13 ms·
What every IT person needs to know about OpenBSD Part 3: That packet filter
- knorker 5y agoBut it doesn't have QoS, right? Sure, shaping is all well and good, but this really all there is to it in OpenBSD. I was shocked that a server OS this old could be this immature on something this basic. It pretty much excludes it from being a serious router/firewall.
- ratorx 5y agoNot sure what exactly you mean by QoS, but there is the `prio` keyword, which lets you put packets into priority queues. However, I tried it a while back and couldn’t actually make it do anything useful, but that might have been me misconfiguring it.
- upofadown 5y agoI am not sure what is meant by this. It certainly seems to have QoS in the form of the queue directive. It works for me for limiting buffer bloat on my VDSL model upstream. The defaults work well for my VOIP stuff so that all I have is this in my pf.conf: queue outq on re1 flows 1024 bandwidth 3000K max 3000K qlimit 1024 default I think the magic is in the "flows" part. Added: Relevant articles: * https://dataswamp.org/~solene/2021-08-30-openbsd-qos-lan.html https://dataswamp.org/~solene/2021-08-30-openbsd-qos-lan.htm... * https://www.pauladamsmith.com/blog/2018/07/fixing-bufferbloat-on-your-home-network-with-openbsd-6.2-or-newer.html https://www.pauladamsmith.com/blog/2018/07/fixing-bufferbloa...
- knorker 5y agoLike I said, this is a very superficial view of QoS. And I'm surprised OpenBSD only did the bare minimum.
- hansel_der 5y agoas said, the "flows" keyword actually summons fq_codel to the task which represents the state of the art in sane-by-default QoS implementations.
- chayleaf 5y agoyou can filter packets by TOS bits and queue them the way you want
- hansel_der 5y agostate of the art is to put packets into separate queues based on the 4-tuple (src,dst,port) then dequeue them fairly based on packet- and queuesize
- upofadown 5y agoOpenBSD is pretty good by default. Traffic with different TOS is separately queued with reasonable priority defaults. So you normally don't have to do anything. I was a bit surprised that my VOIP stuff was just working when I moved my router from Linux to OpenBSD and had to go looking to figure out why.
- john37386 5y agoI used pf + carp on OpenBSD in 2004. It was really awesome to failover from 1 firewall to the other without losing tcp + udp states for all the servers and clients behind the cluster. pf is really powerful. pf on OpenBSD even more! Another nice features is to tweak some tcp options per rules. Let's say you want to fast expires tcp port 443 connections to your cdn servers but, still keep normal tcp timeouts for the rest. Nice article
- deleted 5y ago[deleted]
- user3939382 5y agoBe aware that OpenBSD can, will, and often has, made breaking changes to their packet filter/firewall rule syntax. Keep that in mind if you decide to rely on this for a firewall that's remote and not practical to access but requires patch maintenance without OOB access.
- ratorx 5y agoIt’s unlikely patches will cause syntax changes. Upgrading between versions might, but that requires you to manually run sysupgrade anyway, at which point you probably should be reading the release notes, which should mention it. Do you have any examples where it happened without being mentioned in release notes, or without a version bump?
- tedunangst 5y agoThe most recent change, which user likes to complain about every chance they get, is that some invalid port ranges are now rejected instead of being incorrectly accepted. https://www.openbsd.org/faq/upgrade69.html https://www.openbsd.org/faq/upgrade69.html
- versteegen 5y agoGP didn't say that they make breaking changes without documenting them, that would be horrific. The point is that they apparently make breaking changes, which is quite a nuisance. I'd rather avoid software that doesn't attempt backwards-compatibility between major releases. It can be done.
- protomyth 5y agoThey do not break it every release. The last one I had to be concerned about was 6.8->6.9 and I remember one breaker before that (the queue thing?). You have six months to make mostly minor changes to pf.conf before you are out of support. They release every six months and patch the last release. The changes aren't made for the heck of it, they make a more consistent system overall with new knowledge.
- traceroute66 5y agoNice article and all that. Except for one bit. The lengthly part that talks about defeating SSH dictionary attacks through some fancy PF rules. Why, in 2021, is anybody still writing articles talking about using passwords with SSH and saying the way to counter password attacks on SSH is to write firewall rules ? SSH Certificates are the only method anybody should be implementing these days. Its not difficult to setup or maintain, its nothing put pure laziness that people don't do it. I would have thought someone writing on an APNIC blog would know better.
- gitfan86 5y agoSSH keys are just long passwords.
- andrewchambers 5y agoSSH certificates can sign a key with an expiration, thats a bit different to a password.
- matja 5y agoAn SSH password is sent to the server, the server will get the exact password. An SSH private key is not sent to the server.
- GekkePrutser 5y agoExactly, so even if the server is compromised you're not giving it the means to authenticate as you. I think this is a huge plus.
- valenterry 5y agoMaybe, but it conceptually it doesn't have to be like that. Often, the password is not sent directly, but its hash is sent (sometimes hashed multiple times), so that the same property is true.
- hnaccount141 5y ago
- kristopolous 5y agoYou can drag that annoying colorful star off screen on mobile btw.
- hypertele-Xii 5y agoEvery IT person doesn't need to know about OpenBSD at all. Clickbait title. I'm an IT person, know nothing about OpenBSD (except that it's an OS), and am doing just fine.
- nix23 5y agoI'm sorry for you, sometimes being interested in more then you use for daily work can greatly improve you work.
- Anthony-G 5y agohypertele-Xii didn’t say anything about whether or not they were personally interested in the subject matter. He/she was complaining about the click-bait title that would be more likely to discourage them from reading the article. The vast majority of web articles titled “… you need to know” are junk. I wouldn’t have read the article only I saw it was from APNIC.
- almeria 5y agoAgreed, and you made an excellent call there. If network ops is your bag, then yeah, maybe you "ought to" know about what's in the article. Otherwise -- it's just pure FOMO-based clickbait.
- DeathArrow 5y agoUnfortunately since BSDs don't support the most popular way to build apps these days, a microservice architecture backed by Docker and Kubernetes, I don't think they will get much traction. Does anyone know of some large /complex architectures using BSDs?
- jjav 5y agoBSD has jails which is a superior solution. Not as hyped, sadly.
- nix23 5y agoAnd let's not forget: https://bastillebsd.org/ https://bastillebsd.org/ and https://pot.pizzamig.dev/ https://pot.pizzamig.dev/
- hansel_der 5y agosuperiority and hype aside, jails is not compatible with docker and thus no answer to the demands of the industy or OP
- hansel_der 5y agoMacOS is partly a freebsd derivate, Netflix-cdn runs on freebsd, bigiron controlplane (junos,ios) is often netbsd based, enterprise storage (netapp) also ... there was a list on wikipedia iirc (canot find atm)
- nix23 5y agohttps://en.wikipedia.org/wiki/List_of_products_based_on_FreeBSD https://en.wikipedia.org/wiki/List_of_products_based_on_Free...
- littlestymaar 5y agoYou know what's funny? Your comment exactly highlight why the BSD family has completely lost the OS war: this thread is about OpenBSD, and now you're commenting with Mac OS, FreeBSD and NetBSD, which have diverged from one another almost 30 years ago (just 20 years ago for MacOS X)!