6 ms·

I liked pfSense until it got too beefy for my ALIX board. That forced me to move to OpenBSD, and boy am I glad I did. Once you grok the syntax, it is so much

I liked pfSense until it got too beefy for my ALIX board. That forced me to move to OpenBSD, and boy am I glad I did. Once you grok the syntax, it is so much easier to directly update settings in pf.conf than the pfSense web GUI--especially traffic shaping rules. That, and OpenBSD has great documentation, decent IPv6 support, and almost everything you need already baked-in. Here's a basic set of config files for a home setup: https://github.com/BourgeoisBear/OpenBSDFirewall https://github.com/BourgeoisBear/OpenBSDFirewall If you need IPv6 or anything fancy, PM me.

SSLy 10y ago
ugh, i wish we could use that syntax on the linux side of the computing world
- jstewartmobile 10y ago
  Ha! I wish I could find the jwz article where he shared his tale of woe with iptables before jumping to pf.
- mhurron 10y ago
  Syntax differences between pf and ipchains/iptables are why I chose OpenBSD on my firewall so many years ago.
- lima 10y ago
  nftables (the iptables successor) is really close to the pf syntax. It's awesome.
- tasn 10y ago
  I recently switched to nftables on Linux and the syntax is great, you should give it a go. I wrote a blog post demonstrating my server configuration. Shameless plug: https://stosb.com/blog/explaining-my-configs-nftables/ https://stosb.com/blog/explaining-my-configs-nftables/
  - dhess 10y ago
    Does nftables support packet tagging/policy filtering ala pf's "tag" keyword [1]? It's so nice to tag a packet as "trusted" once it has passed an input filter, and then just pass trusted packets on outbound interfaces based solely on the tag. For example, on my OpenBSD firewall I can write the following simple rules to restrict outbound Internet access to a specific set of IP addresses or networks: # internal_if is the LAN-facing interface; isp_if is the ISP-facing interface, i.e., the Internet. match in log on internal_if from <internet_allowed_networks> tag OUTBOUND pass in log quick on internal_if tagged OUTBOUND ... pass out log on isp_if inet tagged OUTBOUND nat-to (isp_if) static-port The tags are sticky, so that you can apply multiple tags to packets and sort through the tags later in the pipeline. If nftables supports something like this, I'll probably make the switch, as I prefer Linux in every other way to OpenBSD. [1] https://www.openbsd.org/faq/pf/tagging.html https://www.openbsd.org/faq/pf/tagging.html
    - tasn 10y ago
      I'm not familiar with the pf "tag", and I gtg so I don't have time to read more, but it seems very similar to "mark"[1]. It essentially lets you mark a packet with a tag (if memory serves it's a 32 bitmap you can do whatever bitwise/assignment operations to). I used it in the beginning, but then I managed to find cleaner ways to do what I was doing. For me nftables changed the game for linux firewalls. From the almost incomprehensible mess that was iptables we now have a clean language that lets me be quite DRY, and is easy to work with. 1: https://wiki.nftables.org/wiki-nftables/index.php/Setting_packet_metainformation#mark_and_conntrack_mark https://wiki.nftables.org/wiki-nftables/index.php/Setting_pa...
      - jlgaddis 10y ago
        > ... the almost incomprehensible mess that was iptables ... You apparently never had to deal with ipchains or ipfwadm. iptables was a huge upgrade!
        tasn 10y ago
ianai 10y ago
Thank you so much for that link! I just set up my first OpenBSD firewall so this will help.
dhess 10y ago
I also happily use OpenBSD on my firewall. Every year or two I'm tempted by pfSense, and each time I'm scared away by the thought of running PHP on my firewall, and other security issues as outlined so well in this thread by lima [1]. The one thing I most envy is pfSense's multi-WAN failover support. I have a USB LTE modem plugged into my firewall. OpenBSD can see the device, I can use it as my default gateway for Internet access, etc. However, I only want to use it when my primary ISP is down, for some definition of "down" (e.g., major packet loss). I want the firewall to detect this condition; switch to the LTE modem as the egress interface/default route; reload a different pf.conf, tuned for the LTE modem; restart ospfd, ospf6d, and rtadvd; and then watch the primary interface until it recovers, at which point the firewall reverts to its primary config and restarts the routing daemons again. It appears that pfSense supports this scenario out-of-the-box, via "gateway groups" and multi-level tiers [2]. OpenBSD does not -- its multi-WAN support is intended for load-balancing, and/or assumes a carrier-grade routing environment using BGP or equivalent. People have asked for help with this scenario on the OpenBSD mailing lists, and the answer is usually, "this is what ifstated is for, write a script"; which is fine, I guess, but it would be nice if everyone who wanted to do this didn't have to write their own bespoke solution. Speaking of which, does anybody here do this with their OpenBSD firewall and has a nice, clean, well-documented example of how it works? I once trawled through the pfSense source code to see how they do it, and their implementation was all wrapped up in a bunch of PHP. Yuck! [1] https://news.ycombinator.com/item?id=13615724 https://news.ycombinator.com/item?id=13615724 [2] https://doc.pfsense.org/index.php/Multi-WAN#Failover https://doc.pfsense.org/index.php/Multi-WAN#Failover
- jrcii 10y ago
  My solution to this is to have my servers' console plugged into a separate switch and LTE router than their ethernet cards so not only do I have a redundant WAN, but a redundant router and switch as well.
- pyvpx 10y ago
  the bespoke part is "what is your definition of down?". is it 10% packet loss? is it physical loss of link? is it something else? is it a combination? is it 15 seconds of $X or a full minute?
__jal 10y ago
pf's syntax is much easier to reason about than, for instance, iptables. I find myself writing tiny little scripts to emit iptables syntax from something resembling a pythonic-pf, just because I make fewer mistakes when dealing with it.

SSLy 10y ago

ugh, i wish we could use that syntax on the linux side of the computing world

jstewartmobile 10y ago
Ha! I wish I could find the jwz article where he shared his tale of woe with iptables before jumping to pf.
mhurron 10y ago
Syntax differences between pf and ipchains/iptables are why I chose OpenBSD on my firewall so many years ago.
lima 10y ago
nftables (the iptables successor) is really close to the pf syntax. It's awesome.
tasn 10y ago
I recently switched to nftables on Linux and the syntax is great, you should give it a go. I wrote a blog post demonstrating my server configuration. Shameless plug: https://stosb.com/blog/explaining-my-configs-nftables/ https://stosb.com/blog/explaining-my-configs-nftables/
- dhess 10y ago
  Does nftables support packet tagging/policy filtering ala pf's "tag" keyword [1]? It's so nice to tag a packet as "trusted" once it has passed an input filter, and then just pass trusted packets on outbound interfaces based solely on the tag. For example, on my OpenBSD firewall I can write the following simple rules to restrict outbound Internet access to a specific set of IP addresses or networks: # internal_if is the LAN-facing interface; isp_if is the ISP-facing interface, i.e., the Internet. match in log on internal_if from <internet_allowed_networks> tag OUTBOUND pass in log quick on internal_if tagged OUTBOUND ... pass out log on isp_if inet tagged OUTBOUND nat-to (isp_if) static-port The tags are sticky, so that you can apply multiple tags to packets and sort through the tags later in the pipeline. If nftables supports something like this, I'll probably make the switch, as I prefer Linux in every other way to OpenBSD. [1] https://www.openbsd.org/faq/pf/tagging.html https://www.openbsd.org/faq/pf/tagging.html
  - tasn 10y ago
    I'm not familiar with the pf "tag", and I gtg so I don't have time to read more, but it seems very similar to "mark"[1]. It essentially lets you mark a packet with a tag (if memory serves it's a 32 bitmap you can do whatever bitwise/assignment operations to). I used it in the beginning, but then I managed to find cleaner ways to do what I was doing. For me nftables changed the game for linux firewalls. From the almost incomprehensible mess that was iptables we now have a clean language that lets me be quite DRY, and is easy to work with. 1: https://wiki.nftables.org/wiki-nftables/index.php/Setting_packet_metainformation#mark_and_conntrack_mark https://wiki.nftables.org/wiki-nftables/index.php/Setting_pa...
    - jlgaddis 10y ago
      > ... the almost incomprehensible mess that was iptables ... You apparently never had to deal with ipchains or ipfwadm. iptables was a huge upgrade!
      - tasn 10y ago

ianai 10y ago

Thank you so much for that link! I just set up my first OpenBSD firewall so this will help.

dhess 10y ago

I also happily use OpenBSD on my firewall. Every year or two I'm tempted by pfSense, and each time I'm scared away by the thought of running PHP on my firewall, and other security issues as outlined so well in this thread by lima [1]. The one thing I most envy is pfSense's multi-WAN failover support. I have a USB LTE modem plugged into my firewall. OpenBSD can see the device, I can use it as my default gateway for Internet access, etc. However, I only want to use it when my primary ISP is down, for some definition of "down" (e.g., major packet loss). I want the firewall to detect this condition; switch to the LTE modem as the egress interface/default route; reload a different pf.conf, tuned for the LTE modem; restart ospfd, ospf6d, and rtadvd; and then watch the primary interface until it recovers, at which point the firewall reverts to its primary config and restarts the routing daemons again. It appears that pfSense supports this scenario out-of-the-box, via "gateway groups" and multi-level tiers [2]. OpenBSD does not -- its multi-WAN support is intended for load-balancing, and/or assumes a carrier-grade routing environment using BGP or equivalent. People have asked for help with this scenario on the OpenBSD mailing lists, and the answer is usually, "this is what ifstated is for, write a script"; which is fine, I guess, but it would be nice if everyone who wanted to do this didn't have to write their own bespoke solution. Speaking of which, does anybody here do this with their OpenBSD firewall and has a nice, clean, well-documented example of how it works? I once trawled through the pfSense source code to see how they do it, and their implementation was all wrapped up in a bunch of PHP. Yuck! [1] https://news.ycombinator.com/item?id=13615724 https://news.ycombinator.com/item?id=13615724 [2] https://doc.pfsense.org/index.php/Multi-WAN#Failover https://doc.pfsense.org/index.php/Multi-WAN#Failover

jrcii 10y ago
My solution to this is to have my servers' console plugged into a separate switch and LTE router than their ethernet cards so not only do I have a redundant WAN, but a redundant router and switch as well.
pyvpx 10y ago
the bespoke part is "what is your definition of down?". is it 10% packet loss? is it physical loss of link? is it something else? is it a combination? is it 15 seconds of $X or a full minute?

__jal 10y ago

pf's syntax is much easier to reason about than, for instance, iptables. I find myself writing tiny little scripts to emit iptables syntax from something resembling a pythonic-pf, just because I make fewer mistakes when dealing with it.