Cutting the cord

[Annoyed]

Last last year, I grew tired of ever-increasing dollar amount on my cable bill.

I was getting data and tv service from the local cable company. Combined billing for TV and 100M/10M data service (reliably speedtests at 115/12 every time, with excellent reliability, no complaints at all about that service.)

TV package was basic cable, no premium channels and a single STB/DVR unit. The TV portion of the combined bill was about $135 / Mo., and with notification of future increase on the mail.

Enough is enough. So I decided to cut the cord.

There are many ways to do this, depending upon your technical skill level, and as far as local channels go, your geographic location will be a key factor.

For many years, I've run a Linux machine that acts as a firewall/file server/DNS/NTP and basically whatever I want it to do box. If I desire, I can run a web server, FTP server or just about anything else. I do this for several reasons; I don't like advertising-corrupted DNS which you get from all ISP's these days, central document storage for all devices in the house, and the obvious security advantages among other things.

For the equivalent of basic cable channels, I subscribed to Sling, which gives me most of what I want.
However, Sling or the other major services don't offer local channels. (Hulu does offer some, but some key channels are on-demand only and it has other limitations as well)
Streaming works very well, as I have Ethernet cabling going to all the TV's, I don't like wireless 'cause it sucks in comparison. So that part of it is solved.

For local channels, I installed a Plex Server into the server machine in the basement. I've had this for a while, 'cause you can also use it to stream music/media from local sources. For OTA reception/DVR, you need a membership, but that was a one time deal, "lifetime membership" promotion they ran last year sometime.

I then installed a HAUPPAUGE WinTV-quadHD PCI Express TV Tuner Card into the Linux box that lives in the basement. I also added two 6TB hard drives in a RAID 1 configuration for redundancy.

I put an amplified antenna into the attic (height is very important for TV reception), and ran a coax cable from the basement to the attic via a cold air return duct. Antenna selection took some experimenting. With the digital broadcasting that is dominant these days, most, but not all channels are on the UHF band, so almost all of the antennas marketed for cord cutting are for the UHF band. But in my situation, several channels that are very important (ABC, NBC & others) broadcast on VHF. I never did find a "modern" antenna that covered both bands well. I ended up (so far, anyway) using a Recoton amplified old-school "rabbit ears" combined with a UHF loop. It took a while to get it oriented perfectly, but I eventually did.

This gets me 28 local "over the air" channels. Yeah, it could be better, but I'm in a poor location for TV reception to begin with. But I can get the important ones, as well as a number of aux. channels (x.1, x.2, and so forth) which carry smaller networks such as MeTV, Comet and a number of others.

I also have 6 TB of storage for DVR use on that box in the basement, and the tuners can watch/record up to 4 channels simultaneously. All of this is controlled using the Plex app on the Roku boxes. It can also be watched and controlled on PC's and Gadgets.

Picture quality on this setup is way better than what I had on cable, no more compression effects visible on the screen, with OTA even better than Sling's service.

There are a couple of downsides. The biggest is that the UI for Plex on Roku boxes is rather primitive and difficult to use. It's far easier on the web browser interface from a computer on the local network (I could do it from outside as well, if I poke a hole in the firewall for it, but I have no need to do that) The UI for Apple's i-gadgets is also quite good. I expect they will eventually get something more usable for the Roku's, and I hope it's soon. The Roku interface is really lacking.

It also requires that you learn some new habits for watching TV & movies. Channel numbers, for example, are a thing of the past on Sling.

But the big plus is that this setup saves me about $90 bucks a month. That ain't chump change. =)

I may edit this with further info, but I wanted to put what I've learned out here so maybe someone else can gain from it.

[SoulReaver]

wait you put firewall & server on the same machine??

[Annoyed]

wait you put firewall & server on the same machine??

Yes, The firewall drops any unsolicited packets immediately, and the file and other servers only listen for connections on the inside interface NIC.

You can't get to them from the outside interface.

[SoulReaver]

Yes, The firewall drops any unsolicited packets immediately, and the file and other servers only listen for connections on the inside interface NIC.

You can't get to them from the outside interface.

but it's on the same machine
a security system should have the smallest attack surface possible

[Annoyed]

but it's on the same machine
a security system should have the smallest attack surface possible

It does. In addition to the various services not even listening for connections from the network card leading to the "outside", the firewall software doesn't even acknowledge any traffic that is not either in response to traffic initiated from the inside or has a deliberate opening for it for traffic from a specific IP address.

As far as anyone on the outside looking fora hole, this thing is one.. A black hole.

It's not a windows computer. =)

[SoulReaver]

It does. In addition to the various services not even listening for connections from the network card leading to the "outside", the firewall software doesn't even acknowledge any traffic that is not either in response to traffic initiated from the inside or has a deliberate opening for it for traffic from a specific IP address.

As far as anyone on the outside looking fora hole, this thing is one.. A black hole.

It's not a windows computer. =)

problem is if your front facing system (firewall) also has several non-essential services (eg. file or web server) this increases the attack surface thus the likelihood of security exploits on that system
even a simple memory leak can be a problem
dont need to breach the firewall if you can go around it

[Annoyed]

problem is if your front facing system (firewall) also has several non-essential services (eg. file or web server) this increases the attack surface thus the likelihood of security exploits on that system
even a simple memory leak can be a problem
dont need to breach the firewall if you can go around it

Not if those services are not accessible via the outside interface.

For example. suppose eth0 is the outside interface network card, aka uplink, the connection to the outside, then eth1 is the network card that is connected to the inside network.

Samba, NTP, ISC-DHCP, BIND and all the rest can be configured to listen for connections on a specific interface. In my case, they only listen for connections and respond on the inside network card, eth1. Even if something does come through the firewall, the services will ignore the connection anyway.

And the firewall itself is iptables, which has been around a very long time and is well tested, and is kept up to date automatically. Open source OS's such as Linux aren't like windows, which often takes week to patch a new vulnerability. Very often, any new flaws are patched within a day or less.

Granted, this setup might not be adequate for a high value or high visibility target, but it is a hell of a lot more secure than the average home router that most folks are behind.

[SoulReaver]

Not if those services are not accessible via the outside interface.

For example. suppose eth0 is the outside interface network card, aka uplink, the connection to the outside, then eth1 is the network card that is connected to the inside network.

Samba, NTP, ISC-DHCP, BIND and all the rest can be configured to listen for connections on a specific interface. In my case, they only listen for connections and respond on the inside network card, eth1. Even if something does come through the firewall, the services will ignore the connection anyway.

And the firewall itself is iptables, which has been around a very long time and is well tested, and is kept up to date automatically. Open source OS's such as Linux aren't like windows, which often takes week to patch a new vulnerability. Very often, any new flaws are patched within a day or less.

Granted, this setup might not be adequate for a high value or high visibility target, but it is a hell of a lot more secure than the average home router that most folks are behind.

not what I meant

you're right in theory it's the same security

but in practice there's increased risk if several services are on same rig : one can interfere with & compromise the other

your firewall or packet filter wont be of much use if it crashes due to a ram leak caused by your file server for instance
cause all that software's on 1 rig so it is possible (and not unheard of)

so ideally the firewall should be on a dedicated machine

[SoulReaver]

basically dont put all your eggs in same basket (in this case dont put any egg in this basket)

[jelgate]

Put your eggs next to the bacon and eat your breakfast

[SoulReaver]

but only if it's true organic grassfed bacon

[Chaka-Z0]

but only if it's true organic grassfed bacon

I will never accept false gods.

[jelgate]

Bacon is the only true god

[Womble]

I'm living my eighth year without TV.

The key to cord-cutting is changing your TV habits. Once you realize that you don't NEED broadcast TV, it all gets simple. My needs boil down to a Netflix membership for occasional time-burning... and that's it, since I prefer my news in text articles and I have no interest in sports etc.

[Annoyed]

I'm living my eighth year without TV.

The key to cord-cutting is changing your TV habits. Once you realize that you don't NEED broadcast TV, it all gets simple. My needs boil down to a Netflix membership for occasional time-burning... and that's it, since I prefer my news in text articles and I have no interest in sports etc.

There are a number of alphabet network shows and OTA networks that I like, so I need to get the locals.