Hacker News Reader

> - firewall? […] Wherever I looked, people said "it's complicated." After a lot of tinkering and learning I finally got a setup that was pretty safe. (I think.)

I felt this way about pf when I first got PF going around 2011 for my home router/firewall box. Not saying this is the same for you or anyone else, but my issue was that I was approaching it from the point of view of “I want to configure a home firewall router with PF” instead of “I want to learn the fundamentals of what a firewall does”.

It took me a few more years to get well-versed in all that stuff: the structure of packets, what NAT actually means (what addresses are being translated, why, and where), what's going on in the state table, how to debug when things aren't doing what I expect, etc. Once I did it became much more straightforward to express in my `pf.conf` what I want to do, but you're right that doesn't really help new users.

> Lots of pain and hard to find friendly, best practice starter templates.

FreeBSD does include this, however! It's just implemented using IPFW instead of PF. Check out `firewall_type` key in `rc.conf`: https://cgit.freebsd.org/src/tree/libexec/rc/rc.conf?id=edad...

For a very simple NAT gateway, one could set `firewall_type=simple` and then `firewall_simple_(iif|inet|oif|onet)(_ipv6)?` to configure the ISP-side and internal-side interface names and IPv4 and IPv6 network ranges for each.

For a very easy single-machine firewall, one could set `firewall_type=client` or `firewall_type=workstation` if you want to host anything. For the latter, `firewall_myservices` and `firewall_allowservices` control what ports are enabled and who (other networks/IPs) have access to them

For more details and to see exactly what each option actually does, check out `/etc/rc.firewall` where this is all implemented: https://cgit.freebsd.org/src/tree/libexec/rc/rc.firewall?id=...

> - firewall? Lots of pain and hard to find friendly, best practice starter templates. Wherever I looked, people said "it's complicated." After a lot of tinkering and learning I finally got a setup that was pretty safe. (I think.)

I don't use much FreeBSD these days, but pf (from OpenBSD, I know), is one of the best things since sliced bread.

In my first job I was working for a company selling a third-party vertical software and we were proving support for it. We were using a very expensive symantec vpn with most customers connecting with a 33.3kb phone connection, until we reached the license limits, and there was no money for new licenses. In a pinch, me and a coworker set up a new server with openvpn, freebsd, pf, and a ruby-based dns server that I don't remember anymore, and we grew an order of magnitudes more customers.

It's been more that 20 years, I still don't know how to use firewalls in linux, (there are many, I just pretend they don't exists) but I would still be able to setup a pf firewall if needed. I need to say it again, pf is a joy to use.

My gripe with FreeBSD right now is that I miss something like docker swarm. bhyve is fine but AFAIK it works only on a single host. Give me something that works on a bunch of hosts, and I will come back right away

vm-bhyve, which is a friendly wrapper around bhyve, has a vm send command. Not as automatic as docker swarm but is pretty handy for homelabbin’.

I was intrigued and went looking, I can't find any info on a vm send command.

Edit: I think it's 'vm migrate'

https://man.freebsd.org/cgi/man.cgi?query=vm&sektion=8&manpa...

what do you need docker swarm / bhyve for in a selfhosting context?

https://docs.freebsd.org/en/books/handbook/firewalls/

- firewall?

PF seems to me like pretty much the most well regarded firewall there is - with a nice, sensible DSL for config. If you don't like like it, you can use use IPFW or IPFILTER, which are alternative, built-in, firewall front-ends.

- In the end, it was just too much having to re-invent the wheel for common server tasks

Maybe you have built your routine around a system that have reinvented the wheel? I think FreeBSD knowledge degrades more slowly than that of Linux distros.

- I'm just not an OS dev.

That's how I feel when I enter the chaotic Linux world. Do you think my life revolve around keeping up with this shit? :)

> That's how I feel when I enter the chaotic Linux world.

I feel that as a Linux user. I really like Linux, I use it on my desktop and it runs all my servers. Delving into forum posts to find some solution to a specific problem can be exhausting. Sometimes you get a top result from like 2011 and it is out of date so you then need to spend X minutes trying to look up something more recent.

You haven't really gone 'round the block in the world of quasi-modern Linux until you're Googling for answers and guidance to what seems like some obscure issue, wherein: The noise is intense and replete with bad answers, unanswered questions, lack of report (positive? negative? how 'bout "none"?), and dumb SEO spam.

Time passes (how much time? are the birds singing yet?) as you keep slogging through that endless sea of muck.

Finally, you run across an old post on some forum where the person not only wrote about the problem, but also the cause of the problem -- and the answer.

So you're reading along, working to once again evaluate whether your problem matches their problem. And the more you read, the more familiar it all seems... like you've been there before.

"It can't be," you say to yourself.

But you scroll back up to the top of the comment and look at the author's name anyway.

And yep, sure as anything: It was you. Six years ago, you wrote about that exact problem yourself and posted a perfectly-cromulent solution to it.

So you fix it (again), note that the birds are in fact singing, and to try to sleep for a bit while pondering your life's choices: You could have found a hobby in origami or perhaps woodworking. Maybe worked as a Mennonite tradesman producing leather goods, or as a carpenter (even an Amish one if any of that seemed too high-tech).

But you didn't. You chose this path instead. It could have all been so simple, but it isn't.

Addendum: I've used FreeBSD as my daily driver (I hate that term) since around 2004. Including through cs/math university. With Windows in a VM for "I need it". The longer I've used it the more I'm annoyed by the trivialities of Linux distro management. And the bugs that happens between ill fitting parts composed by underfunded distro developers.

And I didn't mean to imply that FreeBSD is stale. There is big stuff happening continuously. Right now it's compatibility with Linux Wifi drivers, which will make FreeBSD more laptop-able. And pkgbase, which brings some of the compile-your-self flexibility of FreeBSD to binary management, and merges the two tools that decides what makes up your system into one. And kinda makes FreeBSD into the slim system that people already claims it to be.

My pet conspiracy is that pkgbase happened because the powers that be didn't want the 1000 battles to remove junk. Any time anyone wants to remove something there's always one or two guys on the mailing list claiming their livelihood depends on not having to do "pkg install Ø". With pkgbase its all gone.

They might've been trying freebsd back when pf wasn't well supported. Back when I last used openbsd (which might be nearly 20yrs ago now - eek), pf support on freebsd was lagging quite a bit.

Not sure what things are like now though - I'm guessing it's much better as pf was obviously the best option :)

My impression:

* PF was imported into FreeBSD from OpenBSD, maybe it had problems at first.

* Both implementations have been actively maintained, further developed, and diverged.

* There is now collaboration in the development of the FreeBSD and OpenBSD implementations.

* PF is the shit. Even though IPFW is the "invented here" firewall.

Yep, started on PF and the Palo and NSX FWs I use at the day job are a piece of cake.

I had similar issues with it. What helps today are LLMs. It’s really a boon to configuring such things. You do it on ace and forget unless that’s your job. Did you try to do what you had wanted back then with a recent LLM?