4 ms·

firewalls. is it iptables, nftables? what is iptables-nft and iptables-legacy doing in this mix? or was I supposed to manage them with firewallctl or ufw? netw

firewalls. is it iptables, nftables? what is iptables-nft and iptables-legacy doing in this mix? or was I supposed to manage them with firewallctl or ufw? network settings. if-up scripts? NetworkManager? Are we already supposed to use that systemd-network thingy or is it still not ready ? I just need to add an IP address in addition to the one given by DHCP... who is managing /etc/resolv.conf today? (my regular frustrations when dealing with both Ubuntu and Rocky Linux hosts..)

epcoa 2y ago
> firewalls This seems like not the best example since FreeBSD has 3 implementations that may be in use depending on the whims of the sysadmin.
- antranigv 2y ago
  FreeBSD has 3 different firewalls, not 3 different interfaces to the same firewall. Each firewall has its own purpose. IPF is lightweight, pf has a nice UI/UX, ipfw is very integrated into the system. More importantly, doing a simple kldstat would tell you which firewall is running. On Ubuntu (as an example) I have no idea if I should be using nftables, iptables or if ufw is working or not.
nequo 2y ago
> both Ubuntu and Rocky Linux hosts This is a little like comparing FreeBSD with macOS. Their userlands share similarities but they are different operating systems.
- hedora 2y ago
  That's the main problem with Linux these days: Experience with distro A rarely transfers to distro B. Also, at least with Ubuntu, switching to a new LTS means that most administration tools have been replaced with different (usually buggier) ones, so knowledge of the old release doesn't necessarily transfer either. It wasn't this way in the early days, but the community focus stopped aligning with end user interest about a decade go. At that point fragmentation + complexity exploded.
  - Gud 2y ago
    I say this as a big time BSD friend, the same can be said about the BSDs. OpenBSD and FreeBSD are very different , I’ve never used NetBSD, but I can only imagine it’s not the same as the other two.
    - temp0826 2y ago
      Yah, it's a bit wrong that people compare an operating system like FreeBSD (or Solaris or AIX etc) to "Linux" which is just a kernel. The distribution IS the operating system, and of course there will be differences. SystemD is changing things up a bit and packaging up all the "boilerplate" and making things more consistent across distros, which is convenient sure. I joke that the old adage "GNU/Linux" should be updated to "SystemD/Linux".
      - Gud 2y ago
        I agree with you, FreeBSD should be judged by its own right against every other operating system out there, including the 100s of GNU/systemd/Linux-distributions, and every obscure operating system out there. How deep you dig depends on you. My preferences have fallen on a combination of FreeBSD, OpenBSD, Manjaro Linux, with FreeBSD my main operating system. The main draw backs are 1) poorer wifi support * 2) non-existing bluetooth support But the main advantages of FreeBSD 1) FreeBSD is a source distribution first, always has been, always will be. 2) The most permissive software licenses are prefered, which I think is really cool 3) By far the best package managers. both ports and pkg are simpler to use than anything I have tried from any other distribution. I know some people swear by Slackware, Gentoo and Arch, but in general their package management do not appeal to me. Plus it always seems like the linux distributions are either source or binary. Sure, you can usually do both(except for the source first distributions) on most linux distributions, it's usually inferior to ports/pkg. 4) first class ZFS support 5) I get to run the same system on my desktop as I do on my production systems which I consider a big advantage. * https://man.freebsd.org/cgi/man.cgi?query=wifibox https://man.freebsd.org/cgi/man.cgi?query=wifibox I have resolved the WIFI support by running wifibox, a tiny virtualized Linux vm running on bhyve. It gives me a 20-fold increase in speed! Coincidentally, it’s based on Aline Linux, which the blog post is all about! When I want to play games, I reboot to Windows or Manjaro, which takes about 60 seconds... Both fairly stable and easy to maintain operating systems. I like MacOS as well, but I don't have any apple computers anymore.
- unilynx 2y ago
  The question was why people may find Linux inconsistent. The distributions are very much part of that, and even within a distribution, just a 2 year later LTS might have wild differences because of the kernel promoting new mechanisms It may not be that much of a problem in practice, I deal with multiple distributions because for new servers, we pick 'm based on expected future support, and they're only a bootstrap to docker/podman which is the great 'equalizer'. So the inconsistencies are only a problem until our Ansible scripts have learned the difference and when we need to debug an issue. Not that often fortunately, once the configurations are in place things are generally stable.
gnuser 2y ago
As a greybeard GNUlinux sysadmin: nftables raw ripping out iptables (newer gui/tui firewall interfaces support nftables) rip out NetworkManager, and use systemd-resolved to manage DNS. (On non-systemd systems like Devuan then this changes.) Use systemd units for powerful program and service control, including systemd-nspawn for containerization.
- leephillips 2y ago
  systemd-nspawn is like a secret weapon. Very few resources about containers mention it. I use it all over the place.
- yjftsjthsd-h 2y ago
  The fact that you have to rip out that much software to make it reasonable is a fantastic argument for the BSDs.
  - doublepg23 2y ago
    ? FreeBSD ships with three different firewalls in base.
    - 0x457 2y ago
      Yes, however, each has a clear set of tools, and it's clear which one are you using. There are no shims to use IPFW tooling with PF and vice versa, while on linux they are all mixed.
  - steve_rambo 2y ago
    iptables has been with us for more than 20 years and is only now being replaced (pretty slowly I might add). The old rules are still supported through iptables-nft, you can just import them and forget nft exists. Distributions I prefer have never used NetworkManager and haven't changed network configuration in a long time. RHEL and its rebuilds have used NM for what feels like an eternity. Ubuntu is the odd one out here with its constant churn, afaik. Same with firewall wrappers like ufw and firewalld. Either your distribution uses one and you just use whatever has been chosen for you, or it doesn't and you go with nftables (or iptables-nft if you prefer). This is all only really a problem if your organization uses a bunch of distributions instead of standardizing on one, but then you probably have a lot more other serious problems than learning how to configure your firewall... As a counterpoint, I evaluated FreeBSD for a project about a year ago and was really put off by its primitive service management (compared to systemd which I know pretty well and use its features extensively, they really do help in your daily work), and the three firewalls which all seem to be approximately equally supported and you never really know where to put your time. (Unfortunately, I had to pass the OS for other reasons which have no relation to its technical merit.)
rakoo 2y ago
In practice, do you interact with many different distributions ?
- leephillips 2y ago
  I only interact with Debian, sometimes Ubuntu, and that description of the Linux situation is fair and accurate. I love Linux, but it’s also a chaotic mess, just as described.
- unilynx 2y ago
  Ubuntu LTS 18 & 20, and decided to move to Rocky 9 for the future.
hestefisk 2y ago
Firewalls is not where I would argue that BSDs are more consistent. FreeBSD comes with three different choices in base: ipfw, pf, and ipf.
BrandoElFollito 2y ago
Linux user since 1994, tiny kernel developments eons ago. My whole home depends on Linux and Home Assistant, Vaultwarden and a few others. I love Linux but the total mess with networking and sound is disheartening. It is a pile of crap. I do not care if this is this or another solution, but for fucks sake - let's have one system and not five that step on each other. This is infuriating.

epcoa 2y ago

> firewalls This seems like not the best example since FreeBSD has 3 implementations that may be in use depending on the whims of the sysadmin.

antranigv 2y ago
FreeBSD has 3 different firewalls, not 3 different interfaces to the same firewall. Each firewall has its own purpose. IPF is lightweight, pf has a nice UI/UX, ipfw is very integrated into the system. More importantly, doing a simple kldstat would tell you which firewall is running. On Ubuntu (as an example) I have no idea if I should be using nftables, iptables or if ufw is working or not.

nequo 2y ago

> both Ubuntu and Rocky Linux hosts This is a little like comparing FreeBSD with macOS. Their userlands share similarities but they are different operating systems.

hedora 2y ago
That's the main problem with Linux these days: Experience with distro A rarely transfers to distro B. Also, at least with Ubuntu, switching to a new LTS means that most administration tools have been replaced with different (usually buggier) ones, so knowledge of the old release doesn't necessarily transfer either. It wasn't this way in the early days, but the community focus stopped aligning with end user interest about a decade go. At that point fragmentation + complexity exploded.
- Gud 2y ago
  I say this as a big time BSD friend, the same can be said about the BSDs. OpenBSD and FreeBSD are very different , I’ve never used NetBSD, but I can only imagine it’s not the same as the other two.
  - temp0826 2y ago
    Yah, it's a bit wrong that people compare an operating system like FreeBSD (or Solaris or AIX etc) to "Linux" which is just a kernel. The distribution IS the operating system, and of course there will be differences. SystemD is changing things up a bit and packaging up all the "boilerplate" and making things more consistent across distros, which is convenient sure. I joke that the old adage "GNU/Linux" should be updated to "SystemD/Linux".
    - Gud 2y ago
      I agree with you, FreeBSD should be judged by its own right against every other operating system out there, including the 100s of GNU/systemd/Linux-distributions, and every obscure operating system out there. How deep you dig depends on you. My preferences have fallen on a combination of FreeBSD, OpenBSD, Manjaro Linux, with FreeBSD my main operating system. The main draw backs are 1) poorer wifi support * 2) non-existing bluetooth support But the main advantages of FreeBSD 1) FreeBSD is a source distribution first, always has been, always will be. 2) The most permissive software licenses are prefered, which I think is really cool 3) By far the best package managers. both ports and pkg are simpler to use than anything I have tried from any other distribution. I know some people swear by Slackware, Gentoo and Arch, but in general their package management do not appeal to me. Plus it always seems like the linux distributions are either source or binary. Sure, you can usually do both(except for the source first distributions) on most linux distributions, it's usually inferior to ports/pkg. 4) first class ZFS support 5) I get to run the same system on my desktop as I do on my production systems which I consider a big advantage. * https://man.freebsd.org/cgi/man.cgi?query=wifibox https://man.freebsd.org/cgi/man.cgi?query=wifibox I have resolved the WIFI support by running wifibox, a tiny virtualized Linux vm running on bhyve. It gives me a 20-fold increase in speed! Coincidentally, it’s based on Aline Linux, which the blog post is all about! When I want to play games, I reboot to Windows or Manjaro, which takes about 60 seconds... Both fairly stable and easy to maintain operating systems. I like MacOS as well, but I don't have any apple computers anymore.
unilynx 2y ago
The question was why people may find Linux inconsistent. The distributions are very much part of that, and even within a distribution, just a 2 year later LTS might have wild differences because of the kernel promoting new mechanisms It may not be that much of a problem in practice, I deal with multiple distributions because for new servers, we pick 'm based on expected future support, and they're only a bootstrap to docker/podman which is the great 'equalizer'. So the inconsistencies are only a problem until our Ansible scripts have learned the difference and when we need to debug an issue. Not that often fortunately, once the configurations are in place things are generally stable.

gnuser 2y ago

As a greybeard GNUlinux sysadmin: nftables raw ripping out iptables (newer gui/tui firewall interfaces support nftables) rip out NetworkManager, and use systemd-resolved to manage DNS. (On non-systemd systems like Devuan then this changes.) Use systemd units for powerful program and service control, including systemd-nspawn for containerization.

leephillips 2y ago
systemd-nspawn is like a secret weapon. Very few resources about containers mention it. I use it all over the place.
yjftsjthsd-h 2y ago
The fact that you have to rip out that much software to make it reasonable is a fantastic argument for the BSDs.
- doublepg23 2y ago
  ? FreeBSD ships with three different firewalls in base.
  - 0x457 2y ago
    Yes, however, each has a clear set of tools, and it's clear which one are you using. There are no shims to use IPFW tooling with PF and vice versa, while on linux they are all mixed.
- steve_rambo 2y ago
  iptables has been with us for more than 20 years and is only now being replaced (pretty slowly I might add). The old rules are still supported through iptables-nft, you can just import them and forget nft exists. Distributions I prefer have never used NetworkManager and haven't changed network configuration in a long time. RHEL and its rebuilds have used NM for what feels like an eternity. Ubuntu is the odd one out here with its constant churn, afaik. Same with firewall wrappers like ufw and firewalld. Either your distribution uses one and you just use whatever has been chosen for you, or it doesn't and you go with nftables (or iptables-nft if you prefer). This is all only really a problem if your organization uses a bunch of distributions instead of standardizing on one, but then you probably have a lot more other serious problems than learning how to configure your firewall... As a counterpoint, I evaluated FreeBSD for a project about a year ago and was really put off by its primitive service management (compared to systemd which I know pretty well and use its features extensively, they really do help in your daily work), and the three firewalls which all seem to be approximately equally supported and you never really know where to put your time. (Unfortunately, I had to pass the OS for other reasons which have no relation to its technical merit.)

rakoo 2y ago

In practice, do you interact with many different distributions ?

leephillips 2y ago
I only interact with Debian, sometimes Ubuntu, and that description of the Linux situation is fair and accurate. I love Linux, but it’s also a chaotic mess, just as described.
unilynx 2y ago
Ubuntu LTS 18 & 20, and decided to move to Rocky 9 for the future.

hestefisk 2y ago

Firewalls is not where I would argue that BSDs are more consistent. FreeBSD comes with three different choices in base: ipfw, pf, and ipf.

BrandoElFollito 2y ago

Linux user since 1994, tiny kernel developments eons ago. My whole home depends on Linux and Home Assistant, Vaultwarden and a few others. I love Linux but the total mess with networking and sound is disheartening. It is a pile of crap. I do not care if this is this or another solution, but for fucks sake - let's have one system and not five that step on each other. This is infuriating.