# move to OpenBSD from FreeBSD



## wolffnx (Jul 22, 2020)

I have forced to move my firewall to OpenBSD because the FreeBSD version of PF doesn't support the `divert-reply` function. The reason is I want to make a L7 PF firewall.

The transition will be too hard? Is there many differences between OpenBSD and FreeBSD for my needs?


----------



## SirDice (Jul 22, 2020)

If I remember correctly FreeBSD's PF is based on PF from OpenBSD 4.5.


----------



## wolffnx (Jul 22, 2020)

I don't want to move on to OpenBSD (only for my firewall) but when I use the rule in PF. I get 
	
	



```
divert-reply has no meaning in FreeBSD pf(4)
```
.


----------



## SirDice (Jul 22, 2020)

It's unlikely any of the additions to OpenBSD's PF _after_ 4.5 are implemented on FreeBSD.


----------



## wolffnx (Jul 22, 2020)

Well, I downloaded and installed the latest OpenBSD ,
the installer was a little confusing compared to the FreeBSD one, but no problem at all
boot...
And in 5 to 7 minutes I have a functional gateway with PF, the network configuration was too easy.

I have some troubles with the path names  and the way to config the interfaces but nothing too difficult.

I miss ZFS  ...
Slow boot(userland), need tunning without disable the security features
No need for X, the console font is toooo nice to read

So, is good for a server but not for a desktop in my opinion

Forgot,the shutdown and reboot are fast compared to FreeBSD (for the file system used by OpenBSD I think)


----------



## olli@ (Jul 22, 2020)

Not sure what `divert-reply` should be good for in PF, but IPFW has several divert features. So if you’re willing to switch from PF to IPFW, that might be an option if you prefer to stay with FreeBSD.


----------



## VladiBG (Jul 22, 2020)

ConfigExamples/Intercept/FreeBsdPf - Squid Web Proxy Wiki
					






					wiki.squid-cache.org


----------



## SirDice (Jul 22, 2020)

wolffnx said:


> No need for X, the console font is toooo nice to read


If I'm correct they're using the Terminus font. There are instructions on the Newcons wiki page how to convert the font for vt(4).  I'm using x11-fonts/terminus-font with X. It's a very nice font indeed, especially for code or shells.


----------



## wolffnx (Jul 22, 2020)

olli@ said:


> Not sure what `divert-reply` should be good for in PF, but IPFW has several divert features. So if you’re willing to switch from PF to IPFW, that might be an option if you prefer to stay with FreeBSD.



for capture a package, send it to an
application for example Snort and
get it back
for make a layer7 firewall
there are few against it,  because
make the packets travel to the userspace to reaching Snort


----------



## wolffnx (Jul 23, 2020)

SirDice said:


> If I'm correct they're using the Terminus font. There are instructions on the Newcons wiki page how to convert the font for vt(4).  I'm using x11-fonts/terminus-font with X. It's a very nice font indeed, especially for code or shells.



Good tip, definitely my FreeBSD consoles need that


----------



## richardtoohey2 (Jul 23, 2020)

OpenBSD is good (I use it for firewalls and desktop.)  FreeBSD seems a bit stronger for performant web serving and MySQL database.  Not yet tried FreeBSD desktop.

They're both great - not perfect, but then nothing is.

The latest OpenBSDs use the Spleen font - I _think_ that's what the OP is talking about. https://undeadly.org/cgi?action=article;sid=20190110064857

I don't think pf does layer 7 processing, though?  Regardless of OS.


----------



## wolffnx (Jul 23, 2020)

richardtoohey2 said:


> I don't think pf does layer 7 processing, though?  Regardless of OS.



you rigth, PF itself not, but with divert and divert-reply you can analize the traffic with an external application
like snort and send it back to PF
with a mark
I never do this,but in teory works


----------



## olli@ (Jul 23, 2020)

wolffnx said:


> you rigth, PF itself not, but with divert and divert-reply you can analize the traffic with an external application


Well, that’s exactly what the divert feature of FreeBSD’s IPFW does. I’ve used this feature before, it works. See the ipfw(4) manual page for an overview of the kernel module, and the ipfw(8) manual page for details on the features and the syntax.

Note that the syntax and handling of IPFW rules is quite different from PF, so you would have to rewrite your rule sets completely. On the other hand, IPFW has quite a lot of features that PF doesn’t have, and that allow to do very clever and efficient things.

For example, IPFW rules are numbered (like line numbers in a BASIC program), and you can jump to other rules at any time, depending on conditions (like “if … goto …” in certain programming languages). Also, you can call a set of rules like a subroutine. And rules can be grouped together in so-called “sets” that can be enabled or disabled as a whole, among other things. These features enable you to structure your rules nicely.


----------



## hruodr (Jul 23, 2020)

wolffnx said:


> I miss ZFS  ...



I moved my desktop from OpenBSD to FreeBSD only because I wanted ZFS for archiving purposes.

Now I am thinking on other solution. It is much easier to deal with OpenBSD than with FreeBSD.


----------



## wolffnx (Jul 23, 2020)

olli@ said:


> Well, that’s exactly what the divert feature of FreeBSD’s IPFW does. I’ve used this feature before, it works. See the ipfw(4) manual page for an overview of the kernel module, and the ipfw(8) manual page for details on the features and the syntax.



I dont know it..when I start using FreeBSD I choise PF and now I feel like in home, before start learning OpenBSD I will give a try to IPWF 
in the man page(I read it from above without enter in too much detail)


```
diverted            Matches only packets generated by a divert socket.
diverted-loopback    Matches only packets coming from a divert socket back into the IP stack input for delivery.
diverted-output       Matches only packets going from a divert socket back outward to the IP stack output for delivery.
```

with divert send out the packets to an application and with one of those 3 options get it back to procesing
in IPFW?



olli@ said:


> Note that the syntax and handling of IPFW rules is quite different from PF, so you would have to rewrite your rule sets completely. On the other hand, IPFW has quite a lot of features that PF doesn’t have, and that allow to do very clever and efficient things.
> 
> For example, IPFW rules are numbered (like line numbers in a BASIC program), and you can jump to other rules at any time, depending on conditions (like “if … goto …” in certain programming languages). Also, you can call a set of rules like a subroutine. And rules can be grouped together in so-called “sets” that can be enabled or disabled as a whole, among other things. These features enable you to structure your rules nicely.



yes, some time ago I use it for basic testings, mi idea now is to make someting like a IDS  between the
firewall and the lan , for L7 filtering from the lan and some IDS features


----------



## wolffnx (Jul 23, 2020)

hruodr said:


> I moved my desktop from OpenBSD to FreeBSD only because I wanted ZFS for archiving purposes.
> 
> Now I am thinking on other solution. It is much easier to deal with OpenBSD than with FreeBSD.



For backup the system for example,what do you do?
a manual backup of system of essential files and dir? , like using UFS?


----------



## Sevendogsbsd (Jul 23, 2020)

hruodr said:


> I moved my desktop from OpenBSD to FreeBSD only because I wanted ZFS for archiving purposes.
> 
> Now I am thinking on other solution. It is much easier to deal with OpenBSD than with FreeBSD.



I had exactly the opposite experience: OpenBSD performance was terrible and the installer was confusing and overly complex. FreeBSD in my opinion, performs far better on the desktop and the installer is very simple. Configuring FreeBSD is also very simple for my use case. I will caveat this statement by saying I tried OpenBSD for about 30 minutes; the time it took me to install and login to the desktop, and then dumped it. I also have some fairly demanding 4K video hardware so I think OpenBSD was not designed for or optimized for this at all, while FreeBSD runs very fast.


----------



## olli@ (Jul 23, 2020)

wolffnx said:


> in the man page(I read it from above without enter in too much detail)
> 
> ```
> diverted            Matches only packets generated by a divert socket.
> ...


The three `diverted*` options that you quoted are only for matching. That is, if you want to make actions depend on the fact whether a packet was diverted or not.

To actually divert a packet, you use the `divert` action. By default, when the application sends the packet back, it continues to be handled by the *next* rule (numerically). This behaviour can be changed by the application if desired, i.e. the application can specify the rule number when sending the packet back to IPFW. It may also decide to not send the packet back at all – this is useful for applications that want to monitor the packets only, but not modify them.

The divert mechanism is documented in the divert(4) manual page.

Alternatively, packets can also be forwarded to a local port (TCP or UDP), using IPFW’s “forward” or “fwd” action. This is used by Squid, for example, to implement a transparent proxy that intercepts all HTTP traffic.


----------



## hruodr (Jul 23, 2020)

wolffnx said:


> a manual backup of system of essential files and dir?



More or less that. I do not need much. Only to keep files many years, perhaps tens of years.

I have FreeBSD on a 2.5'' Hard disk on which I work. I can put this HD in my very silent
desktop or in my "safe", a computer with two 3.5'' ZFS formated disks as mirrors that 
keep important files. 

I transfer from the working HD to the mirror HDs with `rsync`. No networking, no
two computers working at the same time, just making from time to time my backup. That
simple. Of course there are a lot of sophisticated posibilities that I wanted to avoid for one or
other reason.

The reason of using ZFS, namely FreeBSD, is: (1) safe healing features, (2) file System that run
in many OS and probably will live a lot of years.


----------



## hruodr (Jul 23, 2020)

Sevendogsbsd said:


> I had exactly the opposite experience: OpenBSD performance was terrible and the installer was confusing and overly complex.



Yes, it seems the performance is not the best, but it is very stable, more than FreeBSD. The
probability that FreeBSD hangs is much higher.

And the installer is by far much better and well thought than FreeBSDs installer. Very simple
to use and requires few resources. It is very flexible if you want to do non standard things.
It allows you to install OpenBSD in old hardware without any problem. In less than 20 minutes
you install OpenBSD, with FreeBSD you get strange problems and takes a lot of time.


----------



## Sevendogsbsd (Jul 23, 2020)

Not my experience at all: I found the OpenBSD installer to be terrible: hard to use, confusing and convoluted. I have never had a hang or crash on FreeBSD in several years of use. I have had apps core dump on FreeBSD though. My FreeBSD install takes about 7 minutes. My configs take a few more to copy over and I have a fully functional FreeBSD desktop in under 1 hour. I would never use or recommend OpenBSD based on my experience but that is MY experience.


----------



## hruodr (Jul 23, 2020)

wolffnx said:


> For backup the system for example,what do you do?



I must complete my above answer: I do not backup the system. I have absolutely no interest
in backupping the system. Only files, directories of my own, as I described above.

Hard to use, confusing and convoluted, *Sevendogsbsd*, only because you do not know it as
good as the FreeBSD installer. As said: it is exactly the opposite as that.


----------



## wolffnx (Jul 23, 2020)

for the original post , one question:

if I made this topology:

Internet->PF->SNORT->LAN and viceversa

Snort can drop or accept packages not?


----------



## olli@ (Jul 23, 2020)

hruodr said:


> Hard to use, confusing and convoluted, *Sevendogsbsd*, only because you do not know it as
> good as the FreeBSD installer. As said: it is exactly the opposite as that.


I ran OpenBSD for several years on an Alpha workstation. It was awful. Sevendogbsd is right.

And probably the worst thing about it was the hostile and impolite OpenBSD team. Worst open source community experience _ever_. FreeBSD is so much better.


----------



## Sevendogsbsd (Jul 23, 2020)

hruodr said:


> Hard to use, confusing and convoluted, *Sevendogsbsd*, only because you do not know it as
> good as the FreeBSD installer. As said: it is exactly the opposite as that.



Correct, I only used it once, but I found to be unintuitive. Your experience is your opinion, as is mine. You can't state an opinion as an absolute.


----------



## hruodr (Jul 23, 2020)

*Sevendogsbsd*, the OpenBSD installer is in principle nothing special. It is a kernel with a ram-disk in a file: bsd.rd. It contains some few unix/BSD commands, among them ed, fdisk, disklabel, and enough also to get OpenBSD from the internet, but also scripts for installing and upgrading. The process in the script is what you expect: recognizing disks, formatting them, downloading the distribution, etc. If you manage to boot this bsd.rd, for example with pxe or putting it in the disk and calling it with the boot 
loader, you can install, upgrade or start a shell and do some work before installing/upgrading. 
The upgrade is, as an installation, a question of minutes, not like the hours I wasted yesterday
with `freebsd-update`.

In some way the whole OpenBSD is as such, very coherent. In the third posting in this thread
seems that *wolffnx* got what I mean. OpenBSD is more cathedral, FreeBSD is more bazaar. They are different, but I like both.


----------



## Sevendogsbsd (Jul 23, 2020)

My confusion with the OpenBSD installer is the UI: I found it to be unintuitive. That's my only complaint with the installer. The performance of the system once installed was dismal, but I run on a workstation with a very large 4K monitor and experienced screen draws that were the equivalent of an older modem slowly displaying a web page. Not acceptable to me. The performance may be fine for a 13-15 inch laptop screen but not for an enormous 4K monitor. The system did install and boot to a login manager so that was good.

My preference is FreeBSD, which is why I am on these forums.


----------



## kpedersen (Jul 23, 2020)

Sevendogsbsd said:


> Not my experience at all: I found the OpenBSD installer to be terrible: hard to use, confusing and convoluted.



Really? Are we using the same installer? You just hammer the enter button about 6 times 

Possibly my preference is based on the fact that I really do prefer text-based installers. That said the bsdinstall is much nicer than the sysinstall of old.

Both are lightyears ahead of Windows and most Linux. In this world of "cloud". I find GUI installers old-fashioned.


----------



## Sevendogsbsd (Jul 23, 2020)

Yes, I found it terrible. I don't mind text installers at all: I have a Slackware install and that installer is dead simple. FreeBSD's installer is dead simple. I have installed stage one Gentoo too many times to count so am not at all afraid of diving into an install of any OS. I just found OpenBSDs to be unintuitive, that's all.

When installing a new OS on bare metal, I am certainly not going hammer enter 6 times without carefully reading each and every dialog. The partitioning tool also would not let me use 2 block devices so I had to leave my second disk with /home on it out and just use my normal "/" disk. That was OK since I didn't get any further than the initial install and opening of Firefox.

No worries, this is why we have choices!

I may revisit the install in a VM when I have some time though - walk through each step, out of curiosity sake. I have no use really for the OS, but VMs allow for experimentation without destruction


----------



## Emrion (Jul 23, 2020)

I installed OpenBSD in a VM. The biggest problem was the default partitioning because it leaves not enough room to install packages. I reinstalled it with manual partioning and it's all but intuitive. Add to that a bug in the tool (it apparently didn't understand suffixes like G or M for the size) and you can evaluate the time I spent to install this OS.

After that, with some more time, I successfully installed Gnome.

From my point of view, the documentation is somewhat hard to find and there are too many lockings for security reasons. OpenBSD is probably better in making a robust server.


----------



## kpedersen (Jul 23, 2020)

Emrion said:


> I installed OpenBSD in a VM. The biggest problem was the default partitioning because it leaves not enough room to install packages. I reinstalled it with manual partioning and it's all but intuitive. Add to that a bug in the tool (it apparently didn't understand suffixes like G or M for the size) and you can evaluate the time I spent to install this OS.



Once you select [edit] and it opens `disklabel`, you resize the /usr/local partition to something more appropriate for your uses (i.e R h 20G) and it automatically reduces the size of the /home partition to make space. I actually find that fairly ideal!

If you are saying that you would rather `disklabel` not be used during the installer, you will still need to encounter it again when you partition memory sticks, etc. Its worth learning! 

The only thing I found easier to partition disks was in the older FreeBSD sysinstall but that was removed. I believe it was later made standalone called sade (https://www.freebsd.org/cgi/man.cgi?query=sade&sektion=8)


----------



## scottro (Jul 23, 2020)

Hrrm, I find it pretty easy to install. I found their pages to make it seem more difficult than it is, especially about multibooting. Oddly enough, I have this vague memory of much clearer instructions from years ago, but perhaps that's just a hallucination. 
 I have my own page on multibooting with it, for people who just want to play with it, at http://srobb.net/openbsdmultiboot.html

If you're playing with it on a laptop running Linux, it will even go in an extended partition. I'm sure someone as knowledgeable (judging from their posts) as Sevendogsbsd installed it once for each dog they have, they'd quickly get used to it.   (Assuming your forum nick is based on reality.)


----------



## sidetone (Jul 24, 2020)

scottro said:


> I found their pages to make it seem more difficult than it is



Compare an Addison-Wesley, Pearson or Wiley textbook to a Houghton-Mifflin or McGraw-Hill textbook for math or science. The latter make it many times more difficult than it is for these subjects. For other subjects that only need basic understanding and don't require knowing how to do complex problems, they're all ok.

For the better textbooks, sure the subject itself is bit difficult, but they have clear examples, and sufficient explanations that you can go through a few chapters in a day and start working on their problems, instead of dissecting the few rare details from examples they do have for hours or days to solve each different problem. The better textbooks are helpful, and don't make things harder than they are.

I don't know if that's by design, from the belief that certain subjects should be made many times more difficult than they really are.


----------



## Sevendogsbsd (Jul 24, 2020)

scottro said:


> Hrrm, I find it pretty easy to install. I found their pages to make it seem more difficult than it is, especially about multibooting. Oddly enough, I have this vague memory of much clearer instructions from years ago, but perhaps that's just a hallucination.
> I have my own page on multibooting with it, for people who just want to play with it, at http://srobb.net/openbsdmultiboot.html
> 
> If you're playing with it on a laptop running Linux, it will even go in an extended partition. I'm sure someone as knowledgeable (judging from their posts) as Sevendogsbsd installed it once for each dog they have, they'd quickly get used to it.   (Assuming your forum nick is based on reality.)


Ha! It was, alas they are all old and we’ve lost 2.


----------



## scottro (Jul 24, 2020)

Offtopic, but I'm very sorry to hear that. I know how hard it can be to lose a pet.


----------

