This project has evolved from a simple Pi-hole DNS ad-blocker into a **full DIY router/firewall** for the home network. The FCC's March 2026 ban on new foreign-made consumer routers and concerns about closed-source router firmware (eeros) drove the decision to make the CM4 the network brain.
**Changed from:** Option 1 (DNS redirect only, eeros as router)
**Changed to:** Option 3 (CM4 as full router/firewall, eeros in bridge mode)
**Drivers:**
- FCC foreign router ban (March 2026) makes closed-source router future uncertain
- Desire for router-level VPN (protect all devices without client software)
- eeros as black-box devices on network — want to contain their visibility
- Full control over DHCP, firewall, DNS — architectural self-defense
**Software stack confirmed:** Raspberry Pi OS Lite (NOT OpenWrt)
- Pi-hole needs full Linux (systemd, dnsmasq) — won't run on OpenWrt
- Pi OS gives Time Machine support (OpenWrt can't do this easily)
- Manual iptables/nftables for firewall (learning value > GUI)
- WireGuard VPN restored (router-level VPN is a different use case than Tailscale per-device)
**pfSense/OPNsense rejected for CM4:** Both are amd64/x86-64 only. No ARM builds exist. Intel N100 firewall boxes ($150-200) are the hardware swap option if x86 is needed later.
**OpenWrt considered but rejected:** Its built-in `adblock` package works functionally but lacks Pi-hole's web UI, query logs, and per-client breakdown. Pi OS + Pi-hole = better for a learning/demo environment.
### 2026-04-04 — Initial Research
**Hardware selected:** CM4 with dual GbE + eMMC (no SD card!)
**Chosen approach:** Raspberry Pi OS Lite + Pi-hole (manual install)
- Full control
- Well-documented
- eMMC more reliable than SD
- Dual GbE enables passthrough or bridge mode
**Rejected:**
- Pre-built images (outdated, inflexible)
- DietPi (good but less common for troubleshooting)
- Add kill switch (iptables rule to block non-VPN outbound)
- Set up DNS hijacking (DNAT port 53 → Pi-hole)
- Monitor eero traffic with tcpdump
- **Goal:** Privacy layer + containment of eeros as black-box devices
### Phase 4: VLAN Isolation (optional, advanced)
- 802.1Q VLANs on CM4
- VLAN 1: Trusted (wired devices, Time Machine)
- VLAN 2: WiFi/IoT (all eero-connected devices)
- Firewall rules between VLANs
- **Goal:** Even if eero firmware is compromised, it can't see trusted LAN traffic
---
## Router-Level VPN (2026-04-17)
**Why:** All traffic from every device on the network gets VPN protection without installing VPN clients on individual devices. ISP/eeros only see encrypted packets going to a VPN endpoint.
**Architecture:**
```
Devices → eeros (WiFi) → CM4 (Pi-hole DNS first, then VPN tunnel) → Internet
```
Pi-hole resolves DNS locally (ad blocking), then clean requests go through WireGuard tunnel.
| Firmware eavesdropping | Medium | Monitor eero traffic via tcpdump on CM4 |
| Remote management backdoor | Medium | Firewall eero management traffic, block firmware update IPs |
| DNS exfiltration | Low | DNAT port 53 redirect to Pi-hole |
| Full compromise | High | VLAN isolation (Phase 4) |
### Best Mitigation: VLAN Architecture
```
CM4 eth1 → VLAN 1 (Trusted - wired devices)
→ VLAN 2 (WiFi/IoT - eeros only)
```
Even a fully compromised eero can only see VLAN 2 traffic. Trusted wired devices are invisible.
---
## FCC Router Ban — Strategic Context (2026-04-17)
**March 2026:** FCC added all foreign-made consumer routers to its Covered List. No new foreign-made router models can receive FCC authorization for sale in the US.
- Existing routers: Still legal to own and use
- Firmware updates: Waivered until March 1, 2027 (uncertain after that)
- New models: Banned unless manufactured domestically
- US-branded routers (eero, Netgear, Ubiquiti): Also affected — they're all made in Asia
**Why this matters for this project:**
- eeros may stop receiving firmware updates after March 2027
- Building your own router on open hardware sidesteps the entire regulatory issue
- CM4 carrier board is a development board, not a consumer router — different FCC category
- You control the software pipeline, not dependent on any manufacturer
- This ban may be less about security and more about forcing onshore manufacturing where US legal jurisdiction (CALEA, FISA, NSLs) applies
**Conclusion:** Rolling your own router isn't just a fun project — it's architectural self-defense against a future where consumer routers are increasingly subject to government access frameworks.
---
## Learning/Lab Use Cases (Dual GbE Bonus!)
### Packet Capture & Analysis (Wireshark/tcpdump)
**Bridge mode = perfect learning lab:**
```
Router → eth0 → Pi (bridged) → eth1 → House
↓
Full packet capture
```
**What you can learn:**
- Wireshark filters and display rules
- Protocol analysis (DNS, HTTP, SMB, etc.)
- Network troubleshooting
- Security analysis (spot suspicious traffic)
- IoT device behavior (what's my Roomba actually doing?)
**Tools to install:**
-`wireshark` (GUI, needs X11/VNC) or `tshark` (CLI)
**Privacy note:** You'll see EVERYTHING on your network — passwords in plaintext (HTTP), browsing history, device fingerprints. Great for learning, serious responsibility.
---
### Other Lab Scenarios
| Scenario | Setup | Learning Value |
|----------|-------|----------------|
| **Network segmentation** | VLANs on dual NIC | Enterprise networking |
