OpenFeO OpenFeO View source
Pre-alpha · GPL-2.0-or-later

A kernel and one binary.

OpenFeO is a tiny Linux router: an upstream kernel plus one static Rust binary, shipped as a single bootable image.

View source Read the spec

The idea

The binary is the operating system.

The kernel does the forwarding, NAT, filtering and shaping. The binary does everything else: it runs as PID 1 and configures the kernel directly.

No shell, no SSH, no package manager, no stray daemons.

FeO is iron(II) oxide. That is, rust.

/init
the binary
/dev/console
one device node
/dev /proc /sys /run /state /boot /tmp
all empty
The whole root filesystem.

Why

A router you install and forget.

It sits between your network and the internet for years. So it should be small, hard to break into and safe to update.

Memory-safe parsers

Untrusted packets are parsed in Rust, and every parser has a fuzz target.

DHCPv4 · DHCPv6 · NDP · PPP · DNS

Little to attack

No shell, no SSH, no package manager. The binary is the whole userspace.

1 binary · 0 shells

One state machine

A WAN change updates routes, firewall, DHCP and DNS through one loop. No half-applied state.

World → Desired → apply

Updates that roll back

Signed images in A/B slots. If a new image fails to boot, the old one comes back by itself.

planned for M5

Tested against a fake ISP

CI boots the real image in QEMU, wired to fake ISPs and LAN clients, and runs real traffic through it.

make test-harness

Small enough to read

One codebase. The kernel starts from allnoconfig and adds only what a router needs.

Linux 6.18 LTS

The plan

Where it is and what comes next.

Pre-alpha. It routes IPv4 and IPv6 in the lab, over DHCP or PPPoE, and there is nothing to install yet. A milestone is done when its tests pass in CI.

  1. M0

    Harness and skeleton

    The image boots to PID 1 in a VM, in CI.

    Done
  2. M1

    IPv4 router

    NAT, firewall, port forwards, DHCP, DNS and time.

    Done
  3. M2

    IPv6

    Routed and delegated prefixes, VLANs and a v6 firewall.

    Done
  4. M3

    PPPoE

    A full PPP client, carrying IPv4 and IPv6.

    Done
  5. M4

    API and panel

    The web panel, built into the binary. So far: log in and a live, read-only dashboard.

    Under waypart 1 of 5
  6. M5

    Install, update, recovery

    A USB installer, signed A/B updates and automatic rollback.

    Not started
  7. M6

    Multi-WAN and CAKE

    Failover between two ISPs, and traffic shaping.

    Not started
  8. M7

    RB5009

    The first ARM board, a MikroTik RB5009.

    Not started

As of . The progress log has every change.

MVP
M0 to M6 passing in CI, then 30 days on a real fibre line.
First hardware
An x86 N100 mini PC with Intel 2.5 Gbit/s ports. Then the RB5009.
After the MVP
WireGuard first.
Left out
No Wi-Fi in the MVP. No shell or SSH, ever.