Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenBSD Router Guide (2020)

openbsdrouterguide.net

Post reply on HN
Print view View original

21–30 of 41 posts

Re: OpenBSD Router Guide (2020)

#21

Post by eu »

candl wrote: post #17

Is OpenBSD still largely single-threaded or have there been SMP improvements in the network stack over the years? The feature set OpenBSD has is impressive, but is there a large gap in networking perf compared to Linux/FreeBSD?

From my $work computer:

    $ uname -a
    OpenBSD XXXXX 6.9 GENERIC.MP#3 amd64


    $top
    load averages:  0.83,  0.62,  0.44                                                                                                                                                            
    94 processes: 93 idle, 1 on processor                                                                                                                                                                       
    CPU00 states:  0.5% user,  0.0% nice,  0.2% sys,  0.3% spin,  0.6% intr, 98.4% idle
    CPU02 states:  6.5% user,  0.0% nice,  1.9% sys,  0.4% spin,  0.0% intr, 91.1% idle
    CPU04 states:  4.9% user,  0.0% nice,  1.6% sys,  0.3% spin,  0.0% intr, 93.1% idle
    CPU06 states:  4.0% user,  0.0% nice,  1.1% sys,  0.3% spin,  0.0% intr, 94.6% idle
    CPU08 states:  1.4% user,  0.0% nice,  0.6% sys,  0.2% spin,  0.0% intr, 97.8% idle
    CPU10 states:  1.4% user,  0.0% nice,  0.5% sys,  0.2% spin,  0.0% intr, 98.0% idle
    CPU12 states:  0.6% user,  0.0% nice,  0.3% sys,  0.1% spin,  0.0% intr, 99.0% idle
    CPU14 states:  0.7% user,  0.0% nice,  0.3% sys,  0.1% spin,  0.0% intr, 98.8% idle
    Memory: Real: 3292M/5988M act/tot Free: 9109M Cache: 1692M Swap: 0K/15G

Re: OpenBSD Router Guide (2020)

#22

Post by LargoLasskhyfv »

FuriouslyAdrift wrote: post #16
bluedino wrote: post #13

Are there any open-source, "next-generation" firewalls, running on OpenBSD? SD-WAN, DLP, Application-aware filtering, etc

I don't know of any big ones that are still going. OPNSense runs on HardenedBSD (a FreeBSD fork) and is excellent. FreeBSD and/or NetBSD is/was used by Juniper, Sandvine, Dell (Force10). I think the main blocker for OpenBSD in the commercial market is the inability to load binary blob drivers without maintaining a custom kernel.

Next release of OPNSense will be rebased on 'stock' FreeBSD. The current release is the last to be based on HardenedBSD.

This is known since April https://forum.opnsense.org/index.php?topic=22761.0 and confirmed there https://forum.opnsense.org/index.php?topic=24112.0

Re: OpenBSD Router Guide (2020)

#23

Post by LargoLasskhyfv »

1MachineElf wrote: post #19
bluedino wrote: post #13

Are there any open-source, "next-generation" firewalls, running on OpenBSD? SD-WAN, DLP, Application-aware filtering, etc

This is an interesting question. One would think, since OpenBSD is BSD licensed, it would be more likely to have vendorized forks available on the marketplace. Companies being obliged to share their code is allegedly a disadvantage of GPL-licenced Linux. But with OpenBSD, there are no prominent commercial forks. The one "active" OpenBSD fork today is HyperbolaBSD, and it hasn't made a single release yet after 2 years…

Maybe because the founder and team is known for zero tolerance toward BS, gives a shit about percieved 'needs' of shitty 'bizniz', and drama.

Re: OpenBSD Router Guide (2020)

#24

Post by inapis »

madjam002 wrote: post #18

My favourite is currently NixOS for a router, entire configuration (system packages, version, firewall rules, interfaces, VLANs, etc) is declarative and can be deployed with automatic rollbacks in the event of misconfiguration.

That sounds very interesting. Have you documented it somewhere?

Re: OpenBSD Router Guide (2020)

#26

Post by ochoseis »

madjam002 wrote: post #18

My favourite is currently NixOS for a router, entire configuration (system packages, version, firewall rules, interfaces, VLANs, etc) is declarative and can be deployed with automatic rollbacks in the event of misconfiguration.

This is what I’m working on right now too, built around an APU board. I’m also wrestling with hostapd to get WiFi working as well, just because. Once it’s working I’ll try and write it up.

Re: OpenBSD Router Guide (2020)

#27

Post by ochoseis »

inapis wrote: post #24
madjam002 wrote: post #18

My favourite is currently NixOS for a router, entire configuration (system packages, version, firewall rules, interfaces, VLANs, etc) is declarative and can be deployed with automatic rollbacks in the event of misconfiguration.

That sounds very interesting. Have you documented it somewhere?

Here’s a really simple config I started with (not mine, just inspiration): https://github.com/jgillich/nixos/blob/master/roles/router.n...

Re: OpenBSD Router Guide (2020)

#28

Post by na85 »

Arch-TK wrote: post #5

Neat! I already have an OpenBSD firewall running on a PC Engines APU 2. Despite this, I still learned a few things from this guide (namely that urpf-failed already handles antispoof and that scrub shouldn't just be littered without any consideration). I was actually impressed at how well things perform despite the BKL of OpenBSD. I have only a 350Mbps down 35Mbps up connection and OpenBSD is nowhere near being a bott…

Conversely, I tried running openbsd as a router on my ubiquiti edgerouter for my 950 megabit up/down connection and couldn't get even close to the performance of even the shitty ISP-provided router/ONT combo box.

Re: OpenBSD Router Guide (2020)

#29

Post by dragontamer »

q3k wrote: post #12
hultner wrote: post #8

Neat guide but I'd much rather see a guide on how to set up a cost-effective 10Gbps WAN to LAN throughput router/gateway with NAT. Those of us building our own routers (I've done so since about 2006 when I got 1Gbps fibre installed for the first time) usually have a quite large cross-section with people on bleeding edge internet connections, and with (pro-)consumer 10Gbps internet and networking becoming more and mor…

0. Accept that for NAT on home gateway you really don't need wirespeed at minimal MTU, as the majority of your data transfers will be over TCP at max MSS/MTU. 1. Get a Xeon D box (like a Supermicro X10SDV-TLN4F, TDP 45W). 2. Install any Linux distribution on it and just use iptables/nftables. It's good enough. 3. You now have a normal Linux box with normal userspace networking, feel free to also run some more service…

> 0. Accept that for NAT on home gateway you really don't need wirespeed at minimal MTU, as the majority of your data transfers will be over TCP at max MSS/MTU.

This can't be true for video gamers? I'd assume most video game protocols are tiny UDP packets.

But maybe video game protocols don't need "wirespeed", since they're actually quite efficient in terms of bytes transferred. But you want to minimize latency.

Re: OpenBSD Router Guide (2020)

#30

Post by nopcode »

1MachineElf wrote: post #19
bluedino wrote: post #13

Are there any open-source, "next-generation" firewalls, running on OpenBSD? SD-WAN, DLP, Application-aware filtering, etc

This is an interesting question. One would think, since OpenBSD is BSD licensed, it would be more likely to have vendorized forks available on the marketplace. Companies being obliged to share their code is allegedly a disadvantage of GPL-licenced Linux. But with OpenBSD, there are no prominent commercial forks. The one "active" OpenBSD fork today is HyperbolaBSD, and it hasn't made a single release yet after 2 years…

What is a "vendorized fork" ?

There are companies that build commercial (virtual) firewall appliances based on OpenBSD. But they do not publish an open source, BSD-licensed, operating system.

Post reply on HN