The iron

Magikarp — The Router From Hell

A hand-built x86 router that has no business being this fast on a home connection. It replaced a NanoPi R5c the moment the network outgrew it. The spec sheet below is lifted from the box’s own HardInfo report.

8c/16tRyzen 7 5700G

28 GiBDDR4-4000

2×10GIntel X710 SFP+

5 TBNVMe (4TB + 1TB)

AMD Ryzen 7 5700G

Zen 3 "Cezanne" · 8 cores / 16 threads · AM4 · boost to ~4.67 GHz observed

amd-pstate-epp governor. Integrated Vega (RENOIR) graphics used for console.

28 GiB DDR4

Rated & configured at 4000 MT/s · no swap (ZSwap/ZRam compression instead)

~24.5 GiB free at report time — this box is not memory-bound.

Intel X710 dual-port 10G SFP+

i40e driver · PCIe 3.0 x8 · port0 = WAN (10GBASE-T via S+RJ10), port1 = LAN (850nm SR fibre)

The whole reason this box exists. Hardware offloads driven by tune-hell.sh.

Realtek 1GbE (enp42s0)

Emergency / out-of-band management port on 10.10.0.0/24

The "if everything else is on fire" console path.

AM4 motherboard (MSI, Mystic Light)

PCIe 3.0 · external clock 100 MHz

PCIe 4.0 unlocks after the planned 5800X3D swap.

Corsair MP600 PRO LPX 4 TB

3.6 TiB NVMe · mounted at /mnt/bruh

Bulk storage.

Samsung 970 EVO Plus 1 TB

931.5 GiB NVMe · / and /boot

Boot / root device.

Platform

Software foundation

Magikarp runs Gentoo Linux on a custom-compiled kernel (7.1.4-gentoo at last report), with OpenRC as init — no systemd. The CPU is governed by amd-pstate-epp, and there’s no swap partition: memory pressure is absorbed by ZSwap/ZRam compression instead.

The kernel is tailored to the job: in-kernel WireGuard, nftables with flowtable offload, and conntrack sized for a table two million entries deep. NFQUEUE is back and ready for action — mostly so proper queueing of packets to routed interfaces can have proper QOS shaping and services can be rate limited.

Why a 5700G? Zen 3 with AVX2 chews through ChaCha20-Poly1305 without breaking a sweat, and the integrated Vega graphics means no discrete GPU is needed just to see a console. Crypto was never the bottleneck — residential WAN is — so the cores go to packet processing, conntrack and the monitoring daemons instead.

The X710 is the whole point. Port 0 is the 10G WAN (10GBASE-T via an S+RJ10 module), port 1 is the 10G LAN (850 nm SR fibre to the ICX). The tune-hell.sh script wrings every offload out of it.

On the bench

Planned upgrades

Nothing here is speculative fantasy — the parts are mostly already owned or scoped. Each change has a reason and a trade-off.

Upgrade	Status	Why / trade-off
CPU → Ryzen 7 5800X3D	owned	V-Cache cuts memory latency for higher PPS; unlocks PCIe 4.0. Trade-offs: loses the iGPU (needs a dGPU) and idles a little hotter.
dGPU for console → RX 6400	planned	Navi 24, no external power, low-profile, full amdgpu. Restores display output after the X3D swap. RX 550 is the budget fallback.
Flow telemetry stack	planned	Suricata (AF_PACKET IDS on WAN) + pmacctd → IPFIX → Akvorado, native sFlow/Traffic-Flow off the switches & MikroTiks, Zabbix for health.
Partner site turn-up	planned	MikroTik hAP ax3 behind the partner SonicWall as a WG spoke. Audit the SonicWall's exposed SSLVPN before connecting.
IPv6	on hold	Paused until Socket offers native v6 — the HE 6in4 tunnel caused severe packet loss. All v6 config is commented, not deleted.