OPNsense
  • Home
  • Help
  • Search
  • Login
  • Register

  • OPNsense Forum »
  • English Forums »
  • General Discussion »
  • question on FreeBSD for underlying system on OPNsense
« previous next »
  • Print
Pages: [1]

Author Topic: question on FreeBSD for underlying system on OPNsense  (Read 416 times)

ajoeiam

  • Jr. Member
  • **
  • Posts: 75
  • Karma: 1
    • View Profile
question on FreeBSD for underlying system on OPNsense
« on: September 18, 2023, 03:34:33 pm »
Greetings

I have been having a more than somewhat painful odyssey in trying to install and setup opnsense.

Some of the issues (at the very least) are directly related to the state of the drivers on FreeBSD.
Have spent a lot of time reading on FreeBSD forum and in whatever else I can find I'm starting to wonder if
OPNsense is served well in their use of FreeBSD as a base system for OPNsense.

I'm a wondering if anything near the amount of effort, for support and drivers, would be required if one
used a hardened version of Devuan (Debian derivative w/o systemd). Such would remove issues with
drivers and open up the use of a wider range of hardware. I'm likely missing some things and am not
trying to suggest that a move should happen just wondering about the amount of support that I see
necessary in the forum and wonder as to options to reduce that need.

What say you?
Logged

Maurice

  • Hero Member
  • *****
  • Posts: 773
  • Karma: 86
    • View Profile
    • GitHub
Re: question on FreeBSD for underlying system on OPNsense
« Reply #1 on: September 18, 2023, 04:41:17 pm »
Personal opinion: OPNsense is a network appliance, not a general purpose desktop / server OS. Buy the hardware which fits the software, not the other way around. Or use virtualization to offload driver stuff to a hypervisor of your choice (can be Linux-based).

Also, remember that an important part of Deciso's business is developing and selling hardware optimised for OPNsense.

If you prefer a Linux-based firewall, there are other options.

Cheers
Maurice
Logged
OPNsense virtual machine images
OPNsense aarch64 firmware repository

ajoeiam

  • Jr. Member
  • **
  • Posts: 75
  • Karma: 1
    • View Profile
Re: question on FreeBSD for underlying system on OPNsense
« Reply #2 on: September 18, 2023, 06:44:25 pm »
Quote from: Maurice on September 18, 2023, 04:41:17 pm
Personal opinion: OPNsense is a network appliance, not a general purpose desktop / server OS. Buy the hardware which fits the software, not the other way around. Or use virtualization to offload driver stuff to a hypervisor of your choice (can be Linux-based).

Also, remember that an important part of Deciso's business is developing and selling hardware optimised for OPNsense.

If you prefer a Linux-based firewall, there are other options.

Cheers
Maurice

Had I known how incredibly picky and complex the relationship between OPN and FreeBSD was I would have.
Hmmmmmm - - - I haven't been able to find a linux-based firewall that is ipv6 capable.
If you have - - - please advise.
I have had excellent success purchasing used commercial SFF machines and using them as servers and as test bed systems for other critical systems. This was my first foray into the freebsd world  - - - most commentators talked about the similarity - - I've found the differences are huge (if you have problems finding linux support - - that's apple pie easy compared to freebsd support!!).
The first machine I tried to use had been used as a firewall and a number of individuals had reported success in installing opnsense - - - I couldn't get things to install so went with option #2 - a lightly used i5 system with some decent chops - - - just today using more than one rj-45 port is considered bad form so its almost impossible to find such - - - then if you're using a tiny form factor - - - its almost impossible (dunno how one could) drop in a pcie card to give good rj-45 ports. Then without that - - - well freebsd doesn't much like anything but a pcie port card although others seem to have been successful and opn really doesn't seem to like anything other than motherboard direct connected ports.
I had assumed that freebsd was as flexible as *nix - - - wrongly as it turns out.
Also know that there are options to severely harden up *nix - - - so was wondering what advantage was given by using freebsd - - perhaps there is a list of such somewhere.
(It is listed that opn actually modifies freebsd to harden it - - -yes?)

So perhaps the software is also designed to sell the hardware.
In that case - - - sorry - - - its out of my budgetary range (even though I would like to run great software my pocketbook dictates what I do to more than a trivial extent!!).
Logged

lilsense

  • Hero Member
  • *****
  • Posts: 527
  • Karma: 19
    • View Profile
Re: question on FreeBSD for underlying system on OPNsense
« Reply #3 on: September 18, 2023, 08:12:32 pm »
what??? NONESENSE!!!!

have not heard of VyOS?

https://docs.vyos.io/en/equuleus/configuration/firewall/index.html

Thanks for using OPNsense. You can proceed to uninstall and use VyOS. :D
Logged

Patrick M. Hausen

  • Hero Member
  • *****
  • Posts: 3603
  • Karma: 305
    • View Profile
Re: question on FreeBSD for underlying system on OPNsense
« Reply #4 on: September 18, 2023, 11:02:01 pm »
OPNsense and pfSense are deeply rooted in the "pf" firewall, which is only available on BSD. Case closed. Pick a different Linzx based product if that is what you prefer. Nobody is twisting your arm ...
Logged
Supermicro A2SDi-4C-HLN4F mainboard
Supermicro SC101F chassis
Intel Atom C3558 - 4 cores
16 GB ECC memory
Crucial MX 300 SSD M.2 SATA 275 GB
People who think they know everything are a great annoyance to those of us who do. (Isaac Asimov)

passeri

  • Newbie
  • *
  • Posts: 16
  • Karma: 2
    • View Profile
Re: question on FreeBSD for underlying system on OPNsense
« Reply #5 on: September 19, 2023, 02:18:50 am »
ajoeiam, it looks to me that you are trying to build your hardware out of parts lying about the place plus additions. It is not a necessary alternative that you buy hardware from Deciso, much as that may help them to develop OPNsense. There are low-cost router-oriented mini-PCs aplenty on which one can install FreeBSD/OPNsense without any difficulty. I have some so installed, with 4 and 6 ports, passively cooled. One of them came with pfSense already installed (and now replaced), an indicator of suitability. As already noted above, a firewall is and should be an appliance once installed. Reliability is key.

The suggestion you simply run OPNsense in a VM while Linux handles the interface cards may solve your problem but I would not choose your apparent route to a reliable and functional appliance. There are of course Linux options. Choose what suits you best. After considering at some length most of the open, free or similar options plus relevant commercial ones, I am here, largely on grounds of capability+support of the product.
Logged

CJ

  • Sr. Member
  • ****
  • Posts: 432
  • Karma: 17
    • View Profile
    • Have Answer, Will Blog
Re: question on FreeBSD for underlying system on OPNsense
« Reply #6 on: September 20, 2023, 03:30:56 pm »
As someone how has run multiple FreeBSD routers using generic desktops with addon NICs, I'm a bit surprised that you would have issues with going that route.  I can pick up used desktops quite cheaply, and the desktop form factor allows me to have plenty of expandability.

I will admit that the desktop and addon NICs use more space and power than other options but it's not that much different and allows me to have more resources to throw at things like IDS/IPS.  About the only time I regret the higher power budget is my UPS runtime. :D
Logged
Have Answer, Will Blog

meyergru

  • Hero Member
  • *****
  • Posts: 597
  • Karma: 53
    • View Profile
    • congenio
Re: question on FreeBSD for underlying system on OPNsense
« Reply #7 on: September 20, 2023, 04:46:12 pm »
Quote from: ajoeiam on September 18, 2023, 03:34:33 pm
I have been having a more than somewhat painful odyssey in trying to install and setup opnsense.

Some of the issues (at the very least) are directly related to the state of the drivers on FreeBSD.

Apart from the near-impossible porting of OpnSense (or pfSense) to Linux because of lack of pf, having followed many of your posts, I agree you had a painful odyssey, but as to what was the reason, evidence indicates otherwise:

Most of your issues were networking-related stuff and only one (although with several different topics) could be tracked down to drivers (or hardware), namely that you tried to use USB network adapters which are indeed considered unreliable - and not only under FreeBSD.
Logged
DEC760 - the model that Deciso never built

lilsense

  • Hero Member
  • *****
  • Posts: 527
  • Karma: 19
    • View Profile
Re: question on FreeBSD for underlying system on OPNsense
« Reply #8 on: September 20, 2023, 05:26:12 pm »
not that you brought up pf... On an OT, I was just reading up about how netflix uses eBPF on linux to be able to gather streams, etc for monitoring...
Now, I always thought that BPF and PF were the same, aren't they?


Edit:   Ah! Thanks to google ai:

pf is involved in filtering network traffic. bpf is an interface that captures and accesses raw network traffic.
Logged

Patrick M. Hausen

  • Hero Member
  • *****
  • Posts: 3603
  • Karma: 305
    • View Profile
Re: question on FreeBSD for underlying system on OPNsense
« Reply #9 on: September 20, 2023, 06:11:18 pm »
And eBPF is something entirely different because like time and time again Linux folks could not be bothered to just use DTrace.
Logged
Supermicro A2SDi-4C-HLN4F mainboard
Supermicro SC101F chassis
Intel Atom C3558 - 4 cores
16 GB ECC memory
Crucial MX 300 SSD M.2 SATA 275 GB
People who think they know everything are a great annoyance to those of us who do. (Isaac Asimov)

lilsense

  • Hero Member
  • *****
  • Posts: 527
  • Karma: 19
    • View Profile
Re: question on FreeBSD for underlying system on OPNsense
« Reply #10 on: September 21, 2023, 01:04:45 am »
but based on Netflix blog site, eBPF requires very little resources and I know there are comparisons with DTrace. Some things eBPF is far faster and some Dtrace...

I was looking in terms of monitoring OPNsense as a whole with eBPF, as I have not seen one currently there with DTrace??? Maybe I am over looking it...
Logged

Patrick M. Hausen

  • Hero Member
  • *****
  • Posts: 3603
  • Karma: 305
    • View Profile
Re: question on FreeBSD for underlying system on OPNsense
« Reply #11 on: September 21, 2023, 06:12:23 am »
eBPF is not available on FreeBSD. Linux only.
Logged
Supermicro A2SDi-4C-HLN4F mainboard
Supermicro SC101F chassis
Intel Atom C3558 - 4 cores
16 GB ECC memory
Crucial MX 300 SSD M.2 SATA 275 GB
People who think they know everything are a great annoyance to those of us who do. (Isaac Asimov)

lilsense

  • Hero Member
  • *****
  • Posts: 527
  • Karma: 19
    • View Profile
Re: question on FreeBSD for underlying system on OPNsense
« Reply #12 on: September 21, 2023, 06:36:27 pm »
I understand Patrick. I was wondering if the OPNsense is utilizing the dtrace like the link below...

https://www.brendangregg.com/dtracetoolkit.html
Logged

Patrick M. Hausen

  • Hero Member
  • *****
  • Posts: 3603
  • Karma: 305
    • View Profile
Re: question on FreeBSD for underlying system on OPNsense
« Reply #13 on: September 21, 2023, 06:52:03 pm »
Feel free to download the toolkit and debug away. DTrace is part of OPNsense. The toolkit are scripts in the D programming language which DTrace uses.

You might want to start with dwatch(1) which is a simpler frontend to DTrace written by Devin Teske.

HTH, I think I don't quite understand your question. DTrace is a system call tracing facility much like tcpdump/bpf is a packet tracing facility. You use it on the command line to debug misbehaving processes.
Logged
Supermicro A2SDi-4C-HLN4F mainboard
Supermicro SC101F chassis
Intel Atom C3558 - 4 cores
16 GB ECC memory
Crucial MX 300 SSD M.2 SATA 275 GB
People who think they know everything are a great annoyance to those of us who do. (Isaac Asimov)

  • Print
Pages: [1]
« previous next »
  • OPNsense Forum »
  • English Forums »
  • General Discussion »
  • question on FreeBSD for underlying system on OPNsense
 

OPNsense is an OSS project © Deciso B.V. 2015 - 2023 All rights reserved
  • SMF 2.0.19 | SMF © 2021, Simple Machines
    Privacy Policy
    | XHTML | RSS | WAP2