3 ms·

Same here. I'm looking at eventually replacing my router with an OpenBSD box and having it handle the VPN stuff. My servers are primarily FreeBSD, but I would

Same here. I'm looking at eventually replacing my router with an OpenBSD box and having it handle the VPN stuff. My servers are primarily FreeBSD, but I wouldn't recommend doing IPSec on it. FreeBSD 10 doesn't enable IPSEC by default, so you have to recompile the kernel to use it. FreeBSD 11 enables IPSEC but does not enable IPSEC_NAT_T (NAT Traversal, basically IPSec encapsulated in UDP), so you need to recompile to use it since many clients end up being behind NAT at some point. My ideal setup would see OpenBSD gateways in front of my FreeBSD servers, but in some cases that isn't possible. I'll probably end up creating small OpenBSD VMs on the FreeBSD hosts to do the VPN work.

stock_toaster 9y ago
> FreeBSD 11 enables IPSEC but does not enable IPSEC_NAT_T FWIW I heard that FreeBSD 11.1 (already in 11-Stable) is going to removed IPSEC_NAT_T as a tunable, and it will be effectively enabled by default. I wanted to create an openbsd vm (on bhyve) too, but there is some weird issue with openbsd 6.1 and bhyve passing through some funky cpu flags it shouldn't be that causes openbsd to panic. Apparently passing -w to bhyve works, but I haven't tried it yet.
- Mister_Snuggles 9y ago
  > FWIW I heard that FreeBSD 11.1 (already in 11-Stable) is going to removed IPSEC_NAT_T as a tunable, and it will be effectively enabled by default. Sweet!! I guess I'll hold off on upgrading my boxes until 11.1 lands. > I wanted to create an openbsd vm (on bhyve) too, but there is some weird issue with openbsd 6.1 and bhyve passing through some funky cpu flags it shouldn't be that causes openbsd to panic. Apparently passing -w to bhyve works, but I haven't tried it yet. Good to know - thanks!