🛠 Routeur / passerelle réseau double Gigabit avec OpenWrt et PoE

Objectives

Transform the ROCK 3B into a router/gateway: two Gigabit ports (gmac0 + gmac1, both rgmii-id in the mainline device tree), a PoE-powered port via the Radxa 25 W HAT (the port near the USB stack), and an official OpenWrt section in the Radxa documentation. Typical case: ISP box → WAN (eth0), LAN (eth1) to a switch, with the board powered by the switch's PoE — zero mains power supply.

Hardware

• Radxa ROCK 3B (2 GB is sufficient for routing), NVMe SSD or eMMC for persistence
• Radxa 25 W PoE HAT + PoE switch (802.3af)
• USB-C serial console at 1,500,000 baud for recovery, Ethernet cable
• >

Complete code

# 1. Prérequis ABSOLU sur toute image non-Radxa : U-Boot récent, sinon eth1 meurt
#    (« rk_gmac-dwmac ... eth1: Failed to reset the dma ») — flasher l'image SPI
#    Radxa actuelle ou un mainline rock-3b-rk3568_defconfig AVANT tout le reste.

# 2. Option A — OpenWrt (section officielle docs.radxa.com other-os/openwrt) :
#    écrire l'image, configurer /etc/config/network (eth0=WAN wan, eth1=LAN lan),
#    firewall zone wan=LAN->WAN ; le boot NVMe OpenWrt est du DIY (forum 225022).

# 3. Option B — Debian + NAT manuel :
sudo apt install isc-dhcp-server nftables
sudo sysctl -w net.ipv4.ip_forward=1
sudo nft add table ip nat ; sudo nft add chain ip nat postrouting '{ type nat hook postrouting priority 100 ; }'
sudo nft add rule ip nat postrouting oifname "eth0" masquerade
sudo ip link set eth1 up ; sudo ip addr add 192.168.10.1/24 dev eth1

# 4. Débit par port (~940 Mbit/s attendus) :
sudo apt install iperf3 ; iperf3 -s -D ; iperf3 -c <ip-de-la-carte>

Expected verification

ip -br addr shows eth0 (WAN) and eth1 (LAN) active; ethtool indicates 1000 Mb/s on both; a client behind eth1 reaches the Internet (NAT) and iperf3 approaches 940 Mbit/s per port. The board runs, powered solely by the Ethernet cable from the PoE switch.

Common errors

• The board's documented trap #1: only one port works because the bootloader is too old — update U-Boot/SPI before blaming the kernel (forum.radxa.com t/25181, resolved).
• Plugging the PoE into the wrong Ethernet port: only the port on the USB side is HAT-compatible.
• 802.3af 15 W PoE chain vs 25 W HAT: verify that the switch provides the budget, especially with SSD + USB peripherals.
• Under OpenWrt, forgetting to update the SPI image for NVMe boot: trial-and-error procedure documented on the OpenWrt forum, keep a backup microSD.
• Exposing the admin interface (LuCI/SSH) on the WAN zone without filtering.