Firewall update - OpenBSD wins
Short story: If you need a dedicated UNIXy firewall, you really can’t do any better than this:
# uname -sr OpenBSD 4.0
Long story: I’ve been playing around with a WRAP board as my home firewall for a while now. (WRAP is basically a ready to go x86-ish PC-ish computer on a board). It’s a lot more fun than running dd-wrt on a Linksys WRT54GL, if only because I got to try manually bootstrapping a couple BSD and Linux kernels. And hey, it’s cool to setup a bare embedded board on the workbench, dangle cables off it, and build a custom case to stick it in. It’s a lot more functional, too, since you’ve got quite a bit more “oomph” in terms of CPU and memory than the WRT54G. At some point I put m0n0wall (a free embedded firewall software package based on FreeBSD) on it and it’s been doing firewall duty on my desk ever since. Well, until a couple weeks ago, when I did some wiring in the house and built a cage up in the corner of the garage to hold all the networking equipment.. and I dropped my WRAP box 8 feet onto the concrete floor. Apparently my custom WRAP case wasn’t as strong as I had hoped… Ooops.
Since I didn’t care about noise out in the garage, I just grabbed my (now retired) Soltek Qbic SFF to use until I could replace the WRAP. “I’ll just pop Linux on there and use iptables” I thought. And then I remembered how much I’d come to hate iptables last month…
What happened was I had to select a new firewall platform for a client that was replacing some aging PIX 515’s. They wanted near gigabit performance, and had some pretty grand desires in terms of QoS on top of the normal requirements of stateful packet filtering. Before they handed over money to Cisco for the latest generation of PIX, they wanted to take a look at possible alternatives. They had three primary complaints with the PIX:
- The PIX CLI is functional, but the IOS-like interface makes annotating the live config nearly impossible.
- The PIX’s stateful inspection ain’t that hot (lots of “bad shit” making it through the PIX) and they had to turn off nearly all of the fancier “fixup” features or performance went to hell.
- Complete lack of QoS on the PIX wasn’t a show stopper, but they definitely wished they could do the QoS stuff on the same box as the packet filtering.
I prepared a short list and we tested a bunch of setups, including commercial solutions like Checkpoint and free solutions like Linux iptables, FreeBSD/OpenBSD’s “pf“, and ipfilter on Solaris. In the end OpenBSD and it’s home-grown “pf” emerged victorious. There were a few key reasons why OpenBSD was the best fit, even though the client is a Linux/Windows shop:
- OpenBSD’s pf uses an ipfilter-inspired configuration syntax that’s really intuitive, easy to read, and easy to annotate. This was a really, really big deal.
- OpenBSD’s default install is rediculously barebones. Referencing just a couple notes from me, the client was able to do an OpenBSD install from disc and have a secure, functioning firewall in about 30 minutes.
- Performance, even with QoS features enabled, stayed strong throughout the testing.
- A mostly-default config, with pf’s “scrub” enabled, withstood the wide variety of DoS attacks we threw at it better than any of the other systems.
Overall, it really came down to the fact that OpenBSD did the right thing by default. Which is a huge factor in reducing complexity and errors, and increasing operator confidence. Sure, we could have built a stripped down Jumpstart for Solaris, but we didn’t have to change a thing in OpenBSD. Sure, we did get iptables doing nearly everything that pf was doing, but it took, literally, a dozen hours of trial-and-error testing, and several hundred more lines of difficult to grok config statements. Our OpenBSD pf config stayed small and to the point. Checkpoint did fairly well, but was overaly complex and quite non-intuitive. The Checkpoint simply cost too much in terms of capital outlay and in the time required for the team to learn it. In the end, although they had no experience with a BSD, they felt good about the OpenBSD/pf setup, and everyone agreed that it was worth putting a box into production to see how well it held up in the real world. We did that a month ago, and they’re now preparing to bring two more OpenBSD boxes online to replace the PIXes. Happy.
Which brings me, rather verbosely, to my home firewall. What do I run on it? I realized that the same logic that put OpenBSD on top of nearly every evaluation category for the web hosting client also made sense for home. So, unsurpisingly, I’m running OpenBSD 4.0, and I think I’ll keep it that way. I cancelled my WRAP order for now. We’ll see how well the little Qbic holds up in the garage.
18 Comments
Jump to comment form | comments rss [?] | trackback uri [?]