Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenBSD Router Guide (2020)

openbsdrouterguide.net

Post reply on HN
Print view View original

31–40 of 41 posts

Re: OpenBSD Router Guide (2020)

#31

Post by q3k »

dragontamer wrote: post #29
q3k wrote: post #12

Earlier quoted context omitted.

0. Accept that for NAT on home gateway you really don't need wirespeed at minimal MTU, as the majority of your data transfers will be over TCP at max MSS/MTU. 1. Get a Xeon D box (like a Supermicro X10SDV-TLN4F, TDP 45W). 2. Install any Linux distribution on it and just use iptables/nftables. It's good enough. 3. You now have a normal Linux box with normal userspace networking, feel free to also run some more service…

> 0. Accept that for NAT on home gateway you really don't need wirespeed at minimal MTU, as the majority of your data transfers will be over TCP at max MSS/MTU. This can't be true for video gamers? I'd assume most video game protocols are tiny UDP packets. But maybe video game protocols don't need "wirespeed", since they're actually quite efficient in terms of bytes transferred. But you want to minimize latency.

I don't think any games rely on more than a few dozen megabits of Internet bandwidth at a few hundred packets per second. And that netfilter/iptables NAT on a Xeon is not gonna add more latency than the equivalent netfilter/iptables NAT that runs on a typical ARM/MIPS home gateway/router.

Re: OpenBSD Router Guide (2020)

#32

Post by 0xCMP »

madjam002 wrote: post #18

My favourite is currently NixOS for a router, entire configuration (system packages, version, firewall rules, interfaces, VLANs, etc) is declarative and can be deployed with automatic rollbacks in the event of misconfiguration.

I also love this. I ran into issues trying to get it working with extra very strict kernel security features enabled, but even then I eventually figured it out. Was really nice to use.

Re: OpenBSD Router Guide (2020)

#33

Post by wmf »

hultner wrote: post #8

Neat guide but I'd much rather see a guide on how to set up a cost-effective 10Gbps WAN to LAN throughput router/gateway with NAT. Those of us building our own routers (I've done so since about 2006 when I got 1Gbps fibre installed for the first time) usually have a quite large cross-section with people on bleeding edge internet connections, and with (pro-)consumer 10Gbps internet and networking becoming more and mor…

Vanilla Linux/BSD isn't bad at 10G these days but if you want more performance out of less hardware, TNSR is a productized DPDK/VPP router: https://www.tnsr.com/

Re: OpenBSD Router Guide (2020)

#34

Post by Hikikomori »

dragontamer wrote: post #29
q3k wrote: post #12

Earlier quoted context omitted.

0. Accept that for NAT on home gateway you really don't need wirespeed at minimal MTU, as the majority of your data transfers will be over TCP at max MSS/MTU. 1. Get a Xeon D box (like a Supermicro X10SDV-TLN4F, TDP 45W). 2. Install any Linux distribution on it and just use iptables/nftables. It's good enough. 3. You now have a normal Linux box with normal userspace networking, feel free to also run some more service…

> 0. Accept that for NAT on home gateway you really don't need wirespeed at minimal MTU, as the majority of your data transfers will be over TCP at max MSS/MTU. This can't be true for video gamers? I'd assume most video game protocols are tiny UDP packets. But maybe video game protocols don't need "wirespeed", since they're actually quite efficient in terms of bytes transferred. But you want to minimize latency.

It's not needed for games, they use a few megabits at most. We use the wirespeed term in the context of networking devices when discussing their limitations. If a device is wirespeed it's capable of routing or switching on all of its interfaces using the smallest packet size, for a 10Gbit interface that is 14.8m packets per second in one direction.

Re: OpenBSD Router Guide (2020)

#35

Post by isbjorn16 »

RostiB wrote: post #9
AnthonyUK wrote: post #7

Earlier quoted context omitted.

Or OPNSense.

moved from Pfsense to Opnsense, never looking back

What were the compelling reasons for you to switch? Was it something Opnsense did better, or did Netgate just piss you off?

I'm running pfsense now because I'm nothing if not lazy, but if opnsense makes things nicer in some way, I'd like to hear it!

Re: OpenBSD Router Guide (2020)

#36

Post by tadbit »

eu wrote: post #21
candl wrote: post #17

Is OpenBSD still largely single-threaded or have there been SMP improvements in the network stack over the years? The feature set OpenBSD has is impressive, but is there a large gap in networking perf compared to Linux/FreeBSD?

From my $work computer: $ uname -a OpenBSD XXXXX 6.9 GENERIC.MP#3 amd64 $top load averages: 0.83, 0.62, 0.44 94 processes: 93 idle, 1 on processor CPU00 states: 0.5% user, 0.0% nice, 0.2% sys, 0.3% spin, 0.6% intr, 98.4% idle CPU02 states: 6.5% user, 0.0% nice, 1.9% sys, 0.4% spin, 0.0% intr, 91.1% idle CPU04 states: 4.9% user, 0.0% nice, 1.6% sys, 0.3% spin, 0.0% intr, 93.1% idle CPU06 states: 4.0% user, 0.0% nice,…

The person you're responding to was asking about network performance. I imagine specifically regarding pf (packet filter, the firewall component).

To the grandparent: PF is still single threaded. If you had performance issues with that before you may still have them, but CPU improvements over time may have negated that impact. It's worth trying it out again.

Re: OpenBSD Router Guide (2020)

#37

Post by hackbinary »

nopcode wrote: post #30
1MachineElf wrote: post #19

Earlier quoted context omitted.

This is an interesting question. One would think, since OpenBSD is BSD licensed, it would be more likely to have vendorized forks available on the marketplace. Companies being obliged to share their code is allegedly a disadvantage of GPL-licenced Linux. But with OpenBSD, there are no prominent commercial forks. The one "active" OpenBSD fork today is HyperbolaBSD, and it hasn't made a single release yet after 2 years…

What is a "vendorized fork" ? There are companies that build commercial (virtual) firewall appliances based on OpenBSD. But they do not publish an open source, BSD-licensed, operating system.

FreeBSD underpins a fair number of commercial producers. Junos from Juniper perhaps being the most famous.

https://en.m.wikipedia.org/wiki/List_of_products_based_on_Fr...

Re: OpenBSD Router Guide (2020)

#38

Post by Datenstrom »

OpenBSD on the APU2 has been the most reliable, solid, and lowest maintenance router I have ever owned. The thing never needs to be restarted, never hiccups, and just is really rock solid. Highly recommend, just wish there was a good wireless AP solution too.

Re: OpenBSD Router Guide (2020)

#39

Post by 120photo »

Building a OpenBSD router has always been one of those projects in the back of my head but just never had the time. I plan on upgrading my home network in the next year and am considering MikroTik / RouterOS or a Ubiquity router. Anyone have experience with any of those and a custom OpenBSD build? What would be the advantage of going OpenBSD and is it worth it for your setup?

Re: OpenBSD Router Guide (2020)

#40

Post by elevation »

na85 wrote: post #28
Arch-TK wrote: post #5

Neat! I already have an OpenBSD firewall running on a PC Engines APU 2. Despite this, I still learned a few things from this guide (namely that urpf-failed already handles antispoof and that scrub shouldn't just be littered without any consideration). I was actually impressed at how well things perform despite the BKL of OpenBSD. I have only a 350Mbps down 35Mbps up connection and OpenBSD is nowhere near being a bott…

Conversely, I tried running openbsd as a router on my ubiquiti edgerouter for my 950 megabit up/down connection and couldn't get even close to the performance of even the shitty ISP-provided router/ONT combo box.

As someone who had considered a similar setup, what model of edgerouter? Would you consider doing a writeup? What kind of speeds did you achieve?
Post reply on HN