OpenBSD Router Guide (2020) • Hacker News Board

Re: OpenBSD Router Guide (2020)

#11

Post by thedougd » Mon, Aug 02, 2021, 1:12 PM UTC

hultner wrote: post #8

Neat guide but I'd much rather see a guide on how to set up a cost-effective 10Gbps WAN to LAN throughput router/gateway with NAT. Those of us building our own routers (I've done so since about 2006 when I got 1Gbps fibre installed for the first time) usually have a quite large cross-section with people on bleeding edge internet connections, and with (pro-)consumer 10Gbps internet and networking becoming more and mor…

I've found a few open source NAT implementations on DPDK, but several appears to be reference/demo implementations. This project looks interesting: https://vigor-nf.github.io/

DPDK network HBAs have been out for several years now and 25/50/100 is replacing 10 in the datacenter. Maybe there's some deals available on ebay? Quick glance, an Intel X520 is available for ~90 USD.

Re: OpenBSD Router Guide (2020)

#12

Post by q3k » Mon, Aug 02, 2021, 1:46 PM UTC

hultner wrote: post #8

Neat guide but I'd much rather see a guide on how to set up a cost-effective 10Gbps WAN to LAN throughput router/gateway with NAT. Those of us building our own routers (I've done so since about 2006 when I got 1Gbps fibre installed for the first time) usually have a quite large cross-section with people on bleeding edge internet connections, and with (pro-)consumer 10Gbps internet and networking becoming more and mor…

0. Accept that for NAT on home gateway you really don't need wirespeed at minimal MTU, as the majority of your data transfers will be over TCP at max MSS/MTU.

1. Get a Xeon D box (like a Supermicro X10SDV-TLN4F, TDP 45W).

2. Install any Linux distribution on it and just use iptables/nftables. It's good enough.

3. You now have a normal Linux box with normal userspace networking, feel free to also run some more services on it without having to deal with DPDK getting in your way.

DPDK is nice and all if you absolutely need to scream through tiny packets at multi-dozen-gigabit speeds, but you almost certainly don't need it at home for Netflix and seeding Ubuntu ISOs.

Re: OpenBSD Router Guide (2020)

#13

Post by bluedino » Mon, Aug 02, 2021, 1:57 PM UTC

Are there any open-source, "next-generation" firewalls, running on OpenBSD?

SD-WAN, DLP, Application-aware filtering, etc

Re: OpenBSD Router Guide (2020)

#14

Post by [deleted] » Mon, Aug 02, 2021, 2:05 PM UTC

hultner wrote: post #8

Neat guide but I'd much rather see a guide on how to set up a cost-effective 10Gbps WAN to LAN throughput router/gateway with NAT. Those of us building our own routers (I've done so since about 2006 when I got 1Gbps fibre installed for the first time) usually have a quite large cross-section with people on bleeding edge internet connections, and with (pro-)consumer 10Gbps internet and networking becoming more and mor…

[deleted]

Re: OpenBSD Router Guide (2020)

#15

Post by ay » Mon, Aug 02, 2021, 2:10 PM UTC

thedougd wrote: post #11

hultner wrote: post #8

Neat guide but I'd much rather see a guide on how to set up a cost-effective 10Gbps WAN to LAN throughput router/gateway with NAT. Those of us building our own routers (I've done so since about 2006 when I got 1Gbps fibre installed for the first time) usually have a quite large cross-section with people on bleeding edge internet connections, and with (pro-)consumer 10Gbps internet and networking becoming more and mor…

I've found a few open source NAT implementations on DPDK, but several appears to be reference/demo implementations. This project looks interesting: https://vigor-nf.github.io/ DPDK network HBAs have been out for several years now and 25/50/100 is replacing 10 in the datacenter. Maybe there's some deals available on ebay? Quick glance, an Intel X520 is available for ~90 USD.

VPP (http://fd.io) NAT plugins are used in various production deployments.

Various NAT-related perf tests: https://docs.fd.io/csit/master/report/vpp_performance_tests/...

Disclaimer: I am involved with the project

Re: OpenBSD Router Guide (2020)

#16

Post by FuriouslyAdrift » Mon, Aug 02, 2021, 2:18 PM UTC

bluedino wrote: post #13

Are there any open-source, "next-generation" firewalls, running on OpenBSD? SD-WAN, DLP, Application-aware filtering, etc

I don't know of any big ones that are still going. OPNSense runs on HardenedBSD (a FreeBSD fork) and is excellent. FreeBSD and/or NetBSD is/was used by Juniper, Sandvine, Dell (Force10).

I think the main blocker for OpenBSD in the commercial market is the inability to load binary blob drivers without maintaining a custom kernel.

Re: OpenBSD Router Guide (2020)

#17

Post by candl » Mon, Aug 02, 2021, 2:22 PM UTC

Is OpenBSD still largely single-threaded or have there been SMP improvements in the network stack over the years? The feature set OpenBSD has is impressive, but is there a large gap in networking perf compared to Linux/FreeBSD?

Re: OpenBSD Router Guide (2020)

#18

Post by madjam002 » Mon, Aug 02, 2021, 2:38 PM UTC

My favourite is currently NixOS for a router, entire configuration (system packages, version, firewall rules, interfaces, VLANs, etc) is declarative and can be deployed with automatic rollbacks in the event of misconfiguration.

Re: OpenBSD Router Guide (2020)

#19

Post by 1MachineElf » Mon, Aug 02, 2021, 2:39 PM UTC

bluedino wrote: post #13

Are there any open-source, "next-generation" firewalls, running on OpenBSD? SD-WAN, DLP, Application-aware filtering, etc

This is an interesting question.

One would think, since OpenBSD is BSD licensed, it would be more likely to have vendorized forks available on the marketplace. Companies being obliged to share their code is allegedly a disadvantage of GPL-licenced Linux. But with OpenBSD, there are no prominent commercial forks. The one "active" OpenBSD fork today is HyperbolaBSD, and it hasn't made a single release yet after 2 years. Previous attempts at OpenBSD forks have failed (Bitrig, ÆrieBSD). Somehow, OpenBSD appears to be less fork-able than other BSDs.

Why does the OpenBSD project subvert our expectations of a BSD-licenced OS?

I'm asking as someone who had a positive experience setting up an OpenBSD router and VPN, but not much beyond that.

Re: OpenBSD Router Guide (2020)

#20

Post by Hikikomori » Mon, Aug 02, 2021, 2:58 PM UTC

hultner wrote: post #8

Neat guide but I'd much rather see a guide on how to set up a cost-effective 10Gbps WAN to LAN throughput router/gateway with NAT. Those of us building our own routers (I've done so since about 2006 when I got 1Gbps fibre installed for the first time) usually have a quite large cross-section with people on bleeding edge internet connections, and with (pro-)consumer 10Gbps internet and networking becoming more and mor…

Any old gaming PC with 10G NICs from ebay will do the trick. Install any Linux distro, do some basic config and you're done. Wire speed with the smallest packet size isn't required, you'll probably get at least a few million pps which should be enough.

Or ubiquity ER-8-XG.