Carrier-grade ambitions · residential-grade uplinks
The Router From Hell
enterprise routing, run out of a fish tank.
A multi-site network that behaves like an ISP backbone — OSPF, a WireGuard overlay, three VLANs, a self-hosted PBX and a hand-built 10-gigabit router — all riding on ordinary residential fibre. Every device below is real, every address is pulled straight from the running configs, and the whole thing is held together by one person and copious amounts of alcohol.
The full labelled topology — every interface, IP and VLAN — lives on the Topology page.
The idea
Pretend it’s a WAN. Make it act like one.
The premise is simple and slightly unhinged: take the kind of routing an enterprise or ISP does across leased lines — dynamic routing, a real firewall, a hosted voice platform, proper monitoring — and run it entirely over consumer broadband links between a few houses and a VPS.
Everything meets at Magikarp, the hub. Every remote site dials home over WireGuard, and OSPF runs inside those tunnels so routes propagate automatically instead of being hand-stitched. The residential WAN is the only real bottleneck — so the design spends its effort on latency, correctness and observability rather than chasing crypto throughput that was never the limit.
The sites
Six locations, one control plane
Click any site for its subnets, router and role in the overlay.
Fishtank
Max Site / HQ · Columbia, MO
The core. A hand-built x86 router terminates every WireGuard tunnel here and speaks OSPF to all spokes. Two managed…
Jeffrotik
Dad's House · Columbia, MO
MikroTik hAP ax2 spoke. WireGuard back to Magikarp, OSPF speaker in area 0. Runs a segregated VLAN 60 "dad" network…
Lindarotik
Mom's House · Columbia, MO
MikroTik hAP ax3 spoke. Single flat LAN, WireGuard + OSPF back to the hub. Home of the finest SSID on the network: "…
Linode VPS
Cloud Anchor · Linode (Akamai) datacentre
A public-IP anchor in the overlay: stable endpoint, upstream DNS resolver (172.16.20.5) and a fixed rendezvous that…
Partner Site
New Turn-up · Business partner premises
Next site to join the overlay. A MikroTik hAP ax3 will be the site router (the spare NanoPi R5c is now retired from…
melodyrotik
Sister's House · Columbia, MO
MikroTik hAP ax3 spoke. Single flat LAN, WireGuard + OSPF back to the hub. Home of the 2nd best SSID on the network:…
The stack
What actually runs it
- BIRD2 (OSPFv2, hub)
- RouterOS OSPF (spokes)
- static WG-OUT tables
- nftables + flowtable offload
- XDP early-drop (hellgate)
- RouterOS raw/DDoS filters
- in-kernel WireGuard
- point-to-multipoint hub-and-spoke
- MSS clamping via mangle
- dnsmasq (.fishtank)
- adblock blocklists
- Cloudflare public DNS + DDNS
- FusionPBX (Fishfusion)
- Telnyx primary
- Socket hosted PBX (VLAN 77)
- LibreNMS (Pleco)
- hellmon TUI
- snmpd
- Suricata + Akvorado + Zabbix (planned)
- Gentoo Linux + custom kernel
- OpenRC
- amd-pstate-epp
- ZSwap/ZRam