如何建立一套"骨灰级"的家庭路由系统-Linux Router

网络的重要性，对于现代人来说已经不需要太多说明。网络稳定性、高效的使用率一直是很多人头痛的问题，毕竟这个方面对于普通人来说无论知识，还是技能值要求都太高了。而AI大模型的发展，让这个问题成了简单问题。

The importance of networking hardly needs explaining these days. Stable, efficient internet has always been a headache — the knowledge and skills required are simply too high for most people. But the rise of large AI models has turned this into a solvable problem.

因为工作原因，我有几台搭载硬件虚拟系统的服务器…之前一直使用RouterOS作为路由设备，多年使用下来还是很稳定。即便稳定，还是在性能为第一考虑因素下，把RouterOS从工控机上转移到带有多块i350、i550网卡的DELL DX720服务器上。当时也折腾很久，什么网卡在ESXi上的直通给RouterOS等等…系统还是稳定的。但其实心里一直觉得没有好好利用好DELL服务器上的这些高性能网卡…

For work, I have several servers running hardware virtualization... I'd been using RouterOS as my router for years — very stable. But with performance as the top priority, I moved RouterOS from an industrial PC to a DELL DX720 server with multiple i350 and i550 NICs. It was quite an ordeal — NIC passthrough on ESXi to RouterOS, etc. The system stayed stable. But I always felt I wasn't fully utilizing those high-performance server NICs...

一直使用下来问题都不大，但自从Claude、GPT等大模型诱惑越来越大。需要的网络稳定性及安全性要求也随之越来越高。这时我就在想要不要把之前一直没整的终极方案Linux router系统给实施了。这个方案其实是利用Linux的eBPF技术绕过用户层直接走Linux系统内核，就是由网卡来完成数据分流、分发等工作。这在网络的响应速度、稳定度上又提升了一个新的高度。

Things were fine for a while, but as Claude and GPT grew more tempting, network stability and security demands escalated. That's when I thought about finally implementing the ultimate solution: a Linux router system. The idea: leverage Linux's eBPF to bypass userspace and go directly through the kernel — the NIC itself handles traffic splitting and distribution. This takes network responsiveness and stability to a whole new level.

说到这里很多人会说：外面不是有很多路由器产品，有必要这样折腾自己整吗？

Many will ask: aren't there plenty of off-the-shelf routers? Why go through all this trouble?

那就有必要说说那些成品路由器的系统是什么了？一句话：那些品牌路由器系统就是厂商"高度定制化"的linux系统。这个高度定制化也意味着：不会使用最新linux内核，也就没法用最新的技术；很多厂家的系统还是使用最轻量化的linux系统，那就更谈不上可以使用带新技术的新linux内核了；至于会不会为自己未来优化考虑而采集你的信息那就真的不得而知了。硬件方面：厂家第一考虑永远是成本。够用就好，所以很多设备开机一段时间发热大了就要重启一下等等都是这个原因造成的。

Let me explain what those commercial router systems really are. In one sentence: they're "heavily customized" Linux systems by the manufacturer. That heavy customization means: no latest Linux kernel, so no latest tech; many use the most lightweight Linux, making new kernel features impossible. And whether they're collecting your data for future optimization — who knows? On hardware: manufacturers' first consideration is always cost. "Good enough" is the motto. That's why many devices overheat after a while and need rebooting.

方案定了，接下来就简单了——让GPT5.5给我出了设计思路，DS V4完成配置。这里需要说几个事情：

With the approach settled, the rest was straightforward — GPT-5.5 provided the design, DS V4 handled configuration. A few things worth mentioning:

Linux系统的选择

Choice of Linux distro:

很多人一听到Linux系统第一反应就是Ubuntu。而我选的是Debian，实际Debian和Ubuntu是Linux世界里非常有名的"父子"关系。Debian 追求极致的稳定和自由；Ubuntu则基于Debian的非稳定版本开发，更注重易用性和开箱即用的体验。因为要使用eBPF技术，所以需要选择带至少5.8版本以上的Linux内核。GPT5.5给我的最后建议是安装Debian 13。

Many people's first reaction to Linux is Ubuntu. I chose Debian. They have a famous "father-son" relationship in the Linux world: Debian pursues extreme stability and freedom; Ubuntu builds on Debian's unstable branch, focusing on ease of use and out-of-box experience. Since we need eBPF, we need kernel 5.8+. GPT-5.5's final recommendation: install Debian 13.

eBPF技术

eBPF technology:

传统代理方案不管怎么变，流量都要经过用户态处理，绕不开CPU。而eBPF在内核层面就完成了分流，等于网卡在接到数据后自己直接通过linux内核完成任务分配。这样就少了传统路由系统里数据在内核、系统层、用户层三者之间的来回传输。这就意味着延迟更低、不抢CPU、稳定性更高。

Traditional proxy solutions, no matter the variant, force traffic through userspace — you can't bypass the CPU. eBPF handles traffic splitting at the kernel level — the NIC receives data and the Linux kernel completes task allocation directly. This eliminates the back-and-forth between kernel, system, and user layers in traditional routing. Result: lower latency, no CPU contention, higher stability.

这里不得不提一个软件：大鹅 dae（daed），它就是利用eBPF技术的最好运用。

I have to mention a piece of software: dae (daed) — the best implementation of eBPF technology in practice.

关于DNS解析

DNS resolution:

DNS这块我用了两个AdGuard Home：一个走阿里DoH处理国内域名，一个走Google DoH处理国外域名。既能利用AdGuard Home的DNS并行请求和强大的缓存技术，来提高域名解析速度。又能利用它的黑名单过滤体系把那些烦人的广告给屏蔽了。

For DNS, I run two AdGuard Home instances: one via Alibaba DoH for domestic domains, one via Google DoH for international domains. This leverages AdGuard Home's parallel DNS requests and powerful caching to speed up resolution, while its blocklist filtering kills annoying ads.

IPV6

IPv6:

这个系统里最需要注意的是IPv6，很多人会告诉你不要使用IPv6。但至于为什么关了也没说明白。主要原因是IPv6的配置繁琐，网络端很多供应商、设备IPv6的优化还不完善等等原因造成IPv6的实际体验并不好。而我利用IPv6和WireGuard技术，把手机实时连接到家庭网络中。这对于我实时查看家中Homelab服务器工作状态有着很大的帮助。这也为我能利用Mac自带的语音系统给我的手机上的听书、AI语音APP提供了一个免费的TTS服务创造了条件，这个下次有空我也可以来说说。

The trickiest part is IPv6. Many tell you to disable it without explaining why. The main reasons: complex configuration, incomplete IPv6 optimization across ISPs and devices, leading to poor experience. I actually use IPv6 + WireGuard to connect my phone to the home network in real time — invaluable for checking my Homelab server status remotely. It also enables using my Mac's built-in speech system as a free TTS service for audiobook and AI voice apps — a topic for another day.

AI网管

AI network admin:

系统跑起来之后，把DS V4 Flash接进了Prometheus监控，每5分钟自动分析一次节点健康度——延迟、丢包率、历史趋势…然后告诉我系统的健康度。AI帮我搭的路由器，AI自己在里面做网管。这事想起来有点奇妙。

Once running, I connected DS V4 Flash to Prometheus monitoring — every 5 minutes it analyzes node health: latency, packet loss, historical trends — and reports system health. AI helped me build the router, and AI serves as its own network admin. Kind of surreal when you think about it.

AI网管还帮我把家里UniFi AP的无线信道打架的事情给处理好了。家里6个无线AP分布在不同区域，信道打架是常有的事。之前自己调过几次，效果都不理想——某个房间好了，另一个房间又差了；下楼过程中总会有一段AP之间切换造成连接丢了。AI网管帮我分析各AP的信道占用和设备分布，病给出调整建议。按它说的改了之后，全屋无线稳了很多。现在不管有线还是无线，网络质量都挺让人满意的。

The AI admin also fixed my UniFi AP channel conflicts. Six APs across different zones — channel fights were constant. I'd tried adjusting them myself with poor results: one room would improve, another would degrade; walking downstairs always triggered a dropped connection during AP handoff. The AI analyzed channel utilization and device distribution, gave me adjustment recommendations. After following them, wireless across the entire house became much more stable. Now both wired and wireless quality are quite satisfying.

除了以上这些，linux-router系统的基础部分并不复杂：PPPoE拨号、nftables管防火墙和NAT、dnsmasq管全屋四十多台设备的DHCP。只是CAKE QoS做上行整形——电信的上行是瓶颈。我还调整了TCP BBR、buffer大小…用以提高网络视频的缓存大小，这对网络音频、视频等流媒体播放质量的提高有着很大帮助。

Beyond these, the basics aren't complex: PPPoE dialing, nftables for firewall and NAT, dnsmasq handling DHCP for 40+ devices. CAKE QoS for upload shaping — the telecom uplink is the bottleneck. I also tuned TCP BBR and buffer sizes to improve streaming buffer capacity, which significantly boosts audio/video streaming quality.

这套系统跑了几个月，整体很稳。出过问题，但每次系统都自己找到了根因。对网络有完全的控制力，想加什么功能就加什么，出了事不用等厂商更新。当然，让一个万亿参数的大模型做网管这件事上，我觉得还是有点奢侈…接下来会想让这个"网管"帮我管理更多，包括Homelab及其他网络系统。

This system has been running for months — overall very stable. Problems did occur, but each time the system found the root cause on its own. Complete control over the network: add any feature you want, no waiting for vendor updates when something breaks. Though having a trillion-parameter model as network admin does feel a bit extravagant... Next, I want this "admin" to manage more — the Homelab and other network systems.