4 ms·

Here's a tutorial for doing the same thing with OpenBSD from a few years ago: http://www.bsdnow.tv/tutorials/openbsd-router http://www.bsdnow.tv/tutorials/open

Here's a tutorial for doing the same thing with OpenBSD from a few years ago: http://www.bsdnow.tv/tutorials/openbsd-router http://www.bsdnow.tv/tutorials/openbsd-router

zdw 11y ago
The OpenBSD site has an example as well. http://www.openbsd.org/faq/pf/example1.html http://www.openbsd.org/faq/pf/example1.html As a point of comparison, the iptables syntax as shown in the Ars article is far harder to grok at first glance than either of the pf examples. For example: pass in on egress inet proto tcp from any to (egress) port { 80 443 } rdr-to <ipaddr> vs: -A PREROUTING -p tcp -m tcp -i p4p1 --dport 80 -j DNAT --to-destination <ipaddr>:80 -A FORWARD -p tcp -d <ipaddr> --dport 80 -j ACCEPT
- Mister_Snuggles 11y ago
  Yeah, I've always found iptables to be a little hard to understand. It also sounds like it's getting replaced[0]. My guess is that we will see iptables around for a long time after it's been deprecated. ifconfig, for example, is deprecated[1] yet it's still around and being used. [0] https://lwn.net/Articles/564095/ https://lwn.net/Articles/564095/ [1] https://lists.debian.org/debian-devel/2009/03/msg00780.html https://lists.debian.org/debian-devel/2009/03/msg00780.html
  - zdw 11y ago
    ifconfig is BSD derived and standard across more Unix variants, whereas ip and friends are Linux only. See also dladm in illumos as another variation on a theme.
  - Decade 11y ago
    ifconfig is still used on BSD and, most importantly, MacOS X. Also, the Linux replacement for ifconfig is ip from iproute2, and that was made by the guy who did Linux QoS. He sort of sucks at usability. For example, `ifconfig eth0 down` becomes `ip link set dev eth0 down` and `ifconfig eth0 192.168.1.2` becomes `ip add add 192.168.1.2/24 brd + dev eth0`; I had to look these up to make sure I had the correct syntax. Okay, the actual command is `ip address add` and not `ip add add`, but it allows extreme abbreviation at the expense of discoverability.
kebolio 11y ago
i would say that openbsd is the better tool for the job in my opinion. pf is just much nicer and simpler to set up and configure than linux iptables, and openbsd is hardened which is important for a machine that is always facing the internet.
- Mister_Snuggles 11y ago
  Another thing that's nice about the BSDs is that they are whole systems, not different sets of kernel+utilities packed up by third parties. Generally speaking, that means that there's one canonical way to do something instead of a bunch of different ways like in Linux (think 'ifconfig' vs 'ip'). Of course, FreeBSD ships with three different firewalls[0], so that's not always true. There are downsides, of course. A freshly-installed BSD has a lot less stuff than a freshly-installed OpenSUSE/Ubuntu/Fedora/etc. [0] https://www.freebsd.org/doc/handbook/firewalls.html https://www.freebsd.org/doc/handbook/firewalls.html
  - kebolio 11y ago
    i don't think that the minimalism of the default install (i am talking about openbsd mainly, since i have little experience with the other three) is too much of a problem. in the default install is practically all the tools and components one needs to set up and configure a router. any extra components can be grabbed from ports and packages as shown in the aforementioned tutorial, where the dnscrypt client is installed for encrypted dns queries.

Here's a tutorial for doing the same thing with OpenBSD from a few years ago: http://www.bsdnow.tv/tutorials/openbsd-router http://www.bsdnow.tv/tutorials/openbsd-router

zdw 11y ago

The OpenBSD site has an example as well. http://www.openbsd.org/faq/pf/example1.html http://www.openbsd.org/faq/pf/example1.html As a point of comparison, the iptables syntax as shown in the Ars article is far harder to grok at first glance than either of the pf examples. For example: pass in on egress inet proto tcp from any to (egress) port { 80 443 } rdr-to <ipaddr> vs: -A PREROUTING -p tcp -m tcp -i p4p1 --dport 80 -j DNAT --to-destination <ipaddr>:80 -A FORWARD -p tcp -d <ipaddr> --dport 80 -j ACCEPT

Mister_Snuggles 11y ago
Yeah, I've always found iptables to be a little hard to understand. It also sounds like it's getting replaced[0]. My guess is that we will see iptables around for a long time after it's been deprecated. ifconfig, for example, is deprecated[1] yet it's still around and being used. [0] https://lwn.net/Articles/564095/ https://lwn.net/Articles/564095/ [1] https://lists.debian.org/debian-devel/2009/03/msg00780.html https://lists.debian.org/debian-devel/2009/03/msg00780.html
- zdw 11y ago
  ifconfig is BSD derived and standard across more Unix variants, whereas ip and friends are Linux only. See also dladm in illumos as another variation on a theme.
- Decade 11y ago
  ifconfig is still used on BSD and, most importantly, MacOS X. Also, the Linux replacement for ifconfig is ip from iproute2, and that was made by the guy who did Linux QoS. He sort of sucks at usability. For example, `ifconfig eth0 down` becomes `ip link set dev eth0 down` and `ifconfig eth0 192.168.1.2` becomes `ip add add 192.168.1.2/24 brd + dev eth0`; I had to look these up to make sure I had the correct syntax. Okay, the actual command is `ip address add` and not `ip add add`, but it allows extreme abbreviation at the expense of discoverability.

kebolio 11y ago

i would say that openbsd is the better tool for the job in my opinion. pf is just much nicer and simpler to set up and configure than linux iptables, and openbsd is hardened which is important for a machine that is always facing the internet.

Mister_Snuggles 11y ago
Another thing that's nice about the BSDs is that they are whole systems, not different sets of kernel+utilities packed up by third parties. Generally speaking, that means that there's one canonical way to do something instead of a bunch of different ways like in Linux (think 'ifconfig' vs 'ip'). Of course, FreeBSD ships with three different firewalls[0], so that's not always true. There are downsides, of course. A freshly-installed BSD has a lot less stuff than a freshly-installed OpenSUSE/Ubuntu/Fedora/etc. [0] https://www.freebsd.org/doc/handbook/firewalls.html https://www.freebsd.org/doc/handbook/firewalls.html
- kebolio 11y ago
  i don't think that the minimalism of the default install (i am talking about openbsd mainly, since i have little experience with the other three) is too much of a problem. in the default install is practically all the tools and components one needs to set up and configure a router. any extra components can be grabbed from ports and packages as shown in the aforementioned tutorial, where the dnscrypt client is installed for encrypted dns queries.