After being subjected to numerous mean glares from the wife and accusations of "breaking the internet", I think I've got it all configured now...
Ironically, the more "exotic" configuration, like the multiple VPN and VLAN interfaces were pretty simple to set up and worked without much fuss. The part that had me pulling my hair and banging my head against the desk was just trying to get the wifi working on 2.4GHz and 5GHz at the same time... Something wireless routers have been doing flawlessly for over a decade. After enough troubleshooting, googling, and experimenting, though, I had a working router.
I installed AdGuardHome for dns and ad blocking, but kept dnsmasq for DHCP and local rDNS/PRT requests. dsnmasq's DHCP options directs all clients to AGH, and AGH fowards any PTR requests it recessives to dsnmasq.
Next, I installed a Crowdsec bouncer and linked it to my Local Crowdsec Engine. Now, when a scenario is triggered, instead of banning the offending address at the server, it will be blocked at the edge router level instead.
Lastly I installed and configured SQM (Smart Queue Management), which controls the flow of traffic through the router to the WAN interface. Without this management, the WAN interface buffer can get "bogged down" with heavy traffic loads and cause other devices to experience high latency or even lose their connection entirely. SQM performs automatic network scheduling, active queue management, traffic shaping, rate limiting, and QoS prioritization.
For a comparison, I used waveform to test latency under load.
Before SQM:
====== RESULTS SUMMARY ====== Bufferbloat Grade C ====== RESULTS SUMMARY ====== Mean Unloaded Latency (ms) 51.34 Increase In Mean Latency During Download Test (ms) 76.01 Increase In Mean During Upload Test (ms) 8.69
After SQM:
====== RESULTS SUMMARY ====== Bufferbloat Grade A ====== RESULTS SUMMARY ====== Mean Unloaded Latency (ms) 38.92 Increase In Mean Latency During Download Test (ms) 12.75 Increase In Mean During Upload Test (ms) 1.5
I have to say, I'm pretty happy with the results!
Going from a grade C with a 76 ms increase to a grade A with only a 12.75ms is a pretty substantial difference. This does increase the load on the CPU, but with the BPI R3s quad core processor, I expect that I'll still have plenty of overhead.
Overall, I think I'm happy with the configuration and the BPI R3 itself.