Building an OpenBSD Router
openbsd.org
openbsd.org
It provided an example of a static nat forwarding for incoming traffic.
Another common task is blocking certain outgoing traffic
block return out quick on egress from any to any port smtp
to block all outgoing email if your internal machines are all windows (to block spambots or whatever).
Or to block outgoing traffic from one device (perhaps your laser printer, or abandoned smart TV, or an "internet of powned things" device).
block return out quick on egress from 10.1.2.3
You can have huge fun with tables. So make a table of addresses to block from the internet (much like the martians table in the example), and a pile of crontab that pfctl add and pfctl delete the kids i-devices around bed time or homework time or whatever.
As a starter, its pretty good, but there should be commentary on troubleshooting tools. Here's the care and feeding of the log command to figure out what you're actually doing vs what you think you're doing. Here's how you see the current NAT table using pfctl, stuff like that. As with many security issues, its easier to enable uPNP than it is to correctly debate if you should enable uPNP, its easier to enable your whole lan to access the internet rather than blocking the laserprinter, so that's a fun topic in general.
Also it's been a tradition in linux and presumably bsd software firewalls since the mid 90s to add endless complication and logging that serves no useful purpose and is never examined or acted upon after installation until a hardware limit for hardware of that year is reached, then complain software firewalls are too slow and maybe a couple years of hardware advances will make them practical, repeat endlessly. You can shove a couple megs/sec using a 486, I certainly did in the 90s, although you can also clutter up a top of the line desktop today such that the CPU and disk IO will flood about a couple hundred K if you try hard enough by writing every packet to disk and having pages of firewall rules.
It makes pftop so pretty :)
Improvements over the first version: quad core, Intel Gigabit NICS, new CPU supports AES-NI and AVX (AMD-V), ECC memory, and a USB 3.0 bus. Still some issues being ironed out, but will make excellent router hardware. Note that WiFi is a relative weakness on BSD, and you'll need to carefully choose a chipset to support hostap mode. The Atheros abgn cards are generally the best.
(Lack of Intel ethernet ruled out the APU out for me)
Also - How did you know about this? I can't find that page by browsing their site and I didn't even know this existed!
I'm also looking for a good wireless access point. Any suggestions?
You should be able to do a killall dhcp if you don't want to use it.
(That said, I'm still quite fond of openbsd, but from afar)
Yes there were manual steps to perform but they worked so well and were so simple that I couldn't help but think about automating them in a simple script. And finishing up I just did a pkg_add -u to upgrade all packages.
The only thing missing from the example imo is dnsmasq, much easier and lighter to use.
I do wish the openbsd project itself adopted something similar in an official (signed) capacity.
> I used to run openbsd routers
I have been hearing good things about DragonflyBSD lately though too.
[1]: https://github.com/ocochard/netbenches/tree/master/Atom_C255...
Comcast gets a lot of heat, but they at least have done ipv6 right.
Additionally, with a "home/office" router, there's many ways that IPv6 may be implemented by their ISP (e.g. static configured prefix, DHCPv6, prefix delegation etc...) all which require specific configuration on the WAN and LAN side to make it work.
So, I agree, but splitting that particular part into a different FAQ/walkthrough is going to be a better approach.
That said, I've been running dnscurve for a few years on my authoritative internet-facing servers ( `dig ns artcs.net` to see what it looks like), and I generally see between 5-10% of requests coming in as wanting encryption. Most of these are requests from OpenDNS, which supports the protocol.