Turris Omnia
Hrušecký, Michal
CZ.NIC is working hard on releasing their new router called Turris Omnia. It is open source and open hardware, high-performance ARM box that can become the central server of your home as it can actually do much more than just routing. Why is it interesting? What can it do? Can it run openSUSE? All of that and more will be the topic of this talk.
 Hi, everybody. Thank you for staying till the last session. My name is Michal Hrushecki, and I'm going to talk about open source router that we make in Czech Republic. I would start because we are here in foreign country with a little bit introducing company I work for now. We are pretty known in Czech Republic because we are Czech top level domain registrator. We are legally some association, but we are mostly operated like non-profit, and we are getting money from Czech domain registrations, and we are spending all this money to improve internet and work in general. So what do we do? Apart from domains, we do some internet routing daemon that is powering quite some peering centers around the world. We develop DNS server. We publish books regarding IPv6. We translate PerlGit. We have a book about LibreOffice Writer that we are publishing, and we even made a TV series about how end users should work with internet about importance of HTTPS and how they should pick up the password and stuff like that. It was running in Czech TV after main news. So we are trying to do good. One of the things that we did was project called Turis. This was our first router that we got. I would like to speak a little bit about the router that we made before Omnia. It was PowerPC. It had 2 gigabytes of RAM. It has 250 megs of storage, which if you compare it to the typical router that you get in grocery store, you usually get something like 32 megs of RAM, and if you are lucky, 8 megs of storage. So this was pretty powerful machine. And it was given to citizens of Czech Republic for free if they signed the contract. And that contract said that we would spy on them. The idea behind that was we were monitoring the traffic that they were generating, and we were looking for some anomalies. So we would find if they were participating in some DDoS or something like that, if they were distributing some worms, if they had infected computers that were spreading diseases around the internet. And these routers also had, also were endpoints of our central honeypot. So we get people attacking end users, attacking their routers, trying to get inside. And if this attacker attacked like 3 routers that we know about, these routers complained to our central server. And the central servers sent a warning to all the other routers. So this attacker was known to be a bad guy and nobody let him in anymore. So that's what we did. And quite some people liked the router because, as you see, it's quite powerful machine and it's usable for quite a lot of more than just routing and providing Wi-Fi at home. I have even a picture of it. I took a picture without the cover because I know you are all geeks, so you are not interested in how we have a nice blue cover, but you are interested in the internals, right? So plenty of people were interested in this router. And when my colleagues were speaking at some conferences, always somebody asked them, hey, we want this, we want to buy it, sell it to us, and we were saying, no, it's part of the research project we are doing. We are trying to improve security. We are trying to catch bad guys. And basically it was financed from money that we got for check domains, so it wasn't kind of fair to give it to foreigners. So we came up with a new project that was called Thrice Omnia. It's a cool router. It's again open source and open hardware. We kind of focus on security. We have automatic updates. We are doing security updates of packages that are integrated in the router, and these updates get automatically installed. So you can put your router in your corner, in back of your corner somewhere in your house and do not attend it, but it will get all the security fixes, and it will be still secure. And it can do much more than just the router. It can become server that you have at home. It is quite expensive, though. It is even more powerful than original router, and it is actually something that you can finally buy. And all the spying is optional, so you don't have to let us spy on you. But if you would like to, yes, you can opt in and let us use data about your attackers to protect everybody else. So it started, when we started, we did a Indiegogo campaign to figure out how many people were interested, because basically we knew that on conferences people approach us and would like to have such a router. But, yeah, is there reason to actually manufacture it? So we set up pretty low expectations, something like 100,000 US dollars, and we managed to get it in one day. And since then, it was getting more and more popular. Nowadays, there is more than one million US dollars. We sold more than 4,000 of these routers, and hopefully we will start shipping them soon. There was one issue. Before we started the campaign, we knew what we would have to do, and we had everything prepared, and then we found out that when we asked our manufacturer of PCB to make them, that they didn't make them quite okay, and they made them late, and they were broken, and we had to switch to a different provider, and he didn't manage it again. And the last news is that we found a provider that almost managed. They just made some paths too wide or too narrow. I admit I'm not an electric guy, so I don't understand that. But my colleagues explained to me that there are some high-frequency stuff, and if you make it too wide or too narrow, there will be some interferences and whatever. Well, the result was that our Gigabit One port wasn't as reliable as we would like, and we were getting some errors. But it looks promising, because that was the only error, and the manufacturer promised that they can fix that, they can make more control and make it correctly, and new prototypes should be arriving pretty soon. So if they will arrive and will be okay, we will start manufacturing finally. But yeah, the problem is that every try takes several weeks, so it got us a little bit delayed. I'm sorry for that. If you bought our outer, we are sorry. But don't worry, we will deliver. So what will you get? It's an Arm V7, two core, 1.6 GHz. We have two Vyans. You can buy with it with either 1 GB of RAM or 2 GB. We have 8 GB of EMMMC. We have 3 GB ports on SOC. One is dedicated to one to output inside LAN network. We have a manageable switch that can understand VLANs. We have SFP. So if you have a fiber at home, you can use our router. We have mini PCI's, and well, we have three mini PCI's, and one is switchable between mini PCI mode and M-SATA. So if 8 GB of storage is not enough, you could put SSD inside and use it as a server. And we have two USB 3s if you want to extend it a little bit more. This is a picture of one of the latest boards, one of our latest prototypes. And yeah, it's a board. A little bit about the network, how it works. As I said, we have 3 GB ports on SOC. Then we have a switch chip, which goes to all the LAN ports that are behind the router. Two of the GB ports goes to the switch chip as well, and you can configure it any way you want. And then we have one port that is dedicated to one, and basically to get your internet. And there is either classical, internal, metallic, or SFP. And yeah, you can put fiber in there. This one is just switchable. If you don't have anything in SFP, it will use classical, ethernet cable. If you put in SFP, it will switch off classical, metallic one and use SFP. This is how you can configure in WebUI the switch. It actually can do VLANs. So you can use the port that was shown here. You can attach those internal SOC ports to whichever external port you want. Or you can even set up external ports as a tag to some VLAN and then connect the trunk to your SOC and manage it via software inside. Or you can dedicate one port to VLAN trunk and distribute your more complicated network setup somewhere. As I said, it's quite extensible. We have USBs that you can attach pretty much anything nowadays to. We have three mini PCIs, also plenty of stuff that can be attached with. One of the things that we actually sell as accessory is SATA controller that you can connect more hard drives to. We have some GPIers on the header inside. We have I2C, SPI, UART, and we have 3.35 and 12 volts power out. So you can power up the hard drives that you attached with. Let me go back to the picture. So here's the power out. And here's the connector with GPIOs and here's the rest of the stuff. I have a better picture. So SPI, UART, I2C, and GPIOs. So that's one part about the hardware. One of the... There's one more cool thing that I would like to stress. We have RGB LEDs. You can see them blinking here. Here they do just RGB, but they are completely configurable. So you can set up any color you want. They can be pink or cyan or whatever. You can set up them individually. You can configure the color, intensity, what they are triggering. We originally have a configuration tool that we used on the alt routers, but last week one of my colleagues integrated them into kernel. So they are now accessible to normal LED subsystem in kernel. So you can do pretty much anything with them. And it's fun, we. And they are kind of handy sometimes. Now let's get to software. We are shipping it with OpenWRT as it is a router. So in OpenWRT there is plenty of stuff that is already set in a user-friendly way. There is a web UI called Lucy that allows you to manage pretty much anything regarding your network. We wrote our simplified UI for beginners because, yeah, it's nice that you can set up multiple Wi-Fi networks and connect them over bridges and stuff. But if you are a home user and beginner, you get easily lost in all those options. So we have a first round configuration wizard that will guide you to the typical setup that you might need. Then obviously it's, as it's running Linux, you have SSH. So you can SSH to your router and set up everything to SSH. We are delivering it with kernel 4.4. But in general, there is nothing really depending on this patched kernel. We had Andreas Faber installing OpenSUSE on it using Linux Next. And it mostly worked apart from setting up the switches and switching SFP and that. Well, for switching between SFP and Metallic, you need some control over it. But in general, Linux Next works. Uboot, we have, we are using my role one with some patches. We know that this could be improved. But hopefully over the time, we will get to the state that you could use a vanilla kernel and vanilla Uboot. And everything we have is installed on top of butterfs. And we are using snapshots as you might be used to doing in OpenSUSE already. And most of the changes that we had to do to OpenWRT are regarding the update. Because if you know OpenWRT, usually you build heavily compressed small image that you can flash inside that 8M of flash storage that you get. But as we have plenty of space, we are installing individual packages and we are updating as any normal Linux distribution. And yeah, there were some cases that we hit that were not that well supported by OpenWRT. So our patches to OpenWRT are mainly regarding that. And we are trying to contribute upstream as much as possible. Now, one cool thing that I would like to mention is how to do factor reset. We have a reset button and the longer you press it, the more LEDs will power on. And you can actually select between different types of factor reset. You will start if you press it for a short while, you will do just normal reset. If you press it longer, it will just return one snapshot back because, yay, we have a butterf s. Factor reset is basically just returning to the first snapshot that is there. We also added support for flashing system from USB. If you manage to break your butterf s, then you wait for enough LEDs to shine to actually flash new system and format butterf s. And yeah, you can recover using USB. Or if you manage to break it and you want to take a look, there is a serial console port. And if you press reset button long enough, you will end up in recovery system. And you can investigate what went wrong, go through your snapshots that you have, and choose what you want to restore to. Also, if you manage to break recovery system or you boot, you can boot up even over the serial console. You can send Uboot inside, boot up Uboot, and then via Uboot, boot from network, the kernel, and it's really hard to break it completely. There is plenty of options how to recover if you play with it. So as we are using a lot of snapshots, we found out that it would be quite handy to have some tool to manage the snapshots. So we had to, in the end, we wrote one, really simple one. We call it schnapps. And it can do all the basic operations, like show you what snapshots you have, create new snapshots, roll back to the snapshots, and do some comparison between them so you find out what you did. And you don't have to roll back. You can just change some stuff. Apart from that, you probably heard about LXC, about containers. It's a simple method for virtualization. And yeah, it uses C group, namespaces, and you can run virtual system. This virtual system can have its own network interface, which can be connected to some bridge. And this router actually already has a bridge if you boot it up for the first time between the two internal gigabit ports that are connected to LAN and Wi-Fi. So you can easily, when you run virtual machine, you can connect it just to this bridge and you have another computer on your network. And it has the advantage that you are sharing operating memory, so it's much less, yeah, it takes much less resources than full virtualization. And yeah, we have support for that. And actually, there is a nice application in Lucy, so you can set it up over the web interface. This is how it looks like. You get a list of your running containers. You can start them, stop them, somehow modify them, or you can basically download from some template new container, make it run. And yeah, you can get your openSUSE inside the container quite easily. And this way, you get both all the managing capabilities of OpenWRT and all the bells and whistles from the real distribution with all the packages that we have in OpenSUSE, not stripped down. Now, one thing that people sometimes ask is about the central management. Some expensive routers, some routers for companies have this feature. It basically is that you have one router that rules all the other routers. So you have one web UI where you can set up all the routers that you have deployed, for example, on the conference side or in the company. Sometimes they provide even Android application or you set it up via some cloud and all your routers that you have in your company connect to some website somewhere in China and download what they should do and how they should be set up. So it can be quite useful. So how can you do that in our router? Well, if you think about it, our router is just a cool Linux server. So you can use, for example, Unsymbol. You can deploy SSH keys to your router and connect to all your routers and set it up as you want. For Unsymbol, there is UCI module. UCI is the configuration type that is used by OpenWRT and it makes it kind of easy to do stuff and set it up. I know that on this conference you heard a lot about SaltStack. I admit that I haven't played with SaltStack yet, but I plan to do that once I get home because, yeah, learning curve was a little bit steeper than Unsymbol. So I plan to try it afterwards. So that's basically it. What else is there? I just learned today that one guy that was using it installed a GPS inside into mini PCI slot, I didn't thought that it's possible or that it might make sense, but obviously it makes sense for some people. As I said, we are making a NAS perk or accessory which adds a SATA controller and bigger box and you can put two 3.5-inch drives inside. You can create a rate and you can even encrypt your hard drives. This Marvel Armada has hardware acceleration for encryption, so it can be even quite fast. You can do Tor Gateway if your local government supports censorship like in Czech Republic and you can do separate Wi-Fi for your guests. You can do pretty much anything because we have GPIOs, so you can do some electric fans or whatever. You can think about probably some more crazy ideas, what to do. As I said, till today I didn't even think about putting GPS inside, so yeah, whatever you want, try it, play with it and that's all I have prepared. Now questions? Do you have some? Yeah. When you have been talking about Lucy and about the deployment of changes to many servers, is it possible to create something like Autoyast? So make Autolusi. Autolusi, I don't think so, but we have snapshots. When you install your router and you are happy with the configuration, you can just create a snapshot and then if you need to reinstall, instead of reinstalling, you can get back to the snapshot. Yeah. About preparing multiple installations, yeah, we don't have that per se, but you can install basically a system from the USB via this long factory asset and it basically uses just the table of the system, so that should be one way to do it, other way is orchestration. Yeah, we don't have anything fancier. Other questions? So first of all, I'm a bit outside of the actual router business, so my question may sound a bit newish, but I will ask it anyway. So the question is the following. A router is pretty much an end consumer device. It's a specialized device. You get it and you, well, expect it to do tricks. I get the extensibility. That's really great what you have on this slide, but maybe you need to think about presenting it to the end user. So have something like a web foundry where you can get those modules and plug them in. Would that be something that you are planning? It's a nice suggestion. We currently have a forum where people exchange what they already did, but yeah, we are currently quite geek focused. So these people tend to attend the forum and they usually are good at finding information if it is available. But yeah, it's a nice idea. I will, well, currently we are trying to make everything happen, everything perfect before we ship it. Maybe later we will do something like that. As you saw, we already have a few templates for LXC containers. Maybe something for hardware would be interesting at some point. Well, I had more in mind like something really end user specific. So say you have those GPIOs, but what about you having an interface to say home security or stuff like that? I mean, these are the things that people will understand. Yeah, for that, with the previous router, we had actually cooperation with one of the local electronics manufacturer who made some sensors and came among you and smoke detector and stuff like that. And I heard that they are planning to do something similar with this router or not us, but that they are looking forward to this router and they will offer something like that. But in this regard, we are more depending on third parties because we are trying to make a router as best as we can and hopefully there will be other people providing accessories. And mostly these home automation things usually work that you have quite often they are selling some arm board with it that has some special radio put in USB. So we are the arm board and we have USB. So it shouldn't be that the hearts to integrate it. But hopefully some people will work on that. But we are in this regard hoping for the third parties to show up and do stuff. Okay, anybody else? I have a related question. Do you have some plans to create some community around like to provide next cloud packages for tourists or whatever? Well, we are kind of depending for packages on upstream open WRT community. And we currently have some local check committee with who helps with all the routers with testing and support. Hopefully we will get more people with this new router. I think we already solved more than the older routers were actually made. And yeah, you'll see. We definitely hope to have some community but we still have to work on it a little bit. Thank you. So any more questions? No? Then thank you for your attention. And if you have more questions later, I will be here and the router will be somewhere here as well. So catch me later. Thank you.
 Hi, everybody. Thank you for staying till the last session. My name is Michal Hrushecki,  and I'm going to talk about open source router that we make in Czech Republic. I would start  because we are here in foreign country with a little bit introducing company I work for now.  We are pretty known in Czech Republic because we are Czech top level domain  registrator. We are legally some association, but we are mostly operated like non-profit,  and we are getting money from Czech domain registrations, and we are spending all this  money to improve internet and work in general. So what do we do? Apart from domains, we do  some internet routing daemon that is powering quite some peering centers around the world.  We develop DNS server. We publish books regarding IPv6. We translate PerlGit. We have a book about  LibreOffice Writer that we are publishing, and we even made a TV series about how end users  should work with internet about importance of HTTPS and how they should pick up the password  and stuff like that. It was running in Czech TV after main news. So we are trying to do good.  One of the things that we did was project called Turis. This was our first router that we got.  I would like to speak a little bit about the router that we made before Omnia. It was PowerPC.  It had 2 gigabytes of RAM. It has 250 megs of storage, which if you compare it to the typical  router that you get in grocery store, you usually get something like 32 megs of RAM,  and if you are lucky, 8 megs of storage. So this was pretty powerful machine. And it was given to  citizens of Czech Republic for free if they signed the contract. And that contract said that we  would spy on them. The idea behind that was we were monitoring the traffic that they were  generating, and we were looking for some anomalies. So we would find if they were participating in  some DDoS or something like that, if they were distributing some worms, if they had infected  computers that were spreading diseases around the internet. And these routers also had,  also were endpoints of our central honeypot. So we get people attacking end users, attacking  their routers, trying to get inside. And if this attacker attacked like 3 routers that we know about,  these routers complained to our central server. And the central servers sent a warning to all  the other routers. So this attacker was known to be a bad guy and nobody let him in anymore.  So that's what we did. And quite some people liked the router because, as you see, it's quite  powerful machine and it's usable for quite a lot of more than just routing and providing Wi-Fi at home.  I have even a picture of it. I took a picture without the cover because I know you are all geeks,  so you are not interested in how we have a nice blue cover, but you are interested in the internals,  right? So plenty of people were interested in this router. And when my colleagues were speaking at  some conferences, always somebody asked them, hey, we want this, we want to buy it, sell it to us,  and we were saying, no, it's part of the research project we are doing. We are trying to improve  security. We are trying to catch bad guys. And basically it was financed from money that we got  for check domains, so it wasn't kind of fair to give it to foreigners. So we came up with a new project  that was called Thrice Omnia. It's a cool router. It's again open source and open hardware. We kind  of focus on security. We have automatic updates. We are doing security updates of packages that are  integrated in the router, and these updates get automatically installed. So you can put your  router in your corner, in back of your corner somewhere in your house and do not attend it,  but it will get all the security fixes, and it will be still secure. And it can do much more than  just the router. It can become server that you have at home. It is quite expensive, though. It is  even more powerful than original router, and it is actually something that you can finally buy.  And all the spying is optional, so you don't have to let us spy on you. But if you would like to,  yes, you can opt in and let us use data about your attackers to protect everybody else.  So it started, when we started, we did a Indiegogo campaign to figure out how many people were  interested, because basically we knew that on conferences people approach us and would like  to have such a router. But, yeah, is there reason to actually manufacture it? So we set up pretty  low expectations, something like 100,000 US dollars, and we managed to get it in one day.  And since then, it was getting more and more popular. Nowadays, there is more than one million  US dollars. We sold more than 4,000 of these routers, and hopefully we will start shipping them soon.  There was one issue. Before we started the campaign, we knew what we would have to do,  and we had everything prepared, and then we found out that when we asked our manufacturer of PCB  to make them, that they didn't make them quite okay, and they made them late, and they were broken,  and we had to switch to a different provider, and he didn't manage it again.  And the last news is that we found a provider that almost managed. They just made some paths  too wide or too narrow. I admit I'm not an electric guy, so I don't understand that.  But my colleagues explained to me that there are some high-frequency stuff, and if you make it too  wide or too narrow, there will be some interferences and whatever. Well, the result was that our  Gigabit One port wasn't as reliable as we would like, and we were getting some errors. But it  looks promising, because that was the only error, and the manufacturer promised that they can fix that,  they can make more control and make it correctly, and new prototypes should be arriving pretty soon.  So if they will arrive and will be okay, we will start manufacturing finally.  But yeah, the problem is that every try takes several weeks, so it got us a little bit  delayed. I'm sorry for that. If you bought our outer, we are sorry. But don't worry, we will deliver.  So what will you get? It's an Arm V7, two core, 1.6 GHz. We have two Vyans. You can buy with  it with either 1 GB of RAM or 2 GB. We have 8 GB of EMMMC. We have 3 GB ports on SOC.  One is dedicated to one to output inside LAN network. We have a manageable switch that can  understand VLANs. We have SFP. So if you have a fiber at home, you can use our router. We have  mini PCI's, and well, we have three mini PCI's, and one is switchable between mini PCI mode and M-SATA.  So if 8 GB of storage is not enough, you could put SSD inside and use it as a server. And we have  two USB 3s if you want to extend it a little bit more. This is a picture of one of the latest  boards, one of our latest prototypes. And yeah, it's a board. A little bit about the network,  how it works. As I said, we have 3 GB ports on SOC. Then we have a switch chip, which goes to  all the LAN ports that are behind the router. Two of the GB ports goes to the switch chip as well,  and you can configure it any way you want. And then we have one port that is dedicated to one,  and basically to get your internet. And there is either classical,  internal, metallic, or SFP. And yeah, you can put fiber in there. This one is just switchable.  If you don't have anything in SFP, it will use classical,  ethernet cable. If you put in SFP, it will switch off classical, metallic one and use SFP.  This is how you can configure in WebUI the switch. It actually can do VLANs. So you can  use the port that was shown here. You can attach those internal SOC ports to whichever external  port you want. Or you can even set up external ports as a tag to some VLAN and then connect  the trunk to your SOC and manage it via software inside. Or you can dedicate one port to VLAN  trunk and distribute your more complicated network setup somewhere. As I said, it's quite  extensible. We have USBs that you can attach pretty much anything nowadays to. We have three  mini PCIs, also plenty of stuff that can be attached with. One of the things that we actually sell as  accessory is SATA controller that you can connect more hard drives to. We have some GPIers on the  header inside. We have I2C, SPI, UART, and we have 3.35 and 12 volts power out. So you can power up  the hard drives that you attached with. Let me go back to the picture. So here's the power out.  And here's the connector with GPIOs and here's the rest of the stuff. I have a better picture.  So SPI, UART, I2C, and GPIOs. So that's one part about the hardware. One of the... There's one more  cool thing that I would like to stress. We have RGB LEDs. You can see them blinking here.  Here they do just RGB, but they are completely configurable. So you can set up any color you  want. They can be pink or cyan or whatever. You can set up them individually. You can configure  the color, intensity, what they are triggering. We originally have a configuration tool that we used  on the alt routers, but last week one of my colleagues integrated them into kernel. So they  are now accessible to normal LED subsystem in kernel. So you can do pretty much anything with them.  And it's fun, we. And they are kind of handy sometimes. Now let's get to software. We are shipping  it with OpenWRT as it is a router. So in OpenWRT there is plenty of stuff that is already set in a  user-friendly way. There is a web UI called Lucy that allows you to manage pretty much anything  regarding your network. We wrote our simplified UI for beginners because, yeah, it's nice that you  can set up multiple Wi-Fi networks and connect them over bridges and stuff. But if you are a home  user and beginner, you get easily lost in all those options. So we have a first round configuration  wizard that will guide you to the typical setup that you might need. Then obviously it's, as it's  running Linux, you have SSH. So you can SSH to your router and set up everything to SSH. We are  delivering it with kernel 4.4. But in general, there is nothing really depending on this patched  kernel. We had Andreas Faber installing OpenSUSE on it using Linux Next. And it mostly worked  apart from setting up the switches and switching SFP and that. Well, for switching between SFP  and Metallic, you need some control over it. But in general, Linux Next works. Uboot, we have,  we are using my role one with some patches. We know that this could be improved. But  hopefully over the time, we will get to the state that you could use a vanilla kernel and  vanilla Uboot. And everything we have is installed on top of butterfs. And we are using snapshots  as you might be used to doing in OpenSUSE already. And most of the changes that we had to do to  OpenWRT are regarding the update. Because if you know OpenWRT, usually you build heavily compressed  small image that you can flash inside that 8M of flash storage that you get. But as we have  plenty of space, we are installing individual packages and we are updating as any normal Linux  distribution. And yeah, there were some cases that we hit that were not that well supported by  OpenWRT. So our patches to OpenWRT are mainly regarding that. And we are trying to contribute  upstream as much as possible. Now, one cool thing that I would like to mention is how to do factor  reset. We have a reset button and the longer you press it, the more LEDs will power on. And you can  actually select between different types of factor reset. You will start if you press it for a short  while, you will do just normal reset. If you press it longer, it will just return one snapshot back  because, yay, we have a butterf s. Factor reset is basically just returning to the first snapshot  that is there. We also added support for flashing system from USB. If you manage to break your  butterf s, then you wait for enough LEDs to shine to actually flash new system and format butterf s.  And yeah, you can recover using USB. Or if you manage to break it and you want to take a look,  there is a serial console port. And if you press reset button long enough, you will end up in  recovery system. And you can investigate what went wrong, go through your snapshots that you have,  and choose what you want to restore to. Also, if you manage to break recovery system or you boot,  you can boot up even over the serial console. You can send Uboot inside, boot up Uboot,  and then via Uboot, boot from network, the kernel, and it's really hard to break it completely.  There is plenty of options how to recover if you play with it.  So as we are using a lot of snapshots, we found out that it would be quite handy to have some tool  to manage the snapshots. So we had to, in the end, we wrote one, really simple one. We call it  schnapps. And it can do all the basic operations, like show you what snapshots you have, create new  snapshots, roll back to the snapshots, and do some comparison between them so you find out what you did.  And you don't have to roll back. You can just change some stuff.  Apart from that, you probably heard about LXC, about containers. It's a simple method for virtualization.  And yeah, it uses C group, namespaces, and you can run virtual system. This virtual system can  have its own network interface, which can be connected to some bridge. And this router actually  already has a bridge if you boot it up for the first time between the two internal gigabit ports  that are connected to LAN and Wi-Fi. So you can easily, when you run virtual machine, you can  connect it just to this bridge and you have another computer on your network. And it has the advantage  that you are sharing operating memory, so it's much less, yeah, it takes much less resources  than full virtualization. And yeah, we have support for that. And actually, there is a nice  application in Lucy, so you can set it up over the web interface. This is how it looks like.  You get a list of your running containers. You can start them, stop them, somehow modify them,  or you can basically download from some template new container, make it run. And yeah, you can get  your openSUSE inside the container quite easily. And this way, you get both all the managing  capabilities of OpenWRT and all the bells and whistles from the real distribution with all  the packages that we have in OpenSUSE, not stripped down. Now, one thing that people sometimes ask  is about the central management. Some expensive routers, some routers for companies have this  feature. It basically is that you have one router that rules all the other routers. So you have one  web UI where you can set up all the routers that you have deployed, for example, on the  conference side or in the company. Sometimes they provide even Android application or you set it up  via some cloud and all your routers that you have in your company connect to some website  somewhere in China and download what they should do and how they should be set up. So it can be  quite useful. So how can you do that in our router? Well, if you think about it, our router is just  a cool Linux server. So you can use, for example, Unsymbol. You can deploy SSH keys to your router  and connect to all your routers and set it up as you want. For Unsymbol, there is UCI module. UCI  is the configuration type that is used by OpenWRT and it makes it kind of easy to do stuff and set  it up. I know that on this conference you heard a lot about SaltStack. I admit that I haven't  played with SaltStack yet, but I plan to do that once I get home because, yeah, learning curve was  a little bit steeper than Unsymbol. So I plan to try it afterwards. So that's basically it.  What else is there? I just learned today that one guy that was using it installed a GPS inside  into mini PCI slot, I didn't thought that it's possible or that it might make sense, but obviously  it makes sense for some people. As I said, we are making a NAS perk or accessory which adds a  SATA controller and bigger box and you can put two 3.5-inch drives inside. You can create a rate  and you can even encrypt your hard drives. This Marvel Armada has hardware acceleration for  encryption, so it can be even quite fast. You can do Tor Gateway if your local government supports  censorship like in Czech Republic and you can do separate Wi-Fi for your guests. You can do pretty  much anything because we have GPIOs, so you can do some electric fans or whatever. You can think  about probably some more crazy ideas, what to do. As I said, till today I didn't even think about  putting GPS inside, so yeah, whatever you want, try it, play with it and that's all I have prepared.  Now questions? Do you have some?  Yeah.  When you have been talking about Lucy and about the deployment of changes to many servers,  is it possible to create something like Autoyast? So make Autolusi.  Autolusi, I don't think so, but we have snapshots. When you install your router and you are happy  with the configuration, you can just create a snapshot and then if you need to reinstall,  instead of reinstalling, you can get back to the snapshot.  Yeah. About preparing multiple installations, yeah, we don't have that per se, but you can  install basically a system from the USB via this long factory asset and it basically uses just  the table of the system, so that should be one way to do it, other way is orchestration.  Yeah, we don't have anything fancier.  Other questions?  So first of all, I'm a bit outside of the actual router business, so my question may sound a  bit newish, but I will ask it anyway. So the question is the following. A router is pretty  much an end consumer device. It's a specialized device. You get it and you, well, expect it to do  tricks. I get the extensibility. That's really great what you have on this slide, but maybe you  need to think about presenting it to the end user. So have something like a web foundry where you can  get those modules and plug them in. Would that be something that you are planning?  It's a nice suggestion. We currently have a forum where people exchange what they already did,  but yeah, we are currently quite geek focused. So these people tend to attend the forum and they  usually are good at finding information if it is available. But yeah, it's a nice idea. I will,  well, currently we are trying to make everything happen, everything perfect before we ship it.  Maybe later we will do something like that. As you saw, we already have a few templates for  LXC containers. Maybe something for hardware would be interesting at some point.  Well, I had more in mind like something really end user specific. So say you have  those GPIOs, but what about you having an interface to say home security or stuff like that? I mean,  these are the things that people will understand. Yeah, for that, with the previous router, we had  actually cooperation with one of the local electronics manufacturer who made some sensors and  came among you and smoke detector and stuff like that. And I heard that they are planning to do  something similar with this router or not us, but that they are looking forward to this router and  they will offer something like that. But in this regard, we are more depending on third parties  because we are trying to make a router as best as we can and hopefully there will be other people  providing accessories. And mostly these home automation things usually work that you have  quite often they are selling some arm board with it that has some special radio put in USB. So  we are the arm board and we have USB. So it shouldn't be that the hearts to integrate it.  But hopefully some people will work on that. But we are in this regard hoping for the third  parties to show up and do stuff. Okay, anybody else? I have a related question. Do you have  some plans to create some community around like to provide next cloud packages for tourists or  whatever? Well, we are kind of depending for packages on upstream open WRT community. And  we currently have some local check committee with who helps with all the routers with  testing and support. Hopefully we will get more people with this new router.  I think we already solved more than the older routers were actually made. And yeah,  you'll see. We definitely hope to have some community but we still have to work on it a little bit.  Thank you. So any more questions? No? Then thank you for your attention. And if you have more  questions later, I will be here and the router will be somewhere here as well. So catch me later.  Thank you.
Michal_Hrusecky__Turris_Omnia_wf9JvfF7bro_0_203.png Michal_Hrusecky__Turris_Omnia_wf9JvfF7bro_204_251.png Michal_Hrusecky__Turris_Omnia_wf9JvfF7bro_252_299.png Michal_Hrusecky__Turris_Omnia_wf9JvfF7bro_300_347.png Michal_Hrusecky__Turris_Omnia_wf9JvfF7bro_348_455.png Michal_Hrusecky__Turris_Omnia_wf9JvfF7bro_456_503.png Michal_Hrusecky__Turris_Omnia_wf9JvfF7bro_504_551.png Michal_Hrusecky__Turris_Omnia_wf9JvfF7bro_552_623.png Michal_Hrusecky__Turris_Omnia_wf9JvfF7bro_624_671.png Michal_Hrusecky__Turris_Omnia_wf9JvfF7bro_672_719.png Michal_Hrusecky__Turris_Omnia_wf9JvfF7bro_720_767.png Michal_Hrusecky__Turris_Omnia_wf9JvfF7bro_768_815.png Michal_Hrusecky__Turris_Omnia_wf9JvfF7bro_816_863.png Michal_Hrusecky__Turris_Omnia_wf9JvfF7bro_864_911.png Michal_Hrusecky__Turris_Omnia_wf9JvfF7bro_912_3431.png Michal_Hrusecky__Turris_Omnia_wf9JvfF7bro_3432_6815.png Michal_Hrusecky__Turris_Omnia_wf9JvfF7bro_6816_8207.png Michal_Hrusecky__Turris_Omnia_wf9JvfF7bro_8208_10079.png Michal_Hrusecky__Turris_Omnia_wf9JvfF7bro_10080_14531.png Michal_Hrusecky__Turris_Omnia_wf9JvfF7bro_14532_16319.png Michal_Hrusecky__Turris_Omnia_wf9JvfF7bro_16320_16751.png Michal_Hrusecky__Turris_Omnia_wf9JvfF7bro_16752_18971.png Michal_Hrusecky__Turris_Omnia_wf9JvfF7bro_18972_19955.png Michal_Hrusecky__Turris_Omnia_wf9JvfF7bro_19956_21263.png Michal_Hrusecky__Turris_Omnia_wf9JvfF7bro_21264_21659.png Michal_Hrusecky__Turris_Omnia_wf9JvfF7bro_21660_22235.png Michal_Hrusecky__Turris_Omnia_wf9JvfF7bro_22236_23819.png Michal_Hrusecky__Turris_Omnia_wf9JvfF7bro_23820_29231.png Michal_Hrusecky__Turris_Omnia_wf9JvfF7bro_29232_32567.png Michal_Hrusecky__Turris_Omnia_wf9JvfF7bro_32568_32651.png Michal_Hrusecky__Turris_Omnia_wf9JvfF7bro_32652_32711.png Michal_Hrusecky__Turris_Omnia_wf9JvfF7bro_32712_32795.png Michal_Hrusecky__Turris_Omnia_wf9JvfF7bro_32796_32891.png Michal_Hrusecky__Turris_Omnia_wf9JvfF7bro_32892_32951.png Michal_Hrusecky__Turris_Omnia_wf9JvfF7bro_32952_33035.png Michal_Hrusecky__Turris_Omnia_wf9JvfF7bro_33036_33119.png Michal_Hrusecky__Turris_Omnia_wf9JvfF7bro_33120_33191.png Michal_Hrusecky__Turris_Omnia_wf9JvfF7bro_33192_33299.png Michal_Hrusecky__Turris_Omnia_wf9JvfF7bro_33300_35243.png Michal_Hrusecky__Turris_Omnia_wf9JvfF7bro_35244_36707.png Michal_Hrusecky__Turris_Omnia_wf9JvfF7bro_36708_38099.png Michal_Hrusecky__Turris_Omnia_wf9JvfF7bro_38100_39707.png Michal_Hrusecky__Turris_Omnia_wf9JvfF7bro_39708_43271.png Michal_Hrusecky__Turris_Omnia_wf9JvfF7bro_43272_50915.png Michal_Hrusecky__Turris_Omnia_wf9JvfF7bro_50916_52595.png Michal_Hrusecky__Turris_Omnia_wf9JvfF7bro_52596_52713.png
Hi, everybody. Thank you for staying till the last session. My name is Michal Hrushecki, and I'm going to talk about open source router that we make in Czech Republic. I would start because we are here in foreign country with a little bit introducing company I work for now. We are pretty known in Czech Republic because we are Czech top level domain registrator. We are legally some association, but we are mostly operated like non-profit, and we are getting money from Czech domain registrations, and we are spending all this money to improve internet and work in general. So what do we do? Apart from domains, we do some internet routing daemon that is powering quite some peering centers around the world. We develop DNS server. We publish books regarding IPv6. We translate PerlGit. We have a book about LibreOffice Writer that we are publishing, and we even made a TV series about how end users should work with internet about importance of HTTPS and how they should pick up the password and stuff like that. It was running in Czech TV after main news. So we are trying to do good. One of the things that we did was project called Turis. This was our first router that we got. I would like to speak a little bit about the router that we made before Omnia. It was PowerPC. It had 2 gigabytes of RAM. It has 250 megs of storage, which if you compare it to the typical router that you get in grocery store, you usually get something like 32 megs of RAM, and if you are lucky, 8 megs of storage. So this was pretty powerful machine. And it was given to citizens of Czech Republic for free if they signed the contract. And that contract said that we would spy on them. The idea behind that was we were monitoring the traffic that they were generating, and we were looking for some anomalies. So we would find if they were participating in some DDoS or something like that, if they were distributing some worms, if they had infected computers that were spreading diseases around the internet. And these routers also had, also were endpoints of our central honeypot. So we get people attacking end users, attacking their routers, trying to get inside. And if this attacker attacked like 3 routers that we know about, these routers complained to our central server. And the central servers sent a warning to all the other routers. So this attacker was known to be a bad guy and nobody let him in anymore. So that's what we did. And quite some people liked the router because, as you see, it's quite powerful machine and it's usable for quite a lot of more than just routing and providing Wi-Fi at home. I have even a picture of it. I took a picture without the cover because I know you are all geeks, so you are not interested in how we have a nice blue cover, but you are interested in the internals, right? So plenty of people were interested in this router. And when my colleagues were speaking at some conferences, always somebody asked them, hey, we want this, we want to buy it, sell it to us, and we were saying, no, it's part of the research project we are doing. We are trying to improve security. We are trying to catch bad guys. And basically it was financed from money that we got for check domains, so it wasn't kind of fair to give it to foreigners. So we came up with a new project that was called Thrice Omnia. It's a cool router. It's again open source and open hardware. We kind of focus on security. We have automatic updates. We are doing security updates of packages that are integrated in the router, and these updates get automatically installed. So you can put your router in your corner, in back of your corner somewhere in your house and do not attend it, but it will get all the security fixes, and it will be still secure. And it can do much more than just the router. It can become server that you have at home. It is quite expensive, though. It is even more powerful than original router, and it is actually something that you can finally buy. And all the spying is optional, so you don't have to let us spy on you. But if you would like to, yes, you can opt in and let us use data about your attackers to protect everybody else. So it started, when we started, we did a Indiegogo campaign to figure out how many people were interested, because basically we knew that on conferences people approach us and would like to have such a router. But, yeah, is there reason to actually manufacture it? So we set up pretty low expectations, something like 100,000 US dollars, and we managed to get it in one day. And since then, it was getting more and more popular. Nowadays, there is more than one million US dollars. We sold more than 4,000 of these routers, and hopefully we will start shipping them soon. There was one issue. Before we started the campaign, we knew what we would have to do, and we had everything prepared, and then we found out that when we asked our manufacturer of PCB to make them, that they didn't make them quite okay, and they made them late, and they were broken, and we had to switch to a different provider, and he didn't manage it again. And the last news is that we found a provider that almost managed. They just made some paths too wide or too narrow. I admit I'm not an electric guy, so I don't understand that. But my colleagues explained to me that there are some high-frequency stuff, and if you make it too wide or too narrow, there will be some interferences and whatever. Well, the result was that our Gigabit One port wasn't as reliable as we would like, and we were getting some errors. But it looks promising, because that was the only error, and the manufacturer promised that they can fix that, they can make more control and make it correctly, and new prototypes should be arriving pretty soon. So if they will arrive and will be okay, we will start manufacturing finally. But yeah, the problem is that every try takes several weeks, so it got us a little bit delayed. I'm sorry for that. If you bought our outer, we are sorry. But don't worry, we will deliver. So what will you get? It's an Arm V7, two core, 1.6 GHz. We have two Vyans. You can buy with it with either 1 GB of RAM or 2 GB. We have 8 GB of EMMMC. We have 3 GB ports on SOC. One is dedicated to one to output inside LAN network. We have a manageable switch that can understand VLANs. We have SFP. So if you have a fiber at home, you can use our router. We have mini PCI's, and well, we have three mini PCI's, and one is switchable between mini PCI mode and M-SATA. So if 8 GB of storage is not enough, you could put SSD inside and use it as a server. And we have two USB 3s if you want to extend it a little bit more. This is a picture of one of the latest boards, one of our latest prototypes. And yeah, it's a board. A little bit about the network, how it works. As I said, we have 3 GB ports on SOC. Then we have a switch chip, which goes to all the LAN ports that are behind the router. Two of the GB ports goes to the switch chip as well, and you can configure it any way you want. And then we have one port that is dedicated to one, and basically to get your internet. And there is either classical, internal, metallic, or SFP. And yeah, you can put fiber in there. This one is just switchable. If you don't have anything in SFP, it will use classical, ethernet cable. If you put in SFP, it will switch off classical, metallic one and use SFP. This is how you can configure in WebUI the switch. It actually can do VLANs. So you can use the port that was shown here. You can attach those internal SOC ports to whichever external port you want. Or you can even set up external ports as a tag to some VLAN and then connect the trunk to your SOC and manage it via software inside. Or you can dedicate one port to VLAN trunk and distribute your more complicated network setup somewhere. As I said, it's quite extensible. We have USBs that you can attach pretty much anything nowadays to. We have three mini PCIs, also plenty of stuff that can be attached with. One of the things that we actually sell as accessory is SATA controller that you can connect more hard drives to. We have some GPIers on the header inside. We have I2C, SPI, UART, and we have 3.35 and 12 volts power out. So you can power up the hard drives that you attached with. Let me go back to the picture. So here's the power out. And here's the connector with GPIOs and here's the rest of the stuff. I have a better picture. So SPI, UART, I2C, and GPIOs. So that's one part about the hardware. One of the... There's one more cool thing that I would like to stress. We have RGB LEDs. You can see them blinking here. Here they do just RGB, but they are completely configurable. So you can set up any color you want. They can be pink or cyan or whatever. You can set up them individually. You can configure the color, intensity, what they are triggering. We originally have a configuration tool that we used on the alt routers, but last week one of my colleagues integrated them into kernel. So they are now accessible to normal LED subsystem in kernel. So you can do pretty much anything with them. And it's fun, we. And they are kind of handy sometimes. Now let's get to software. We are shipping it with OpenWRT as it is a router. So in OpenWRT there is plenty of stuff that is already set in a user-friendly way. There is a web UI called Lucy that allows you to manage pretty much anything regarding your network. We wrote our simplified UI for beginners because, yeah, it's nice that you can set up multiple Wi-Fi networks and connect them over bridges and stuff. But if you are a home user and beginner, you get easily lost in all those options. So we have a first round configuration wizard that will guide you to the typical setup that you might need. Then obviously it's, as it's running Linux, you have SSH. So you can SSH to your router and set up everything to SSH. We are delivering it with kernel 4.4. But in general, there is nothing really depending on this patched kernel. We had Andreas Faber installing OpenSUSE on it using Linux Next. And it mostly worked apart from setting up the switches and switching SFP and that. Well, for switching between SFP and Metallic, you need some control over it. But in general, Linux Next works. Uboot, we have, we are using my role one with some patches. We know that this could be improved. But hopefully over the time, we will get to the state that you could use a vanilla kernel and vanilla Uboot. And everything we have is installed on top of butterfs. And we are using snapshots as you might be used to doing in OpenSUSE already. And most of the changes that we had to do to OpenWRT are regarding the update. Because if you know OpenWRT, usually you build heavily compressed small image that you can flash inside that 8M of flash storage that you get. But as we have plenty of space, we are installing individual packages and we are updating as any normal Linux distribution. And yeah, there were some cases that we hit that were not that well supported by OpenWRT. So our patches to OpenWRT are mainly regarding that. And we are trying to contribute upstream as much as possible. Now, one cool thing that I would like to mention is how to do factor reset. We have a reset button and the longer you press it, the more LEDs will power on. And you can actually select between different types of factor reset. You will start if you press it for a short while, you will do just normal reset. If you press it longer, it will just return one snapshot back because, yay, we have a butterf s. Factor reset is basically just returning to the first snapshot that is there. We also added support for flashing system from USB. If you manage to break your butterf s, then you wait for enough LEDs to shine to actually flash new system and format butterf s. And yeah, you can recover using USB. Or if you manage to break it and you want to take a look, there is a serial console port. And if you press reset button long enough, you will end up in recovery system. And you can investigate what went wrong, go through your snapshots that you have, and choose what you want to restore to. Also, if you manage to break recovery system or you boot, you can boot up even over the serial console. You can send Uboot inside, boot up Uboot, and then via Uboot, boot from network, the kernel, and it's really hard to break it completely. There is plenty of options how to recover if you play with it. So as we are using a lot of snapshots, we found out that it would be quite handy to have some tool to manage the snapshots. So we had to, in the end, we wrote one, really simple one. We call it schnapps. And it can do all the basic operations, like show you what snapshots you have, create new snapshots, roll back to the snapshots, and do some comparison between them so you find out what you did. And you don't have to roll back. You can just change some stuff. Apart from that, you probably heard about LXC, about containers. It's a simple method for virtualization. And yeah, it uses C group, namespaces, and you can run virtual system. This virtual system can have its own network interface, which can be connected to some bridge. And this router actually already has a bridge if you boot it up for the first time between the two internal gigabit ports that are connected to LAN and Wi-Fi. So you can easily, when you run virtual machine, you can connect it just to this bridge and you have another computer on your network. And it has the advantage that you are sharing operating memory, so it's much less, yeah, it takes much less resources than full virtualization. And yeah, we have support for that. And actually, there is a nice application in Lucy, so you can set it up over the web interface. This is how it looks like. You get a list of your running containers. You can start them, stop them, somehow modify them, or you can basically download from some template new container, make it run. And yeah, you can get your openSUSE inside the container quite easily. And this way, you get both all the managing capabilities of OpenWRT and all the bells and whistles from the real distribution with all the packages that we have in OpenSUSE, not stripped down. Now, one thing that people sometimes ask is about the central management. Some expensive routers, some routers for companies have this feature. It basically is that you have one router that rules all the other routers. So you have one web UI where you can set up all the routers that you have deployed, for example, on the conference side or in the company. Sometimes they provide even Android application or you set it up via some cloud and all your routers that you have in your company connect to some website somewhere in China and download what they should do and how they should be set up. So it can be quite useful. So how can you do that in our router? Well, if you think about it, our router is just a cool Linux server. So you can use, for example, Unsymbol. You can deploy SSH keys to your router and connect to all your routers and set it up as you want. For Unsymbol, there is UCI module. UCI is the configuration type that is used by OpenWRT and it makes it kind of easy to do stuff and set it up. I know that on this conference you heard a lot about SaltStack. I admit that I haven't played with SaltStack yet, but I plan to do that once I get home because, yeah, learning curve was a little bit steeper than Unsymbol. So I plan to try it afterwards. So that's basically it. What else is there? I just learned today that one guy that was using it installed a GPS inside into mini PCI slot, I didn't thought that it's possible or that it might make sense, but obviously it makes sense for some people. As I said, we are making a NAS perk or accessory which adds a SATA controller and bigger box and you can put two 3.5-inch drives inside. You can create a rate and you can even encrypt your hard drives. This Marvel Armada has hardware acceleration for encryption, so it can be even quite fast. You can do Tor Gateway if your local government supports censorship like in Czech Republic and you can do separate Wi-Fi for your guests. You can do pretty much anything because we have GPIOs, so you can do some electric fans or whatever. You can think about probably some more crazy ideas, what to do. As I said, till today I didn't even think about putting GPS inside, so yeah, whatever you want, try it, play with it and that's all I have prepared. Now questions? Do you have some? Yeah. When you have been talking about Lucy and about the deployment of changes to many servers, is it possible to create something like Autoyast? So make Autolusi. Autolusi, I don't think so, but we have snapshots. When you install your router and you are happy with the configuration, you can just create a snapshot and then if you need to reinstall, instead of reinstalling, you can get back to the snapshot. Yeah. About preparing multiple installations, yeah, we don't have that per se, but you can install basically a system from the USB via this long factory asset and it basically uses just the table of the system, so that should be one way to do it, other way is orchestration. Yeah, we don't have anything fancier. Other questions? So first of all, I'm a bit outside of the actual router business, so my question may sound a bit newish, but I will ask it anyway. So the question is the following. A router is pretty much an end consumer device. It's a specialized device. You get it and you, well, expect it to do tricks. I get the extensibility. That's really great what you have on this slide, but maybe you need to think about presenting it to the end user. So have something like a web foundry where you can get those modules and plug them in. Would that be something that you are planning? It's a nice suggestion. We currently have a forum where people exchange what they already did, but yeah, we are currently quite geek focused. So these people tend to attend the forum and they usually are good at finding information if it is available. But yeah, it's a nice idea. I will, well, currently we are trying to make everything happen, everything perfect before we ship it. Maybe later we will do something like that. As you saw, we already have a few templates for LXC containers. Maybe something for hardware would be interesting at some point. Well, I had more in mind like something really end user specific. So say you have those GPIOs, but what about you having an interface to say home security or stuff like that? I mean, these are the things that people will understand. Yeah, for that, with the previous router, we had actually cooperation with one of the local electronics manufacturer who made some sensors and came among you and smoke detector and stuff like that. And I heard that they are planning to do something similar with this router or not us, but that they are looking forward to this router and they will offer something like that. But in this regard, we are more depending on third parties because we are trying to make a router as best as we can and hopefully there will be other people providing accessories. And mostly these home automation things usually work that you have quite often they are selling some arm board with it that has some special radio put in USB. So we are the arm board and we have USB. So it shouldn't be that the hearts to integrate it. But hopefully some people will work on that. But we are in this regard hoping for the third parties to show up and do stuff. Okay, anybody else? I have a related question. Do you have some plans to create some community around like to provide next cloud packages for tourists or whatever? Well, we are kind of depending for packages on upstream open WRT community. And we currently have some local check committee with who helps with all the routers with testing and support. Hopefully we will get more people with this new router. I think we already solved more than the older routers were actually made. And yeah, you'll see. We definitely hope to have some community but we still have to work on it a little bit. Thank you. So any more questions? No? Then thank you for your attention. And if you have more questions later, I will be here and the router will be somewhere here as well. So catch me later. Thank you.
central server. And the central servers sent a quite a lot of more than just routing and again open source and open hardware. We kind of be still secure. And it can do much more than just the router. It can become server that you have at home. It is quite expensive, though. It your openSUSE inside the container quite easily. will get more people with this new router. I