Slashdot Mirror

Might want to do your research a bit more. OpenBSD is very useful for VPN Tunnels, Firewalls (some of the easiest to configure and most powerful), routers, etc.

I run OpenBSD as a firewall OS and I challenge anyone to gain root on a similar setup, since it has no IPs on it's interfaces it might be a bit hard.

http://www.openlysecure.org/openbsd/how-to/invisib le_firewall.html

...and another one...

I was born on a command line, no really... Used to make firewalls with RedHat, ohh the pain. OpenBSD offers more out of the box than most other OS's, If I need a Firewall I grab a copy and let the packets fly. Interesting note OBSD is the ONLY NIX that can do this, Invisible Firewall RedHat is based on Minix. BSD was around much longer than that, and ultimately they all came from Multics/UniCS, but how many here ever worked on PDP11? BSD also has the benifit of millons of slave labour hours from thousands of University Students. No other operating system can have that kind of claim. I'm happy to call OBSD a Canadian Product. You will love the blowfish!

Theres a good guide to setting up openbsd IPF firewalls here

A much more secure solution would be to have a firewall with no IP addresses.

Memoirs of an Invisible Firewall

Using OpenBSD (and linux could work too) it is possible to create a bridging firewall with no IPs that simply scrubs packets as they come through the interface.

One could always add a dialup modem to the machine in case remote access was neccessary but when you have two nics neither of which have IP addresses or running services it makes a machine a whole hell of a lot more useful then a linux machine in halted mode which could EASILY run into weird memory/timing issues. (which the author didn't bring up)

In the stone age of firewalling, a firewall was a fairly complicated device that was less-than-trivial to factor into your network. It needed an IP address on it's outside, and another on the inside. This immediately created subnetting problems, forcing wasted IP allocation and overall disquietude amongst the cognoscenti. It also meant that your firewall was very visible to the world, and its function was rather obvious and easy to deduce. There had to be a better way. And now there is...

Dream with me for a moment: A black box, shimmering in the soft LED-green glow of the network cabinet. You take the network cable from your router, which previously went into a switch, and stick it in one of the snappy plugs in the back of the box. There's one more plug on the black box, so you grab another cable and hook the box up to the switch. You step back, and suddenly: everything looks the same. You go to all your computers. As far as you can tell from inside and outside the network, the box doesn't exist. It does nothing. A few minutes later, you have a monitor and keyboard hooked up to the back of the box. You quickly and easily begin to tweak a file that gives you fine grained control over access to your network. You shut off all access to your mailserver from the outside world except on port 25.

I don't subscribe to the notion that these are in opposition to one another. That OpenBSD is not always the answer is very true. But all good things have their purposes. In fact, I use them both in my segmented, handy-man-special, home network:

OpenBSD for Mac68K (all these were bought for a pittance on eBay):
2 Quadra 700s: transparent firewall (ipf) and 3-legged NAT (ipnat)
Quadra 610: mail server (qmail)
Centris 610 (w/68040): dns server (djbdns)

LinuxPPC: (Bastille'd by using the Sparc trick on the FAQ)
2 7300s: apache and MySQL (soon to be PostgreSQL?)
9500/G3: mol / streaming with videod, icecast (Better choices are welcome.)
Pismo PowerBook: dual boot

I haven't had as many years using Linux (only 2) as you have. And aside from that my computer experience amounts to a few mid-'80s semesters of VAXen and the entire life of the Mac platform -- and around 4 months of NetBSD and OpenBSD. But I have to say it (adding BSD to the mix) hasn't been that hard at all. There are many similarities with Linux. Much of your current knowledge will transfer. For anyone who has learned guitar and then tried bass, or ukulele, you've experienced this before.

-B...