168.10.1)<br/>Safe / DHCP Enabled"] BLUE["Blue Network<br/>(WLAN / IoT: 192.168.11.1)<br/>Restricted / MAC Filtered"] ORANGE["Orange Network<br/>(Optional DMZ)"] end

RED --> GREEN RED --> BLUE RED -.-> ORANGE BLUE -.->|"Blocked by Default"| GREEN ```

Installation begins conventionally: write the downloaded IPFire ISO image onto a USB flash drive using Rufus and boot the machine. The installer prompts for basic system choices: - **File System:** EXT4 is selected alongside preferred language and system drive. - **Hostname and Domain:** Defaults work fine. - **Credentials:** IPFire requires two distinct passwords during setup—one for the root command-line interface and another for the web administration interface.

IPFire organizes traffic across four distinct, color-coded security zones: - **Red:** Untrusted external Internet connection (WAN). - **Green:** Trusted local internal network (LAN). - **Orange:** Optional DMZ for public-facing servers. - **Blue:** Semi-trusted guest or wireless network (WLAN/IoT).

For this build, a Red, Green, and Blue configuration is selected. The Blue interface does not have to be strictly wireless; its out-of-the-box restrictions make it an ideal candidate for an isolated guest or IoT segment. Using trial and error to sort out driver-to-port assignments, the system's gigabit NIC is allocated to Blue, while two 10-gigabit ports are assigned to Red and Green.

The console IP setup is configured as follows: - **Green IP:** `192.168.10.1` - **Blue IP:** `192.168.11.1` - **Red:** Set to obtain an IP via DHCP - **Green DHCP Pool:** Start address of `192.168.10.100` and end address of `192.168.10.200`

[40:50](https://www.youtube.com/watch?v=sJidlu3pPb4&t=2450s) IPFire Web UI Configuration, Quirks, and Limitations

Once console initialization finishes, the web UI is accessed by connecting a client to the Green port and navigating to `https://192.168.10.1:444`. Omitting either the `https://` protocol or port `444` prevents the interface from loading.

Initial setup revealed that DNS resolution was non-functional under the Network > Domain Name System menu—likely caused by running in a nested lab environment behind existing office networking gear. This was remedied by designating Cloudflare's `1.1.1.1` as the primary resolver and unchecking the option to use ISP-assigned DNS servers.

Configuring the Blue network requires addressing several interdependent settings: - **MAC Filtering:** Blue enables MAC address filtering by default. Each allowed device must have its hardware MAC address added, checked as enabled, and saved under Firewall > Blue Access. - **DHCP Services:** The DHCP server settings from the Red/Green configuration must be manually adapted under Network > DHCP Server to support the `192.168.11.x` subnet. - **DNS Leak/Isolation Bug:** Global DNS settings applied only to the Red network, requiring an explicit entry of `1.1.1.1` inside the Blue DHCP server menu so clients could resolve domain names. - **Web UI Hardening:** By default, Blue traffic cannot access Green, but locking out access to the router's web admin UI from Blue requires manually appending two lines of code to the system configuration file with the `192.168.11.x` subnet specified.

System maintenance features stand out positively: IPFire provides hardware sensor graphs for CPU and memory usage, along with a dedicated vulnerability status tab listing known hardware security flaws tied to the detected processor and platform.

On the downside, community support and flexibility are narrower compared to the FreeBSD giants: - IPFire lacks any UPnP (Universal Plug and Play) support by design, requiring manual port forwarding under Firewall > Firewall Rules for every service or game. - The color-coded layout enforces a rigid topology that simplifies standard deployments but restricts complex bespoke network designs. - “We also get the impression that the two senses completely dominate the DIY router space by market share,” leaving smaller distributions like IPFire with sparser documentation and slower forum assistance.

[43:22](https://www.youtube.com/watch?v=sJidlu3pPb4&t=2602s) ISP Hardware Lock-in and Wendell on AT&T Fiber Bypasses

The guide pivots toward the friction of dealing with mandatory ISP-supplied hardware. Many users turn to custom routers to escape vendor tracking and bloated hardware, only to find the ISP insists on their equipment remaining the frontline access point. Level1Techs' Wendell joins the discussion to unpack the practical frustrations of ISP-mandated gear:

> “AT&T with their fiber really want to control the endpoint. And even if you use your own custom router, the options in like the BGW gateways, for example, the pass-through router option there is still really limited. Like a couple power users in a household can saturate everything that that piece of equipment can handle.”

Wendell explains that AT&T locks authentication strictly to their proprietary hardware using an embedded digital encryption certificate. If you want to bypass the hardware completely, “you have to get a special piece of equipment, and you have to emulate the serial number on from your gateway, and you have to peel off the encryption certificate from the AT&T gateway, and stuff it onto a new piece of equipment that's not, you know, brain-dead, and then you have a reasonable internet experience.”

Some ISPs do not mandate this level of control. Google Fiber, for instance, allows customers to connect an Ethernet cable straight out of the provided fiber jack into any third-party router without requiring vendor authentication.

[45:24](https://www.youtube.com/watch?v=sJidlu3pPb4&t=2724s) Bypassing ISP Gateways: IP Passthrough vs. ONT Emulation

For customers trapped with restrictive ISPs, the simplest starting point is checking whether the provider gateway supports a true bridge mode or an IP Passthrough mode. On popular AT&T gateways such as the Humax BGW320-505, this can be configured directly in the interface: - Log in to the gateway interface at `192.168.1.254`. - Navigate to the Firewall > IP Passthrough page. - Change the Allocation Mode to "Passthrough." - Disable the gateway's built-in Wi-Fi radios entirely to prevent interference, then run an Ethernet cable straight to the WAN interface of your custom router.

While IP Passthrough avoids the complexity of hardware hacking, it still leaves the ISP gateway handling the physical link and running its constrained internal state tables. To cut the ISP gateway out of the circuit completely, users must deploy their own Optical Network Terminal (ONT)—the device where the fiber optic strand terminates into copper Ethernet.

Replacing the ONT requires spoofing the ISP's original gateway credentials: - The replacement ONT acts like a shapeshifter, mimicking the factory hardware down to its serial number, MAC address, and extracted authentication certificates. As Steve jokes, “It's kind of like when CEOs like Mark Zuckerberg kill a human and then wear their skin. They pretend to be the original. That's what you're doing to AT&T.” - Community resources like `pon.wiki` document the process thoroughly and maintain the 8311 community firmware commonly used to emulate AT&T ONTs. - Pre-flashed SFP-based ONTs typically run upwards of $100 from third-party sellers. - SFP-based ONT modules demand hardware planning: the custom router or upstream switch must feature an SFP/SFP+ cage, alongside appropriate transceivers and cables. - Thermal management is a major engineering hurdle for miniaturized ONTs. These pluggable modules run notoriously hot, with vendors frequently bundling stick-on aluminum heatsinks or requiring community-designed 3D-printed fan brackets (housing 25mm or 40mm fans) to keep the transceivers from overheating and dropping packets.

[47:55](https://www.youtube.com/watch?v=sJidlu3pPb4&t=2875s) Bypassing ISP Hardware: The AT&T Gateway Bypass

Replacing ISP-mandated hardware entirely is a complex, hyper-specific project that could easily fill its own dedicated video. Even so, if users are clever and willing to seek out independent documentation, it is entirely possible to sever ties with the provider's equipment at the fiber level. Taking AT&T as a prime example, the community wiki guides walk through swapping an AT&T BGW320-505 gateway using a third-party SFP+ optical network terminal (ONT), such as the Aztek / Azores or AXON USG-PF. The procedure requires precise execution: checking the AT&T fiber status page to confirm the connection operates at a 1270 nm wavelength, equipping the DIY router with an SFP+ card, and spoofing the official AT&T gateway's MAC address on the router's WAN port.

```mermaid flowchart TD accTitle: AT&T Gateway Bypass Flowchart accDescr: Step-by-step process of configuring a DIY router to bypass and replace an AT&T fiber gateway using an SFP+ ONT. subgraph Prep ["Preparation & Verification"] A["Confirm 1270 nm Fiber Wavelength"] --> B["Equip DIY Router with SFP+ Card"] B --> C["Acquire Replacement SFP+ ONT Module"] end subgraph Config ["Configuration & Spoofing"] C --> D["Spoof AT&T Gateway MAC on WAN"] D --> E["Set up SNAT to Reach Local ONT Craft Tool"] E --> F["Clone Gateway Info:<br>Equipment ID & Firmware Version"] end subgraph Deployment ["Fiber Cutover"] F --> G["Hot-swap Fiber Cable to DIY Router"] G --> H{"Verify Connection"} H -->|Success| I["Full Liberation from ISP Hardware"] H -->|Timeout| J["Troubleshoot or Revert"] end ```

Before plugging in the fiber, the user must set up Source NAT (SNAT) on the router to access the ONT's Local Craft Terminal (LCT). Through the ONT's web configuration interface, the user clones the equipment ID, software version, and remaining identity parameters of the original carrier gateway. Only then is the fiber line hot-swapped into the replacement unit to determine if the handshake succeeds or times out from AT&T's end. Patrick personally tackled this configuration for his own home setup, and it consumed an entire Saturday. Steve summarizes the exhausting effort and the ultimate payoff:

> “When Patrick did this for himself, personally, it took him a Saturday to do. But, the reward is that you're free of their [shit]. And that's a pretty big reward.”

The community wiki is packed with technical jargon, abbreviations, and steep hurdles. Although Gamers Nexus has no affiliation with the 8311 Discord community, they advise anyone attempting an ISP bypass to join that server and confer with experienced members before buying hardware or altering their connection.

[49:23](https://www.youtube.com/watch?v=sJidlu3pPb4&t=2963s) Overview of RouterOS, DD-WRT, and FreshTomato

Beyond the primary distributions tested in the main guide, several other long-standing operating systems warrant mention for users exploring alternative platforms:

```mermaid flowchart LR accTitle: Router Firmware Ecosystem Overview accDescr: Summary of RouterOS, DD-WRT, and Tomato alternatives, their origins, and current status. subgraph MikroTik ["MikroTik"] ROS["RouterOS (1999)"] --> WB["Managed via WinBox GUI"] ROS --> LIC["Requires License Key after 24h"] end subgraph WRT_Family ["WRT Family & Ports"] LNK["Linksys WRT54G"] --> DD["DD-WRT (Perpetual Betas)"] LNK --> HYP["HyperWRT"] HYP --> TOM["Tomato"] TOM --> FT["FreshTomato"] TOM --> T64["Tomato64 (x86-64 / ARM64)"] end ```

* **RouterOS (MikroTik):** MikroTik’s software actually predates their dedicated hardware; the company was founded in 1996 and debuted RouterOS in 1999. The software runs without initial registration, but it mandates acquiring and registering a license key within 24 hours of uptime. While a free trial license is available upon creating a MikroTik account, its feature comparison matrix reveals heavy limitations on advanced networking capabilities. Unlike web-managed distributions, RouterOS is configured via a dedicated graphical tool called WinBox, which functions on Linux and macOS in addition to Windows. Running RouterOS on bare-metal, non-MikroTik hardware requires custom manual configuration right out of the gate, categorized in their documentation under "router without default configuration" for advanced users. * **DD-WRT:** Emerging alongside OpenWrt during the early surge of third-party Linksys firmware projects, DD-WRT is broadly compatible with both off-the-shelf consumer routers and generic x86 hardware. However, deploying it on standard PC hardware feels even less like an intended use-case than running x86 OpenWrt. Users who want to test it must pull raw disc images from directory paths like `downloads/betas/latest/x86_64/raw-dd-wrt-64-public-vga.image`. Notably, every single DD-WRT release since 2008 has carried a "beta" designation. Image burning can be handled through utilities hosted on the m0n0wall website. * **FreshTomato & Tomato64:** Tomato traces its heritage back to the Linksys WRT54G through the HyperWRT lineage. The modern branch, FreshTomato, continues development, though its maintainer regularly struggles to keep the project financially viable. Tomato was originally engineered for low-power embedded router chipsets, but a fork named Tomato64 provides a port targeted directly at x86-64 and ARM64 standard PCs. Because Tomato64 exists as a port of a fork of a fork, it lacks the stable architectural foundation of more established projects and remains outside the team's top recommendations.

[51:26](https://www.youtube.com/watch?v=sJidlu3pPb4&t=3086s) Reclaiming Network Ownership and the DIY Spirit

Setting up a custom router evokes the early days of personal computer building—scrapping disparate components together into an operational machine that sparks genuine pride, even if it is not the fastest or flashiest box. Steve emphasizes that taking ownership of critical edge devices is one of the few direct ways enthusiasts can counter modern tech trends:

> “And we talk all the time about you'll own nothing, but there are ways you can fight back.”

Because a router governs internet connectivity for an entire household, configuring one without prior experience can quickly lead to frustration if things break. Anyone attempting this should schedule the project during downtime when there is zero time pressure to be online.

```mermaid flowchart TD accTitle: Safe DIY Router Deployment Strategy accDescr: Recommended transition strategy to deploy a DIY router without risking home internet downtime. subgraph Fallback ["Primary Network (Untouched)"] Old["Existing ISP / Commercial Router"] end subgraph Testing ["Secondary Rig (Staging)"] New["DIY Router (Old PC + Extra NIC)"] New --> Step1["Install OS & Review Settings Slowly"] Step1 --> Step2["Change Default Passwords & Apply Updates"] end subgraph Cutover ["Safe Cutover"] Step2 --> Swap["Swap Ethernet Cables to DIY Router"] Swap --> Test{"Working?"} Test -->|Yes| Keep["Enjoy Private Network Ownership"] Test -->|No| Revert["Instantly Swap Cables Back to Old Router"] end ```

The safest path is retaining your existing, functioning router as a live backup and building the DIY router on secondary hardware—such as an idle desktop outfitted with an add-in network card—rather than flashing your sole household gateway. By running the hardware side-by-side, you can simply transfer the ethernet cables over to the new box. If any issue arises, moving the cables straight back to the old router restores internet immediately, allowing you to debug the DIY machine later at your leisure.

Steve observes that while tinkering with homebrew infrastructure is intrinsically fun, the current urgency behind the homelab movement is driven by an industry-wide erosion of consumer rights and security standards:

> “The reason that we're looking to it now is because beyond being fun, all of us, I think, have become a lot more aware of the practical reasons that we should be doing this, which is you can't trust any of these [fucking] companies to just sell you a thing and then do their job to keep it secure so that you can use it safely.”

For enthusiasts who feel priced out or alienated by modern PC component markets, repurposing older desktop hardware as a dedicated firewall restores that agency. When something goes wrong on a homebrew system, troubleshooting and fixing it is entirely in your own hands, providing an authentic learning experience. Recent investigations into recurring smart TV tracking (such as LG) and chronic vulnerabilities across consumer hardware (such as recurring ASUS router flaws) underscore why maintaining your own edge firewall has become vital.

[55:21](https://www.youtube.com/watch?v=sJidlu3pPb4&t=3321s) Final Firmware Recommendations and Future DIY Guides

Reflecting on the platforms surveyed throughout the guide, Steve and the team share their preferences based on practical use cases:

* **pfSense & OPNsense:** These two FreeBSD-derived giants remain the most exciting platforms for Gamers Nexus, partly inspired by collaborating with Wendell from Level1Techs, whose "bunker of oddities" routinely yields an endless stream of homelab project ideas. While both operating systems offer extensive plug-in ecosystems, they represent massive overkill for ordinary domestic setups. * **OpenWrt:** A practical alternative for households that do not require enterprise-grade routing. Its web interface closely resembles traditional consumer firmwares from brands like Netgear or Linksys, giving users a familiar control paradigm combined with granular administrative power. * **IPFire:** Although functionally capable, its rigid, color-coded zoning architecture imposes strict network topologies that become cumbersome and overbearing as soon as a user deviates from standard designs.

When deploying any of these distributions, the best safety practice is to proceed through the initial setup wizard methodically, researching every setting before modifying it. Even if you maintain the default parameters, understanding the logic behind those defaults is essential for managing your own security. Default administrative usernames and passwords must be changed immediately, and system updates should always be verified and applied before placing the router into daily production.

Steve closes by expressing his hope that this walkthrough channels community dissatisfaction with modern corporate electronics into constructive technical projects. Future guides in this expanding series will focus on self-hosted infrastructure, including custom DIY VPN deployments and personal private cloud storage.

[57:15](https://www.youtube.com/watch?v=sJidlu3pPb4&t=3435s) Taking Back Ownership and Supporting the Series

Steve wraps up the comprehensive DIY router guide by inviting the community to get involved in shaping the future of this content. He asks viewers to share feedback and let the team know what specific projects, software, or hardware setups they want covered as the homelab and self-hosting series expands. At its core, this push into independent networking is motivated by reclaiming personal agency over consumer tech. Steve emphasizes the fundamental ethos driving the effort: “It's all about taking back ownership and to quote Louis Rossmann, owning your shit.” He jokes about platform moderation quirks, noting that while YouTube’s algorithm would almost certainly suppress or bury the upload if profanity were placed in the title, speaking it aloud in the video is somehow considered acceptable.

Producing extensive networking tutorials represents a significant pivot from the outlet's standard coverage, requiring substantial research and production overhead. Steve admits that sticking strictly to traditional DIY PC hardware benchmarks would be vastly easier since the team has refined that workflow for nearly two decades. Because venture into self-hosted networking infrastructure is fresh territory, he encourages viewers to help sustain the independent testing through community support. He points viewers toward Patreon and their official web store, where fans can pick up bench supplies like mouse mats, mod mats, and soldering mats, or physical Blu-ray discs featuring their in-depth investigative reports, such as the AI GPU black market documentary, the LG investigation, and their international factory tour series.

- **Audience suggestions:** Community input is requested to determine upcoming topics for self-hosting, homelab setups, and networking guides. - **Support platforms:** Viewers can back the ongoing series directly via `store.gamersnexus.net` or `patreon.com/gamersnexus`. - **Physical releases & merchandise:** Featured store items include Blu-ray physical editions of the AI GPU black market documentary, the LG investigation, factory tour collections, and workshop gear like mod mats and solder mats.

## Notable quotes > [51:26](https://www.youtube.com/watch?v=sJidlu3pPb4&t=3086s) You can't trust any of these [fucking] companies to just sell you a thing and then do their job to keep it secure so that you can use it safely. — Steve Burke

> [20:21](https://www.youtube.com/watch?v=sJidlu3pPb4&t=1221s) Of all the options here, pfSense is the only one that requires an account with your name, address, and phone number, which flies in the face of privacy, which is a lot of the reason we're doing this. — Steve Burke

## Mentioned Gamers Nexus, Steve Burke, Patrick Lathan, Wendell, Level1Techs, Louis Rossmann, FULU Foundation, FCC, WIPO, Netgate, Deciso, Jim Thompson, Franco Fichtner, Intel Core i7-4930K, Intel X79, Intel Arc A380, Corsair CX550M, pfSense, pfSense Plus, pfSense Community Edition, OPNsense, OpenWrt, DD-WRT, IPFire, RouterOS, Tomato64, FreshTomato, Tomato, HyperWRT, m0n0wall, IPCop, Smoothwall, FreeBSD, Rufus, BalenaEtcher, ZFS, UFS, Kea DHCP, ISC DHCP, Unbound DNS, DNSmasq, Pi-hole, Tailscale, Pangolin, AT&T, Google Fiber, Netgear, TP-Link, ASUS, ZTE, Huawei, Cisco, Linksys, Linksys WRT54G, MikroTik, WinBox, Humax BGW320-505, Aztek / Azores, AXON USG-PF, 8311 Discord community, pon.wiki, LG, Mark Zuckerberg, Patreon

## Video description SPONSOR: Contribute to FULU Foundation's Consumer Rights Wiki https://geni.us/lAWAZ or join their Zulip server to take action! https://geni.us/jeEBB Find their bounties here: https://geni.us/Iyzy2n It's time to apply all the DIY PC spirit and desire for knowledge toward device ownership, decentralizing, and taking control back from companies. This guide is our first attempt at building DIY routers. We tried several big names, like OPNsense, OpenWrt, DD-WRT, pfSense, IPFire, RouterOS, and Tomato in our efforts to detach from ISPs and big brands that have proven untrustworthy with their routers, especially as privacy policies have expanded to claw deeper into your packet history than even necessary to provide internet functionality. This is part of our new series of self-ownership of devices like routers, NASes, VPNs, self-hosted media, and more. This is part of our Data Dragnet fundraising campaign! Thank you to our viewers for making this possible! https://store.gamersnexus.net/data-dragnet

WE NEED YOUR HELP TO FUND THIS SERIES. The best way to support our work is through our store: https://store.gamersnexus.net/ Check out Wendell here! https://www.youtube.com/c/Level1Techs

Like our content? Please consider becoming our Patron to support us: http://www.patreon.com/gamersnexus

This is part of a growing movement of self-hosting, homelab, and DIY content that's brewing from the scraps of DIY PCs. Not only does a DIY router give you more control, including over your privacy, it's also just fun to learn.

TIMESTAMPS

00:00 - Own Everything And Be Happy 02:06 - It's Just Fun 04:37 - The FCC's Short-Sighted Router Ban 06:33 - Building a DIY Router 09:06 - ISPs Mandating Hardware 12:31 - Disclaimer and Disclosures 13:45 - DIY ROUTER: GETTING STARTED 16:53 - pfSense's Crazy History 20:21 - pfSense Setup: How-To Guide 29:02 - OPNsense's History 31:44 - OPNsense Setup: How-To Guide 35:35 - OpenWrt's History 36:38 - OpenWrt Setup: How-To Guide 38:55 - IPFire Setup: How-To Guide 43:22 - ISPs Are Evil, ft. AT&T 45:24 - Replacing ISP ONTs and Routers 49:23 - RouterOS Overview 50:16 - DD-WRT Overview 50:51 - Tomato Overview 51:26 - Conclusion

** Please like, comment, and subscribe for more! **

Links to Amazon and Newegg are typically monetized on our channel (affiliate links) and may return a commission of sales to us from the retailer. This is unrelated to the product manufacturer. Any advertisements or sponsorships are disclosed within the video ("this video is brought to you by") and above the fold in the description. We do not ever produce paid content or "sponsored content" (meaning that the content is our idea and is not funded externally aside from whatever ad placement is in the beginning) and we do not ever charge manufacturers for coverage.

Follow us in these locations for more gaming and hardware updates:

t: http://www.twitter.com/gamersnexus f: http://www.facebook.com/gamersnexus w: http://www.gamersnexus.net/

Our policies, processes, and ethics statements relating to review samples, advertising, travel, errors, and more are transparently and publicly available on this page: https://gamers.nexus/ethics-statements

Steve Burke: Host, Additional Writing, Research Patrick Lathan: Writing, Testing, Research Vitalii Makhnovets: Camera, Editing Tim Phetdara: Editing, Camera

[Source](https://www.youtube.com/watch?v=sJidlu3pPb4)