Is it possible to run an IDS with a mirrored port using only a Archer C7 router running OpenWrt and a RPi?

Hardware Questions and Recommendations
1

See title...

I would also like to keep using the same RPi as my DNS sinkhole IF that's possible.

2

You can set your DHCP server on Archer C7 to set gateway as RPi IP address. This way, everyone sends WAN packets to RPi. RPi will have to do NAT and send to Archer C7 which forwards over WAN. If you don't do NAT on RPi, packets from LAN to WAN go via RPi but packets from WAN to LAN directly go to the devices.

If you think some devices may bypass DHCP advertised gateway, you can enforce this on your Archer C7 firewall. I used this method to run ntopng on my RPi.

3

Won't that increase latency?

Or is that inavoidable in case of IDS/port mirroring?

4

In my case, I recall it increased latency by 0.5ms (that is fine with me, usually latency to sites I care about is around 15ms minimum, so it didn't matter for me). Technically, one could mirror the port and then asynchronously do IDS/IPS analysis on a separate system that doesn't forward any packets. Moreover, I didn't know how to do port mirroring (using openwrt).