The iron

Magikarp — The Router From Hell

A hand-built x86 router that has no business being this fast on a home connection. It replaced a NanoPi R5c the moment the network outgrew it. The spec sheet below is lifted from the box’s own HardInfo report.

8c/16tRyzen 7 5700G

28 GiBDDR4-4000

2×10GIntel X710 SFP+

5 TBNVMe (4TB + 1TB)

AMD Ryzen 7 5700G

Zen 3 "Cezanne" · 8 cores / 16 threads · AM4 · boost to ~4.67 GHz observed

amd-pstate-epp governor. Integrated Vega (RENOIR) graphics used for console.

28 GiB DDR4

Rated & configured at 4000 MT/s · no swap (ZSwap/ZRam compression instead)

~24.5 GiB free at report time — this box is not memory-bound.

Intel X710 dual-port 10G SFP+

i40e driver · PCIe 3.0 x8 · port0 = WAN (10GBASE-T via S+RJ10), port1 = LAN (850nm SR fibre)

The whole reason this box exists. Hardware offloads driven by tune-hell.sh.

Realtek 1GbE (enp42s0)

Emergency / out-of-band management port on 10.10.0.0/24

The "if everything else is on fire" console path.

AM4 motherboard (MSI, Mystic Light)

PCIe 3.0 · external clock 100 MHz

PCIe 4.0 unlocks after the planned 5800X3D swap.

Corsair MP600 PRO LPX 4 TB

3.6 TiB NVMe · mounted at /mnt/bruh

Bulk storage.

Samsung 970 EVO Plus 1 TB

931.5 GiB NVMe · / and /boot

Boot / root device.

Platform

Software foundation

Magikarp runs Gentoo Linux on a custom-compiled kernel (7.1.4-gentoo at last report), with OpenRC as init — no systemd. The CPU is governed by amd-pstate-epp, and there’s no swap partition: memory pressure is absorbed by ZSwap/ZRam compression instead.

The kernel is tailored to the job: in-kernel WireGuard, nftables with flowtable offload, and conntrack sized for a table two million entries deep. NFQUEUE is back and ready for action — mostly so proper queueing of packets to routed interfaces can have proper QOS shaping and services can be rate limited.

Why a 5700G? Zen 3 with AVX2 chews through ChaCha20-Poly1305 without breaking a sweat, and the integrated Vega graphics means no discrete GPU is needed just to see a console. Crypto was never the bottleneck — residential WAN is — so the cores go to packet processing, conntrack and the monitoring daemons instead. All of that, along with the low power usage and being X86-64 gives it more than enough horsepower to make it a souped up Corvette amongst Honda Civics and Toyota Camrys to give an accurate comparison.

The X710 is the whole point. Port 0 is the 10G WAN (10GBASE-T via a Mikrotik S+RJ10 module), port 1 is the 10G LAN (850 nm SR fibre to the ICX). The tune-hell.sh script wrings every offload out of it. Paired with the Ryzen 5700G CPU and copious amounts of RAM and custom tuning allows for as many packets to be sent and processed as fast as possible without FCS / interface or Kernel errors.

On the bench

Planned upgrades

Nothing here is speculative fantasy — the parts are mostly already owned or scoped. Each change has a reason and a trade-off.

Upgrade	Status	Why / trade-off
CPU → Ryzen 7 5800X3D	owned	V-Cache cuts memory latency for higher PPS; unlocks PCIe 4.0. Trade-offs: loses the iGPU (needs a dGPU) and idles a little hotter.
dGPU for console → RX 6400	planned	Navi 24, no external power, low-profile, full amdgpu. Restores display output after the X3D swap. RX 550 is the budget fallback.
Flow telemetry stack	planned	Suricata (AF_PACKET IDS on WAN) + pmacctd → IPFIX → Akvorado, native sFlow/Traffic-Flow off the switches & MikroTiks, Zabbix for health.
Partner site turn-up	planned	MikroTik hAP ax3 behind the partner SonicWall as a WG spoke. Audit the SonicWall's exposed SSLVPN before connecting.
IPv6	on hold	Paused until Socket offers native v6 — the HE 6in4 tunnel caused severe packet loss. All v6 config is commented, not deleted.