Messages

Here's a little teaser. There's a couple things I gotta do to cleanup, then I'll update to 16.1.1 when that comes out for OpenSSL SA goodness. Then I'll publish the build.

http://imgur.com/1kZLoXZ

It's official: I've started work on the HardenedBSD + OPNSense 16.1. I'll hopefully have a build I myself will test this weekend and push out for general availability by the end of next week.

FreeBSD / HardenedBSD 10-STABLE is great to use. However, there are certain enhancements from FreeBSD 11-CURRENT (which HardenedBSD syncs from every six hours) that I myself need (mainly, the updates to the ath(4) driver). Though I publish these builds for others to use, they're primarily for my own usage. I just publish them in the hope that others find them useful.

So, I will be basing my OPNSense + HardenedBSD builds based on 11-CURRENT (and, when 11.0 comes out, 11-STABLE). The biggest problem is the changes to the 802.11 stack that remove the raw wireless devices from  ifconfig output. That throws a wrench into OPNSense (and I'll assume pfSense as well, though since I have no way to produce my own builds, I can't verify). I'm very slowly working to resolve that issue. My next builds will be published regardless of the status of the fix.

My time is extremely limited these days. I'm holding off doing new builds until 16.1 is published. Once that's published, I need to forward-port my custom patches to our forked OPNSense code. I probably won't release any builds until 16.1.1 (it'll probably take around a week after 16.1 is published to finish the forward port).

With all that said, there's nothing stoping anyone from doing their own builds based on HardenedBSD 10-STABLE (or 10.2-RELEASE). I've even included instructions on how I do builds on my personal blog: http://0xfeedface.org/2015/11/07/hbsd-opnsense.html

Let me know if you have any questions, comments, or concerns.

Cool! Thanks! It'll be another couple weeks before I can work further on the wireless issues. I've got a patch to core.git that I've yet to commit to hbsd's fork that starts the port. I need to get back with Adrian Chadd to see if the wireless issues I'm having on 11-CURRENT with hostap mode are specific to me or if he can reproduce. I'll be celebrating five years of marriage with my wife next week, so it'll be a while before I can finish this up.

Yup. Both of these issues are caused by changes upstream (FreeBSD). Neither are caused by OPNSense.

[pfsync kernel panic]

Here's a little status update and a sneak peek:

I have an 11-CURRENT build that I'm testing out. However, there are two issues:

• pfsync kernel panic: I've disabled pfsync for now, so no HA setups.
• Wireless non-functional: The wireless stack on FreeBSD 11-CURRENT has changed quite drastically. Wireless is broken. I've filed a bug report here: https://github.com/opnsense/core/issues/480.

I've also now figured out how to build for the Netgate APU4. My next builds will contain images for: generic, netgate rcc-ve 4860, and the netgate apu4. Please be aware that this build will require a full reinstallation, but backing up and restoring your config ought to work like normal. Going forward, I'll only be using -CURRENT.

Screenshot of a working test installation on my Netgate RCC-VE 4860: http://imgur.com/XVHcZV7

I just documented my build setup: http://0xfeedface.org/2015/11/07/hbsd-opnsense.html

So I realize I just said that my latest build supports binary upgrades, but due to some issues with going from 15.7.16 to 15.7.18, I'm going to say that it's not possible to do a binary upgrade. There's also a few more changes I should make to the UI (like removing all the mirrors in one of the drop downs). I'm expecting to work on a new build any time within the next 30 days. I'm slightly on the busy side these days with work and a cute wife.

Thanks for all those who are helping test this!

It ought to work once I get the right bits pushed to the web server. I've got a few high-priority things going on and will hopefully take care of that part by the end of October.

New experimental builds posted! You can find them here: https://hardenedbsd.org/~shawn/opnsense/hbsd-exp-06-15.7/

I still need to populate the package repo on our web server, but this build itself now supports binary updates.

I can't speak for the OPNSense crew, but I'll be continuously providing builds based on HardenedBSD. I'm doing a new build now based on 15.7.15. :-) And I have all the bits in place to support binary updates along with managed secadm rule updates. Build seven will likely also include Integriforce rules for all of userland. :-)

Shawn Webb here. Yeah, the HardenedBSD experimental builds support the same hardware as OPNSense. Build number six was going to happen yesterday, but will be delayed until next week at the earliest and October at the latest.

Please note that build five doesn't support binary updates, but build six will. So going from three to five (four is intentionally missing) or five to six you'll have to backup your config, reinstall, then restore your config. Versions six and onward will have the same binary upgrade capabilities you currently enjoy with OPNSense.

Great work. I'll look into this in a bit more detail as I get time. I'm hoping to create an OPNSense build that acts simply as a Tor transparent proxy.