Making opensource routers
CC Attribution 4.0 International:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Hrusecky, Michal
At CZ.NIC we are making open source Turris routers. What's the point? How are those special? Why should you care? Well on this event you probably do care a lot about stuff like security and privacy. But building on top of open source and being part of open source brings many benefits even for end users. So what cool open source projects did we integrated and how? The talk with describe how do we do stuff, what challenges do we face in regards to having self-updating router that people can and thinker with and then we go into details of some really nice security features that we integrated and made really easy for people to use.
 Hi, everybody. Thank you for coming and listening to my talk. And my name is Mikhail Hushetski, and I will be talking about rotors that we make and why we are making rotors, how did we started making them, and how open source makes our rotors great, and how open source is actually powering up our routers and what it allows us to do. So, who we are? I'm from a company, it's called CZNIC, and we are actually a check-top-level domain registry. And how did we get to making routers? We are actually doing much more than just a registry. Legally, we are some association of companies that actually compete with each other, so their only common goal is to make working internet and make the internet as best as possible. So, we are run as a non-profit because that's the only thing that they agree on. And we are making some open source contributions and we are making some open source software, especially when it is connected to internet and making internet a better place. So, we are developing Bert, routing demon that you might know. We are developing Knott DNS resolver and Knott DNS server, but we are also helping to educate generic public in Czech Republic. We are producing some books and for example, we translated Progrid. We have a Czech author that is writing a really great book about IPv6 and updating it every few years depending on how IPv6 adoption proceeds. We even made a TV series that explained people how to handle internet and that they shouldn't trust everything, how they should buy online and don't let scam and stuff like that. So, we are trying to do a lot of good in general and at the end, we are making Wi-Fi out of this as part of that. So, apart from that, we also run a Czech national C-Serts team, which is a team of people that are monitoring security threats and coordinating with ISPs and other similar teams around the world about security threats and security on the internet. That's going to get important as we go again as we go along. So, how it all started? How did we get to making routers? We had this big question that we wanted to have answered. How safe are the home users from network attacks? Is somebody attacking home users? This average Joe that is just browsing YouTube, is he safe? How often is he attacked? What are the attackers trying to do? We had no clue. We know what is happening on our servers, but our servers are usually they serve some purpose, so they have various services and these attacks can be targeted at them and attackers probably learned about our servers from the services that they are offering. So, what happens with average people at home? So, we wanted to know that and so we started a project to actually assess what's going on on the devices that you have at home and that are facing the internet. So, we created the first tourist router and goal wasn't to create a hardware router. The goal was to create some probe that we could give to people and actually monitor the threats that are coming in. So, we were researching how to do that and in the end we found out that no device actually meets our requirements, so we had to create one and we created a first tourist router. We gave it for free in Czech Republic because it was financed from the money that we get for Czech domains. So, we thought that we should give it back to people who were buying the domains and since we were making router, we decided to make it as we thought that the routers should be made. So, we created a way to propagate security updates to the users, make it so that those updates will be automatically installed and we gave obviously people root account on their routers because it's device that is running in their network, so they should be able to control it somehow. And we had just one condition on those people who were given the router and that was that they will allow us to monitor some stuff and run some security research on top of those devices. And one point was that we were collecting firewall logs to figure out who's attacking them and optionally we allowed them to run some kind of honeypots. For some services, we call it mini-pot. Basically, it's a service that opens up a port, for example, telnet port. And when attacker tries to connect, it asks for credentials and when attacker provides the credentials, it closes the connection. So, it just collects the credentials that attackers are using to connect to telnet, HTTP and stuff like that. And we also allowed people to run some kind of honeypot. I will get to that later. And hardware-wise, we had dual core, power PC, 2 gigs of RAM and 250 megs of storage. So, that was something that we couldn't find in any router on the market that easily at that time. So, the result was that we gave it to people, we run some security research on top of it. And our C-SET team guys were happy. They had plenty of data. They could do quite some research. They found some ways of attack, some new attacks. They found some worms that were going through the internet. And, yeah, it was a great source of data. They were doing presentations around the world about what they found. And, by the way, they were mentioning the project that we created. And plenty of people were actually interested, not only in the results, but also in the router, because they were saying that they would like to have such a router for themselves. A router that is quite powerful, can be made into doing quite a lot of things. And with a root account, not having to figure out the way how to flash unoriginal firmware and losing warranty and stuff like that. So, we were interested whether it's just our impression or whether people actually want such a device. And we ended up with Turisomnia, which was our answer to that question. We created a router that we wanted people to be able to actually buy, because the first one was made from money for check domain, so we didn't want to sell it or give it to people abroad who never ever buy check domain. So, we created a Turisomnia, and we run Indiegogo campaign to basically figure out whether people are really interested. And we found out that they are interested. So we made it happen, and nowadays you can buy it in normal shops. We made it even more powerful than the old router, and we tried to put everything interesting inside. So, we have an RV7, 2GB of RAM, 8GB of storage, both Wi-Fi, 2.4 and 5GB AC. We put in a SFP port, so you can use fiber directly. We have some mini PCI Express slots, M-SATA, USB 3, everything. And it ships with open source software, and again, users get a root account and they can modify it. They can even refresh it. We have plenty of users that are not using our software, but their favorite distribution. And we have normal screws. We are letting people open up the box. We are not voiding the warranty. And yeah, we are trying to be good. We are trying to be good. So, as we put everything in, we get a feedback for Omnia. And the feedback was that price tag between 200 and 300 euros is quite high. That who needs SFP? I don't have a fiber at home. Who needs Ethernet ports? I'm using just Wi-Fi. Who needs Wi-Fi? I'm using only Ethernet ports. And why just five Ethernet ports? I have 20 devices. I need more. And why only two USB 3s? I have plenty of stuff that I need to attach. So, yeah, as you can see, those requests kind of conflict with each other. So, we tried to address all of those. And we came up with something new. And the new thing is called Tourismox. And we tried to make everybody happy again. And we made it modular. So, you have a base module that you can start with. It has R8, two cores, some RAM and USB 3 and nothing more. And then you have optional modules that you can buy and put it together like a Lego and make the router that perfectly fits your needs. So, that's how we got to producing the hardware. And that's our latest step in producing hardware and trying to address people's needs. Currently, it's still on Indiegogo and should be available in retail probably beginning of the next year. So, we were talking about the hardware. Now, what makes our router special? I would say that the most important stuff is that we are using free and open source software on those. You get access to our repositories. You can take a look at the software. You can contribute back some patches. We also have quite enough resources so you can run various services that you would like. There is plenty of open source software available in our repositories. So, you can install additional software. And yeah, you are running your average, well, you are running clean distribution on your router. So, you get all the advantages of that. Main one being security update. And yeah, because it's your device, you bought it. You deserve to have a root account on it, which is something that nowadays vendors are trying to make as hard as possible. And since it started as a security research project, we still have some security features. And we are pretty open regarding everything. You get full schematics online. And yeah, when we were running the campaign, it happened to us a few times that somebody asked some hardware question and it was late in the night. And before our hardware guys woke up and were ready to actually answer it, somebody figured it out from the schematics and answered. So, yeah. That's great. And so, I would like to speak more about the software and show you a few examples of what is really great and cool and what you can do with the open source software on your router. If you get some of the software, it's actually kind of limited that it needs powerful hardware as well. So, yeah. I will start from the Linux distribution that we are using. We are based on distribution called OpenWRT. If you ever heard about it, it's distribution that's targeting embedded devices, but most common use case is using it on routers. Thanks to it, it's optimized for small devices. Packages are small, doesn't eat all much RAM. They have quite some packages already prepared and they have some extra functionality for routers. That's why we basically choose it. They are doing a lot of Wi-Fi development and testing, some firewall development as well. And they have a nice web user interface that you can use to configure almost anything, although sometimes it can be quite confusing for end user because sometimes there is just too many options and you don't know what to do. And their way of doing stuff because their average target is routers that has something like 8M of storage, 8M of RAM. So, they have to compress everything. Usually, you get a highly compressed root FS and you will get something like 1M of storage extra that you will try to use for extra packages and configuration. We don't have to be that restricted. So, our OS that is running in our routers is based on OpenWRT. And for our users, we created much simpler web interface named Foris. It's trying to provide basic and even some advanced functions in a simple way. So, even average Joe can understand them and set it up. From the advanced functionality, one thing that even I as an experienced user really appreciate is OpenVPN server setup. If you ever tried to set up OpenVPN, it's actually not that hard. Just few configuration options. But then the hard part is you actually have to create certification authority and create certificates and somehow take care of that part. And that's something that's hard to explain to beginners. So, we integrated into our web interface and with few clicks, you can create certification authority, create certificates for individual devices, enable OpenVPN server and let your devices in. You just download the configuration file that has everything embedded, put it on your device and you connect. Another example, what we try to make is simple, is create separate SSID for Wi-Fi so people can get kind of guess network for devices that they don't trust and give them internet access like IoT. Because we wanted to make it as simple as possible for people to use, we spent some time making sure that we can update and that those updates is possible to install those updates automatically. So, our users can enable automatic updates, set up their router and that router will stay in the corner, work, sometimes get update, update itself and then just send you email. I just updated few packages, there were some security issues, they are not only there, you are protected. Apart from that, because we have much more resources at our disposal, what we are also doing differently is file system. We are not using heavily compressed images with some overlay on top. We have 8 gigs of storage on Omnia so we can use real file systems for grown servers and desktops. So we picked butterfs because it is the coolest file system out there for Linux and it has some nice features that we are using. The most important one is snapshot. It is really handy and we are doing snapshots all the time just to make sure that you have something to get back to if something goes wrong. We are making snapshots automatically before each update. We are also making snapshots automatically once a week and we also wrote a simple tool that can be controlled from CLI and it will allow you to actually create snapshots manually when you need to. For example, if you are going to try to reconfigure your whole network, you have been to some community meeting, you have been to some conference, then you went with your friends to some pub and when you get back from pub you have this great idea how to reconfigure everything. So you can create snapshots before you start and then when you finally figure out that the idea wasn't really great and you no longer can connect to your device from any port, you can just press the reset button for long enough and it will roll back to the last snapshot before the current stay. So it's really handy. And you can repeat that if your last state was broken already, you can revert even more, you can compare the snapshots, take a look what was there and try to figure out what went wrong. So we think that this functionality is really handy if you are doing stuff with your router and it's really important that you have it accessible with just one hardware button and you are able to roll back to the previous snapshot even if you cannot connect to the router. Another thing that we can do thanks to having plenty of resources at our disposal is Linux containers. Containers are also quite popular nowadays and what we are using them for is that some of our users really like the way their distribution works and they are really accustomed to their favorite distribution. So they prefer to run services the way their distribution offers them. So if they want to set up some tour or web server or IRC server or mail server or DNS server on their router, they prefer to do it in their own distribution. So we are offering, we have a LXC tools integrated, that's something that is done on OpenWRT site already. Somehow we just polished it a little bit and integrated it better and you can with few clicks in web UI, you can install some Linux distribution into container. It will automatically get its virtual interface assigned to LAN bridge and you can start using it. As I was saying that we started from a security research project. One part of the security research project that was really interesting and people asked us how for a long time we actually split up from the TRIS router project and created a separate project for it. This functionality is called HAAS, Honeypot as a service. Basically the reasoning and how this works is Honeypots are cool and you want to see and alert those attackers to some Honeypot and see what they are trying to do and make life a little bit harder for them. But there is still some small risk that they might actually escape from the Honeypot depending on how well you manage it. Even if they don't escape, they might try to do something nasty in there. The average Joe wouldn't try to install Honeypot on his router, he would be scared. So there is an easy solution, let somebody else run the Honeypot and we would gladly do that for you. With this project you can register on our website, you get a special token and then you download just proxy software. It is easily doable on our routers because we have it integrated very well. Some distributions already have this software packaged so it might be available in your distribution and you can install it on your server as well. After a little configuration, when somebody tries to access your device over SSH, this software will actually do many in the middle on him and send him to our servers and he will end up in our Honeypot while thinking that he successfully got into your device. You get all the output, you get to see what was going on, you get some statistics, you are completely safe and I think it can happen to you. All those information actually go to our C-SET team that also does some research on top of it and if they found something interesting they let other C-SET teams around the world know. So you are having fun and you are contributing to the general safety on the internet at the same time. I will show you how it looks. This is my Honeypot when I logged in. I have various devices here and I picked my home router and you can see who was trying to get in, where they succeeded and what username password they used, their IP addresses, where they were from and at the end you see from which country I alerted the most attackers. Looks like somebody in France has something against me. And if you can also click at individual sessions and see what they were looking for. So this guy was looking for some bitcoins. The other guy was just looking around and wanted to see what's in there. And even if you don't participate actively and don't send us your walks so you can view it like this on the website, we have some statistics that are available publicly. You can see how many people are participating, number of sessions and stuff like that. You can also download the data that we collected on Unimized so you don't know who was the guy that was attacked but you know everything about the attackers. So if you are a security researcher you might want to take a look. And we also have the same map just from that data from everybody so you see that people from France attacking my router is not that common and most of the time it's people from China and the US. It's just specialty of my router that is hated by French guys. So yeah, that's one of the software that we developed while we started and now we forked it and now it's a separate project. Apart from that we are using some software that other people developed and we are integrating it to make sure that it provides our users with some additional features and additional services that they might like. One of the projects that we are integrating is called Suikata and that's helpful if you need more than average firewall. It's an intrusion detection or intrusion prevention system. It works somehow with network flows and it looks much deeper into the traffic than your average firewall. It looks even into data and is able to understand how protocols work and extract the data that are interested in some structured way. It can either lock the information or it can even in some setups block the connections. It can alert you somehow and there is plenty of open source rules that you can download and try to integrate and you can write your own rules. Just a few examples of what it can do. Nowadays everything is encrypted. That would be nice but it's not so. Plenty of traffic is encrypted but what is usually unencrypted is DNS queries which contains quite some interesting information like what server you are trying to address when you went to this public web hosting that contains thousands of servers or even if you are establishing encrypted connection during the initial connection you exchange some information which usually contains the server certificate which usually contains the name that you were trying to access. You also get some IP, MAC address, length of connection, how much data was transferred and stuff like that. You can collect plenty of metadata about the traffic even if you can't get the actual traffic. What you can do that, what can you use it for? You can monitor devices you don't trust, figure out what's your fridge doing when you are not home, what's your TV doing when you are not watching it, where is it connecting? There is plenty of open source rules that are trying to detect some of the suspicious activity. There are rules that are trying to match some known worms. There are rules that are trying to match some common disallowed behavior like if you are working in a company, in some evil companies it's disallowed to use IRC, disallowed to connect to Jabber, disallowed to use Dropbox which I would maybe even agree with and stuff like that. There are rules for quite some events and you can try to integrate them. Currently we don't have anything that advanced to make it easy but we plan to extend it at some point. Just an example what you can get from the encrypted communication. You have no clue what's going on afterwards but at the beginning you know who issued the certificate, what was it issued for and stuff like that. Even if the connection is encrypted and you don't see actually HTTP headers, you see the certificate which also tells you quite some information. Just some example how rules look like. I said that Suicata is something that we don't develop. It's a separate open source project but we like them and we try to integrate it. We integrated it and we created a software we call Palcon. It uses Suicata currently just to collect the information about your traffic and figure out what was going on. It can collect those information, aggregate it and then you can watch it in either CLI or in simple web interface. It can also allow you when a new device shows up on your local network. That can be handy if you get an email, if something new is on your network and you have to figure out then by yourself whether it is the new fridge that you bought or whether it is your neighbor. Just a small example. We actually created a demo web page, demo.tourist.cz that is actually showcasing our simplified web interface. It's just static web pages so you don't get to configure that much. Part of it is the open VPN configuration that I was talking about. It also has few options but mostly you just enable it, create certification authority and then you just name the client, click create and then get config for the client and that is how you manage your certification authority. A little bit easier than open SSL. The stuff that I was going to show you right now is the Pacoani. You can see what device was trying to connect. You can see where it was trying to connect and how much data it sent, received, how long it was there. You can filter it by client or you can filter it by the destination so you can see who was using Facebook on your local network and how long and how much data did they transfer or you can just select your TV and see where your TV is going, what website is your TV using. I found out that my TV really likes Baidu. I don't know why but it's spending quite some time there. It gives you more insight into what's going on in your home network and you might find some devices that you might not want to trust anymore. That's one of the examples of software that there is a really great and big and powerful software that somebody else is doing and we just integrate it and give our users plenty of advanced features. Other software that kind of makes sense is for example NextCloud. Some people or some of our users were asking for it and when you take a look at it, it kind of makes sense. If you are thinking about NextCloud, you want to have your data secure and so you want to run the latest released version with all the fixes and all the security updates. That's what we are doing for our software and you want to make sure that your data stays private. You want to host your next instance on infrastructure you trust. We are kind of ultimate self-hosting for that because it will be hosted in your flat behind your closed doors and if somebody breaks up into your apartment, then probably he can get much more valuable information than your NextCloud already. It's kind of a natural fit. We are working on that. As I was speaking about our modular router, we created one that has four USB ports. One module with four USB ports so you can attach multiple hard drives and use it for example NextCloud. What we already have in place is easy VPN so you can connect from anywhere to your NextCloud instance. We have automatic updates so you are always on the latest secure version. We even have NextCloud packages ready and we have CLI wizard that will guide you through setting up your NextCloud instance. We still need to put it into simplified web UI. Recently we also got in our web UI option how to format and mount hard drives. It's the first version of this plugin. We need to extend it to support rate because if you are storing important data on your router, you want to have a rate on your router. That's something that we are working towards too. The question was whether it will be hardware or software rate. We will be using software rate because we are using USB drives mostly. What we are thinking about is we really like ButterFS and ButterFS supports rate as well. We are thinking about using ButterFS rate. One of the cool features of using ButterFS over classic Linux rate is that you don't have to have drives with the same size and it will distribute data. You don't have to think that much about how you are doing it. With not the same size drives, you can do it even with Linux rates but you have to think about it and make the partitions and mirrors and stuff. With ButterFS, it will do everything for you. That's what we are looking for. That's what we are planning to use. One more example of what people are actually doing with their routers. There is this software called TV Head End that you can install on our routers and people are doing it. Then you get DVBT dongle, put it into your router. You get external hard drive attached to your router and then you just turn your router into DVR. You can record the shows on TV. You can stream your TV into your local network. Another software that we have available is MiniDLNA. You can make the shows that you recorded available on your local network in a way that even your Dump Smart TV understands. That's just one example of crazy stuff that you can do. There is much more software that is available and it's up to your imagination what you turn your router into. It's just another device that is powerful. It's running 24-7 and can run any software you can imagine. Thank you for your attention. I have a few more pointers if you want to look some stuff up. Now I would like to open for questions. Thank you. How much of your work goes upstream and what's the experience trying to upstream? Okay. Upstreaming. Obvious question and kind of difficult one because nobody wants to speak about what we didn't manage. Upstreaming regarding Omnia, we managed together with some community guys to get basic support in vanilla news kernel. Apart from SFP and LADs, you can get your Omnia running latest vanilla kernel. Regarding OpenWRT, the situation is a little bit trickier. Back then when we started, they were still using SVN and there were some discussions about that they don't like how they are doing releases. Back then we forked them and then they forked themselves. Then they reworked how they are doing releases and they reworked their version control system and nowadays they are doing it in a really great way, in a really sane way. But in the meantime, we actually released our devices so we still have to maintain what we released. We are now in process of rebasing on top of the newer OpenWRT release. The tricky part is that we promised our users automatic updates that wouldn't break anything. We need to make sure that there is a smooth migration path from the older release to the newer release. That's something that OpenWRT doesn't have to. We are trying to rebase on top of the new release and as part of that we are trying to clean up our patches and send as much as possible upstream. There is stuff that never will be upstream like some customizations that we are doing because we don't have to care about size that much. We care about functionality more. Sometimes OpenWRT people are a little bit radical in cutting down the size. We are trying to take a more conservative approach on that side. We are trying to upstream as much as possible. We are starting right now. We also have to do support for the devices that we have out and we are making a new device. But with the new device situation is actually much better because we learned. If you take a look at Uboot and Linux mailing list you will already see the patches going in for Turismox. We are building on top of latest Uboot upstream. With the kernel we are trying to stick with 4.14 that went to 1806 OpenWRT. My colleague is sending patches to the latest Vanoa Linux as well and trying to get upstream support for it as well. For customizations about OpenWRT there is still quite some stuff that we have to go through and clean up and send upstream. But we are trying to work on it. Is it possible to deploy your own applications on the router? Yes, sure. With a few things. You have to be aware of a few things. First is it is an ARMv7 or ARMv8. Different architecture than your desktop. It depends on your favorite language. What is your favorite language? I like Python. If you like Python then you are fine. Because you don't have to compile binaries. We actually have Python and in our team we have plenty of people that love Python as well. For example the web UI that you saw is written in Python. And our pack is written I believe in Python as well. So scripted languages like Python or Shell are really fine. And you can install it easily. When you get into more troubles is when you try to compile something. Then you need to cross compile it. And you either need to statically link it on your computer and copy the binary. Or you have to use SDK from openwrt and try to integrate it with that. And then it gets a little bit tricky. Because sometimes for the current releases that we have in 1505 SDK doesn't work always. And especially as it is all the release it doesn't build well on new systems. So we are actually using some old LTS on our build machine to be able to actually build for the old three that we have. So it gets a little bit tricky. If you are looking for the long-term window the easiest way is to get your package into openwrt into packages feed and then we will compile it automatically when we migrate to 1806. Okay. Another question? No more? Okay. So thank you again. And if you will think about another question later on we have a boot in Menza area and you can drop by see our rotors for ourselves, play Tetris on them and ask us anything about them. Thank you.
 Hi, everybody. Thank you for coming and listening to my talk. And my name is Mikhail Hushetski,  and I will be talking about rotors that we make and why we are making rotors, how did  we started making them, and how open source makes our rotors great, and how open source  is actually powering up our routers and what it allows us to do. So, who we are? I'm from  a company, it's called CZNIC, and we are actually a check-top-level domain registry. And how did  we get to making routers? We are actually doing much more than just a registry. Legally,  we are some association of companies that actually compete with each other, so their only  common goal is to make working internet and make the internet as best as possible. So,  we are run as a non-profit because that's the only thing that they agree on. And we are making  some open source contributions and we are making some open source software, especially when it is  connected to internet and making internet a better place. So, we are developing Bert,  routing demon that you might know. We are developing Knott DNS resolver and Knott DNS server,  but we are also helping to educate generic public in Czech Republic. We are producing some books  and for example, we translated Progrid. We have a Czech author that is writing a really great  book about IPv6 and updating it every few years depending on how IPv6 adoption proceeds. We even  made a TV series that explained people how to handle internet and that they shouldn't trust  everything, how they should buy online and don't let scam and stuff like that. So, we are trying to  do a lot of good in general and at the end, we are making Wi-Fi out of this as part of that. So,  apart from that, we also run a Czech national C-Serts team, which is a team of people that are  monitoring security threats and coordinating with ISPs and other similar teams around the world  about security threats and security on the internet. That's going to get important as we go  again as we go along. So, how it all started? How did we get to making routers? We had this big  question that we wanted to have answered. How safe are the home users from network attacks? Is  somebody attacking home users? This average Joe that is just browsing YouTube, is he safe?  How often is he attacked? What are the attackers trying to do? We had no clue. We know what is  happening on our servers, but our servers are usually they serve some purpose, so they have  various services and these attacks can be targeted at them and attackers probably learned about our  servers from the services that they are offering. So, what happens with average people at home?  So, we wanted to know that and so we started a project to actually assess what's going on  on the devices that you have at home and that are facing the internet. So, we created the first  tourist router and goal wasn't to create a hardware router. The goal was to create some probe that  we could give to people and actually monitor the threats that are coming in. So, we were  researching how to do that and in the end we found out that no device actually meets our  requirements, so we had to create one and we created a first tourist router. We gave it for  free in Czech Republic because it was financed from the money that we get for Czech domains. So,  we thought that we should give it back to people who were buying the domains and since we were  making router, we decided to make it as we thought that the routers should be made. So,  we created a way to propagate security updates to the users, make it so that those updates will  be automatically installed and we gave obviously people root account on their routers because  it's device that is running in their network, so they should be able to control it somehow.  And we had just one condition on those people who were given the router and that was that they  will allow us to monitor some stuff and run some security research on top of those devices. And  one point was that we were collecting firewall logs to figure out who's attacking them and  optionally we allowed them to run some kind of honeypots. For some services, we call it  mini-pot. Basically, it's a service that opens up a port, for example, telnet port. And when  attacker tries to connect, it asks for credentials and when attacker provides the credentials,  it closes the connection. So, it just collects the credentials that attackers are using to  connect to telnet, HTTP and stuff like that. And we also allowed people to run some kind of  honeypot. I will get to that later. And hardware-wise, we had dual core, power PC, 2 gigs of RAM and  250 megs of storage. So, that was something that we couldn't find in any router on the market  that easily at that time. So, the result was that we gave it to people, we run some security  research on top of it. And our C-SET team guys were happy. They had plenty of data. They  could do quite some research. They found some ways of attack, some new attacks. They found  some worms that were going through the internet. And, yeah, it was a great source of data.  They were doing presentations around the world about what they found. And, by the way, they  were mentioning the project that we created. And plenty of people were actually interested,  not only in the results, but also in the router, because they were saying that they would like  to have such a router for themselves. A router that is quite powerful, can be made into doing  quite a lot of things. And with a root account, not having to figure out the way how to flash  unoriginal firmware and losing warranty and stuff like that. So, we were interested whether  it's just our impression or whether people actually want such a device. And we ended  up with Turisomnia, which was our answer to that question. We created a router that we  wanted people to be able to actually buy, because the first one was made from money  for check domain, so we didn't want to sell it or give it to people abroad who never ever  buy check domain. So, we created a Turisomnia, and we run Indiegogo campaign to basically  figure out whether people are really interested. And we found out that they are interested.  So we made it happen, and nowadays you can buy it in normal shops. We made it even more  powerful than the old router, and we tried to put everything interesting inside. So,  we have an RV7, 2GB of RAM, 8GB of storage, both Wi-Fi, 2.4 and 5GB AC. We put in a  SFP port, so you can use fiber directly. We have some mini PCI Express slots, M-SATA,  USB 3, everything. And it ships with open source software, and again, users get a root  account and they can modify it. They can even refresh it. We have plenty of users that are  not using our software, but their favorite distribution. And we have normal screws. We  are letting people open up the box. We are not voiding the warranty. And yeah, we are  trying to be good. We are trying to be good. So, as we put everything in, we get a feedback  for Omnia. And the feedback was that price tag between 200 and 300 euros is quite high.  That who needs SFP? I don't have a fiber at home. Who needs Ethernet ports? I'm using  just Wi-Fi. Who needs Wi-Fi? I'm using only Ethernet ports. And why just five Ethernet  ports? I have 20 devices. I need more. And why only two USB 3s? I have plenty of stuff  that I need to attach. So, yeah, as you can see, those requests kind of conflict with  each other. So, we tried to address all of those. And we came up with something new.  And the new thing is called Tourismox. And we tried to make everybody happy again. And  we made it modular. So, you have a base module that you can start with. It has R8, two cores,  some RAM and USB 3 and nothing more. And then you have optional modules that you can buy  and put it together like a Lego and make the router that perfectly fits your needs. So,  that's how we got to producing the hardware. And that's our latest step in producing hardware  and trying to address people's needs. Currently, it's still on Indiegogo and should be available  in retail probably beginning of the next year. So, we were talking about the hardware. Now,  what makes our router special? I would say that the most important stuff is that we are  using free and open source software on those. You get access to our repositories. You can  take a look at the software. You can contribute back some patches. We also have quite enough  resources so you can run various services that you would like. There is plenty of open  source software available in our repositories. So, you can install additional software. And  yeah, you are running your average, well, you are running clean distribution on your  router. So, you get all the advantages of that. Main one being security update. And yeah,  because it's your device, you bought it. You deserve to have a root account on it, which  is something that nowadays vendors are trying to make as hard as possible. And since it  started as a security research project, we still have some security features. And we  are pretty open regarding everything. You get full schematics online. And yeah, when  we were running the campaign, it happened to us a few times that somebody asked some  hardware question and it was late in the night. And before our hardware guys woke up and were  ready to actually answer it, somebody figured it out from the schematics and answered. So,  yeah. That's great. And so, I would like to speak more about the software and show you  a few examples of what is really great and cool and what you can do with the open source  software on your router. If you get some of the software, it's actually kind of limited  that it needs powerful hardware as well. So, yeah. I will start from the Linux distribution  that we are using. We are based on distribution called OpenWRT. If you ever heard about it,  it's distribution that's targeting embedded devices, but most common use case is using  it on routers. Thanks to it, it's optimized for small devices. Packages are small, doesn't  eat all much RAM. They have quite some packages already prepared and they have some extra functionality  for routers. That's why we basically choose it. They are doing a lot of Wi-Fi development  and testing, some firewall development as well. And they have a nice web user interface  that you can use to configure almost anything, although sometimes it can be quite confusing  for end user because sometimes there is just too many options and you don't know what to  do. And their way of doing stuff because their average target is routers that has something  like 8M of storage, 8M of RAM. So, they have to compress everything. Usually, you get a  highly compressed root FS and you will get something like 1M of storage extra that you  will try to use for extra packages and configuration. We don't have to be that restricted. So, our  OS that is running in our routers is based on OpenWRT. And for our users, we created  much simpler web interface named Foris. It's trying to provide basic and even some advanced  functions in a simple way. So, even average Joe can understand them and set it up. From  the advanced functionality, one thing that even I as an experienced user really appreciate  is OpenVPN server setup. If you ever tried to set up OpenVPN, it's actually not that  hard. Just few configuration options. But then the hard part is you actually have to  create certification authority and create certificates and somehow take care of that  part. And that's something that's hard to explain to beginners. So, we integrated into  our web interface and with few clicks, you can create certification authority, create  certificates for individual devices, enable OpenVPN server and let your devices in. You  just download the configuration file that has everything embedded, put it on your device  and you connect. Another example, what we try to make is simple, is create separate SSID  for Wi-Fi so people can get kind of guess network for devices that they don't trust  and give them internet access like IoT. Because we wanted to make it as simple as possible  for people to use, we spent some time making sure that we can update and that those updates  is possible to install those updates automatically. So, our users can enable automatic updates,  set up their router and that router will stay in the corner, work, sometimes get update,  update itself and then just send you email. I just updated few packages, there were some  security issues, they are not only there, you are protected. Apart from that, because  we have much more resources at our disposal, what we are also doing differently is file  system. We are not using heavily compressed images with some overlay on top. We have 8  gigs of storage on Omnia so we can use real file systems for grown servers and desktops.  So we picked butterfs because it is the coolest file system out there for Linux and it has  some nice features that we are using. The most important one is snapshot. It is really  handy and we are doing snapshots all the time just to make sure that you have something  to get back to if something goes wrong. We are making snapshots automatically before  each update. We are also making snapshots automatically once a week and we also wrote  a simple tool that can be controlled from CLI and it will allow you to actually create  snapshots manually when you need to. For example, if you are going to try to reconfigure your  whole network, you have been to some community meeting, you have been to some conference,  then you went with your friends to some pub and when you get back from pub you have this  great idea how to reconfigure everything. So you can create snapshots before you start  and then when you finally figure out that the idea wasn't really great and you no longer  can connect to your device from any port, you can just press the reset button for long enough  and it will roll back to the last snapshot before the current stay. So it's really handy.  And you can repeat that if your last state was broken already, you can revert even more,  you can compare the snapshots, take a look what was there and try to figure out what  went wrong. So we think that this functionality is really handy if you are doing stuff with  your router and it's really important that you have it accessible with just one hardware  button and you are able to roll back to the previous snapshot even if you cannot connect  to the router. Another thing that we can do thanks to having plenty of resources at our  disposal is Linux containers. Containers are also quite popular nowadays and what we  are using them for is that some of our users really like the way their distribution works  and they are really accustomed to their favorite distribution. So they prefer to run services  the way their distribution offers them. So if they want to set up some tour or web server  or IRC server or mail server or DNS server on their router, they prefer to do it in their  own distribution. So we are offering, we have a LXC tools integrated, that's something  that is done on OpenWRT site already. Somehow we just polished it a little bit and integrated  it better and you can with few clicks in web UI, you can install some Linux distribution  into container. It will automatically get its virtual interface assigned to LAN bridge  and you can start using it. As I was saying that we started from a security  research project. One part of the security research project that was really interesting  and people asked us how for a long time we actually split up from the TRIS router project  and created a separate project for it. This functionality is called HAAS, Honeypot as a  service. Basically the reasoning and how this works is Honeypots are cool and you want to  see and alert those attackers to some Honeypot and see what they are trying to do and make  life a little bit harder for them. But there is still some small risk that they might actually  escape from the Honeypot depending on how well you manage it. Even if they don't escape,  they might try to do something nasty in there. The average Joe wouldn't try to install Honeypot  on his router, he would be scared. So there is an easy solution, let somebody else run  the Honeypot and we would gladly do that for you. With this project you can register on  our website, you get a special token and then you download just proxy software. It is easily  doable on our routers because we have it integrated very well. Some distributions already have  this software packaged so it might be available in your distribution and you can install it  on your server as well. After a little configuration, when somebody tries to access your device over  SSH, this software will actually do many in the middle on him and send him to our servers  and he will end up in our Honeypot while thinking that he successfully got into your device.  You get all the output, you get to see what was going on, you get some statistics, you  are completely safe and I think it can happen to you. All those information actually go  to our C-SET team that also does some research on top of it and if they found something interesting  they let other C-SET teams around the world know. So you are having fun and you are contributing  to the general safety on the internet at the same time. I will show you how it looks. This  is my Honeypot when I logged in. I have various devices here and I picked my home router and  you can see who was trying to get in, where they succeeded and what username password they  used, their IP addresses, where they were from and at the end you see from which country  I alerted the most attackers. Looks like somebody in France has something against me. And if  you can also click at individual sessions and see what they were looking for. So this  guy was looking for some bitcoins. The other guy was just looking around and wanted to  see what's in there. And even if you don't participate actively and don't send us your  walks so you can view it like this on the website, we have some statistics that are  available publicly. You can see how many people are participating, number of sessions and  stuff like that. You can also download the data that we collected on Unimized so you  don't know who was the guy that was attacked but you know everything about the attackers.  So if you are a security researcher you might want to take a look. And we also have the  same map just from that data from everybody so you see that people from France attacking  my router is not that common and most of the time it's people from China and the US. It's  just specialty of my router that is hated by French guys. So yeah, that's one of the  software that we developed while we started and now we forked it and now it's a separate  project. Apart from that we are using some software that other people developed and we  are integrating it to make sure that it provides our users with some additional features and  additional services that they might like. One of the projects that we are integrating  is called Suikata and that's helpful if you need more than average firewall. It's an intrusion  detection or intrusion prevention system. It works somehow with network flows and it  looks much deeper into the traffic than your average firewall. It looks even into data and  is able to understand how protocols work and extract the data that are interested in some  structured way. It can either lock the information or it can even in some setups block the connections.  It can alert you somehow and there is plenty of open source rules that you can download  and try to integrate and you can write your own rules. Just a few examples of what it can  do. Nowadays everything is encrypted. That would be nice but it's not so. Plenty of traffic  is encrypted but what is usually unencrypted is DNS queries which contains quite some  interesting information like what server you are trying to address when you went to this  public web hosting that contains thousands of servers or even if you are establishing  encrypted connection during the initial connection you exchange some information which usually  contains the server certificate which usually contains the name that you were trying to access.  You also get some IP, MAC address, length of connection, how much data was transferred  and stuff like that. You can collect plenty of metadata about the traffic even if you  can't get the actual traffic. What you can do that, what can you use it for? You can  monitor devices you don't trust, figure out what's your fridge doing when you are not  home, what's your TV doing when you are not watching it, where is it connecting? There  is plenty of open source rules that are trying to detect some of the suspicious activity.  There are rules that are trying to match some known worms. There are rules that are trying  to match some common disallowed behavior like if you are working in a company, in some evil  companies it's disallowed to use IRC, disallowed to connect to Jabber, disallowed to use Dropbox  which I would maybe even agree with and stuff like that. There are rules for quite some  events and you can try to integrate them. Currently we don't have anything that advanced  to make it easy but we plan to extend it at some point. Just an example what you can get  from the encrypted communication. You have no clue what's going on afterwards but at  the beginning you know who issued the certificate, what was it issued for and stuff like that.  Even if the connection is encrypted and you don't see actually HTTP headers, you see  the certificate which also tells you quite some information. Just some example how rules  look like. I said that Suicata is something that we don't develop. It's a separate open  source project but we like them and we try to integrate it. We integrated it and we created  a software we call Palcon. It uses Suicata currently just to collect the information  about your traffic and figure out what was going on. It can collect those information,  aggregate it and then you can watch it in either CLI or in simple web interface. It  can also allow you when a new device shows up on your local network. That can be handy  if you get an email, if something new is on your network and you have to figure out then  by yourself whether it is the new fridge that you bought or whether it is your neighbor.  Just a small example. We actually created a demo web page, demo.tourist.cz that is actually  showcasing our simplified web interface. It's just static web pages so you don't get to  configure that much. Part of it is the open VPN configuration that I was talking about.  It also has few options but mostly you just enable it, create certification authority  and then you just name the client, click create and then get config for the client and that  is how you manage your certification authority. A little bit easier than open SSL. The stuff  that I was going to show you right now is the Pacoani. You can see what device was trying  to connect. You can see where it was trying to connect and how much data it sent, received,  how long it was there. You can filter it by client or you can filter it by the destination  so you can see who was using Facebook on your local network and how long and how much data  did they transfer or you can just select your TV and see where your TV is going, what  website is your TV using. I found out that my TV really likes Baidu. I don't know why  but it's spending quite some time there. It gives you more insight into what's going  on in your home network and you might find some devices that you might not want to trust  anymore. That's one of the examples of software that  there is a really great and big and powerful software that somebody else is doing and we  just integrate it and give our users plenty of advanced features. Other software that  kind of makes sense is for example NextCloud. Some people or some of our users were asking  for it and when you take a look at it, it kind of makes sense. If you are thinking about  NextCloud, you want to have your data secure and so you want to run the latest released  version with all the fixes and all the security updates. That's what we are doing for our  software and you want to make sure that your data stays private. You want to host your  next instance on infrastructure you trust. We are kind of ultimate self-hosting for that  because it will be hosted in your flat behind your closed doors and if somebody breaks up  into your apartment, then probably he can get much more valuable information than your  NextCloud already. It's kind of a natural fit. We are working on that. As I was speaking  about our modular router, we created one that has four USB ports. One module with four USB  ports so you can attach multiple hard drives and use it for example NextCloud. What we  already have in place is easy VPN so you can connect from anywhere to your NextCloud instance.  We have automatic updates so you are always on the latest secure version. We even have  NextCloud packages ready and we have CLI wizard that will guide you through setting up your  NextCloud instance. We still need to put it into simplified web UI. Recently we also got  in our web UI option how to format and mount hard drives. It's the first version of this  plugin. We need to extend it to support rate because if you are storing important data  on your router, you want to have a rate on your router. That's something that we are  working towards too. The question was whether it will be hardware or software rate. We will  be using software rate because we are using USB drives mostly. What we are thinking about  is we really like ButterFS and ButterFS supports rate as well. We are thinking about using  ButterFS rate. One of the cool features of using ButterFS over classic Linux rate is  that you don't have to have drives with the same size and it will distribute data. You  don't have to think that much about how you are doing it. With not the same size drives,  you can do it even with Linux rates but you have to think about it and make the partitions  and mirrors and stuff. With ButterFS, it will do everything for you. That's what we are  looking for. That's what we are planning to use. One more example of what people are actually  doing with their routers. There is this software called TV Head End that you can install on  our routers and people are doing it. Then you get DVBT dongle, put it into your router.  You get external hard drive attached to your router and then you just turn your router  into DVR. You can record the shows on TV. You can stream your TV into your local network.  Another software that we have available is MiniDLNA. You can make the shows that you  recorded available on your local network in a way that even your Dump Smart TV understands.  That's just one example of crazy stuff that you can do. There is much more software that  is available and it's up to your imagination what you turn your router into. It's just  another device that is powerful. It's running 24-7 and can run any software you can imagine.  Thank you for your attention. I have a few more pointers if you want to look some stuff  up. Now I would like to open for questions. Thank you.  How much of your work goes upstream and what's the experience trying to upstream?  Okay. Upstreaming. Obvious question and kind of difficult one because nobody wants to  speak about what we didn't manage. Upstreaming regarding Omnia, we managed together with  some community guys to get basic support in vanilla news kernel. Apart from SFP and LADs,  you can get your Omnia running latest vanilla kernel. Regarding OpenWRT, the situation is  a little bit trickier. Back then when we started, they were still using SVN and there were some  discussions about that they don't like how they are doing releases. Back then we forked  them and then they forked themselves. Then they reworked how they are doing releases  and they reworked their version control system and nowadays they are doing it in a really  great way, in a really sane way. But in the meantime, we actually released our devices  so we still have to maintain what we released. We are now in process of rebasing on top of  the newer OpenWRT release. The tricky part is that we promised our users automatic updates  that wouldn't break anything. We need to make sure that there is a smooth migration path  from the older release to the newer release. That's something that OpenWRT doesn't have  to. We are trying to rebase on top of the new release and as part of that we are trying  to clean up our patches and send as much as possible upstream. There is stuff that never  will be upstream like some customizations that we are doing because we don't have to  care about size that much. We care about functionality more. Sometimes OpenWRT people are a little  bit radical in cutting down the size. We are trying to take a more conservative approach  on that side. We are trying to upstream as much as possible. We are starting right now.  We also have to do support for the devices that we have out and we are making a new device.  But with the new device situation is actually much better because we learned. If you take  a look at Uboot and Linux mailing list you will already see the patches going in for  Turismox. We are building on top of latest Uboot upstream. With the kernel we are trying  to stick with 4.14 that went to 1806 OpenWRT. My colleague is sending patches to the latest  Vanoa Linux as well and trying to get upstream support for it as well. For customizations  about OpenWRT there is still quite some stuff that we have to go through and clean up and  send upstream. But we are trying to work on it.  Is it possible to deploy your own applications on the router? Yes, sure. With a few things.  You have to be aware of a few things. First is it is an ARMv7 or ARMv8. Different architecture  than your desktop. It depends on your favorite language. What is your favorite language?  I like Python. If you like Python then you are fine. Because  you don't have to compile binaries. We actually have Python and in our team we have plenty  of people that love Python as well. For example the web UI that you saw is written in Python.  And our pack is written I believe in Python as well. So scripted languages like Python  or Shell are really fine. And you can install it easily. When you get into more troubles  is when you try to compile something. Then you need to cross compile it. And you either  need to statically link it on your computer and copy the binary. Or you have to use SDK  from openwrt and try to integrate it with that. And then it gets a little bit tricky.  Because sometimes for the current releases that we have in 1505 SDK doesn't work always.  And especially as it is all the release it doesn't build well on new systems. So we are  actually using some old LTS on our build machine to be able to actually build for the old three  that we have. So it gets a little bit tricky. If you are looking for the long-term window  the easiest way is to get your package into openwrt into packages feed and then we will  compile it automatically when we migrate to 1806. Okay. Another question? No more? Okay.  So thank you again. And if you will think about another question later on we have a boot  in Menza area and you can drop by see our rotors for ourselves, play Tetris on them  and ask us anything about them. Thank you.
2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_0_47.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_48_167.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_168_227.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_228_311.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_312_551.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_552_1139.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_1140_5135.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_5136_11699.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_11700_12935.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_12936_13691.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_13692_15479.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_15480_15683.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_15684_16667.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_16668_17411.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_17412_17831.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_17832_19391.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_19392_22247.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_22248_25679.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_25680_25895.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_25896_29159.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_29160_29747.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_29748_29915.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_29916_29963.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_29964_30527.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_30528_33155.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_33156_33683.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_33684_34763.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_34764_35747.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_35748_36395.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_36396_41987.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_41988_42071.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_42072_42563.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_42564_42611.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_42612_42791.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_42792_42947.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_42948_43019.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_43020_43367.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_43368_43475.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_43476_43799.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_43800_44099.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_44100_44267.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_44268_44423.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_44424_44555.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_44556_45035.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_45036_45227.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_45228_45731.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_45732_45839.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_45840_45911.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_45912_46175.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_46176_46871.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_46872_48095.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_48096_51479.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_51480_51839.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_51840_52607.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_52608_52751.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_52752_54539.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_54540_54659.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_54660_54791.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_54792_54839.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_54840_54911.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_54912_55139.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_55140_55271.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_55272_55331.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_55332_56015.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_56016_56159.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_56160_57947.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_57948_58439.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_58440_63155.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_63156_64331.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_64332_66827.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_66828_66959.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_66960_76487.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_76488_77891.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_77892_78515.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_78516_78635.png 2018_-_Turris__secure_open_source_router_vdIk0Yvg_QM_78636_78757.png