DaemonForums  

Go Back   DaemonForums > OpenBSD > OpenBSD Security

OpenBSD Security Functionally paranoid!

Reply
 
Thread Tools Display Modes
  #1   (View Single Post)  
Old 16th January 2009
guitarscn guitarscn is offline
Package Pilot
 
Join Date: Oct 2008
Posts: 166
Default Is there a purpose for using pf if you have a hardware router/firewall?

I haven't started using pf yet, but I'm wondering if it would still be worth using if I already have a built-in firewall with my router and what the difference is between that and setting up a dedicated box as a pf firewall for everything to run through first before reaching any other computers on my network as opposed to not having one and just using the firewall router.
Reply With Quote
  #2   (View Single Post)  
Old 16th January 2009
BSDfan666 BSDfan666 is offline
Real Name: N/A, this is the interweb.
Banned
 
Join Date: Apr 2008
Location: Ontario, Canada
Posts: 2,223
Default

There are many benefits.. what you call a router is simply a embedded packet filter, a firewall is just a term used to describe some of the features it provides.

If you were to replace the router with a dedicated OpenBSD router, there would be benefits.. advanced networking abilities.. flexibility.. and access to the source code is always nice.

I'm not going to list all the benefits of using OpenBSD instead of some embedded device running a generic RTOS, but personally.. I would always choose the former over the latter.

Hope it helps..
Reply With Quote
  #3   (View Single Post)  
Old 16th January 2009
BSDfan666 BSDfan666 is offline
Real Name: N/A, this is the interweb.
Banned
 
Join Date: Apr 2008
Location: Ontario, Canada
Posts: 2,223
Default

Note; there is no reason to have both... if that's what you were asking, it would be highly redundant.
Reply With Quote
  #4   (View Single Post)  
Old 16th January 2009
ctaranotte ctaranotte is offline
New User
 
Join Date: May 2008
Posts: 5
Default

Quote:
Originally Posted by guitarscn View Post
I haven't started using pf yet, but I'm wondering if it would still be worth using if I already have a built-in firewall with my router and what the difference is between that and setting up a dedicated box as a pf firewall for everything to run through first before reaching any other computers on my network as opposed to not having one and just using the firewall router.
Your main concerns should be:

1) The nature and volume of the expected traffic. Would you have a FTP, HTTP and/or SSH server? Would you do some p2p? Would you use an XBox?

2) The specifications of your network: would it link two desktop computers? More computers and a server? Or else?

3) The specifications of the router: is this a heavy-duty router or one you just bought from you favorite consumer hardware shop? Could it handle the nature and volume of your traffic?

Depending on your answers to 1), 2) and 3), my guess is that you might better scrap your router for a dedicated box (OpenBSD, FreeBSD or NetBSD), pf, AltQ and a switch instead.

Hope its helps.

Last edited by ctaranotte; 16th January 2009 at 12:51 PM.
Reply With Quote
  #5   (View Single Post)  
Old 16th January 2009
jggimi's Avatar
jggimi jggimi is offline
More noise than signal
 
Join Date: May 2008
Location: USA
Posts: 7,975
Default

Why use PF if you're not using OpenBSD as a router or bridge? Perhaps it's being used as a small server, or perhaps a workstation?
  • Filtering rules can be used to control access out, or access in.
  • Queue management rules can be used to shape outbound traffic
  • State table management rules can be used to manage and control inbound requests for services
  • Advanced UDP/TCP port redirection can be used for service management
You're probably familiar with filtering rules if you've ever used "personal firewall" software. The flexibility (and perhaps complexity) of PF rules typically allow more control over filtering than other firewall software.

Let's look at the other three features.
First, having used a SOHO NAT router, you may be familiar with "port forwarding" to expose services on your local network. This is a subset of the capabilities of PF port redirection rules. In particular, redirection to loopback can provide great flexibilty for virtual server control and management.

As for the last two features, I'm not aware of any SOHO router that can do traffic shaping (bandwidth control by application or network service) or inbound request rate control.
Keep your NAT router for the time being, and begin to learn how to use PF to your advantage. Eventually, you may sell your router and replace it with an OpenBSD platform. I did.

Last edited by jggimi; 16th January 2009 at 02:03 PM.
Reply With Quote
  #6   (View Single Post)  
Old 20th January 2009
ai-danno's Avatar
ai-danno ai-danno is offline
Spam Deminer
 
Join Date: May 2008
Location: Boca Raton, Florida
Posts: 284
Default

Traffic shaping isn't the only feature/capability OpenBSD with PF has that most commercial SOHO routers don't-

- IDS/IPS (Intrusion Detection and Prevention)
- traffic and performance graphing.
- A/V protection
- DNS server with dynamic DNS
- high-grade site-to-site VPN tunnelling and road-warrior capability
- HA (High Availability) with another firewall
- Spam filter (that works!)
- OS is itself secure, so low likelihood of exploitation.
- OS and applications are regularly updated.

Of course, you have to learn how to install, configure, and maintain the applications that provide the aforementioned functionality, but that's some huge potential.

But I believe the choice is not based on feature-comparison, but rather love of the job- you like OpenBSD/PF for various reasons already and know that it would do the same job and more, so why not use it?
__________________
Network Firefighter
Reply With Quote
  #7   (View Single Post)  
Old 20th January 2009
jggimi's Avatar
jggimi jggimi is offline
More noise than signal
 
Join Date: May 2008
Location: USA
Posts: 7,975
Default

Little of that is PF, however.
Reply With Quote
  #8   (View Single Post)  
Old 20th January 2009
ai-danno's Avatar
ai-danno ai-danno is offline
Spam Deminer
 
Join Date: May 2008
Location: Boca Raton, Florida
Posts: 284
Default

Very true. I don't want to bait and switch- I guess the idea is that SOHO routers have zero extensibility, while OBSD firewalls are completely extensible beyond a simple PF NAT Firewall.
__________________
Network Firefighter
Reply With Quote
  #9   (View Single Post)  
Old 22nd January 2009
JMJ_coder JMJ_coder is offline
VPN Cryptographer
 
Join Date: May 2008
Posts: 464
Default

Quote:
Originally Posted by BSDfan666 View Post
Note; there is no reason to have both... if that's what you were asking, it would be highly redundant.
But, would it affect network performance?
__________________
And the WORD was made flesh, and dwelt among us. (John 1:14)
Reply With Quote
Old 23rd January 2009
ai-danno's Avatar
ai-danno ai-danno is offline
Spam Deminer
 
Join Date: May 2008
Location: Boca Raton, Florida
Posts: 284
Default

Quote:
Originally Posted by JMJ_coder View Post
But, would it affect network performance?
Not at average residential speeds. As a real-world example, here's my current setup-

- L2 unmanaged switch
- ADSL router with NAT (connected to switch and ISP)
- Desktop (connected to switch)
- OBSD box (connected to switch)


The Desktop gets a DHCP address (MAC-controlled) from the OBSD box that points it to the OBSD box for routing. The OBSD box is just a one-armed (single nic) NAT translator. The OBSD box picks up the packets from the Desktop, translates and filters them, then routes them out to the ADSL router, which NATs the packets one more time before routing them on to my ISP.

It's not the most network-efficient setup- but I have seen zero performance problems. I will eventually scale down what the ADSL router does in favor of the OBSD box (read: PPOE, NAT) and re-do the OBSD box with two nics, but for now, it's fine.

The OBSD box also fulfills the following functions with no discernible network latency-

- Cacti graphing
- DNS
- NTP
- IDS (with Snort/BASE)
- web server
- db server

... and will soon take on VPN services and IPS (snort2c). All with no network performance issues at all so far.
__________________
Network Firefighter
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Hardware recommendation: what hardware to buy for my new FreeBSD desktop? Broodjegehaktmetmayo General Hardware 92 11th February 2009 10:43 PM
FreeBSD as firewall/router on VMware ESXi Bruco FreeBSD General 12 6th December 2008 08:37 PM
What Sun hardware do you have revzalot General Hardware 7 22nd August 2008 01:44 PM
Point-to-Point VPN + Firewall + Router (sorta) - What should I use? Bruco FreeBSD General 6 5th July 2008 11:09 PM
Firewall Hardware Questions gunderwood OpenBSD General 3 15th May 2008 03:50 AM


All times are GMT. The time now is 04:56 AM.


Powered by vBulletin® Version 3.8.4
Copyright ©2000 - 2024, Jelsoft Enterprises Ltd.
Content copyright © 2007-2010, the authors
Daemon image copyright ©1988, Marshall Kirk McKusick