4 ms·

I recently switched my personal box to FreeBSD. I honestly find it significantly easier to manage than Linux, and have greater trust in its reliability merely f

I recently switched my personal box to FreeBSD. I honestly find it significantly easier to manage than Linux, and have greater trust in its reliability merely from its simplicity. The single biggest thing which stood out for me was PF (from OpenBSD). Anybody who has ever had the grace of managing IPTables on Linux, give PF a go with /etc/pf.conf (docs: https://www.freebsd.org/doc/handbook/firewalls-pf.html https://www.freebsd.org/doc/handbook/firewalls-pf.html, my config: https://github.com/jamescun/infrastructure/blob/master/roles/common/files/pf.conf https://github.com/jamescun/infrastructure/blob/master/roles...).

liotier 11y ago
> Anybody who has ever had the grace of managing IPTables on Linux Nowadays few people manage IPTables directly. Long ago I used to maintain my own convoluted scripts (ipfwadm, ipchains, iptables...) but once I discovered Shorewall I never looked back - multi-interface multi-VLAN rounting setups can now be sanely managed from the comfort of very readable configuration files.
aktau 11y ago
On that note, I'm currently on Debian Stretch which has a Linux 4.2 kernel and consequently great support for nftables (iptables replacement). I never truly grokked iptables but configuring nftables reminded me of putting up a pf firewall on OSX. In fact, I'd say it was even easier. The docs could be a tad bit better, but the actual format itself is intuitive and easy to understand. I'd highly recommend it over iptables if one has the chance.
atmosx 11y ago
Here's PF from a VPS running FreeBSD (slightly changed): https://gist.github.com/atmosx/1d4bf8ad42d0447cb415 https://gist.github.com/atmosx/1d4bf8ad42d0447cb415
jms703 11y ago
That PF code is from OpenBSD 4.5, released in May 2009. I wonder what fixes and improvements are missing.
- bbatha 11y ago
  Its a fork that has a different development focus. The biggest difference is that the OpenBSD version has an improved config file format, and the the FreeBSD one supports SMP.
- feld 11y ago
  Internally it has changed so much you can't consider it to be the same as the OpenBSD pf. It's a permanent fork.
Thaxll 11y ago
afaik Iptables is more complex but also has more features than PF.

liotier 11y ago

> Anybody who has ever had the grace of managing IPTables on Linux Nowadays few people manage IPTables directly. Long ago I used to maintain my own convoluted scripts (ipfwadm, ipchains, iptables...) but once I discovered Shorewall I never looked back - multi-interface multi-VLAN rounting setups can now be sanely managed from the comfort of very readable configuration files.

aktau 11y ago

On that note, I'm currently on Debian Stretch which has a Linux 4.2 kernel and consequently great support for nftables (iptables replacement). I never truly grokked iptables but configuring nftables reminded me of putting up a pf firewall on OSX. In fact, I'd say it was even easier. The docs could be a tad bit better, but the actual format itself is intuitive and easy to understand. I'd highly recommend it over iptables if one has the chance.

atmosx 11y ago

Here's PF from a VPS running FreeBSD (slightly changed): https://gist.github.com/atmosx/1d4bf8ad42d0447cb415 https://gist.github.com/atmosx/1d4bf8ad42d0447cb415

jms703 11y ago

That PF code is from OpenBSD 4.5, released in May 2009. I wonder what fixes and improvements are missing.

bbatha 11y ago
Its a fork that has a different development focus. The biggest difference is that the OpenBSD version has an improved config file format, and the the FreeBSD one supports SMP.
feld 11y ago
Internally it has changed so much you can't consider it to be the same as the OpenBSD pf. It's a permanent fork.

Thaxll 11y ago

afaik Iptables is more complex but also has more features than PF.