Hacker News Reader

Comment by yuvadam | Hacker News Reader

What's wrong with Linux for firewalls? Either openwrt, or any distro really.

Why would any BSD perform better?

(edit: genuinely curious why BSDs are such popular firewalls)

One thing I like about using OpenBSD for my home router is almost all the necessary daemons being developed and included with the OS. DHCPv4 server/client, DHCPv6 client, IPv6 RA server, NTP, and of course SSH are all impeccably documented, use consistent config file formats/command-line arg styles, and are privilege-separated with pledge.

Also it's a really well trodden path. You aren't likely to run into an OpenBSD firewall problem that hasn't been seen before.

Regarding any BSD used for any purpose, BSD has a more consistent logic to how everything works. That said, if you're used to Linux then you're going to be annoyed that everything is very slightly different. I am always glad that multiple BSD projects have survived and still have some real users, I think that's good for computing in general.

The recent addition of dhcp6leased is a great example: Built into the base system, simpler to configure than either dhcp6c or dhcpcd, and presumably also more secure than either.

  Compared to working with iptables, PF is like this haiku:

  A breath of fresh air,
  floating on white rose petals,
  eating strawberries.

  Now I'm getting carried away:

  Hartmeier codes now,
  Henning knows not why it fails,
  fails only for n00b.

  Tables load my lists,
  tarpit for the asshole spammer,
  death to his mail store.

  CARP due to Cisco,
  redundant blessed packets,
  licensed free for me.

(From https://marc.info/?l=openbsd-pf&m=108507584013046&w=2 )

Nftables has improved the situation on Linux somewhat, but PF is incredibly intuitive and powerful. A league of its own when it comes to firewalling.

Has there ever been an effort to port PF over to linux, or to create an adaption layer that makes things compatible?

pf has been ported to Debian/kFreeBSD, but afaik no effort has been made to port it to the Linux kernel. A lot of networking gear already runs a BSD kernel, so my guess is the really high-level network devs don't bother because they already know BSD so well.

Nftables is alright IME

Uhh... no idea but yea. Its that much better that it deserves a poem.

I assume in this case they already had a bunch of firewall rules for PF and switching from OpenBSD -> FreeBSD is a much easier lift then going to linux because both the BSDs are using PF, although IIRC there are some differences between both implementations.

PF is really nice. (Source: me. Cissp and a couple decades of professional experience with open source and proprietary firewalls).

And if they are already using it on openbsd, it’s almost certainly an easier lift to move from one BSD PF implementation to another versus migrating everything to Linux and iptables.

Agreed. Once you've gone pf you'll pine for it when working with anything else.

I've gotta me-too this. I've written any number of firewall rulesets on various OSes and appliances over the years, and pf is delightful. It was the first and only time I've seen a configuration file that was clearly The Way It Should Be.

The only configuration language I like more is Juniper. I picked that up and became fluent in it within about a day.

I'm pretty die-hard Linux, but I had a client who needed to do traffic shaping on hundreds or thousands of this ISPs users. I've tried multiple times to get anything more than the most simple traffic shaping working under Linux, with pretty bad luck at it. I set them up with a FreeBSD box and the shaping config, IIRC, was a one-liner and just worked, I never heard any complaints about it.

I've run a lot of Linux firewalls over the decades, but FreeBSDs shaping is <chefs kiss>

What features have you used for shaping with pf/FreeBSD? I remember (around 8ish years ago) using dummynet with pf, but it wasn't supported out of the box and I used some patches from the mailing lists for this purpose. It wasn't perfect, at times buggy. Back then ipfw had better support for such features, but I didn't like the syntax just as much as iptables. I eventually settled on Linux as I have grown to understand iptables (I hate that nftables is the brand new thing with entirely different syntax to learn again... and even requires more work upfront because basic chains are not preconfigured...) but traffic shaping sucked big time on linux, I never understood the tc tool to be effective, it's just too arcane. I always admired pf, especially on OpenBSD since it had more features but the single threaded nature killed it for any serious usage for me.

I did traffic shaping per user for a few hundred users on 1GHz Pentium III on Linux. It can be done just fine.

The user interface is literally 1000x better. That's all

Linux is enormously higher performance but it is a huge pain in the ass to squeeze the performance out AND retain any level of readability

which is why there are like a dozen vendors selling various solutions that quietly compile their proprietary filter definitions to bpf for use natively in the kernel netfilter code...

Too many random changes, too fiddly to maintain, too much general flakiness. Especially for simple single-purpose devices that you want to set up once and leave alone for years, BSD is generally much nicer than Linux. I'd actually flip your question: why would you ever use Linux rather than FreeBSD?

Do you have any specific examples where a Linux-based firewall was too "random" or "fiddly" or "flaky"? Or provide examples of ways that BSD "much nicer"?

It sounds to me like you picked a bad Linux distro for your use case.

I've seen plenty of single-purpose Linux-based network appliances, and none of them have come across as flaky or unreliable because of the OS. In fact they can be easier to use for people who have more operational experience using Linux already.

> Do you have any specific examples where a Linux-based firewall was too "random" or "fiddly" or "flaky"?

They switched out ifconfig for some other thing. There's been about 3 different firewall systems that you've have to migrate between. Some of the newer systems (docker and I think maybe flatpak/the other one) bypass your firewall rules by default, which is a nasty surprise. A couple of times I did a system upgrade and my system wouldn't boot because drivers or boot systems or what have you had changed. That stuff doesn't happen on FreeBSD.

I'm sure to someone who lives and breathes Linux, or who works on this stuff, it's all trivial. But if it's not something you work on day-to-day, it's something you want to set and forget as an appliance, Linux adds pain.

> It sounds to me like you picked a bad Linux distro for your use case.

Were there any grounds at all in what I said for thinking that, or did you just make it up out of blind tribalism?

> In fact they can be easier to use for people who have more operational experience using Linux already.

Of course, but that's purely circular logic. Whatever OS you use for most of your systems, systems using that OS will be easier for you to use.

Not the OP, but I've been with Linux since 2.2 times. You had ipchains, iptables, nftables and now god knows what. *BSD had pf ever since.

What's wrong with using any BSD? Can't people use whatever suits their needs?

Of course, I'm genuinely curious why BSDs are more popular as firewalls.

Because of pf[1]. It's just a very capable firewall with a pleasurable configuration language.

[1] https://www.openbsd.org/faq/pf/

Agreed, `pf` is a delight to use.

Borrowing a demonstration from https://srobb.net/pf.html

    tcp_pass = "{ 22 25 80 110 123 }"
    udp_pass = "{ 110 631 }"
    block all
    pass out on fxp0 proto tcp to any port $tcp_pass keep state
    pass out on fxp0 proto udp to any port $udp_pass keep state

Note last rule matching wins, so you put your catch-all at the top, "block all". Then in this case fxp0 is the network interface. So they're defining where traffic can go to from the machine in question, in this case any source as long as it's to port 22, 25, 80, 110, or 123 for TCP, and either 110 or 631, for UDP.

<action> <direction> on <interface> proto <protocol> to <destination> port <port> <state instructions>

One can further parametrize things with, e.g.,

    int_if = "fxp0"

The BSDs still tend to use device-specific names versus the generic ethX or location-specific ensNN, so if you have multiple interfaces knowing about internal and external may help the next person who sees your code to grok it.

doing the same thing with nftables is not really complicated either

The documentation on BSDs, and in particular OpenBSD, are generally high quality

One thing unexpected I found when setting up an OpenBSD based router recently: the web isn’t riddled with low-quality and often wrong SEO and AI slop about OpenBSD like it is for Linux. I guess there just isn’t enough money to be made producing it for it for such a niche audience.

If you search up a problem, you get real documentation, real technical blog posts, and real forum posts with actual useful conversations happening.

I've used both and the main advantage is PF/ipfw syntax.

But now with nftables I actually am going back to RHEL on Firewalls. I want something ultra-stable and long lived.

I've been using OpenBSD and PF for nearly 25 years (PF debuted December 2001). Over those years there have been syntax changes to pf.conf, but the most disruptive were early on, and I can't remember the last syntax change that effected my configs (mostly NAT, spamd, and connection rate limiting).

During that time the firewall tool du jour on Linux was ipchains, then iptables, and now nftables, and there have been at least some incompatible changes within the lifespan of each tool.

OpenBSD has an additional leg up in that incompatible changes between releases are concisely, clearly, and consistently documented, e.g. https://www.openbsd.org/faq/upgrade78.html The last incompatible pf.conf syntax change I could find was for 6.9, nearly 5 years ago, https://www.openbsd.org/faq/upgrade69.html

You left off ipfwadm before ipchains.

And iptables has been around since 2001, and can still be used.

Alternatively you can use nftables which has only been around for the past 12 years.

I realise that one change per quarter century is possibly a little fast paced for BSD but I can cope with it.

PF is also from 2001. But its roots go further back, I once used a very PF-like syntax on a Unix firewall from 1997. I forget which type of Unix it was, maybe Solaris.

Either way, I don't think there is any defense for the strange syntax of IPtables, the chains, the tables. And that's coming from a person who transitioned fully from BSD to Linux 15 years ago, and has designed commercial solutions using IPtables and ipset.

We migrated to a linux nftables based firewall.

I never liked iptables, but nftables is pretty nice to write and use.

And with one "flowtable" line added to your nftables.conf you can even in theory have faster routing when conntrack is active

https://thermalcircle.de/doku.php?id=blog:linux:flowtables_1...

Let me extend the question to what’s wrong with NFTables on Linux? It’s a different way to manage Netfilter, out of IPTables

Because of PF or Packet Filter (the PF in pfSense FWIW): https://en.wikipedia.org/wiki/PF_(firewall)

Reply on news.ycombinator.com