Found a very nice website https://openbsdrouterguide.net/
Posts Tagged ‘openbsd’
openbsdrouterguide
Thursday, August 5th, 2021OpenBSD PF: limit incoming connections per time period
Wednesday, November 8th, 2017In iptables there is a nice module called hashlimit.
Being in love with OpenBSD and PF, I decided to find if this wonderful firewall has the same feature.
As a minimal example, you can use this rule to allow =< 2 SSH connections per 60 seconds:
pass in on $ext_if proto tcp from any to any port 22 keep state (max-src-conn-rate 2/60)
Note that you have to use parentheses, even using just one option (max-src-conn-rate), otherwise you’ll get an error while parsing the ruleset.
Keep in mind that one of keep state, modulate state, or synproxy state must be specified explicitly to apply this option to a rule.
For more information read the documentation for pf.conf syntax.
OpenBSD pkg_add: flavours
Tuesday, August 20th, 2013Use pkg_add -i to choose from package flavours.
Package description (pkg_info asterisk) tells us that it can be standard or have IMAP flavour:
Asterisk supports Voice over IP in many protocols, and can
interoperate with almost all standards-based telephony equipment
using relatively inexpensive hardware.
Flavours:
IMAP - use imap for voicemail storage instead of files.
Maintainer: Stuart Henderson
WWW: http://www.asterisk.org/
Installation:
# pkg_add -ivvv asterisk
Ambiguous: choose package for asterisk
a 0:
1: asterisk-10.12.1
2: asterisk-10.12.1-imap
Your choice: 2
OpenBSD: security – periodic system security check
Sunday, January 13th, 2013While continuing learning OpenBSD at my spare time I’ve faced an interesting tool included in this OS.
security – periodic system security check.
OpenVPN в OpenBSD
Wednesday, July 4th, 2012OpenBSD – клиент.
В конфиге (который на ура работает в Linux), прописано “dev tun”. В OpenBSD это уже не прокатит. Надо называть интерфейс – tun0.
Не указав этот неприметный ноль, мы получим примерно такие ошибки в выводе OpenVPN’a:
ifconfig: SIOCSIFMTU: Device not configured ifconfig: SIOCGIFFLAGS: Device not configured Thu Sep 17 13:23:44 2009 OpenBSD
ifconfig failed: external program exited with error status: 1
Thu Sep 17 13:23:44 2009 Exiting
Обсуждение проблемы тут: http://www.daemonforums.org/showthread.php?p=27062
OpenBSD systat
Wednesday, July 4th, 2012Некоторые полезные параметры команды systat:
systat ifstat – статистика сетевых интерфейсов
systat netstat – покажет сетевые соединения
systat pf – статистика PF (аналог pfctl -s queue)
systat queues – статистика очередей ALTQ
systat rules – правила PF (аналог pfctl -s rules)
systat sensors – данные доступных hw sensors
systat states – статистика PF states (аналог pfctl -s states)
systat swap – использование файла подкачки
OpenBSD. Ограничение потока в ALTQ 4 гбит/с
Wednesday, July 4th, 2012Вряд ли конечно придется попробовать ALTQ на 10-гигабитных интерфейсах, но тем не менее не стоит забывать:
ALTQ using hfsc is limited to a maximum parent bandwidth of 4294Mb.
This value is 2^32 or 4,294,967,296 bits. If you set the bandwidth any
higher, altq will flip back to zero. This “bug” was found when trying
to test 10 gigabit and 40 gigabit bandwidth models. These tests were
done on OpenBSD 32bit and 64bit as well as FreeBSD 32bit and 64bit.
http://lists.freebsd.org/pipermail/freebsd-pf/2011-July/006203.html
OpenBSD packages’ post-install notes
Wednesday, July 4th, 2012you can always re-read the post-install notes afterward by using pkg_info -M
OpenBSD egress
Wednesday, July 4th, 2012Your first card [in the bridge] that has an IP address is considered your “egress” card and faces the internet.
rc.conf и rc.conf.local в OpenBSD
Wednesday, July 4th, 2012Очередная заметка, поскольку память хорошо “очищается”, если не пользуешься чем-то продолжительное время.
Итак, после успешной установки OpenBSD, копируем файл /etc/rc.conf , называем /rc.conf.local . И удаляем в нем (т.е. в файле-копии) 2 строки:
local_rcconf=”/etc/rc.conf.local”
и
[ -f ${local_rcconf} ] && . ${local_rcconf} # Do not edit this line
Далее, при необходимости, все поправки касаемо стартующих демонов вносим только в /etc/rc.conf.local .