7 ms·

No, there isn't. The pf in FreeBSD has forked away. The much ranted about "performance improvement" in OpenBSD's pf isn't an issue on FreeBSD. http://lists.p

• talideon 12y ago
  Well, I guess all that talk on the BSD Now podcast a few weeks ago was nonsense then? I'll go back listen to them again and pick out the episode along with a timestamp, if you'd like. Anyhow, I'm not referring to the OpenBSD performance improvements being a reason to port it over. You're right: it isn't an issue for FreeBSD. However, it benefits FreeBSD if the version of pf used is simply OpenBSD pf with SMP support and a few other bits because that means that means less stuff to maintain.
  • detaro 12y ago
    If they really have diverged that much, the effort to merge them (if even possible from an architectural point of view) gets you a lot of maintenance on both sides. (Not to talk of the personal issues that obviously exist)
• chriscappuccio 12y ago
  What a ridiculous statement, Jim. FreeBSD PF has to run on multiple cores just to get less performance than OpenBSD PF gets with a single core. On the same machine, same config. TODAY. In this post, you rightly call out Reyk Floeter for being so butt-hurt about if_trunk. It's not like anyone in OpenBSD sits around crediting Garrett Wollman for writing the if_vlan driver that I ported, or that anyone credits me for various improvements before porting to NetBSD, or that anyone credits Reyk for the if_vxlan driver, and so on. Why? Because NOBODY FUCKING CARES. If someone cares, they'll look at the revision history. So, you said something that I generally agree with. But then you also say "It clearly shows that OpenBSD’s “pf” isn’t anywhere near as fast (even on a single CPU) as the other popular firewalls." You put quotes around pf, like it's laughable, despite it being the definitive implementation! What you miss, is that FreeBSD pf (compared to OpenBSD pf) isn't keeping up. It's missing features, and it's slow. Maybe NPF is the true winner here. FreeBSD's pf is not. I run 10GbE Myricom cards, one of the few OpenBSD NIC drivers that isn't part of the giant lock. I do 10GbE NAT across multiple boxes for my network. Right now, OpenBSD is at a point where I won't need to upgrade hardware for some years, as performance is simply increasing, incrementally, to where I'll be doing NAT and routing across all cores as my traffic load increases. (Now that's Just-In-Time technology :) Perhaps it's sad to people like you that OpenBSD has lagged so far behind in areas like this. For me, it's not sad at all, it is not only fun, but the overall system is so much better than FreeBSD could ever be, I have no regrets. It's very, very nice. Within two years I think we'll see huge performance gains on OpenBSD's networking code under SMP, and FreeBSD will be left behind because of arrogance like this. Now, pfSense has a particularly bad and slow web interface. In fact, it has gotten so bad over the years, it can't even run (in any usable sense) on hardware that you used to sell for the better part of a decade. I don't understand why you don't spend your resources to fix your house, instead of criticizing people who are fixing their own.