So, it's just meant to be for a two minutes. And in pretty bit of a time, it's meant to explain why you should, you should maybe, or should not try a securing a network of OpenBestie.
So, so it's just a disclaimer. I'm from UK and therefore I've only really got a, where it's meant to do this for UK R-S-B's.
I-S-B's assign addresses differently. This is also not an in-depth guide. There's only 20 minutes. I can't go through all the specifics of a networking for it.
And networking is personal, each person's network is different. So, you will need to adapt whatever configuration I would have provided if I had time.
As I said, there was a get at the end of, I'll have a QR code at the end of the talk. And, in fact, it was to go to the GitHub.
I was meant to upload example configs to play with, so that it's easier to get into.
But I didn't get time to push these before the talk, and I'll do that by Monday. So, if you hold on to the link by Monday, it should be up there and you'll be able to play with them.
So, why would you want to use open business on the router? Well, firstly, ISB routers include, in every time I refer to ISB routers in the talk, I also include off-the-shelf routers, so TP link, et cetera.
They run, provide your versions of Linux, and the main issue is this, is that they go end of life quickly, and they do not get reliable security patches.
Often, even your network open to attackers, and it also they limit how much control you actually have a view in network.
So, for those who really care about having the freedom to configure their network, this is one way of doing so.
So, the benefits of using open business for routing, firstly, it's free and open source under ISC, and it's from a specific license, so it's business friendly basically.
So, the security patches are very quickly, and we apply this patch, and which handles all of the patching of the system for you.
You've got full control of your network and BSD. You've also got access to additional features such as Blands, which most consumer hardware would limit you access to.
Often, you need to buy business grade hardware for this, and even though consumer hardware could technically do it, it's software limited, because of the proprietary operations system.
Using open business general purpose, so not only can it route your traffic for your network, but you can also add additional functions to it, so you can technically have it as a basic file server as well.
All of what I like to do is use unbound and verify the SNS second, to stop a DNS moving, or manage middle attacks, because DNS is only encrypted.
The security patch is come directly from upstream, so with Linux based images, you would have the security patch pushed to Linux, and then you would rely on the OEM to
actually ship that security patch, which in the case of most embedded routers, you very rarely get anything but critical security patches.
All of your utilities needed for a small medium-sized network is within your BSD base, so you very rarely need to add any additional software from the ports.
And the benefits of using open business over Linux is that the base is one complete system, so you don't have to worry about updating packages, this patch will do everything for you.
The downside of using open business for router is that the current file system does not journal.
Be sure if a lot of people use to unplug in their routers from the switch or directly without actually powering them off.
If you do this to an open BSD router, FSCheck will fail, and this can cause file system production.
This can be solved by using a UPS, but it is a hefty drawback. Hardware support isn't as wide as Linux, so you do have to be careful about what hardware you try to use it on.
And the network stack is not to performance for BSD, and it can be some hefty bottlenecks.
So if performance is important, you may want to use an operating system such as PSM or use for your BSD instead.
So why not open the BRT? Well, it is used for embedded hardware, and this means that there is very limited set of hardware.
There is a big table of what is hardware, but each embedded hardware has to be supported separately.
With Open BSD, any general purpose machine can be used as router provided by it has enough Ethernet ports for your network.
So it can run on most computers, and any old laptop will probably suffice.
Well, not the F-sense, but there is not really many reasons other than the fact that you can do it all over the CLI via SSH, and that it can be as distinctly cooler.
So for the hardware requirements of it, you can use any old hardware.
So if you got something lying around, instead from it in the bin, you can turn it into a more secure router for your network.
But you need to ensure that you have two Ethernet ports.
Most devices will not have this, so a cheeky way around it is using USB-Nix.
The performance isn't amazing, but it allows you to have use any hardware you wish.
You will preferably want it to have a low power consumption, because this will have to run 247, and if you are using a big desktop, which draws up the power,
then it will probably cut the bank.
You probably also want a network switch to connect more devices, because your team of hardware isn't designed for having lots of Ethernet ports,
but you can add network interface cards in order to increase it.
A managed switch could be useful, because you can do a routing on a stick, where you use a VLAN trunk on your LAN interface,
to then separate off multiple networks, virtually.
The software requirements for it is to mimic a ISP-nice-off-the-shoff router.
You will need HTTP, unless you want to configure it every device yourself.
HTTP-D is included in an OpenBSD base, so you don't have to install anything further.
You need a firewall, mainly just for that, and blocking incoming packets to the network, because by default you should.
PFS-OpenBSD native firewall, and it's very powerful, and very easy to use for people who haven't done, who are not experiencing firewalling.
You optionally can add for cursive DNS using an unbound, which I explained that I do myself earlier.
The benefit of this is you don't actually rely on any upstream recursive DNS server, but also allows you to validate the NSEC.
If I could be six, you want Slack, which you need a RAD, which is also included in the base.
So, how do we actually do this?
For a very basic network, you only need two interfaces, one for one, which you will connect to whatever your ISP provides,
whoever that's a modem, or an O&T.
This is where it differs on setup, because some ISP can use PPRE, and some may use a DHCP.
If this person to your network and has to be changed accordingly, for LAN, you pick a range from RAC for 1918,
which is any private IP range.
You want to run H2BD on your LAN to allocate the addresses, and if you are using IPB6, you want RAD on your LAN to advertise the IPB6 block.
So, as for basis of firewalling for, you want to block everything where default, and that is default to most firewalls.
You will need, unless you've got an abundance of IPB4 addresses, you will need to map.
You can block in margin packets.
So, private IP addresses come in and around is not 100% quiet, because the ISP should never pass you it, but it is good practice to do so.
And optionally, you can block in a block packet coming in from known spammer's users' families.
And that's pretty much it.
So, once you have a solid foundation, you can build on an open base a lot.
So, firstly, you want to track your configuration in a VCS, such as Git, so that any change you make to your configs can be tracked.
And also, so that you can eat your cover from a failure.
You can choose more networks, this is what I referenced earlier.
I've been learning, allowing you to separate multiple networks and keeping them separate from one another.
So, for example, if you've got a business, you might want to separate off your Wi-Fi from your servers to prevent, talk between the two networks.
You could set up redundant interconnections, you can do this by a PF sync.
And another useful thing is to set up as a VPN tunnel to your network, allowing you to administrative remotely without having to forward any ports.
As for Wi-Fi, Wi-Fi support an open BSD is already limiting, and then host a P support for open BSD is even more limiting.
So, your struggle to find any hardware, which actually will be able to access an Wi-Fi AP.
And that for further issues, consumer hardware has really weak antennas, which potentially would cause a rather bad performance.
However, there was discussions on this on IRC, and there could potentially be a future to open how to actually do Wi-Fi APs on open BSD well.
So, as for now, recommendations which I would use for Wi-Fi would be using in terms of Wi-Fi AP, because it is designed specifically for this purpose.
And you can open a WRT for it, and this is only for the Wi-Fi AP section, so your router will still be open BSD.
You would want to prefer to separate off your Wi-Fi from other networks using Vigning.
WPA is weak, WPA free is somewhat secure, but overlaying with a VPN such as Wi-Guard, allows you to be more sure on a more secure, a bit more, yeah.
If possible, you probably still want to be safe in that, it's faster, it's more reliable, and it's more secure, and it's one thing which is still good.
Further reading on this, so Book of P.F. is a great book for learning how to firewall on Open BSD.
Absolutely at Open BSD is a good book to learn Open BSD fundamentals.
The man pages for PF.com.
Hello soon for AF, DHBD.com, and I'm bound and right, we'll allow you to configure that work, and at the bottom is linked to Open BSD's upstream FAQs on P.F.
and DHBD have a guide on how to do a very basic Open BSD router.
Thank you.