@jam said: which firewall should I use when learning freebsd?
I've been through this pain. Ended up with IPFW more down to the (potential) integration with Webmin, than any other reason.
In stasis until the shitposting stops/abates.
Than=compare;then=sequence:brought=bring;bought=buy:staffs=pile of sticks:informations/infos=no plural. It wisnae me! A big boy done it and ran away. || NVMe2G for life! until death (the end is nigh).
BTW, has anyone had any more success with using a NetBSD KASLR kernel? Using the instructions from https://wiki.netbsd.org/security/kaslr/ only results in a page fault:
Thanks for cloudbsd.xyz and also for suggesting unitedbsd.com on cloudbsd.com.
I read cloudbsd.xyz. I thought it would be a lot of fun to try it!
I plan to post here my quick recipe listing the steps I used to install from @cmeerw's NetBSD 10 image and update to what seems like self-compiled NetBSD-current. The post is done -- I just want to run through the steps once more to double check.
Then I hope to try your cloudbsd.xyz install method. Haha, I bet fifty cents I can generate a question or two or three!
Bonus points for non-Americanized (sic) spelling.
An interesting quick read (excluding the code), that (IMHO) is well written/formatted. A few corrections..
pivot_chroot on the other end will actually swap mounting points.
-->
pivot_root on the other hand will actually swap mounting points.
..understanding quite straightforward.
to be swapped, once everything is ready.
(might read a bit better)
..go further: use an emulator
..tools to be developped
..the processus processes
(said phonetically? )
Well done though!
(I wisnae being a totally pedant )
In stasis until the shitposting stops/abates.
Than=compare;then=sequence:brought=bring;bought=buy:staffs=pile of sticks:informations/infos=no plural. It wisnae me! A big boy done it and ran away. || NVMe2G for life! until death (the end is nigh).
An interesting quick read (excluding the code), that (IMHO) is well written/formatted.
Well done though!
First, thanks for the compliment on the article
A few corrections..
No
I don't want be brutal, but did not come here to seek for grammar feedbacks.
I already got feedbacks on that early on and only came because people looked interested and I like to share.
English is not my first language and was never good at writing/formulations even in my mother-tongue.
In my experience everyone have (and often colliding) feedbacks on potential corrections.
There is a time where it is relentless not to "cut the losses" and where it has to stop.
Otherwise in 4 years from now, someone's gonna come back again telling me to change something.
I was open to grammar feedbacks while it was fresh, not any-more.
(I wisnae being a totally pedant )
I know this comes out of a good intent.
However 4 months after publication, this becomes irrelevant and annoying.
I'm happy to share interesting things and that is what mattered/matters.
I'll take the feedback anyway, but no guaranty in terms of publishing the changes on the short term.
Bonus points for non-Americanized (sic) spelling.
I try my best, currently living in Scotland.
wisnae
Always happy talking with a Scottish fellow.
Nb: The pivot_root part was hard to write to keep some clarity without writing an essay just on that.
Nb2: Yeah maybe I'm a bit susceptible regarding my writing abilities.
.. was primarily to save confusion, due to the typo.
In stasis until the shitposting stops/abates.
Than=compare;then=sequence:brought=bring;bought=buy:staffs=pile of sticks:informations/infos=no plural. It wisnae me! A big boy done it and ran away. || NVMe2G for life! until death (the end is nigh).
I don't want be brutal, but did not come here to seek for grammar feedbacks.
LES uses an advanced biomechanical AI for spelling and grammar corrections.
The feature is now fully automated so users needn't make a request or tick any options for it to be activated.
It is also hard-coded, so can't be disabled.
I think we see fewer providers offering NetBSD images because NetBSD isn't requested as often as other BSDs.
I used @cmeerw's NetBSD 10 image because it was readily available thanks to the courtesy of Linveo. Some providers won't install custom OS images, so their customers are stuck with what's available. That's why @naguam developed CloudBSD.xyz, so people could install NetBSD without needing any customization on the provider side.
Even if I had installed using a NetBDSD-current image, I still would have to go through pretty much the same steps to keep the image up-to-date. All I have to do now to stay up-to-date is run cvs update, rebuild, reinstall, and reboot. I'm sure there are times when the build breaks or the reboot fails, but in my limited experience of a few years, I don't recall a build or a reboot failure.
If I misunderstood your question, please ask again.
@Crab said: May I ask what was your experience with them? What made you go back to Slack?
With @Crab, may I please join in asking what was your experience with the BSDs and what made you go back to Slack?
FWIW, I like Slackware too! Darkstar, my old server in Texas, ran Slackware-current. Everything worked great! Maybe LES needs a Slackware thread? @AuroraZero also likes Slack, or so I hear. I vote for making a Slackware thread!
In case anybody has been trying to set up FreeBSD as a VPN server and has been struggling with somewhat lackluster network performance with virtio drivers (e1000 actually work very well in KVM), keep on reading.
Despite @linveo having excellent network performance on their nodes, the VPN download has been very slow (~1Mbps), and I wanted to get to the bottom of it.
First, I thought that there's something to do with my firewall/NAT settings and I tried regular ipfw, ipfw in-kernel and pf, but they all shared the same symptoms: download is crawling, but upload is good.
Second, I was wondering whether the network driver has something to do with it and it absolutely does. I tried virtio with other providers and the same download performance issue kept occurring. Some control panels allow you to use e1000, which is not necessarily provide you the greatest performance, but is a reliable driver and with that VPN connections sped up significantly.
@linveo has excellent network performance on his nodes, but VirtFusion they use doesn't allow to change the network driver, so I kept looking for some clues and I stumbled upon this thread:
After a reboot, I was very happy and relieved to see that the download speeds increased drastically, over 100x! YMMW, but give it a try if you have had similar issues.
Also please note that I did try OpenVPN and Wireguard just to see whether there could be something to do with the actual VPN implementation, but both were actually behaving the same way.
TL;DR: If you have download performance problems with FreeBSD and either OpenVPN or Wireguard VPN server, try the /boot/loader.conf settings provided above.
It was the VPN problems i had.. 1st i had firewalls problems could not get any internet, and after makin that work; slow speeds. I know that network is good and should receive better speeds but that was slow. So now is rock solid
I ended up reinstalling and rebuilding my nice Linveo VPS <3 -- not as expected in Debian so as to try @naguam's install -- but, instead of Debian, again in NetBSD-current upgraded from @cmeerw's NetBSD 10 Minimum.
This time I additionally installed pkgsrc and compiled a few packages also from src. Everything seems to work really fast and really smoothly.
Maybe I should continue doing more NetBSD-current stuff on the Linveo VPS and try the CloudBSD.xyz Debian to NetBSD install elsewhere.
Back in the old days I had stuff I wanted to accomplish with NetBSD. Now I have free time to look around and to try stuff. It's peaceful!
Might anyone here want a shell account on my NetBSD-current VPS?
In stasis until the shitposting stops/abates.
Than=compare;then=sequence:brought=bring;bought=buy:staffs=pile of sticks:informations/infos=no plural. It wisnae me! A big boy done it and ran away. || NVMe2G for life! until death (the end is nigh).
@Not_Oles said: What are all you other guys doing on BSD nowadays?
Not much really, just noticed a small glitch in the network setup in my NetBSD 10 image. But it's probably really just cosmetic - it adds "alias" flags to the addresses when it shouldn't. Just something to keep in mind for the 10.1 update, once that gets released.
Other than that (not BSD related), need to start replacing my InceptionHosting VPSes, and then watch the C++ safety battles next week.
Today I had fun doing three things on my Linveo NetBSD-current VPS.
First, I tested the backup and restore function of the Virtfusion hypervisor. It seemed to work okay.
My test procedure was:
Initially I shutdown the VM within NetBSD (shutdown -h now). Then I powered off the VM in the Linveo Control Panel.
Next I made the backup, then restarted the VM, made a test file (touch tomwashere), and shut the VM down a second time, again both inside NetBSD and in the Control Panel.
Then I restored from the backup, which seemed to restart the VM automagically.
The restored VM seems to work fine, even without tomwashere (at least, it appears that the backup and restore function did not simply restart the existing image which had contained tomwashere).
Making the backup took about 7 minutes. Restoring from the backup took about 3-1/2 minutes.
I didn't see a way to export or download the backup image to another location. Did I miss something?
Here's the command I used to add a little left margin when reading the NetBSD code style guide on my Linveo VPS via ssh from my Chromebook:
linveo# pwd
/usr/src/share/misc
linveo# sed 's/^/ /g' style | less
Third, I wondered about NetBSD's ability to run Linux binaries. I looked at Chapter 31 of the NetBSD Guide, which covers NetBSD's Linux emulation. I wondered whether NetBSD might run Yabs. I'm still using the default sh shell, but pkgsrc has bash as well as fio and iperf3. Maybe even Geekbench 6 might run?
@Not_Oles said:
What are all you other guys doing on BSD nowadays?
I used to host the website on a NetBSD VPS running Caddy in a chroot as a user (and using npf to redirect the standard ports to ports above 1024).
I also used it for OpenVPN. (I had problems with IKEv2 and wireguard (both their implementation and the userspace implementation so I decided OpenVPN was good enough).
Now I always got interests in various OS and NetBSD looked more approachable to me to contribute at my level.
Overall you can host most common webservices on NetBSD despites some of its limitations.
Here is a non-exhaustive list of limitations I have with NetBSD for server use.
Lack of integration with many automation tools.
virtio, necessary for performance in most cloud providers is not always perfectly supported. (there are drivers but I've got many problems, including regarding storage and network where it is the most crucial.
Lack of hardware support in case of bare metal.
NPF is not too bad, but lacks features (it is L3 only, but sometimes L2 can be useful)
Same with other BSD but to be fair there is a need for a container-like solution and resource isolation among processes. (could be proper jails, only FreeBSD has some).
The Linux CAPs are very useful to let an app use reserved port ranges ( < 1024), on NetBSD you rely on manual port-forwarding firewall config.
Because NPF is custom, it is clearly absent of all automated configuration tools or api in programming langages.
NPF (not exhaustive) lacks proper documentation. I read examples and managed to build something, but to get what's allowed or what's not, is very hard.
NetBSD tun only supports ipv4, it's probably gonna change soon (maybe 10.1), but it is a problem.
A lot of Integrated services lack updates in terms of modern needs (Ipsec, TLS versions) and a lot of alternatives in repos lacks a default service script available.
Other things I forget.
And overall I'm sold with the Linux's Plan9 inspired Namespaces, necessary for containers, as well as cgroups.
One can do very interesting stuff with these.
I really thing BSD's would benefit from such a thing.
Here is a non-exhaustive list of limitations I have with NetBSD for server use.
[ . . . ]
virtio, necessary for performance in most cloud providers is not always perfectly supported. (there are drivers but I've got many problems, including regarding storage and network where it is the most crucial.
@Not_Oles said: I tested the backup and restore function of the Virtfusion hypervisor. It seemed to work okay.
This means that I can install Debian on my Linveo VPS, try @naguam's NetBSD install at CloudBSD.xyz all the while feeling somewhat confident that I probably can quickly and easily restore to the point where I left NetBSD.
Does anybody have a Kimsufi system with FreeBSD 14.1 and working IPv6 setup? I had a weak moment and got a box from their Black Friday sale, but IPv6 simply refuses to work no matter what I do. I have verified it working fine on Linux with their rescue system, so it has to be the OS setup, but as you know there's not much to it.
It really shouldn't be much more than this in /etc/rc.conf which works great elsewhere:
I can ping the gateway address just fine, but nothing beyond that. SLAAC doesn't seem to be supported, so it has to be set statically. I have tried different prefix lengths as well.
Trying to add the default router manually gives this error:
add net default: gateway 2607:5300:xx:xx:xx fib 0: Invalid argument
I have googled this up quite a bit without real success and tried various different ways described at FreeBSD forums and Reddit, but nothing conclusive. I even reached out to their support and all they told me is to follow their guide which doesn't say much.
Prefixlen 64 through rc.conf doesn't work, but for reason doing it manually like this does. Also route addition through rc.conf returns and invalid argument error, but manually works. Perhaps somebody here can explain why, but I'm just happy to have it finally working
Geekbench 6 is a downloaded, pre-compiled Linux ELF binary:
bash-5.2# file geekbench6
geekbench6: ELF 64-bit LSB pie executable, x86-64, version 1 (GNU/Linux), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, not stripped
bash-5.2#
Maybe there is a newer version of Geekbench than 6-1-0? I happened to have 6-1-0 handy.
What's up with the lines in the terminal output below that say >! [ 612604.8349775] linux_sys_rt_sigaction: setting signal 64 ignored? Maybe ignoring signal 64 is a safety feature in NetBSD Linux emulation? Seems like signal 64 is sometimes used in rootkits? Are people running Geekbench sometimes giving Geekbench root privileges even if they don't run Geekbench as root?
linveo# cd /use/pkgsrc/emulators/suse131_base
linveo# make && make install
[ . . . ]
linveo# modload compat_linux
linveo# echo $?
0
linveo# cd /emul/linux/bin
linveo# bash
bash-5.2# bash --version
GNU bash, version 5.2.37(1)-release (x86_64--netbsd)
Copyright (C) 2022 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software; you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
bash-5.2# cd /usr/pkgsrc/emulators/suse131_base/
bash-5.2# ls
CVS INSTALL MESSAGE.NetBSD distinfo
DEINSTALL MESSAGE.DragonFly Makefile files
DESCR MESSAGE.FreeBSD PLIST work
bash-5.2# ls ~
.bash_history .login Geekbench-6.1.0-Linux
.cshrc .profile Geekbench-6.1.0-Linux.tar.gz
.klogin .shrc motowashere
.lesshst .ssh plan9-environment-variables
bash-5.2# ls ~/Geekbench-6.1.0-Linux
geekbench-workload.plar geekbench6 geekbench_x86_64
geekbench.plar geekbench_avx2
bash-5.2# ls -l ~/Geekbench-6.1.0-Linux
total 488224
-rw-r--r-- 1 tom 1000 316570457 Jun 6 2023 geekbench-workload.plar
-rw-r--r-- 1 tom 1000 4295615 Jun 6 2023 geekbench.plar
-rwxr-xr-x 1 tom 1000 3468192 Jun 6 2023 geekbench6
-rwxr-xr-x 1 tom 1000 91511824 Jun 6 2023 geekbench_avx2
-rwxr-xr-x 1 tom 1000 83715032 Jun 6 2023 geekbench_x86_64
bash-5.2# ~/Geekbench-6.1.0-Linux/geekbench6
Geekbench 6.1.0 : https://www.geekbench.com/
Geekbench 6 requires an active internet connection and automatically uploads
benchmark results to the Geekbench Browser.
Upgrade to Geekbench 6 Pro to enable offline use and unlock other features:
https://store.primatelabs.com/v6
Enter your Geekbench 6 Pro license using the following command line:
/root/Geekbench-6.1.0-Linux/geekbench6 --unlock <email> <key>
System Information
Operating System openSUSE Leap 15.5 Alpha
Kernel Linux 6.3.10 x86_64
Model N/A
Motherboard N/A
CPU Information
Name AMD Ryzen 9 7950X
Topology 1 Processor, 1 Core, 2 Threads
Identifier AuthenticAMD Family 25 Model 97 Stepping 2
Base Frequency 4.49 GHz
L1 Instruction Cache 32.0 KB
L1 Data Cache 32.0 KB
L2 Cache 1.00 MB
L3 Cache 64.0 MB
Memory Information
Size 4.00 GB
Single-Core
Running File Compression
Running Navigation
Running HTML5 Browser
Running PDF Renderer
Running Photo Library
Running Clang
Running Text Processing
[ 612426.8340863] linux_sys_rt_sigaction: setting signal 64 ignored
Running Asset Compression
Running Object Detection
Running Background Blur
Running Horizon Detection
Running Object Remover
Running HDR
Running Photo Filter
Running Ray Tracer
Running Structure from Motion
Multi-Core
Running File Compression
Running Navigation
Running HTML5 Browser
Running PDF Renderer
Running Photo Library
Running Clang
Running Text Processing
[ 612604.8349775] linux_sys_rt_sigaction: setting signal 64 ignored
Running Asset Compression
Running Object Detection
Running Background Blur
Running Horizon Detection
Running Object Remover
Running HDR
Running Photo Filter
Running Ray Tracer
Running Structure from Motion
Uploading results to the Geekbench Browser. This could take a minute or two
depending on the speed of your internet connection.
Upload succeeded. Visit the following link and view your results online:
https://browser.geekbench.com/v6/cpu/9018149
Visit the following link and add this result to your profile:
https://browser.geekbench.com/v6/cpu/9018149/claim?key=903037
bash-5.2#
Wanted to post that I had some very unique router requirements, and ended up installing OPNSense on some hardware I put together and it not only worked out of the box, it pushes 10gbps pixies with ease on hardware sub 60w. Was a bear to configure though.
@ZizzyDizzyMC said:
Wanted to post that I had some very unique router requirements, and ended up installing OPNSense on some hardware I put together and it not only worked out of the box, it pushes 10gbps pixies with ease on hardware sub 60w. Was a bear to configure though.
That's the BSD power right there! What kind of hardware configuration you have if I may ask?
@ZizzyDizzyMC said:
Wanted to post that I had some very unique router requirements, and ended up installing OPNSense on some hardware I put together and it not only worked out of the box, it pushes 10gbps pixies with ease on hardware sub 60w. Was a bear to configure though.
That's the BSD power right there! What kind of hardware configuration you have if I may ask?
I'm using a box from Riverside Networks that was bricked, I opened it up reflashed the nvram chip and put on stock intel bios for the Xeon D cpu onboard. It has a Xeon D-1553N (8c16t) and 32GB of ram, quad 10g and 8 1g, but only 2 10g and 6 1g ports are usable due to the hardware design of the board using a multiplier that seems to only be supported by Riverside's custom distro stuff.
Definitely would never recommend Riverside's equipment due to how locked down it is, but used it can be made into something cool if you know your way around hardware.
@yoursunny It's a nice offer to share your ASN, thank you, but maybe you are just trolling. How can I know that you are not trolling?
We are the Official Troll so you can never tell.
When IPv6 is delivered via a BGP session, it is guaranteed to be a routed subnet instead of an on-link subnet.
Routed subnets have fewer problems than on-link subnets as you don't need to answer Neighbor Solicitations.
We accept Karma donations for the last flan. 🍮 affbrr
How is Official Troll status working for you? How will others' "never being able to tell" help you long term?
What I hope for, for you, instead of Official Troll status, would be to see you holding a wonderful reputation as helpful, friendly, and kind. And also as a fundamental contributor to the larger internet community. Like Rich Stevens: Guru of the Unix gurus. I want to see the US Congress and the President give you a standing ovation on the occasion of their granting you honorary full citizenship. But that's just what I want. You should do what you want.
When IPv6 is delivered via a BGP session, it is guaranteed to be a routed subnet instead of an on-link subnet.
Routed subnets have fewer problems than on-link subnets as you don't need to answer Neighbor Solicitations.
Thanks @yoursunny! Now I remember your ndpresponder which you told me about and which I used previously to get IPv6 working. I appreciate your patience in telling me a second time! Probably only 42 more times will be required!
So, @Crab, it looks like @yoursunny is kindly hinting that your issue with IPv6 and FreeBSD rc.conf not working but configuring rc.local working might be caused by rc.conf expecting but not receiving NDP responses.
@Not_Oles said:
So, @Crab, it looks like @yoursunny is kindly hinting that your issue with IPv6 and FreeBSD rc.conf not working but configuring rc.local working might be caused by rc.conf expecting but not receiving NDP responses.
Wireshark is your friend.
Wireshark solves confirms or denies all networking problems.
We accept Karma donations for the last flan. 🍮 affbrr
@Not_Oles said:
So, @Crab, it looks like @yoursunny is kindly hinting that your issue with IPv6 and FreeBSD rc.conf not working but configuring rc.local working might be caused by rc.conf expecting but not receiving NDP responses.
After reading through the latest comments, I went back and checked what I actually did to make it work and I realized my initial post about this was incorrect.
According to Kimsufi, only /128 is assigned to you. This means that you have 'neighbors' very close to you and according to our resident expert, @yoursunny, you have to deal with 'Neighbor Solicitations'.
The IPv6 configuration for my box is this:
inet6 2607:5300:1234:1234::1 prefixlen 128
and I said that adding the same thing with prefix length 64 from rc.conf didn't work but worked when you manually issued the command. Well, I was actually wrong with this statement and what I actually did was created a /64 for the same interface:
inet6 2607:5300:1234:12ff::1 prefixlen 64
As you can see the last 1234 is 12FF instead which now means that the neighbors and not anymore close by and if I interpret @yoursunny's comment 'Routed subnets have fewer problems' properly, that's exactly what is happening here.
Once /64 setting was added, creating a route for it didn't throw an error like it did when I just had /128:
When I was trying to get this work initially, I was asking Co-Pilot some advice for different possible configuration options. I asked it now why this type of config is needed, and this is what it responded:
In FreeBSD, when you assign an IPv6 address with a prefix length of /128 (like 2607:5300:1234:1234::1/128),
it means that this address is a single, specific address with no additional addresses in the same subnet.
This can sometimes cause issues with routing and connectivity because there's no room for a subnet prefix.
By adding a /64 address range (like 2607:5300:1234:12ff::1/64), you're defining a larger subnet that includes
your specific address. This helps with routing and ensures that your interface can communicate properly
within the network.
IPv6 addresses are divided into two parts: the network prefix and the interface identifier. When you use
a /128 prefix, you're saying that all 128 bits of the address are used to identify a single device. This
leaves no bits to define a network range or to address other devices within the same subnet. Essentially,
it’s like having a street address without naming the street—it’s too specific to form a neighborhood.
Here's a quick analogy:
/128 Prefix: This is like having a precise address like "123 Main St, Apartment 456." This address points
to a single apartment in a building, with no other addresses.
/64 Prefix: This is more like "Main St." This allows for many houses or buildings to be part of "Main St,"
defining a range of addresses within that street.
In networking terms, having a /64 prefix is standard practice for IPv6 because it allows for a vast number
of individual device addresses (2^64 addresses) within the same subnet. This facilitates proper routing
and communication between devices on the same network.
Thus, assigning a /64 address to your interface helps the network to understand that it’s part of a larger
subnet, making routing and communication smoother.
TL;DR
My last post was incorrect. You need to set up /128 AND /64 AND route on /64 to make it work:
I've not delved into IPv6 before (no need) so above was interesting. Analogous to IPv4 /32 & /24 methinks.
(Though I still don't get the convention of calling them a prefix, when they're often expressed as a suffix.)
In stasis until the shitposting stops/abates.
Than=compare;then=sequence:brought=bring;bought=buy:staffs=pile of sticks:informations/infos=no plural. It wisnae me! A big boy done it and ran away. || NVMe2G for life! until death (the end is nigh).
it looks like the server gets two IPv6 addresses, one from each invocation of ifconfig. The second line gives a single address (a /128 from a /64). The first line gives another single /128 address which, with respect to the /64 from the second line, is out-of-band because 1234:: is not part of 12ff::.
I guess that the router at 12ff:ff:ff:ff:ff might be configured to forward from and to send to 1234::1. Maybe the router neither accepts from nor sends to 12ff::1. Or maybe the 12ff::1 is used by your server both when packets from 1234::1 are sent to and when packets are received from 12ff:ff:ff:ff:ff.
I am not sure whether anything I am saying here is correct. It amazes me how complex the subject of networking seems.
At the least, it is delightful that you got IPv6 working with FreeBSD on your server! Congrats!
Are you assigned both 1234::1 and 12ff::1? If not, what happens if other VMs on that node use the same 12ff::1? Shouldn't that be at least an address that is guaranteed to be unique?
@cmeerw said:
Are you assigned both 1234::1 and 12ff::1? If not, what happens if other VMs on that node use the same 12ff::1? Shouldn't that be at least an address that is guaranteed to be unique?
Very good question! @Not_Oles is wondering about the same thing. 1234::1 is /64 which could easily be assigned instead of /128, but 12ff::1 is /56!
This is a dedicated, so there's no other tenant on the same box, but your question is still valid. If I have 1234::1, is there another person in OVH with 1235::1?
After posting the last message I tried bunch of different variations of this but nothing else works. Either you get 'No buffer space available' error while pinging, or 'Invalid argument' for just trying to set the route, or 'No route to host'. The /56 interface of 2607:5300:1234:12ff::1 also becomes pingable from outside network, so perhaps OVH is assigning /56 after all.
Hopefully somebody more knowledgeable (@yoursunny) can explain this. The strangest thing is that this works just fine with /128 address and provided gateway in Linux, but FreeBSD is refusing to accept them in the first place (invalid argument)!
@Crab said: The strangest thing is that this works just fine with /128 address and provided gateway in Linux, but FreeBSD is refusing to accept them in the first place (invalid argument)!
I think Linux only gets around this by letting you add a "random" host route on the network interface that you can then use for your default gateway.
On thing you could do on the BSDs is to use the link-local address of the gateway for your default route (although that has the disadvantage that the link-local address might change when the gateway device is replaced)
Otherwise, widening the network to a /56 (and making sure not to assign IPv6 addresses outside your assigned network to your local machine) might be the best option.
Comments
I've been through this pain. Ended up with IPFW more down to the (potential) integration with Webmin, than any other reason.
In stasis until the shitposting stops/abates.
Than=compare;then=sequence:brought=bring;bought=buy:staffs=pile of sticks:informations/infos=no plural.
It wisnae me! A big boy done it and ran away. || NVMe2G for life! until death (the end is nigh).
BTW, has anyone had any more success with using a NetBSD KASLR kernel? Using the instructions from https://wiki.netbsd.org/security/kaslr/ only results in a page fault:
@cmeerw Maybe I could build KASLR and try it if my building KASLR seems like it somehow might be helpful?
No, the string "KASLR" probably isn't random! /s
K = kernel
A = Address
S = Space
L = Layout
R = Randomization
Address space layout randomization
https://en.wikipedia.org/wiki/Address_space_layout_randomization
Kernel address space layout randomization
https://lwn.net/Articles/569635/
Opinions will vary but I’ve used PF for many years with success.
Hi,
I am the author of https://cloudbsd.xyz.
I saw people got interested in here so I created an account.
If you got questions do not hesitate.
For you information as I saw the question being asked, systemctl isolate is equivalent to telinit with sysv.
Systemd targets are equivalent to sysv runlevels.
In my case it is because it is an easy way to shutdown everything that's not a rescue ssh shell.
Cheers,
Hello @naguam!
Wow! Nice to meet you!
Thanks for cloudbsd.xyz and also for suggesting unitedbsd.com on cloudbsd.com.
I read cloudbsd.xyz. I thought it would be a lot of fun to try it!
I plan to post here my quick recipe listing the steps I used to install from @cmeerw's NetBSD 10 image and update to what seems like self-compiled NetBSD-current. The post is done -- I just want to run through the steps once more to double check.
Then I hope to try your cloudbsd.xyz install method. Haha, I bet fifty cents I can generate a question or two or three!
Thanks again for joining us here at LES!
Best!
Tom
Bonus points for non-Americanized (sic) spelling.
An interesting quick read (excluding the code), that (IMHO) is well written/formatted. A few corrections..
-->
(might read a bit better)
(said phonetically?
)
Well done though!
)
(I wisnae being a totally pedant
In stasis until the shitposting stops/abates.
Than=compare;then=sequence:brought=bring;bought=buy:staffs=pile of sticks:informations/infos=no plural.
It wisnae me! A big boy done it and ran away. || NVMe2G for life! until death (the end is nigh).
First, thanks for the compliment on the article
No
I don't want be brutal, but did not come here to seek for grammar feedbacks.
I already got feedbacks on that early on and only came because people looked interested and I like to share.
English is not my first language and was never good at writing/formulations even in my mother-tongue.
In my experience everyone have (and often colliding) feedbacks on potential corrections.
There is a time where it is relentless not to "cut the losses" and where it has to stop.
Otherwise in 4 years from now, someone's gonna come back again telling me to change something.
I was open to grammar feedbacks while it was fresh, not any-more.
I know this comes out of a good intent.
However 4 months after publication, this becomes irrelevant and annoying.
I'm happy to share interesting things and that is what mattered/matters.
I'll take the feedback anyway, but no guaranty in terms of publishing the changes on the short term.
I try my best, currently living in Scotland.
Always happy talking with a Scottish fellow.
Nb: The pivot_root part was hard to write to keep some clarity without writing an essay just on that.
Nb2: Yeah maybe I'm a bit susceptible regarding my writing abilities.
I'm always in awe of guys like you and @bikegremlin when it comes to your comms. skills.
The quoting of ..
.. was primarily to save confusion, due to the typo.
In stasis until the shitposting stops/abates.
Than=compare;then=sequence:brought=bring;bought=buy:staffs=pile of sticks:informations/infos=no plural.
It wisnae me! A big boy done it and ran away. || NVMe2G for life! until death (the end is nigh).
LES uses an advanced biomechanical AI for spelling and grammar corrections.
The feature is now fully automated so users needn't make a request or tick any options for it to be activated.
It is also hard-coded, so can't be disabled.
🔧 BikeGremlin guides & resources
Why people do not create some templates ready made for it?
I believe in good luck. Harder that I work ,luckier i get.
Hi @Chievo!
Sorry for the late reply. I think you are asking why people do not create templates ready made for NetBSD-current.
At https://nycdn.netbsd.org/pub/NetBSD-daily/HEAD/202410301200Z/images/ you can see that there are NetBSD-current images prepared every few days.
I think we see fewer providers offering NetBSD images because NetBSD isn't requested as often as other BSDs.
I used @cmeerw's NetBSD 10 image because it was readily available thanks to the courtesy of Linveo. Some providers won't install custom OS images, so their customers are stuck with what's available. That's why @naguam developed CloudBSD.xyz, so people could install NetBSD without needing any customization on the provider side.
Even if I had installed using a NetBDSD-current image, I still would have to go through pretty much the same steps to keep the image up-to-date. All I have to do now to stay up-to-date is run
cvs update, rebuild, reinstall, and reboot. I'm sure there are times when the build breaks or the reboot fails, but in my limited experience of a few years, I don't recall a build or a reboot failure.If I misunderstood your question, please ask again.
Best wishes!
Tom
Sadly after 2 months tinkering with BSD's i just could not resist and went back to this beauty on Linveo
ServerStatus , slackvpn , linux mirrors
Recommended Providers: Servarica(aff) | HostBRR(aff) | SolidVPS(aff) | RackNerd(aff) | KuroIT(aff) | AlphaVPS(aff) | HostDare(aff)
May I ask what was your experience with them? What made you go back to Slack?
@emperor
With @Crab, may I please join in asking what was your experience with the BSDs and what made you go back to Slack?
FWIW, I like Slackware too! Darkstar, my old server in Texas, ran Slackware-current. Everything worked great! Maybe LES needs a Slackware thread? @AuroraZero also likes Slack, or so I hear. I vote for making a Slackware thread!
In case anybody has been trying to set up FreeBSD as a VPN server and has been struggling with somewhat lackluster network performance with virtio drivers (e1000 actually work very well in KVM), keep on reading.
Despite @linveo having excellent network performance on their nodes, the VPN download has been very slow (~1Mbps), and I wanted to get to the bottom of it.
First, I thought that there's something to do with my firewall/NAT settings and I tried regular ipfw, ipfw in-kernel and pf, but they all shared the same symptoms: download is crawling, but upload is good.
Second, I was wondering whether the network driver has something to do with it and it absolutely does. I tried virtio with other providers and the same download performance issue kept occurring. Some control panels allow you to use e1000, which is not necessarily provide you the greatest performance, but is a reliable driver and with that VPN connections sped up significantly.
@linveo has excellent network performance on his nodes, but VirtFusion they use doesn't allow to change the network driver, so I kept looking for some clues and I stumbled upon this thread:
https://www.reddit.com/r/freebsd/comments/jqa4vw/wireguard_vpn_very_slow_on_freebsd/
They advised to put these lines into /boot/loader.conf:
hw.vtnet.0.tso_disable="1"hw.vtnet.tso_disable="1"hw.vtnet.lro_disable="1"hw.vtnet.0.lro_disable="1"hw.vtnet.csum_disable="1"hw.vtnet.0.csum_disable="1"After a reboot, I was very happy and relieved to see that the download speeds increased drastically, over 100x! YMMW, but give it a try if you have had similar issues.
Also please note that I did try OpenVPN and Wireguard just to see whether there could be something to do with the actual VPN implementation, but both were actually behaving the same way.
TL;DR: If you have download performance problems with FreeBSD and either OpenVPN or Wireguard VPN server, try the /boot/loader.conf settings provided above.
You sexy biatch!!!!
The Yeti has left the building.
It was the VPN problems i had.. 1st i had firewalls problems could not get any internet, and after makin that work; slow speeds. I know that network is good and should receive better speeds but that was slow. So now is rock solid
ServerStatus , slackvpn , linux mirrors
Recommended Providers: Servarica(aff) | HostBRR(aff) | SolidVPS(aff) | RackNerd(aff) | KuroIT(aff) | AlphaVPS(aff) | HostDare(aff)
I ended up reinstalling and rebuilding my nice Linveo VPS <3 -- not as expected in Debian so as to try @naguam's install -- but, instead of Debian, again in NetBSD-current upgraded from @cmeerw's NetBSD 10 Minimum.
This time I additionally installed pkgsrc and compiled a few packages also from src. Everything seems to work really fast and really smoothly.
Maybe I should continue doing more NetBSD-current stuff on the Linveo VPS and try the CloudBSD.xyz Debian to NetBSD install elsewhere.
Back in the old days I had stuff I wanted to accomplish with NetBSD. Now I have free time to look around and to try stuff. It's peaceful!
Might anyone here want a shell account on my NetBSD-current VPS?
What are all you other guys doing on BSD nowadays? @Crab @FrankCastle @cmeerw @AlwaysSkint @naguam
Other pressures preventing me from playing.
In stasis until the shitposting stops/abates.
Than=compare;then=sequence:brought=bring;bought=buy:staffs=pile of sticks:informations/infos=no plural.
It wisnae me! A big boy done it and ran away. || NVMe2G for life! until death (the end is nigh).
Not much really, just noticed a small glitch in the network setup in my NetBSD 10 image. But it's probably really just cosmetic - it adds "alias" flags to the addresses when it shouldn't. Just something to keep in mind for the 10.1 update, once that gets released.
Other than that (not BSD related), need to start replacing my InceptionHosting VPSes, and then watch the C++ safety battles next week.
Today I had fun doing three things on my Linveo NetBSD-current VPS.
First, I tested the backup and restore function of the Virtfusion hypervisor. It seemed to work okay.
My test procedure was:
Initially I shutdown the VM within NetBSD (
shutdown -h now). Then I powered off the VM in the Linveo Control Panel.Next I made the backup, then restarted the VM, made a test file (
touch tomwashere), and shut the VM down a second time, again both inside NetBSD and in the Control Panel.Then I restored from the backup, which seemed to restart the VM automagically.
The restored VM seems to work fine, even without
tomwashere(at least, it appears that the backup and restore function did not simply restart the existing image which had containedtomwashere).Making the backup took about 7 minutes. Restoring from the backup took about 3-1/2 minutes.
I didn't see a way to export or download the backup image to another location. Did I miss something?
Second, I skimmed the NetBSD Developer Documentation: Notes on development and code style and the referenced NetBSD source code style guide. I noticed the line which says "from: @(#)style 1.12 (Berkeley) 3/18/94." Just for fun, if I look, maybe I will be able to find the 1994 antecedent Berkeley source. Maybe it's in the Unix Tree?
Here's the command I used to add a little left margin when reading the NetBSD code style guide on my Linveo VPS via ssh from my Chromebook:
Third, I wondered about NetBSD's ability to run Linux binaries. I looked at Chapter 31 of the NetBSD Guide, which covers NetBSD's Linux emulation. I wondered whether NetBSD might run Yabs. I'm still using the default
shshell, but pkgsrc hasbashas well asfioandiperf3. Maybe even Geekbench 6 might run?Yeah, another fun day here!
Howdy! Welcome to the site, and thank you for the software!
Right now just chillin'. FreeBSD 14.2 is out soon, so plenty of fun coming up.
Hopefully the NetBSD fix that @cmeerw introduced will be mainlined soon, so I could kick more of its tires.
That and saving some energy for upcoming Black Friday. Hopefully we'll see some killer deals, so that "everyone gets the servers they want!"
I used to host the website on a NetBSD VPS running Caddy in a chroot as a user (and using npf to redirect the standard ports to ports above 1024).
I also used it for OpenVPN. (I had problems with IKEv2 and wireguard (both their implementation and the userspace implementation so I decided OpenVPN was good enough).
Now I always got interests in various OS and NetBSD looked more approachable to me to contribute at my level.
Overall you can host most common webservices on NetBSD despites some of its limitations.
On my day to day, I run Linux though.
What are its main limitations in your opinion?
Here is a non-exhaustive list of limitations I have with NetBSD for server use.
And overall I'm sold with the Linux's Plan9 inspired Namespaces, necessary for containers, as well as cgroups.
One can do very interesting stuff with these.
I really thing BSD's would benefit from such a thing.
Hi @naguam!
What would you do to test NetBSD compatibility on a new Linux based cloud provider?
Can you share NetBSD compatibility information respecting Hetzner Cloud and Linveo? Linveo is Virtfusion based, if that helps.
Thanks!
Tom
This means that I can install Debian on my Linveo VPS, try @naguam's NetBSD install at CloudBSD.xyz all the while feeling somewhat confident that I probably can quickly and easily restore to the point where I left NetBSD.
Does anybody have a Kimsufi system with FreeBSD 14.1 and working IPv6 setup? I had a weak moment and got a box from their Black Friday sale, but IPv6 simply refuses to work no matter what I do. I have verified it working fine on Linux with their rescue system, so it has to be the OS setup, but as you know there's not much to it.
It really shouldn't be much more than this in /etc/rc.conf which works great elsewhere:
ifconfig_igb0_ipv6="inet6 2607:5300:xx:xx:xx prefixlen 128"
ipv6_defaultrouter="2607:5300:xx:xx:xx"
I can ping the gateway address just fine, but nothing beyond that. SLAAC doesn't seem to be supported, so it has to be set statically. I have tried different prefix lengths as well.
Trying to add the default router manually gives this error:
add net default: gateway 2607:5300:xx:xx:xx fib 0: Invalid argument
I have googled this up quite a bit without real success and tried various different ways described at FreeBSD forums and Reddit, but nothing conclusive. I even reached out to their support and all they told me is to follow their guide which doesn't say much.
Any tips or advice are greatly appreciated!
@yoursunny
I was finally able to get it working with this in rc.local:
/sbin/ifconfig igb0 inet6 <ipv6_address> prefixlen 64/sbin/route -6 add default -ifp igb0 <ipv6_gw_address>Prefixlen 64 through rc.conf doesn't work, but for reason doing it manually like this does. Also route addition through rc.conf returns and invalid argument error, but manually works. Perhaps somebody here can explain why, but I'm just happy to have it finally working
Congrats!
Why?
Why?
Seems like NetBSD's Linux emulation can run Geekbench 6!
Geekbench 6 scores for our nice Linveo 2 vCore Ryzen 9 7950X NetBSD/Linux VPS:
Check https://browser.geekbench.com/v6/cpu/9018149 if you want to see the full test result.
Geekbench 6 is a downloaded, pre-compiled Linux ELF binary:
Maybe there is a newer version of Geekbench than 6-1-0? I happened to have 6-1-0 handy.
What's up with the lines in the terminal output below that say
>! [ 612604.8349775] linux_sys_rt_sigaction: setting signal 64 ignored? Maybe ignoring signal 64 is a safety feature in NetBSD Linux emulation? Seems like signal 64 is sometimes used in rootkits? Are people running Geekbench sometimes giving Geekbench root privileges even if they don't run Geekbench as root?Thanks @Linveo!
Rent our ASN and IPv6 magically starts to work.
Both BIRD and Pathvector support FreeBSD.
We accept Karma donations for the last flan. 🍮 affbrr
Do we have a list of LES providers who are offering BSD VPS options?
VPS providers to check out:
@yoursunny It's a nice offer to share your ASN, thank you, but maybe you are just trolling. How can I know that you are not trolling?
@Not_Oles my friend you're having way too much fun with your NetBSD!
Wanted to post that I had some very unique router requirements, and ended up installing OPNSense on some hardware I put together and it not only worked out of the box, it pushes 10gbps pixies with ease on hardware sub 60w. Was a bear to configure though.
That's the BSD power right there! What kind of hardware configuration you have if I may ask?
I'm using a box from Riverside Networks that was bricked, I opened it up reflashed the nvram chip and put on stock intel bios for the Xeon D cpu onboard. It has a Xeon D-1553N (8c16t) and 32GB of ram, quad 10g and 8 1g, but only 2 10g and 6 1g ports are usable due to the hardware design of the board using a multiplier that seems to only be supported by Riverside's custom distro stuff.
Definitely would never recommend Riverside's equipment due to how locked down it is, but used it can be made into something cool if you know your way around hardware.
We are the Official Troll so you can never tell.
When IPv6 is delivered via a BGP session, it is guaranteed to be a routed subnet instead of an on-link subnet.
Routed subnets have fewer problems than on-link subnets as you don't need to answer Neighbor Solicitations.
We accept Karma donations for the last flan. 🍮 affbrr
How is Official Troll status working for you? How will others' "never being able to tell" help you long term?
What I hope for, for you, instead of Official Troll status, would be to see you holding a wonderful reputation as helpful, friendly, and kind. And also as a fundamental contributor to the larger internet community. Like Rich Stevens: Guru of the Unix gurus. I want to see the US Congress and the President give you a standing ovation on the occasion of their granting you honorary full citizenship. But that's just what I want. You should do what you want.
Thanks @yoursunny! Now I remember your ndpresponder which you told me about and which I used previously to get IPv6 working. I appreciate your patience in telling me a second time!
Probably only 42 more times will be required! 
So, @Crab, it looks like @yoursunny is kindly hinting that your issue with IPv6 and FreeBSD rc.conf not working but configuring rc.local working might be caused by rc.conf expecting but not receiving NDP responses.
Thanks again, @yoursunny!
Wireshark is your friend.
Wireshark solves confirms or denies all networking problems.
We accept Karma donations for the last flan. 🍮 affbrr
After reading through the latest comments, I went back and checked what I actually did to make it work and I realized my initial post about this was incorrect.
According to Kimsufi, only /128 is assigned to you. This means that you have 'neighbors' very close to you and according to our resident expert, @yoursunny, you have to deal with 'Neighbor Solicitations'.
The IPv6 configuration for my box is this:
inet6 2607:5300:1234:1234::1 prefixlen 128and I said that adding the same thing with prefix length 64 from rc.conf didn't work but worked when you manually issued the command. Well, I was actually wrong with this statement and what I actually did was created a /64 for the same interface:
inet6 2607:5300:1234:12ff::1 prefixlen 64As you can see the last 1234 is 12FF instead which now means that the neighbors and not anymore close by and if I interpret @yoursunny's comment 'Routed subnets have fewer problems' properly, that's exactly what is happening here.
Once /64 setting was added, creating a route for it didn't throw an error like it did when I just had /128:
/sbin/route -6 add default -ifp igb0 2607:5300:1234:12ff:ff:ff:ff:ffAfter this everything started to work!
When I was trying to get this work initially, I was asking Co-Pilot some advice for different possible configuration options. I asked it now why this type of config is needed, and this is what it responded:
In FreeBSD, when you assign an IPv6 address with a prefix length of /128 (like 2607:5300:1234:1234::1/128),
it means that this address is a single, specific address with no additional addresses in the same subnet.
This can sometimes cause issues with routing and connectivity because there's no room for a subnet prefix.
By adding a /64 address range (like 2607:5300:1234:12ff::1/64), you're defining a larger subnet that includes
your specific address. This helps with routing and ensures that your interface can communicate properly
within the network.
IPv6 addresses are divided into two parts: the network prefix and the interface identifier. When you use
a /128 prefix, you're saying that all 128 bits of the address are used to identify a single device. This
leaves no bits to define a network range or to address other devices within the same subnet. Essentially,
it’s like having a street address without naming the street—it’s too specific to form a neighborhood.
Here's a quick analogy:
/128 Prefix: This is like having a precise address like "123 Main St, Apartment 456." This address points
to a single apartment in a building, with no other addresses.
/64 Prefix: This is more like "Main St." This allows for many houses or buildings to be part of "Main St,"
defining a range of addresses within that street.
In networking terms, having a /64 prefix is standard practice for IPv6 because it allows for a vast number
of individual device addresses (2^64 addresses) within the same subnet. This facilitates proper routing
and communication between devices on the same network.
Thus, assigning a /64 address to your interface helps the network to understand that it’s part of a larger
subnet, making routing and communication smoother.
TL;DR
My last post was incorrect. You need to set up /128 AND /64 AND route on /64 to make it work:
/sbin/ifconfig igb0 inet6 2607:5300:1234:1234::1 prefixlen 128/sbin/ifconfig igb0 inet6 2607:5300:1234:12ff::1 prefixlen 64/sbin/route -6 add default -ifp igb0 2607:5300:1234:12ff:ff:ff:ff:ffI've not delved into IPv6 before (no need) so above was interesting. Analogous to IPv4 /32 & /24 methinks.
(Though I still don't get the convention of calling them a prefix, when they're often expressed as a suffix.)
In stasis until the shitposting stops/abates.
Than=compare;then=sequence:brought=bring;bought=buy:staffs=pile of sticks:informations/infos=no plural.
It wisnae me! A big boy done it and ran away. || NVMe2G for life! until death (the end is nigh).
Hi @Crab!
Wow! Thanks!
I have to confess not understanding most of what you just posted. From the last part,
it looks like the server gets two IPv6 addresses, one from each invocation of
ifconfig. The second line gives a single address (a /128 from a /64). The first line gives another single /128 address which, with respect to the /64 from the second line, is out-of-band because 1234:: is not part of 12ff::.I guess that the router at 12ff:ff:ff:ff:ff might be configured to forward from and to send to 1234::1. Maybe the router neither accepts from nor sends to 12ff::1. Or maybe the 12ff::1 is used by your server both when packets from 1234::1 are sent to and when packets are received from 12ff:ff:ff:ff:ff.
I am not sure whether anything I am saying here is correct. It amazes me how complex the subject of networking seems.
At the least, it is delightful that you got IPv6 working with FreeBSD on your server!
Congrats! 
Are you assigned both
1234::1and12ff::1? If not, what happens if other VMs on that node use the same12ff::1? Shouldn't that be at least an address that is guaranteed to be unique?Very good question! @Not_Oles is wondering about the same thing. 1234::1 is /64 which could easily be assigned instead of /128, but 12ff::1 is /56!
This is a dedicated, so there's no other tenant on the same box, but your question is still valid. If I have 1234::1, is there another person in OVH with 1235::1?
After posting the last message I tried bunch of different variations of this but nothing else works. Either you get 'No buffer space available' error while pinging, or 'Invalid argument' for just trying to set the route, or 'No route to host'. The /56 interface of 2607:5300:1234:12ff::1 also becomes pingable from outside network, so perhaps OVH is assigning /56 after all.
Hopefully somebody more knowledgeable (@yoursunny) can explain this. The strangest thing is that this works just fine with /128 address and provided gateway in Linux, but FreeBSD is refusing to accept them in the first place (invalid argument)!
I think Linux only gets around this by letting you add a "random" host route on the network interface that you can then use for your default gateway.
On thing you could do on the BSDs is to use the link-local address of the gateway for your default route (although that has the disadvantage that the link-local address might change when the gateway device is replaced)
Otherwise, widening the network to a /56 (and making sure not to assign IPv6 addresses outside your assigned network to your local machine) might be the best option.