From nobody Tue Apr  1 12:59:53 2025
X-Original-To: questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZRp4b5dq0z5rVWx
	for <questions@mlmmj.nyi.freebsd.org>; Tue, 01 Apr 2025 12:59:59 +0000 (UTC)
	(envelope-from freebsd-doc@fjl.co.uk)
Received: from bs1.fjl.org.uk (bs1.fjl.org.uk [84.45.41.196])
	by mx1.freebsd.org (Postfix) with ESMTP id 4ZRp4Z6SVJz3FcW
	for <questions@freebsd.org>; Tue, 01 Apr 2025 12:59:58 +0000 (UTC)
	(envelope-from freebsd-doc@fjl.co.uk)
Authentication-Results: mx1.freebsd.org;
	dkim=none;
	dmarc=none;
	spf=pass (mx1.freebsd.org: domain of freebsd-doc@fjl.co.uk designates 84.45.41.196 as permitted sender) smtp.mailfrom=freebsd-doc@fjl.co.uk
Received: from [192.168.1.109] (host86-177-85-71.range86-177.btcentralplus.com [86.177.85.71])
	(authenticated bits=0)
	by bs1.fjl.org.uk (8.14.4/8.14.4) with ESMTP id 531Cxwmf050367
	for <questions@freebsd.org>; Tue, 1 Apr 2025 13:59:58 +0100 (BST)
	(envelope-from freebsd-doc@fjl.co.uk)
Message-ID: <16ef99c3-6dbc-4968-b173-22dfc225abc0@fjl.co.uk>
Date: Tue, 1 Apr 2025 13:59:53 +0100
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
From: Frank Leonhardt <freebsd-doc@fjl.co.uk>
Subject: Re: GPT secondary corrupt. Is dd'ing the first 40 sectors as a backup
 sufficient?
To: questions@freebsd.org
References: <e26bb5cc-f0fb-4342-9448-468f0ec5a0c4@heuristicsystems.com.au>
 <e9266bce-67ba-4657-aa93-494e64e7c8ff@fjl.co.uk>
 <74c931f5-d9ed-4afa-bf5b-f7a2064136c1@heuristicsystems.com.au>
 <5f802d32-0ee0-4909-9374-7e57c5c9278a@fjl.co.uk>
 <e2799d28-00bd-4b34-8497-2db1268af668@heuristicsystems.com.au>
Content-Language: en-GB
In-Reply-To: <e2799d28-00bd-4b34-8497-2db1268af668@heuristicsystems.com.au>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
X-Spamd-Result: default: False [1.54 / 15.00];
	RBL_SENDERSCORE_REPUT_9(-1.00)[84.45.41.196:from];
	SUBJECT_ENDS_QUESTION(1.00)[];
	NEURAL_SPAM_MEDIUM(1.00)[1.000];
	NEURAL_SPAM_LONG(0.76)[0.755];
	NEURAL_HAM_SHORT(-0.22)[-0.219];
	ONCE_RECEIVED(0.20)[];
	R_SPF_ALLOW(-0.20)[+ip4:84.45.41.196:c];
	RCVD_NO_TLS_LAST(0.10)[];
	MIME_GOOD(-0.10)[text/plain];
	MIME_TRACE(0.00)[0:+];
	ASN(0.00)[asn:25577, ipnet:84.45.0.0/17, country:GB];
	ARC_NA(0.00)[];
	RCVD_COUNT_ONE(0.00)[1];
	MID_RHS_MATCH_FROM(0.00)[];
	RCPT_COUNT_ONE(0.00)[1];
	TO_MATCH_ENVRCPT_ALL(0.00)[];
	TO_DN_NONE(0.00)[];
	FROM_EQ_ENVFROM(0.00)[];
	PREVIOUSLY_DELIVERED(0.00)[questions@freebsd.org];
	FROM_HAS_DN(0.00)[];
	DMARC_NA(0.00)[fjl.co.uk];
	MLMMJ_DEST(0.00)[questions@freebsd.org];
	R_DKIM_NA(0.00)[]
X-Rspamd-Queue-Id: 4ZRp4Z6SVJz3FcW
X-Spamd-Bar: +

On 19/03/2025 07:16, Dewayne Geraghty wrote:
> Thank-you for your advise and script.  I performed a large array of 
> tests on both FreeBSD 12.4S, 14.1S and HardenedBSD 14.2S systems.  All 
> tests were performed on memory devices then on separate drives and 
> booted to init.
> <snip>
> To your questions Frank:  As I vaguely recall Pawel's intent was to 
> provide software RAID vs hw RAID cards.  If you have disks of 
> dissimilar sizes, gmirroring the two disks will result in a mirror 
> that uses the size of the smaller disk.  Yes, if you wish to mirror a 
> partition, gmirror does a good job and retains access to the rest of 
> the device(s).
>
> I appreciate the script that you provided which I successfully used. I 
> went further with testing to reveal various failure states and their 
> recovery.  Unfortunately this resulted in my embarrassment for asking 
> such naive questions at the outset.
>
> Regards, Dewayne
> PS I chose not to set kern.geom.part.check_integrity=0. And yes, it is 
> a pity that zfs doesn't support MAC labels :}
>
Hi Dewayne,

Thanks for posting this. I've been a bit busy so I waited to read this 
all properly before replying. Your results were pretty much exactly what 
I'd have expected.

I routinely blank disks before adding them to ZFS or a GEOM Mirror. I 
agree it's not strictly necessary to wipe the entire drive as the 
beginning and end are the only places likely to contain metadata to 
screw things up, but I do it anyway to test that the drive is working 
properly before use. A surprising number have failures in the middle 
that have appeared during storage. It's also better if you want to take 
a compressed image. I use LTO tape a lot and a drive that's mostly zeros 
compresses really well ;-)

I guess you agree that GPT is the way to go for larger drives? For GEOM 
Mirror I just create one large partition and mirror that - it stops the 
GPT and Gmirror data clashing and means I don't have to worry if a 
replacement drive is a few Gb smaller. I always use different drives to 
start with anyway - getting two "matched" hard disks for the same type 
from the same batch is asking for them to fail at the same time :-)

I really ought to put that script up on the blog now that you've 
reminded me. Do you mind if I reference and add your research? I haven't 
actually tested anything with a BSD partition table for a very long time.

Feel free to look me up if you're ever in London. If you think the 
script was worth it you can buy me a coffee :-)

Regards, Frank.



From nobody Tue Apr  1 14:54:02 2025
X-Original-To: freebsd-questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZRrcQ20V2z5rfBD
	for <freebsd-questions@mlmmj.nyi.freebsd.org>; Tue, 01 Apr 2025 14:54:14 +0000 (UTC)
	(envelope-from mail@souji-thenria.net)
Received: from alisa.souji-thenria.net (alisa.souji-thenria.net [188.68.37.165])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA512)
	(Client did not present a certificate)
	by mx1.freebsd.org (Postfix) with ESMTPS id 4ZRrcN6jlYz44BK
	for <freebsd-questions@freebsd.org>; Tue, 01 Apr 2025 14:54:12 +0000 (UTC)
	(envelope-from mail@souji-thenria.net)
Authentication-Results: mx1.freebsd.org;
	dkim=pass header.d=souji-thenria.net header.s=20231116 header.b=xaD504p7;
	dmarc=pass (policy=quarantine) header.from=souji-thenria.net;
	spf=pass (mx1.freebsd.org: domain of mail@souji-thenria.net designates 188.68.37.165 as permitted sender) smtp.mailfrom=mail@souji-thenria.net
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=souji-thenria.net;
	s=20231116; t=1743519244;
	h=from:from:reply-to:subject:subject:date:date:message-id:message-id:
	 to:to:cc:mime-version:mime-version:content-type:content-type:
	 in-reply-to:in-reply-to:references:references;
	bh=QN6mF79D9obeQ8YWlnz5sZnmkA1Z6gEGKIgTYj52q+M=;
	b=xaD504p7iy6gE6T7DQmvvWQo44X5pSefCrOlpaH24AIlTVlLjVHbmVPb+U0KlBgYCf8Xs0
	0divGNEKClHZdEr+82GZ9TMFvt3AOq0KSoHp3KsQ8X+v54zczcY1+sPd5kXOFAPzFxmmHY
	2PFIuT4CNHGcnBoA0kVFqP7Qpm8MpBXX+B9xjT+w0TWsBBT1hu25AYX0mD9DGF5H3Ib1eA
	bT9GzgyOIE2gv1G7l/I2UQiIG5rX7yfZ1uDQ/+nvPY3yb26znWlnk17lHGxTuHBFgo01b7
	4xgItSbX0B+RwVnOJ/giu6ctM4Qbn3ApJL97EOVuMU3a3/dnbSvJCRF++5XSSwzq6A4yjC
	YOT96fFuBH6wHRkfKGJ78zeqrvirPVLZFAHGYMZCOefPAMkeHGgMXriuir90VA9sQvL2SA
	0d3Bt6GxqgFb8u0ZCbLUvlttdDkaAFc5DfEB7eEWnhdiKR6dH0Xrc7c6QzHSl9o6tQrEsU
	O1wa5zu8q6aSNF8EkN8M+FeRc5Ugoa0rdkx0RIJAadNyxoGwFVc0X3P9N5hwzWFFf38Dq0
	05tqbfTaj4Sk8MpG+wX7nHTGMFFJ5e5q8rHGao/r0OWxUlPgsraMTp0CQT1gNSSKjimbNo
	CsFVUjKBKUKt387CLErfVb5TS3h/66X+ji+alzAt1eOQhn5IAkvhY=
Received: 
	by alisa.souji-thenria.net (OpenSMTPD) with ESMTPSA id 3ebee58c (TLSv1.3:TLS_AES_256_GCM_SHA384:256:NO)
	for <freebsd-questions@freebsd.org>;
	Tue, 1 Apr 2025 16:54:03 +0200 (CEST)
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
Mime-Version: 1.0
Content-Type: multipart/signed;
 boundary=44859d5cf90bfe9e88f5c6e0b0f37d96fa665d4864bf6ea0f2fd18bf40f0;
 micalg=pgp-sha512; protocol="application/pgp-signature"
Date: Tue, 01 Apr 2025 16:54:02 +0200
Message-Id: <D8VDZMJC1FQK.BEE4WNNH0JGB@souji-thenria.net>
From: "Souji Thenria" <mail@souji-thenria.net>
To: <freebsd-questions@freebsd.org>
Subject: Re: IPv6 MTU discovery - packet too big
References: <D67JA9B6KWZ8.M2G1BLK8A6KZ@souji-thenria.net>
In-Reply-To: <D67JA9B6KWZ8.M2G1BLK8A6KZ@souji-thenria.net>
X-Spamd-Result: default: False [-4.95 / 15.00];
	SIGNED_PGP(-2.00)[];
	NEURAL_HAM_LONG(-0.98)[-0.983];
	NEURAL_HAM_MEDIUM(-0.95)[-0.946];
	NEURAL_HAM_SHORT(-0.62)[-0.617];
	DMARC_POLICY_ALLOW(-0.50)[souji-thenria.net,quarantine];
	MV_CASE(0.50)[];
	MIME_GOOD(-0.20)[multipart/signed,text/plain];
	R_SPF_ALLOW(-0.20)[+mx];
	R_DKIM_ALLOW(-0.20)[souji-thenria.net:s=20231116];
	ONCE_RECEIVED(0.20)[];
	DKIM_TRACE(0.00)[souji-thenria.net:+];
	RCPT_COUNT_ONE(0.00)[1];
	RCVD_TLS_ALL(0.00)[];
	TO_MATCH_ENVRCPT_ALL(0.00)[];
	MISSING_XM_UA(0.00)[];
	FROM_HAS_DN(0.00)[];
	RCVD_VIA_SMTP_AUTH(0.00)[];
	ASN(0.00)[asn:197540, ipnet:188.68.36.0/22, country:DE];
	TO_DN_NONE(0.00)[];
	FROM_EQ_ENVFROM(0.00)[];
	RCVD_COUNT_ONE(0.00)[1];
	PREVIOUSLY_DELIVERED(0.00)[freebsd-questions@freebsd.org];
	MID_RHS_MATCH_FROM(0.00)[];
	MLMMJ_DEST(0.00)[freebsd-questions@freebsd.org];
	ARC_NA(0.00)[];
	MIME_TRACE(0.00)[0:+,1:+,2:~]
X-Rspamd-Queue-Id: 4ZRrcN6jlYz44BK
X-Spamd-Bar: ----

--44859d5cf90bfe9e88f5c6e0b0f37d96fa665d4864bf6ea0f2fd18bf40f0
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset=UTF-8

On Mon Dec 9, 2024 at 11:47 PM CET, Souji Thenria wrote:
> Hey all,
>
> On a VPS, I want to create separate jails for most services and assign
> each jail a public IPv6 address. However, I ran into an MTU issue, where
> the external interface of the host system sends multiple ICMPv6
> messages, stating that the received packets are too big to a remote
> server I tried to connect to from inside a jail. And the other server is
> ignoring these messages.
>
> I'm running FreeBSD 14.1-RELEASE on that server and use Bastille to
> manage my jails.
>
> The setup is as follows:
> <epair1> -- <eapir0> -- <bridge> -- <ext_inter>
>
> ext_inter: This interface is connected to the internet and has a public
> IPv6 address. It is NOT connected to the bridge.
>
> bridge: The bridge acts as default gateway for the jails and has a
> public IPv6 address assigned to it.
>
> epair0: Is a member of the bridge.
>
> epair1: This interface is passed to the jail, and a public IPv6 address i=
s
> assigned inside the jail.
>
> The idea is that the jails can communicate over the bridge with each
> other, and when communicating with hosts on the internet, the traffic is
> routed over the ext_inter interface.
> All interfaces have an MTU of 1500 configured.
>
>
> The Problem:
> When I try to connect to, e.g. a web server, the ext_inter interface
> sends a lot of ICMPv6 packets saying:
> ICMP6, packet too big, mtu 1500, length 1240
>
> When I make the same request from the host itself, it works without any
> issues. I suspect that this is because the ext_inter interface has the
> 'JUMBO_MTU' option set, allowing packets to pass with a larger MTU.
> However, this shouldn't happen since the bridge and epair0/1 don't have
> this option.
>
> I can also confirm that the ICMP messages pass the firewall and reach
> the remote server. However, all servers I tried seemed to ignore that
> message and resent their packets without fragmenting them to a fitting
> size.
>
>
> Does anyone know what the issue might be, or have they had a similar
> problem and been able to solve it?
>
> Regards,
> Souji
>
>
> --
> Souji Thenria
> Website: www.souji-thenria.net

Hi all,

I finally found the Solution to my problem. In case anyone else runs
into it, if you are on a VPS (or any other virtual machine) and use the
vtnet driver, you just have to set the following in /boot/loader.conf:

hw.vtnet.csum_disable=3D"1"
hw.vtnet.tso_disable=3D"1"
hw.vtnet.lro_disable=3D"1"

Only disabling checksum offloading might actually be enough.

Regards,
Souji

--=20
Souji Thenria
Website: www.souji-thenria.net

--44859d5cf90bfe9e88f5c6e0b0f37d96fa665d4864bf6ea0f2fd18bf40f0
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iHUEABYKAB0WIQSG4/SRE6pqved9MLdAFYmA9YTsaAUCZ+v+CwAKCRBAFYmA9YTs
aJbdAQD58XN/NUmV9nk95IS6iy+x/qwqhNSUS7lXW2BoEEL83QD9EBnCkwHFakoM
SR5y3hAOihm4ivMAVgxRiSqQHfUYFgo=
=+WHV
-----END PGP SIGNATURE-----

--44859d5cf90bfe9e88f5c6e0b0f37d96fa665d4864bf6ea0f2fd18bf40f0--

From nobody Tue Apr  1 17:33:28 2025
X-Original-To: freebsd-questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZRw8Y6JWFz5rrff
	for <freebsd-questions@mlmmj.nyi.freebsd.org>; Tue, 01 Apr 2025 17:33:49 +0000 (UTC)
	(envelope-from humo3302@gmail.com)
Received: from mail-pj1-x102e.google.com (mail-pj1-x102e.google.com [IPv6:2607:f8b0:4864:20::102e])
	(using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)
	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "smtp.gmail.com", Issuer "WR4" (verified OK))
	by mx1.freebsd.org (Postfix) with ESMTPS id 4ZRw8Y0MqTz49rQ
	for <freebsd-questions@freebsd.org>; Tue, 01 Apr 2025 17:33:49 +0000 (UTC)
	(envelope-from humo3302@gmail.com)
Authentication-Results: mx1.freebsd.org;
	dkim=pass header.d=gmail.com header.s=20230601 header.b=YcK3xcdn;
	dmarc=pass (policy=none) header.from=gmail.com;
	spf=pass (mx1.freebsd.org: domain of humo3302@gmail.com designates 2607:f8b0:4864:20::102e as permitted sender) smtp.mailfrom=humo3302@gmail.com
Received: by mail-pj1-x102e.google.com with SMTP id 98e67ed59e1d1-30384072398so7887941a91.0
        for <freebsd-questions@freebsd.org>; Tue, 01 Apr 2025 10:33:49 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20230601; t=1743528827; x=1744133627; darn=freebsd.org;
        h=to:subject:message-id:date:from:mime-version:from:to:cc:subject
         :date:message-id:reply-to;
        bh=eVF830AJmmXmNHp5Pnixp0sMIEHGQiwyP7bX0eNN77Q=;
        b=YcK3xcdn3FuM5fnSSfkMMcb1OFlLbvKsTLe7vR5kpT5bNPWLA8wPISmTL3rhR+e3Dq
         AcoJp7zTS9vnttX2CezxS7PCgzSmj9R0VrxnoD3ZMA5yo1GzuPC3l+9Pj7SqQh/K3Csf
         Yw4afCx6/BthnKJzYgXdntOb1bzhSXdD2AlHz/DlDOuwp4RpaMCwCoeDyWeOpXB9n/eC
         wKHr6y6UM4haKS8fxaBrFBHRd+h1+aratZFGmFFeLumDWq4s72JyUiFWHvQIUUy1mdEc
         aZULocXIJlqk0qolHDQQ1/C9s4C14iL+GcqXLbdHhoeTC6CHFxpHM6tr4OxWA1Uemg1Z
         9cwg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20230601; t=1743528827; x=1744133627;
        h=to:subject:message-id:date:from:mime-version:x-gm-message-state
         :from:to:cc:subject:date:message-id:reply-to;
        bh=eVF830AJmmXmNHp5Pnixp0sMIEHGQiwyP7bX0eNN77Q=;
        b=eXpAjXvG5JR8KVk8Iiv3XyGO8IMMVM+Xzjbq9g+VPPf/gxGnCfRPKdc8ePY1/tNrxk
         1ZwruYk2gvtarZmvXnbXY7nI36gAO5P5zcxZtdPyCzMAlZkrMepEtQIIk4KVc/XUcmTy
         qDCtp83RueVrqCx+HiJ+zcMCNIMu83tBXITWccOkuzCAiaEPM9e5T2QIOSnJKVWtGmG+
         5puLB5hK6megZFtEzQVPd92JGjIxQAHCVCHdhifcy0XRIQpA2a5hpGKxYAMRRTeepf+Q
         /DiwVjLQK6s+O7Rzm8Bu7G9dw7svqtthEI69CltfSsQQcJd533Ee1y3oyXPHmmmRzXao
         tbPg==
X-Gm-Message-State: AOJu0YyBPhxTe8JV+fEW4dl7Pw6NSm7eAt5njOp7IvHJOmeRJEBVMVoy
	9wKCkKhVNYdXf2QpkGS8RV40Aww1Hcn/3XsO5oW4jqhOYQvGi64yxhwq0qQF2cxMtWT+liPwCsS
	72WX98xmC6GnqSSNYdl4aB8Qao5Ztww==
X-Gm-Gg: ASbGncsC1u0V77DkGXmxKbhiSCX9dmDCtOQThu8fcSGbwlA4AE+Y0lyhLtno151Efxc
	iEfgsK5fyPyRMbj6JEihVhZMdqtuymRWDUcRwkoW7rOxkAc3j85W5ZQ8GHzzgy66vmJOb2wcSVC
	A11Vav6UKgUyWxxfI+A+5DHil9WVI8
X-Google-Smtp-Source: AGHT+IH+CG9x0GskHS0Bq+aAcbXHacmZ3efLr5XrtW8rKl3Cpp0RIE4Ld883LzRf78UHDAMZFIB/GQg/o6EkBf1W0gU=
X-Received: by 2002:a17:90b:1897:b0:305:5f2c:c577 with SMTP id
 98e67ed59e1d1-3055f2cc5b2mr5001587a91.3.1743528827368; Tue, 01 Apr 2025
 10:33:47 -0700 (PDT)
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
MIME-Version: 1.0
From: Mauricio <humo3302@gmail.com>
Date: Tue, 1 Apr 2025 13:33:28 -0400
X-Gm-Features: AQ5f1JrBdzaOoaCZqlWGTMxS19s8U7DyVhziI2_zW9vRevPQsvCHQJVlZ-tQON0
Message-ID: <CAMsoGZ0Uj7bnYFYXrVi_VpXSZGBb98UdUHgFwsjiEa949GGf2A@mail.gmail.com>
Subject: Problems with WiFi networks - HP 255 G7, FreeBSD 14.2
To: freebsd-questions@freebsd.org
Content-Type: multipart/alternative; boundary="000000000000693aef0631baf0ad"
X-Spamd-Result: default: False [-0.02 / 15.00];
	NEURAL_SPAM_LONG(0.98)[0.982];
	NEURAL_SPAM_MEDIUM(0.97)[0.967];
	NEURAL_HAM_SHORT(-0.97)[-0.966];
	DMARC_POLICY_ALLOW(-0.50)[gmail.com,none];
	R_SPF_ALLOW(-0.20)[+ip6:2607:f8b0:4000::/36];
	R_DKIM_ALLOW(-0.20)[gmail.com:s=20230601];
	MIME_GOOD(-0.10)[multipart/alternative,text/plain];
	TO_MATCH_ENVRCPT_ALL(0.00)[];
	RCVD_TLS_LAST(0.00)[];
	ARC_NA(0.00)[];
	RCPT_COUNT_ONE(0.00)[1];
	DWL_DNSWL_NONE(0.00)[gmail.com:dkim];
	FREEMAIL_FROM(0.00)[gmail.com];
	MIME_TRACE(0.00)[0:+,1:+,2:~];
	FREEMAIL_ENVFROM(0.00)[gmail.com];
	DKIM_TRACE(0.00)[gmail.com:+];
	MISSING_XM_UA(0.00)[];
	PREVIOUSLY_DELIVERED(0.00)[freebsd-questions@freebsd.org];
	TO_DN_NONE(0.00)[];
	FROM_EQ_ENVFROM(0.00)[];
	RCVD_IN_DNSWL_NONE(0.00)[2607:f8b0:4864:20::102e:from];
	MID_RHS_MATCH_FROMTLD(0.00)[];
	ASN(0.00)[asn:15169, ipnet:2607:f8b0::/32, country:US];
	MLMMJ_DEST(0.00)[freebsd-questions@freebsd.org];
	RCVD_COUNT_ONE(0.00)[1];
	FROM_HAS_DN(0.00)[]
X-Rspamd-Queue-Id: 4ZRw8Y0MqTz49rQ
X-Spamd-Bar: /

--000000000000693aef0631baf0ad
Content-Type: text/plain; charset="UTF-8"

Hey! : )

I have decided to install FreeBSD 14.2 in my laptop (HP 255 G7).
This model use a WiFi card detected as rtw880 in the system.

Ive used FreeBSD 14.1 in this laptop before, and i had to add the line "
compat.linuxkpi.skb.mem_limit=1"
in my /boot/loader.conf file for the WiFi card to work.

I did the same for this 14.2 installation. And my WiFi card is recognized
when looking at the ifconfig output.

I proceeded to add the lines needed at
/etc/rc.conf and /etc/wpa_supplicant.conf for the system to connect to my
desired network.
(As shown in the robonuggie youtube channel which has been appropiate for
me in the 14.1 system version.

Anyways, when i use "ping 1.1.1.1" to check the status of my connection,
last lines indicate "No route to host"
so i guess system didnt make the connection.

I also tried to configure the network in bsdconfig, but i cannot select any
network that appear as scanned in the interface.

What can i do to resolve this issue?


P.D: Im still new to these mailing lists, so if im not following whatever
convention that is appropiate here, feel free to let me know.
And thanks for the attention!

--000000000000693aef0631baf0ad
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"auto">Hey! : )<div dir=3D"auto"><br></div><div dir=3D"auto">I h=
ave decided to install FreeBSD 14.2 in my laptop (HP 255 G7).</div><div dir=
=3D"auto">This model use a WiFi card detected as rtw880 in the system.</div=
><div dir=3D"auto"><br></div><div dir=3D"auto">Ive used FreeBSD 14.1 in thi=
s laptop before, and i had to add the line &quot;<span style=3D"background-=
color:rgb(255,255,255);color:rgb(0,0,0);font-size:small">compat.linuxkpi.sk=
b.mem_limit=3D1&quot;=C2=A0</span></div><div dir=3D"auto">in my /boot/loade=
r.conf file for the WiFi card to work.</div><div dir=3D"auto"><br></div><di=
v dir=3D"auto">I did the same for this 14.2 installation. And my WiFi card =
is recognized when looking at the ifconfig output.</div><div dir=3D"auto"><=
br></div><div dir=3D"auto">I proceeded to add the lines needed at</div><div=
 dir=3D"auto">/etc/rc.conf and /etc/wpa_supplicant.conf for the system to c=
onnect to my desired network.</div><div dir=3D"auto">(As shown in the robon=
uggie youtube channel which has been appropiate for me in the 14.1 system v=
ersion.</div><div dir=3D"auto"><br></div><div dir=3D"auto">Anyways, when i =
use &quot;ping 1.1.1.1&quot; to check the status of my connection, last lin=
es indicate &quot;No route to host&quot;</div><div dir=3D"auto">so i guess =
system didnt make the connection.</div><div dir=3D"auto"><br></div><div dir=
=3D"auto">I also tried to configure the network in bsdconfig, but i cannot =
select any network that appear as scanned in the interface.</div><div dir=
=3D"auto"><br></div><div dir=3D"auto">What can i do to resolve this issue?<=
/div><div dir=3D"auto"><br></div><div dir=3D"auto"><br></div><div dir=3D"au=
to">P.D: Im still new to these mailing lists, so if im not following whatev=
er convention that is appropiate here, feel free to let me know.</div><div =
dir=3D"auto">And thanks for the attention!</div><div dir=3D"auto"><br></div=
><div dir=3D"auto"><br></div></div>

--000000000000693aef0631baf0ad--

From nobody Wed Apr  2 08:15:32 2025
X-Original-To: freebsd-questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZSHk50P80z5rvt0
	for <freebsd-questions@mlmmj.nyi.freebsd.org>; Wed, 02 Apr 2025 08:15:41 +0000 (UTC)
	(envelope-from freebsd-doc@fjl.co.uk)
Received: from bs1.fjl.org.uk (bs1.fjl.org.uk [84.45.41.196])
	by mx1.freebsd.org (Postfix) with ESMTP id 4ZSHk40YmDz4CyQ
	for <freebsd-questions@freebsd.org>; Wed, 02 Apr 2025 08:15:40 +0000 (UTC)
	(envelope-from freebsd-doc@fjl.co.uk)
Authentication-Results: mx1.freebsd.org;
	dkim=none;
	dmarc=none;
	spf=pass (mx1.freebsd.org: domain of freebsd-doc@fjl.co.uk designates 84.45.41.196 as permitted sender) smtp.mailfrom=freebsd-doc@fjl.co.uk
Received: from [192.168.1.109] (host86-173-148-176.range86-173.btcentralplus.com [86.173.148.176])
	(authenticated bits=0)
	by bs1.fjl.org.uk (8.14.4/8.14.4) with ESMTP id 5328Fc9s035088
	for <freebsd-questions@freebsd.org>; Wed, 2 Apr 2025 09:15:38 +0100 (BST)
	(envelope-from freebsd-doc@fjl.co.uk)
Content-Type: multipart/alternative;
 boundary="------------3RzSfic7k0b1p0X5nmHVh0xT"
Message-ID: <5ae22d3b-77c9-4dcf-9656-b113e49ba48d@fjl.co.uk>
Date: Wed, 2 Apr 2025 09:15:32 +0100
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: Problems with WiFi networks - HP 255 G7, FreeBSD 14.2
Content-Language: en-GB
To: freebsd-questions@freebsd.org
References: <CAMsoGZ0Uj7bnYFYXrVi_VpXSZGBb98UdUHgFwsjiEa949GGf2A@mail.gmail.com>
From: Frank Leonhardt <freebsd-doc@fjl.co.uk>
In-Reply-To: <CAMsoGZ0Uj7bnYFYXrVi_VpXSZGBb98UdUHgFwsjiEa949GGf2A@mail.gmail.com>
X-Spamd-Result: default: False [0.02 / 15.00];
	RBL_SENDERSCORE_REPUT_9(-1.00)[84.45.41.196:from];
	NEURAL_SPAM_LONG(1.00)[1.000];
	NEURAL_SPAM_MEDIUM(1.00)[1.000];
	NEURAL_HAM_SHORT(-0.98)[-0.984];
	R_SPF_ALLOW(-0.20)[+ip4:84.45.41.196:c];
	ONCE_RECEIVED(0.20)[];
	MIME_GOOD(-0.10)[multipart/alternative,text/plain];
	RCVD_NO_TLS_LAST(0.10)[];
	ARC_NA(0.00)[];
	ASN(0.00)[asn:25577, ipnet:84.45.0.0/17, country:GB];
	RCVD_COUNT_ONE(0.00)[1];
	MIME_TRACE(0.00)[0:+,1:+,2:~];
	FROM_EQ_ENVFROM(0.00)[];
	FROM_HAS_DN(0.00)[];
	RCPT_COUNT_ONE(0.00)[1];
	TO_MATCH_ENVRCPT_ALL(0.00)[];
	TO_DN_NONE(0.00)[];
	MID_RHS_MATCH_FROM(0.00)[];
	PREVIOUSLY_DELIVERED(0.00)[freebsd-questions@freebsd.org];
	MLMMJ_DEST(0.00)[freebsd-questions@freebsd.org];
	DMARC_NA(0.00)[fjl.co.uk];
	R_DKIM_NA(0.00)[]
X-Rspamd-Queue-Id: 4ZSHk40YmDz4CyQ
X-Spamd-Bar: /

This is a multi-part message in MIME format.
--------------3RzSfic7k0b1p0X5nmHVh0xT
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

On 01/04/2025 18:33, Mauricio wrote:
> Hey! : )
>
> I have decided to install FreeBSD 14.2 in my laptop (HP 255 G7).
> This model use a WiFi card detected as rtw880 in the system.
>
> Ive used FreeBSD 14.1 in this laptop before, and i had to add the line 
> "compat.linuxkpi.skb.mem_limit=1"
> in my /boot/loader.conf file for the WiFi card to work.
>
> I did the same for this 14.2 installation. And my WiFi card is 
> recognized when looking at the ifconfig output.
>
> I proceeded to add the lines needed at
> /etc/rc.conf and /etc/wpa_supplicant.conf for the system to connect to 
> my desired network.
> (As shown in the robonuggie youtube channel which has been appropiate 
> for me in the 14.1 system version.
>
> Anyways, when i use "ping 1.1.1.1" to check the status of my 
> connection, last lines indicate "No route to host"
> so i guess system didnt make the connection.
>
> I also tried to configure the network in bsdconfig, but i cannot 
> select any network that appear as scanned in the interface.
>
> What can i do to resolve this issue?
>
>
> P.D: Im still new to these mailing lists, so if im not following 
> whatever convention that is appropiate here, feel free to let me know.
> And thanks for the attention!

Hi Maurico,

I don't know about the WiFi aspect specifically but if ping this is your 
only test for an IPv4 connection some more debugging information would 
be useful.

What's the output of ifconfig      ?

What's the output of netstat -r   ?

Regards, Frank.


--------------3RzSfic7k0b1p0X5nmHVh0xT
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit

<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  </head>
  <body>
    <div class="moz-cite-prefix">On 01/04/2025 18:33, Mauricio wrote:<br>
    </div>
    <blockquote type="cite"
cite="mid:CAMsoGZ0Uj7bnYFYXrVi_VpXSZGBb98UdUHgFwsjiEa949GGf2A@mail.gmail.com">
      <meta http-equiv="content-type" content="text/html; charset=UTF-8">
      <div dir="auto">Hey! : )
        <div dir="auto"><br>
        </div>
        <div dir="auto">I have decided to install FreeBSD 14.2 in my
          laptop (HP 255 G7).</div>
        <div dir="auto">This model use a WiFi card detected as rtw880 in
          the system.</div>
        <div dir="auto"><br>
        </div>
        <div dir="auto">Ive used FreeBSD 14.1 in this laptop before, and
          i had to add the line "<span
style="background-color:rgb(255,255,255);color:rgb(0,0,0);font-size:small">compat.linuxkpi.skb.mem_limit=1" </span></div>
        <div dir="auto">in my /boot/loader.conf file for the WiFi card
          to work.</div>
        <div dir="auto"><br>
        </div>
        <div dir="auto">I did the same for this 14.2 installation. And
          my WiFi card is recognized when looking at the ifconfig
          output.</div>
        <div dir="auto"><br>
        </div>
        <div dir="auto">I proceeded to add the lines needed at</div>
        <div dir="auto">/etc/rc.conf and /etc/wpa_supplicant.conf for
          the system to connect to my desired network.</div>
        <div dir="auto">(As shown in the robonuggie youtube channel
          which has been appropiate for me in the 14.1 system version.</div>
        <div dir="auto"><br>
        </div>
        <div dir="auto">Anyways, when i use "ping 1.1.1.1" to check the
          status of my connection, last lines indicate "No route to
          host"</div>
        <div dir="auto">so i guess system didnt make the connection.</div>
        <div dir="auto"><br>
        </div>
        <div dir="auto">I also tried to configure the network in
          bsdconfig, but i cannot select any network that appear as
          scanned in the interface.</div>
        <div dir="auto"><br>
        </div>
        <div dir="auto">What can i do to resolve this issue?</div>
        <div dir="auto"><br>
        </div>
        <div dir="auto"><br>
        </div>
        <div dir="auto">P.D: Im still new to these mailing lists, so if
          im not following whatever convention that is appropiate here,
          feel free to let me know.</div>
        <div dir="auto">And thanks for the attention!</div>
      </div>
    </blockquote>
    <p>Hi Maurico, </p>
    <p>I don't know about the WiFi aspect specifically but if ping this
      is your only test for an IPv4 connection some more debugging
      information would be useful.</p>
    <p>What's the output of ifconfig      ?</p>
    <p>What's the output of netstat -r   ?<br>
    </p>
    <p>Regards, Frank.</p>
    <p><br>
    </p>
  </body>
</html>

--------------3RzSfic7k0b1p0X5nmHVh0xT--

From nobody Wed Apr  2 08:29:49 2025
X-Original-To: freebsd-questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZSJ2q5w3Sz5rx7n
	for <freebsd-questions@mlmmj.nyi.freebsd.org>; Wed, 02 Apr 2025 08:30:11 +0000 (UTC)
	(envelope-from dch@skunkwerks.at)
Received: from fout-a4-smtp.messagingengine.com (fout-a4-smtp.messagingengine.com [103.168.172.147])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256)
	(Client did not present a certificate)
	by mx1.freebsd.org (Postfix) with ESMTPS id 4ZSJ2q45Rgz4FVP
	for <freebsd-questions@freebsd.org>; Wed, 02 Apr 2025 08:30:11 +0000 (UTC)
	(envelope-from dch@skunkwerks.at)
Authentication-Results: mx1.freebsd.org;
	none
Received: from phl-compute-08.internal (phl-compute-08.phl.internal [10.202.2.48])
	by mailfout.phl.internal (Postfix) with ESMTP id 2D5621380145;
	Wed,  2 Apr 2025 04:30:10 -0400 (EDT)
Received: from phl-imap-15 ([10.202.2.104])
  by phl-compute-08.internal (MEProxy); Wed, 02 Apr 2025 04:30:10 -0400
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=skunkwerks.at;
	 h=cc:content-transfer-encoding:content-type:content-type:date
	:date:from:from:in-reply-to:in-reply-to:message-id:mime-version
	:references:reply-to:subject:subject:to:to; s=fm3; t=1743582610;
	 x=1743669010; bh=Riqg51Fo9o/2ybY6yIpRy1i7DKYzK1oCZMXRf9EjMps=; b=
	Fu4k1UyeNia1h/Yergs7Awr8XFK7A1FgxUqEqUVBkwRVdJ2QSqXWqmpGNhgKndH4
	5KI/A8A1Uv088UyGS+qd79hq5/tRQ9td8rYs2T6okZuVr5gCZ8qwaTuAPRL/Vig7
	TFvvjfP/NlIK0DfrsvHevlzD2gXsbKPqVB47CxQwCaJnmCXBUOH6WkTrEhrE9q2w
	Adb9LWVbd8Ru41XAMGbtG65wn21myyA0UOmsB9RP5YQsOlDlQErVxx70U+MNeine
	4hiHID3iuGOx5YLeiGl2HU310n97+tz9Z8d/vg5EEbsKqDTEpMFqHoQUgvBT5zlq
	zYA/vzgpXU6gJPxa6VW3Yw==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=
	messagingengine.com; h=cc:content-transfer-encoding:content-type
	:content-type:date:date:feedback-id:feedback-id:from:from
	:in-reply-to:in-reply-to:message-id:mime-version:references
	:reply-to:subject:subject:to:to:x-me-proxy:x-me-sender
	:x-me-sender:x-sasl-enc; s=fm2; t=1743582610; x=1743669010; bh=R
	iqg51Fo9o/2ybY6yIpRy1i7DKYzK1oCZMXRf9EjMps=; b=iKlFPMXSfoUe13k+Z
	zwcd8vbV3rLPY8fY/gZ95PDkRs7J2IfLrLS4QHOmtQdIYB4wnZ6FxHhzu+2SB8Nz
	lHJYdsRoKHDZA3VK1AScaDT+JfotMEz8NjjboT/75bTr88H2isNE9uCCh6o1e4TV
	+lO3WFLsQvT082B4JyBLn0b2VnIUz6kp/oLYzRAsnT7upAy73F9s9BMnSUtsJO0+
	3y2/MwEtdoa0ELfzUUP3euXfCaH+hc6LfpCGtKClUlqbv821lJtlvEbd0dHrQuwJ
	R8avlfBV3KLeKEvEK6PjVBbRGWat7I3/W1paDsXlOgvZTtArAaXFQP9WB4U/OJxp
	yGDow==
X-ME-Sender: <xms:kfXsZ8s9p_zjtvaOiCdRb9Qr7zcwWVjMKQsmo_JrZ6SeerZ52kuscA>
    <xme:kfXsZ5fN0x2VLKNlJ0Qh3VuEHHXmU1nJfDroFkLYpLX_D3WS_DLy4TEhINa_gMDBU
    Tsm06aBdf-Vk-q_Vg>
X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeefvddrtddtgddukeehudelucetufdoteggodetrf
    dotffvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdggtfgfnhhsuhgsshgtrhhisggv
    pdfurfetoffkrfgpnffqhgenuceurghilhhouhhtmecufedttdenucenucfjughrpefogg
    ffhffvkfgjfhfutgfgsehtjeertdertddtnecuhfhrohhmpedfffgrvhgvucevohhtthhl
    vghhuhgsvghrfdcuoegutghhsehskhhunhhkfigvrhhkshdrrghtqeenucggtffrrghtth
    gvrhhnpeegieeltdejjeekueeftdeukeehfeevkedvueeutdffhfehkeegleeggfejiefg
    tdenucffohhmrghinheplhgvrghsvghsrdhonhgvnecuvehluhhsthgvrhfuihiivgeptd
    enucfrrghrrghmpehmrghilhhfrhhomhepuggthhesshhkuhhnkhifvghrkhhsrdgrthdp
    nhgspghrtghpthhtohepvddpmhhouggvpehsmhhtphhouhhtpdhrtghpthhtohepfhhrvg
    gvsghsugdqqhhuvghsthhiohhnshesfhhrvggvsghsugdrohhrghdprhgtphhtthhopehh
    uhhmoheffedtvdesghhmrghilhdrtghomh
X-ME-Proxy: <xmx:kfXsZ3yLeG5gviOab6Vx6_fUbootkHrmYUIGAFwTUmbXW3vRk_s26g>
    <xmx:kfXsZ_M32LmNrA7eSv0oKtJp0P4LKki5WE-dVRVm2qP5L-TCj5LWew>
    <xmx:kfXsZ8_om-01uYmPmXypEhxLDKN4bZp7r4cvKZOVber-QOX9KT3WwA>
    <xmx:kfXsZ3W2RuB4FsuIJ4oPqTNKVtTLRnLNZOKDmf4TUTjaR_xRPhpRTA>
    <xmx:kvXsZ6f-enM8ncE_r_mKoV-WK8q83DWizF0LyWPoXZX8C_iafEZpGUyq>
Feedback-ID: ic0e84090:Fastmail
Received: by mailuser.phl.internal (Postfix, from userid 501)
	id 7C4EE78006A; Wed,  2 Apr 2025 04:30:09 -0400 (EDT)
X-Mailer: MessagingEngine.com Webmail Interface
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
MIME-Version: 1.0
X-ThreadId: Td9e8b6f32610bd47
Date: Wed, 02 Apr 2025 08:29:49 +0000
From: "Dave Cottlehuber" <dch@skunkwerks.at>
To: Mauricio <humo3302@gmail.com>,
 freebsd-questions <freebsd-questions@freebsd.org>
Message-Id: <093f0f3a-c9dc-4817-9be7-1d0c285f8e5c@app.fastmail.com>
In-Reply-To: 
 <CAMsoGZ0Uj7bnYFYXrVi_VpXSZGBb98UdUHgFwsjiEa949GGf2A@mail.gmail.com>
References: 
 <CAMsoGZ0Uj7bnYFYXrVi_VpXSZGBb98UdUHgFwsjiEa949GGf2A@mail.gmail.com>
Subject: Re: Problems with WiFi networks - HP 255 G7, FreeBSD 14.2
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
X-Rspamd-Pre-Result: action=no action;
	module=replies;
	Message is reply to one we originated
X-Spamd-Result: default: False [-4.00 / 15.00];
	REPLY(-4.00)[];
	ASN(0.00)[asn:209242, ipnet:103.168.172.0/24, country:US]
X-Rspamd-Queue-Id: 4ZSJ2q45Rgz4FVP
X-Spamd-Bar: ----

On Tue, 1 Apr 2025, at 17:33, Mauricio wrote:
> Hey! : )
>
> I have decided to install FreeBSD 14.2 in my laptop (HP 255 G7).
> This model use a WiFi card detected as rtw880 in the system.

Welcome Mauricio!

> I did the same for this 14.2 installation. And my WiFi card is 
> recognized when looking at the ifconfig output.

A general suggestion is to provide the relevant info:

- the section of dmesg

- rc.conf if its not obvious what you'd have

- any output like ifconfig wlan0

> Anyways, when i use "ping 1.1.1.1" to check the status of my 
> connection, last lines indicate "No route to host"
> so i guess system didnt make the connection.

other that `ifconfig wlan0` what's in `netstat -r4n` ?

This will show if you got an IP at all, and also if a default
route has been created.

There should be a file in /var/db/dhclient.leases.* 

One possibility is that the DHCP client either didn't run, or
did not get an answer in time.

Try deleting /var/db/dhclient.leases.* and running

`service dhclient restart wlan0`

or in the foreground:

# service dhclient stop wlan0
$ dhclient -d wlan0

This should produce output like this:

DHCPREQUEST on igc0 to 255.255.255.255 port 67
DHCPACK from 172.16.1.1
bound to 172.16.1.4 -- renewal in 150000 seconds.

and it should also run the hook script which sets the
default route.

A+
Dave

From nobody Wed Apr  2 16:16:27 2025
X-Original-To: freebsd-questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZSVP84HrHz5sTg5
	for <freebsd-questions@mlmmj.nyi.freebsd.org>; Wed, 02 Apr 2025 16:16:44 +0000 (UTC)
	(envelope-from humo3302@gmail.com)
Received: from mail-pj1-x102f.google.com (mail-pj1-x102f.google.com [IPv6:2607:f8b0:4864:20::102f])
	(using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)
	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "smtp.gmail.com", Issuer "WR4" (verified OK))
	by mx1.freebsd.org (Postfix) with ESMTPS id 4ZSVP771rfz3pl5
	for <freebsd-questions@freebsd.org>; Wed, 02 Apr 2025 16:16:43 +0000 (UTC)
	(envelope-from humo3302@gmail.com)
Authentication-Results: mx1.freebsd.org;
	none
Received: by mail-pj1-x102f.google.com with SMTP id 98e67ed59e1d1-30155bbbed9so8943787a91.1
        for <freebsd-questions@freebsd.org>; Wed, 02 Apr 2025 09:16:43 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20230601; t=1743610602; x=1744215402; darn=freebsd.org;
        h=cc:to:subject:message-id:date:from:in-reply-to:references
         :mime-version:from:to:cc:subject:date:message-id:reply-to;
        bh=U97Xd1z5KGQrKgLzfnGBqBCEXi6UwjT0JJNBLgBLYUs=;
        b=mo6Z1TBBL4V0BHvOFdcLHINx56ubp2IsQRbyCpVOxen7BWt3MQnl2NZdMtzl6lE+pv
         71DuJQi8nUe8ezzUS8dB3VFYYBTdgfkHTzaGVmhOq3XUdFUtNVL3fBvbSqVt/81qGPIz
         hFldyYhfYCR7OxgS7hgt6EkfnZ8Gfn3ThZ3L+C33lqTgK+7NfckXiEdYlv04v2u29pGU
         GbqiNv4pAGpoP2q6nYDUfdpI+b90rVz9xqUeekwtb1YF35Lreywoj1cyEoRp1qP9d0Q7
         YPn3vJCI7QNJGGusE18+rL8wAJiu012RWFaqF/OB8I9QC05gQ1RG7RDcODKGK/n4GWk3
         pNyg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20230601; t=1743610602; x=1744215402;
        h=cc:to:subject:message-id:date:from:in-reply-to:references
         :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id
         :reply-to;
        bh=U97Xd1z5KGQrKgLzfnGBqBCEXi6UwjT0JJNBLgBLYUs=;
        b=UiFdaytsxhJzIc1W04zj+v+rmmzyGblCGTNJb70Tvabz2iDL4X/QiZwH3EcGGVFdIR
         Ee0VS7LPsujE6wbMJuZ3ZTnCniZ6p8tJYIkWrqTVSaiZBHl+QxZAy+2deOk4CkcCrg2P
         IFIu5v2f2uovSdNzIyUsK+Jdf0lF+eJaj/eR2lsJ2oTOE5W1cFDQlpTdYiXICRCqAfyz
         VyK1UESyXEz20PWDbiLDtCSJIeYjxNc8DK9r9VgceMB6vWaepRSHe1nhLDuDXev0bIOH
         18XqltF9wDbZ5kCmHq9UY7LzFBlgSaqmcnt90gh1UWkFxiy7KhJa1/G0oLh0R4AipMsB
         x55A==
X-Gm-Message-State: AOJu0YwJSYX76GvP/l9xoNJ3Nf/fbVvPAAmn0LVn7REjFQ342RjicRN/
	LxYTCRSIQrTEtwBU+V8aUKC42DOyEPmSAPodzNCjXMsnqpcHlH+WxYhPGQ3982kVvDdhimhSKU1
	TXZJxCjFqHw68re1H5mVyJDF9O+SxeXQK
X-Gm-Gg: ASbGncv2NdC3OqJooW2SDM3YmPDqnLEaYIvE/f/8Mx/la72py/sKjxSz1zCmERgmg84
	SoUBUZnetwf2rzRO05KuC15zKKl1fCkgVLTZTQnj4FcfBXP9XRKs57JRIp9xDE6cQJqz9baFmVv
	KJFA2M4JBpMKNksQH4aAObTTEOvuo=
X-Google-Smtp-Source: AGHT+IFWKmM+MhX2gKf0PFra+s4rrzloDERlffWyoLhZAujFGNSwgk5END6iL76f+47fkcE3lEwxsVni922VYEozWes=
X-Received: by 2002:a17:90b:4ec6:b0:2fe:b470:dde4 with SMTP id
 98e67ed59e1d1-30560878f12mr11964772a91.12.1743610601605; Wed, 02 Apr 2025
 09:16:41 -0700 (PDT)
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
MIME-Version: 1.0
References: <CAMsoGZ0Uj7bnYFYXrVi_VpXSZGBb98UdUHgFwsjiEa949GGf2A@mail.gmail.com>
 <093f0f3a-c9dc-4817-9be7-1d0c285f8e5c@app.fastmail.com>
In-Reply-To: <093f0f3a-c9dc-4817-9be7-1d0c285f8e5c@app.fastmail.com>
From: Mauricio <humo3302@gmail.com>
Date: Wed, 2 Apr 2025 12:16:27 -0400
X-Gm-Features: AQ5f1JpZlkHwFsDOsYhKl1oqbktp-yMcrCEfmxS4iRkhEV-ntwa2RGpOCnDDXjU
Message-ID: <CAMsoGZ2Y9uoXbasjoisWxNt7EeNMcrJsfD50rMyRVD3EAc48dw@mail.gmail.com>
Subject: Re: Problems with WiFi networks - HP 255 G7, FreeBSD 14.2
To: Dave Cottlehuber <dch@skunkwerks.at>
Cc: freebsd-questions <freebsd-questions@freebsd.org>
Content-Type: multipart/alternative; boundary="000000000000893cb80631cdfa75"
X-Rspamd-Pre-Result: action=no action;
	module=replies;
	Message is reply to one we originated
X-Spamd-Result: default: False [-4.00 / 15.00];
	REPLY(-4.00)[];
	ASN(0.00)[asn:15169, ipnet:2607:f8b0::/32, country:US]
X-Rspamd-Queue-Id: 4ZSVP771rfz3pl5
X-Spamd-Bar: ----

--000000000000893cb80631cdfa75
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Thanks for the attention, both of you.

Here i share the output of the commands you requested:

dmesg: https://pastebin.com/pYWAkSed

ifconfig: https://pastebin.com/JcETgrGU

netstat -r: https://pastebin.com/298KabLG

netstat -r4n: https://pastebin.com/5kMhuFB6

And my rc.conf file: https://pastebin.com/55Gt0yGG

> There should be a file in /var/db/dhclient.leases.*

I could not find it, everything mentioned after /var/db was not in the
location.

So i could not delete it as you suggested.

Running $ dhclient -d wlan0 outputs: https://pastebin.com/VSRPTUD2







On Wed, Apr 2, 2025 at 4:30=E2=80=AFAM Dave Cottlehuber <dch@skunkwerks.at>=
 wrote:

> On Tue, 1 Apr 2025, at 17:33, Mauricio wrote:
> > Hey! : )
> >
> > I have decided to install FreeBSD 14.2 in my laptop (HP 255 G7).
> > This model use a WiFi card detected as rtw880 in the system.
>
> Welcome Mauricio!
>
> > I did the same for this 14.2 installation. And my WiFi card is
> > recognized when looking at the ifconfig output.
>
> A general suggestion is to provide the relevant info:
>
> - the section of dmesg
>
> - rc.conf if its not obvious what you'd have
>
> - any output like ifconfig wlan0
>
> > Anyways, when i use "ping 1.1.1.1" to check the status of my
> > connection, last lines indicate "No route to host"
> > so i guess system didnt make the connection.
>
> other that `ifconfig wlan0` what's in `netstat -r4n` ?
>
> This will show if you got an IP at all, and also if a default
> route has been created.
>
> There should be a file in /var/db/dhclient.leases.*
>
> One possibility is that the DHCP client either didn't run, or
> did not get an answer in time.
>
> Try deleting /var/db/dhclient.leases.* and running
>
> `service dhclient restart wlan0`
>
> or in the foreground:
>
> # service dhclient stop wlan0
> $ dhclient -d wlan0
>
> This should produce output like this:
>
> DHCPREQUEST on igc0 to 255.255.255.255 port 67
> DHCPACK from 172.16.1.1
> bound to 172.16.1.4 -- renewal in 150000 seconds.
>
> and it should also run the hook script which sets the
> default route.
>
> A+
> Dave
>

--000000000000893cb80631cdfa75
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Thanks for the attention, both of you.</div><div><br>=
</div><div>Here i share the output of the commands you requested:</div><div=
><br></div><div>dmesg: <a href=3D"https://pastebin.com/pYWAkSed">https://pa=
stebin.com/pYWAkSed</a></div><div><br></div><div>ifconfig: <a href=3D"https=
://pastebin.com/JcETgrGU">https://pastebin.com/JcETgrGU</a></div><div><br><=
/div><div>netstat -r: <a href=3D"https://pastebin.com/298KabLG">https://pas=
tebin.com/298KabLG</a></div><div><br></div><div>netstat -r4n: <a href=3D"ht=
tps://pastebin.com/5kMhuFB6">https://pastebin.com/5kMhuFB6</a></div><div><b=
r></div><div>And my rc.conf file: <a href=3D"https://pastebin.com/55Gt0yGG"=
>https://pastebin.com/55Gt0yGG</a></div><div><br></div><div>&gt; There shou=
ld be a file in /var/db/dhclient.leases.* </div><div><br></div><div>I could=
 not find it, everything mentioned after /var/db was not in the location.</=
div><div><br></div><div>So i could not delete it as you suggested.</div><di=
v><br></div><div>Running $ dhclient -d wlan0 outputs: <a href=3D"https://pa=
stebin.com/VSRPTUD2">https://pastebin.com/VSRPTUD2</a></div><div><br></div>=
<div><br></div><div><br></div><div><br></div><div><br></div><div><br></div>=
</div><br><div class=3D"gmail_quote gmail_quote_container"><div dir=3D"ltr"=
 class=3D"gmail_attr">On Wed, Apr 2, 2025 at 4:30=E2=80=AFAM Dave Cottlehub=
er &lt;<a href=3D"mailto:dch@skunkwerks.at">dch@skunkwerks.at</a>&gt; wrote=
:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.=
8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On Tue, 1 Apr =
2025, at 17:33, Mauricio wrote:<br>
&gt; Hey! : )<br>
&gt;<br>
&gt; I have decided to install FreeBSD 14.2 in my laptop (HP 255 G7).<br>
&gt; This model use a WiFi card detected as rtw880 in the system.<br>
<br>
Welcome Mauricio!<br>
<br>
&gt; I did the same for this 14.2 installation. And my WiFi card is <br>
&gt; recognized when looking at the ifconfig output.<br>
<br>
A general suggestion is to provide the relevant info:<br>
<br>
- the section of dmesg<br>
<br>
- rc.conf if its not obvious what you&#39;d have<br>
<br>
- any output like ifconfig wlan0<br>
<br>
&gt; Anyways, when i use &quot;ping 1.1.1.1&quot; to check the status of my=
 <br>
&gt; connection, last lines indicate &quot;No route to host&quot;<br>
&gt; so i guess system didnt make the connection.<br>
<br>
other that `ifconfig wlan0` what&#39;s in `netstat -r4n` ?<br>
<br>
This will show if you got an IP at all, and also if a default<br>
route has been created.<br>
<br>
There should be a file in /var/db/dhclient.leases.* <br>
<br>
One possibility is that the DHCP client either didn&#39;t run, or<br>
did not get an answer in time.<br>
<br>
Try deleting /var/db/dhclient.leases.* and running<br>
<br>
`service dhclient restart wlan0`<br>
<br>
or in the foreground:<br>
<br>
# service dhclient stop wlan0<br>
$ dhclient -d wlan0<br>
<br>
This should produce output like this:<br>
<br>
DHCPREQUEST on igc0 to 255.255.255.255 port 67<br>
DHCPACK from 172.16.1.1<br>
bound to 172.16.1.4 -- renewal in 150000 seconds.<br>
<br>
and it should also run the hook script which sets the<br>
default route.<br>
<br>
A+<br>
Dave<br>
</blockquote></div>

--000000000000893cb80631cdfa75--

From nobody Wed Apr  2 23:30:06 2025
X-Original-To: freebsd-questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZSh1b5Mjlz5s4Fp
	for <freebsd-questions@mlmmj.nyi.freebsd.org>; Wed, 02 Apr 2025 23:30:27 +0000 (UTC)
	(envelope-from dch@skunkwerks.at)
Received: from fhigh-a8-smtp.messagingengine.com (fhigh-a8-smtp.messagingengine.com [103.168.172.159])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256)
	(Client did not present a certificate)
	by mx1.freebsd.org (Postfix) with ESMTPS id 4ZSh1b37mmz44Lw
	for <freebsd-questions@freebsd.org>; Wed, 02 Apr 2025 23:30:27 +0000 (UTC)
	(envelope-from dch@skunkwerks.at)
Authentication-Results: mx1.freebsd.org;
	none
Received: from phl-compute-12.internal (phl-compute-12.phl.internal [10.202.2.52])
	by mailfhigh.phl.internal (Postfix) with ESMTP id CD6981140202;
	Wed,  2 Apr 2025 19:30:26 -0400 (EDT)
Received: from phl-imap-15 ([10.202.2.104])
  by phl-compute-12.internal (MEProxy); Wed, 02 Apr 2025 19:30:26 -0400
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=skunkwerks.at;
	 h=cc:cc:content-transfer-encoding:content-type:content-type
	:date:date:from:from:in-reply-to:in-reply-to:message-id
	:mime-version:references:reply-to:subject:subject:to:to; s=fm3;
	 t=1743636626; x=1743723026; bh=2sgMPhiAAlHZts3yYysfITNwPnohn50T
	wR13iEGEziw=; b=SYcJrpbEGf8KDzrf567meTN228nOhpGEsAAVTolS0lGwPpKp
	EzHstm+pwO/+FGb6fLexmgi9Zq7oPjSCDyDEI8kODhC2uugpzFPOSdtS7583ZJsT
	TBPHe2wuL8YPSJ/HxbDfrYptZZygzknfmrREJML74+EFfYoQUzsSnMyeHnh22a7O
	g0PgtNqsuZQN6NFXgLeLd6DKGVT+x2hXmpQcKUxM8Jcf7SRAzyWfaquKRHY6sfF1
	FcTRSq+RiEOjE9sTdcEkhjmMAaFtCwPyAgotryMnaR9h2jA+FRkdskz91UtuQL+3
	l5ZXGy/rkotXouanQ0zDHWTLeO9jTD5/mfJ1KA==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=
	messagingengine.com; h=cc:cc:content-transfer-encoding
	:content-type:content-type:date:date:feedback-id:feedback-id
	:from:from:in-reply-to:in-reply-to:message-id:mime-version
	:references:reply-to:subject:subject:to:to:x-me-proxy
	:x-me-sender:x-me-sender:x-sasl-enc; s=fm2; t=1743636626; x=
	1743723026; bh=2sgMPhiAAlHZts3yYysfITNwPnohn50TwR13iEGEziw=; b=L
	HIS/am0QZTY0p1V613gR64arSdtPeTDYQNUmr/ijdWrZskOVrBsjgk2NyE/xI1Ov
	hQ5Qjde5Xw7+O8oAiG0L9J8JYZj63jOFBWvo+9cEC6n0l6z2phDjt1NA7U7EdNlt
	k2n57Stb7MIMLEy74d76jbTNsL8RZOINqsq32NP41dx6u8J4/FPiBhh+atgcr6p4
	BhrKVr2ltJScmIO7lnOoemoWZC7PqVClPfofHQsEUswHgOVNiohCR1akJRu7+krz
	88l7NrwuXq4mIsMaEgGkAP1TtEPJewbrYvH12EkmIgQwna6C2j0FHdKf7KiPd3he
	cY4nrLpakW/X5PEeZR1zg==
X-ME-Sender: <xms:ksjtZ4K7e0taqiAWUh6it6rZTbnQG8pGqF18gamDo88heURP1tPhOg>
    <xme:ksjtZ4K-8y1Q8gHGjArjpUHhyHd0L2fDaOI7_YToV9qhNHnXkz7HHMNq8t1BvEDQs
    IHwe1cdqG55O3BR3g>
X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeefvddrtddtgddukeeileekucetufdoteggodetrf
    dotffvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdggtfgfnhhsuhgsshgtrhhisggv
    pdfurfetoffkrfgpnffqhgenuceurghilhhouhhtmecufedttdenucenucfjughrpefogg
    ffhffvvefkjghfufgtgfesthhqredtredtjeenucfhrhhomhepfdffrghvvgcuvehothht
    lhgvhhhusggvrhdfuceouggthhesshhkuhhnkhifvghrkhhsrdgrtheqnecuggftrfgrth
    htvghrnheptdeigfeuleefvdelvdfgkeejtdehgeeiudefkedtheffgeevvdfgheeljeek
    ffdvnecuffhomhgrihhnpehfrhgvvggsshgurdhorhhgpdhprghsthgvsghinhdrtghomh
    enucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepmhgrihhlfhhrohhmpegutghh
    sehskhhunhhkfigvrhhkshdrrghtpdhnsggprhgtphhtthhopedvpdhmohguvgepshhmth
    hpohhuthdprhgtphhtthhopehfrhgvvggsshguqdhquhgvshhtihhonhhssehfrhgvvggs
    shgurdhorhhgpdhrtghpthhtohephhhumhhofeeftddvsehgmhgrihhlrdgtohhm
X-ME-Proxy: <xmx:ksjtZ4tBKeE49JFW7gVoSbFPHLyDPPzCLBewxSeVvcO1E2CNArjGYQ>
    <xmx:ksjtZ1Y2eyq0Qd04VCX6QvqezCe9pq7p2KzYXjicRq5uiR2J4dU0sA>
    <xmx:ksjtZ_Yq07BACzMufmTs4J9IECm7mXBD5hoFpBTHPsl9sTsaj-ce0Q>
    <xmx:ksjtZxDrMHKFXytubkZDf8T2cmFMn_SGXqEsa8VHONAyy1juSf0RKw>
    <xmx:ksjtZzrrV1pyXse1WYjecm7le03n_mp1msOx4CudP7IYBhlzVZ3xvmP7>
Feedback-ID: ic0e84090:Fastmail
Received: by mailuser.phl.internal (Postfix, from userid 501)
	id 5E75778006A; Wed,  2 Apr 2025 19:30:26 -0400 (EDT)
X-Mailer: MessagingEngine.com Webmail Interface
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
MIME-Version: 1.0
X-ThreadId: Td9e8b6f32610bd47
Date: Thu, 03 Apr 2025 01:30:06 +0200
From: "Dave Cottlehuber" <dch@skunkwerks.at>
To: Mauricio <humo3302@gmail.com>
Cc: freebsd-questions <freebsd-questions@freebsd.org>
Message-Id: <d46b0ad1-0499-4d19-927c-ff4873cdc937@app.fastmail.com>
In-Reply-To: 
 <CAMsoGZ2Y9uoXbasjoisWxNt7EeNMcrJsfD50rMyRVD3EAc48dw@mail.gmail.com>
References: 
 <CAMsoGZ0Uj7bnYFYXrVi_VpXSZGBb98UdUHgFwsjiEa949GGf2A@mail.gmail.com>
 <093f0f3a-c9dc-4817-9be7-1d0c285f8e5c@app.fastmail.com>
 <CAMsoGZ2Y9uoXbasjoisWxNt7EeNMcrJsfD50rMyRVD3EAc48dw@mail.gmail.com>
Subject: Re: Problems with WiFi networks - HP 255 G7, FreeBSD 14.2
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
X-Rspamd-Pre-Result: action=no action;
	module=replies;
	Message is reply to one we originated
X-Spamd-Result: default: False [-4.00 / 15.00];
	REPLY(-4.00)[];
	ASN(0.00)[asn:209242, ipnet:103.168.172.0/24, country:US]
X-Rspamd-Queue-Id: 4ZSh1b37mmz44Lw
X-Spamd-Bar: ----

> On Wed, Apr 2, 2025 at 4:30=E2=80=AFAM Dave Cottlehuber <dch@skunkwerk=
s.at> wrote:
>> On Tue, 1 Apr 2025, at 17:33, Mauricio wrote:
>> > Hey! : )
>> >
>> > I have decided to install FreeBSD 14.2 in my laptop (HP 255 G7).
>> > This model use a WiFi card detected as rtw880 in the system.
>>=20
>> Welcome Mauricio!
>>=20
>> > I did the same for this 14.2 installation. And my WiFi card is=20
>> > recognized when looking at the ifconfig output.

TLDR try installing 14-STABLE to see if this is resolved.

I wrote most of the notes below before finding PR283142, so just
use it to refer to in future.

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D272145 seems relevant
with https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D283903
as does https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D283142 which
looks like a fix may already be in 14-STABLE, my suggestion would be
to see if 14-STABLE works or not.

> dmesg: https://pastebin.com/pYWAkSed

rtw880: <rtw_8821ce> port 0x2000-0x20ff mem 0xc0600000-0xc060ffff at dev=
ice 0.0 on pci1
rtw880: successfully loaded firmware image 'rtw88/rtw8821c_fw.bin'
rtw880: Firmware version 24.8.0, H2C version 12

> ifconfig: https://pastebin.com/JcETgrGU

wlan0: flags=3D8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu=
 1500
	options=3D0
	ether 00:e9:3a:db:06:fb
	groups: wlan
	ssid "" channel 11 (2462 MHz 11g). <---------
	regdomain FCC country US authmode WPA1+WPA2/802.11i privacy ON
	deftxkey UNDEF txpower 30 bmiss 7 scanvalid 60 protmode CTS wme
	roaming MANUAL
	parent interface: rtw880
	media: IEEE 802.11 Wireless Ethernet autoselect (autoselect)
	status: no carrier <-------------------------

So you're not getting an IP address from DHCP server because no
connection is being established to the access point (no carrier).

While I can't diagnose this, you should grab output of wifi scan,
and run wpa_supplicant in debug mode, and update one of the=20
tickets above if its still an issue on 14-STABLE.

# ifconfig -v wlan0 list scan
# pkill -ilf wpa_supplicant
# wpa_supplicant -tddi wlan0 -c /etc/wpa_supplicant.conf

You may need to sanitise this file, it may contain your wifi password

A+
Dave

From nobody Thu Apr  3 20:36:52 2025
X-Original-To: freebsd-questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZTD763SP1z5sRtB
	for <freebsd-questions@mlmmj.nyi.freebsd.org>; Thu, 03 Apr 2025 20:37:06 +0000 (UTC)
	(envelope-from humo3302@gmail.com)
Received: from mail-pj1-x1036.google.com (mail-pj1-x1036.google.com [IPv6:2607:f8b0:4864:20::1036])
	(using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)
	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "smtp.gmail.com", Issuer "WR4" (verified OK))
	by mx1.freebsd.org (Postfix) with ESMTPS id 4ZTD761p1Mz3qSJ
	for <freebsd-questions@freebsd.org>; Thu, 03 Apr 2025 20:37:06 +0000 (UTC)
	(envelope-from humo3302@gmail.com)
Authentication-Results: mx1.freebsd.org;
	none
Received: by mail-pj1-x1036.google.com with SMTP id 98e67ed59e1d1-301302a328bso1469411a91.2
        for <freebsd-questions@freebsd.org>; Thu, 03 Apr 2025 13:37:06 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20230601; t=1743712625; x=1744317425; darn=freebsd.org;
        h=cc:to:subject:message-id:date:from:in-reply-to:references
         :mime-version:from:to:cc:subject:date:message-id:reply-to;
        bh=okikkG2+9dEleXGo5UJFPzPq1CV3C6w9d+Vt41PW3w0=;
        b=l4+L6bg6n1M2/733uBZ1ZbjEhTUCr5Z0kww4Jua5jJ1VcTay73NCMXTY6h7HP3ORie
         XhyAZmqWTnKJve2auGXQEieu/OOOZOaBaTLr2HrFb6PcxLsNPjywSWjXgvy0xhfHeMh2
         fTCmJwSCxWZhafpDvswRf/k6FxFmUK3DqxqrvwdLGprEYt29sm3/wGnP7hFFyyujRj7J
         EsuafUVya+5S5TMzLgidvLyoLTGmVEX5Xzi9ZeXrtYZa9Yl2aoCu/XvwTB895cMSVlFS
         sElj+CxQF2VQxP60AzzL+KvG6qLEvnPr0PDXFQpjThOgud03ZxJM35/hDxOfaSd91nDN
         rCMg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20230601; t=1743712625; x=1744317425;
        h=cc:to:subject:message-id:date:from:in-reply-to:references
         :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id
         :reply-to;
        bh=okikkG2+9dEleXGo5UJFPzPq1CV3C6w9d+Vt41PW3w0=;
        b=u4ST2x9vPgZKmjmtN/cKsK0+x0dQVZvnHxcnWhUlObfybW0ETLgVVPXx9t70K5bTCB
         W44w5rccQjInqAdNh4ToTyXRgLJz2Jt78C+NlFRPkCx11+Iub7S3rXLO5ZcYyMLnFm5Q
         ZDZ5LzboYJ94RcKxk7Da8+quftwn/fwUrKIAuv1NJponn5i465NXXAUD+mYv3A0twUCj
         HxH1d7+Ql0Yh4bKP/B7QprpmWU7sUrksmxd3Oxoris0eqs868wejlsc2uFrJAFTh4Hpl
         p8iNf/TotR7M3CL3vn1mRdQ11ixPIMR6J9EOUmfl1vnl18/2NJHJzMbaFC3xUFF+uup1
         Nm7Q==
X-Gm-Message-State: AOJu0YwI8jiPd6YCRP/srkbaFCzFiA/unDot4Ak/h8w9qn2cxqLSaNNk
	GDYjr4CCb4k1FwYxmnlU2wlQDaFN1HHKWbO4BK+76+cGErDh4oLYriNfiluhG9GM8hBgllnSCNf
	QZdI6pJRX2XxVH0yuxsTDZHgD5uCjgQ==
X-Gm-Gg: ASbGncuenEULXpnC+RoAkinHy6Tnfz3tWV3LEhrhwfk0KfRmQs+DabI7vRrPKKnDFtc
	TKcnhMhYY+HpXWmyFMavk0oG/hthWMTg3Ja4Ti1GqXna8FtBnQ+mkLhLuYMmdecDLodNHTOgm2q
	CvFyNHgPPTsnvjjeiQ1ycnrieiOg==
X-Google-Smtp-Source: AGHT+IEcEffyD7n2n9sWoejThTb24za4V6jkG1cH87+rpkG4BXQumfXyFcrOfFDyxkWdhFHeuea420gsUtnHX74kLSA=
X-Received: by 2002:a17:90a:c887:b0:2ff:5c4e:5acd with SMTP id
 98e67ed59e1d1-306a62967bcmr158319a91.35.1743712624823; Thu, 03 Apr 2025
 13:37:04 -0700 (PDT)
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
MIME-Version: 1.0
References: <CAMsoGZ0Uj7bnYFYXrVi_VpXSZGBb98UdUHgFwsjiEa949GGf2A@mail.gmail.com>
 <093f0f3a-c9dc-4817-9be7-1d0c285f8e5c@app.fastmail.com> <CAMsoGZ2Y9uoXbasjoisWxNt7EeNMcrJsfD50rMyRVD3EAc48dw@mail.gmail.com>
 <d46b0ad1-0499-4d19-927c-ff4873cdc937@app.fastmail.com>
In-Reply-To: <d46b0ad1-0499-4d19-927c-ff4873cdc937@app.fastmail.com>
From: Mauricio <humo3302@gmail.com>
Date: Thu, 3 Apr 2025 16:36:52 -0400
X-Gm-Features: ATxdqUHdvxWVQoef7UuJogDquZ1aWaUW9OBk6Qu6ijlMT6qPF3tLwElIrph_yYE
Message-ID: <CAMsoGZ3o60PMoHhTjAwRz1vAVBdTuvQ9G82tC47w17YPHLdgHg@mail.gmail.com>
Subject: Re: Problems with WiFi networks - HP 255 G7, FreeBSD 14.2
To: Dave Cottlehuber <dch@skunkwerks.at>
Cc: freebsd-questions <freebsd-questions@freebsd.org>
Content-Type: multipart/alternative; boundary="00000000000097d9840631e5bb00"
X-Rspamd-Pre-Result: action=no action;
	module=replies;
	Message is reply to one we originated
X-Spamd-Result: default: False [-4.00 / 15.00];
	REPLY(-4.00)[];
	ASN(0.00)[asn:15169, ipnet:2607:f8b0::/32, country:US]
X-Rspamd-Queue-Id: 4ZTD761p1Mz3qSJ
X-Spamd-Bar: ----

--00000000000097d9840631e5bb00
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

The suggestion of trying FreeBSD 14 STABLE ended with success.
I can use WiFi correctly now.

One good thing i noticed is that i dont need to type anymore that
"linuxkpi..." in /boot/loader.conf anymore for the WiFi card to work
correctly.

I'm really thankful for all your help.
I want to keep digging on this system and now its more easy.

By the way, thanks for made me know about the risks of one of my text
files, however, i tought about it beforehand, and found that i had reasons
to not care about that for now.
Again, thanks for the help.

El mi=C3=A9, 2 abr. 2025 7:30 p. m., Dave Cottlehuber <dch@skunkwerks.at>
escribi=C3=B3:

> > On Wed, Apr 2, 2025 at 4:30=E2=80=AFAM Dave Cottlehuber <dch@skunkwerks=
.at>
> wrote:
> >> On Tue, 1 Apr 2025, at 17:33, Mauricio wrote:
> >> > Hey! : )
> >> >
> >> > I have decided to install FreeBSD 14.2 in my laptop (HP 255 G7).
> >> > This model use a WiFi card detected as rtw880 in the system.
> >>
> >> Welcome Mauricio!
> >>
> >> > I did the same for this 14.2 installation. And my WiFi card is
> >> > recognized when looking at the ifconfig output.
>
> TLDR try installing 14-STABLE to see if this is resolved.
>
> I wrote most of the notes below before finding PR283142, so just
> use it to refer to in future.
>
> https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D272145 seems relevant
> with https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D283903
> as does https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D283142 which
> looks like a fix may already be in 14-STABLE, my suggestion would be
> to see if 14-STABLE works or not.
>
> > dmesg: https://pastebin.com/pYWAkSed
>
> rtw880: <rtw_8821ce> port 0x2000-0x20ff mem 0xc0600000-0xc060ffff at
> device 0.0 on pci1
> rtw880: successfully loaded firmware image 'rtw88/rtw8821c_fw.bin'
> rtw880: Firmware version 24.8.0, H2C version 12
>
> > ifconfig: https://pastebin.com/JcETgrGU
>
> wlan0: flags=3D8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu =
1500
>         options=3D0
>         ether 00:e9:3a:db:06:fb
>         groups: wlan
>         ssid "" channel 11 (2462 MHz 11g). <---------
>         regdomain FCC country US authmode WPA1+WPA2/802.11i privacy ON
>         deftxkey UNDEF txpower 30 bmiss 7 scanvalid 60 protmode CTS wme
>         roaming MANUAL
>         parent interface: rtw880
>         media: IEEE 802.11 Wireless Ethernet autoselect (autoselect)
>         status: no carrier <-------------------------
>
> So you're not getting an IP address from DHCP server because no
> connection is being established to the access point (no carrier).
>
> While I can't diagnose this, you should grab output of wifi scan,
> and run wpa_supplicant in debug mode, and update one of the
> tickets above if its still an issue on 14-STABLE.
>
> # ifconfig -v wlan0 list scan
> # pkill -ilf wpa_supplicant
> # wpa_supplicant -tddi wlan0 -c /etc/wpa_supplicant.conf
>
> You may need to sanitise this file, it may contain your wifi password
>
> A+
> Dave
>

--00000000000097d9840631e5bb00
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<p dir=3D"ltr">The suggestion of trying FreeBSD 14 STABLE ended with succes=
s.<br>
I can use WiFi correctly now.</p>
<p dir=3D"ltr">One good thing i noticed is that i dont need to type anymore=
 that &quot;linuxkpi...&quot; in /boot/loader.conf anymore for the WiFi car=
d to work correctly.</p>
<p dir=3D"ltr">I&#39;m really thankful for all your help.<br>
I want to keep digging on this system and now its more easy.</p>
<p dir=3D"ltr">By the way, thanks for made me know about the risks of one o=
f my text files, however, i tought about it beforehand, and found that i ha=
d reasons to not care about that for now.<br>
Again, thanks for the help.</p>
<br><div class=3D"gmail_quote gmail_quote_container"><div dir=3D"ltr" class=
=3D"gmail_attr">El mi=C3=A9, 2 abr. 2025 7:30 p.=C2=A0m., Dave Cottlehuber =
&lt;<a href=3D"mailto:dch@skunkwerks.at">dch@skunkwerks.at</a>&gt; escribi=
=C3=B3:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8=
ex;border-left:1px #ccc solid;padding-left:1ex">&gt; On Wed, Apr 2, 2025 at=
 4:30=E2=80=AFAM Dave Cottlehuber &lt;<a href=3D"mailto:dch@skunkwerks.at" =
target=3D"_blank" rel=3D"noreferrer">dch@skunkwerks.at</a>&gt; wrote:<br>
&gt;&gt; On Tue, 1 Apr 2025, at 17:33, Mauricio wrote:<br>
&gt;&gt; &gt; Hey! : )<br>
&gt;&gt; &gt;<br>
&gt;&gt; &gt; I have decided to install FreeBSD 14.2 in my laptop (HP 255 G=
7).<br>
&gt;&gt; &gt; This model use a WiFi card detected as rtw880 in the system.<=
br>
&gt;&gt; <br>
&gt;&gt; Welcome Mauricio!<br>
&gt;&gt; <br>
&gt;&gt; &gt; I did the same for this 14.2 installation. And my WiFi card i=
s <br>
&gt;&gt; &gt; recognized when looking at the ifconfig output.<br>
<br>
TLDR try installing 14-STABLE to see if this is resolved.<br>
<br>
I wrote most of the notes below before finding PR283142, so just<br>
use it to refer to in future.<br>
<br>
<a href=3D"https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D272145" rel=
=3D"noreferrer noreferrer" target=3D"_blank">https://bugs.freebsd.org/bugzi=
lla/show_bug.cgi?id=3D272145</a> seems relevant<br>
with <a href=3D"https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D283903"=
 rel=3D"noreferrer noreferrer" target=3D"_blank">https://bugs.freebsd.org/b=
ugzilla/show_bug.cgi?id=3D283903</a><br>
as does <a href=3D"https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D2831=
42" rel=3D"noreferrer noreferrer" target=3D"_blank">https://bugs.freebsd.or=
g/bugzilla/show_bug.cgi?id=3D283142</a> which<br>
looks like a fix may already be in 14-STABLE, my suggestion would be<br>
to see if 14-STABLE works or not.<br>
<br>
&gt; dmesg: <a href=3D"https://pastebin.com/pYWAkSed" rel=3D"noreferrer nor=
eferrer" target=3D"_blank">https://pastebin.com/pYWAkSed</a><br>
<br>
rtw880: &lt;rtw_8821ce&gt; port 0x2000-0x20ff mem 0xc0600000-0xc060ffff at =
device 0.0 on pci1<br>
rtw880: successfully loaded firmware image &#39;rtw88/rtw8821c_fw.bin&#39;<=
br>
rtw880: Firmware version 24.8.0, H2C version 12<br>
<br>
&gt; ifconfig: <a href=3D"https://pastebin.com/JcETgrGU" rel=3D"noreferrer =
noreferrer" target=3D"_blank">https://pastebin.com/JcETgrGU</a><br>
<br>
wlan0: flags=3D8843&lt;UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST&gt; metric 0 =
mtu 1500<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 options=3D0<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 ether 00:e9:3a:db:06:fb<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 groups: wlan<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 ssid &quot;&quot; channel 11 (2462 MHz 11g). &l=
t;---------<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 regdomain FCC country US authmode WPA1+WPA2/802=
.11i privacy ON<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 deftxkey UNDEF txpower 30 bmiss 7 scanvalid 60 =
protmode CTS wme<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 roaming MANUAL<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 parent interface: rtw880<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 media: IEEE 802.11 Wireless Ethernet autoselect=
 (autoselect)<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 status: no carrier &lt;------------------------=
-<br>
<br>
So you&#39;re not getting an IP address from DHCP server because no<br>
connection is being established to the access point (no carrier).<br>
<br>
While I can&#39;t diagnose this, you should grab output of wifi scan,<br>
and run wpa_supplicant in debug mode, and update one of the <br>
tickets above if its still an issue on 14-STABLE.<br>
<br>
# ifconfig -v wlan0 list scan<br>
# pkill -ilf wpa_supplicant<br>
# wpa_supplicant -tddi wlan0 -c /etc/wpa_supplicant.conf<br>
<br>
You may need to sanitise this file, it may contain your wifi password<br>
<br>
A+<br>
Dave<br>
</blockquote></div>

--00000000000097d9840631e5bb00--

From nobody Thu Apr  3 21:55:35 2025
X-Original-To: questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZTFss4VKvz5sY2f
	for <questions@mlmmj.nyi.freebsd.org>; Thu, 03 Apr 2025 21:55:45 +0000 (UTC)
	(envelope-from mlist@jarasoft.net)
Received: from nl.netnl.net (nl.netnl.net [194.145.195.57])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256
	 client-signature ECDSA (secp384r1) client-digest SHA384)
	(Client CN "netnl.net", Issuer "E5" (verified OK))
	by mx1.freebsd.org (Postfix) with ESMTPS id 4ZTFsr1wDHz40Cp
	for <questions@freebsd.org>; Thu, 03 Apr 2025 21:55:44 +0000 (UTC)
	(envelope-from mlist@jarasoft.net)
Authentication-Results: mx1.freebsd.org;
	dkim=none;
	dmarc=pass (policy=reject) header.from=jarasoft.net;
	spf=pass (mx1.freebsd.org: domain of mlist@jarasoft.net designates 194.145.195.57 as permitted sender) smtp.mailfrom=mlist@jarasoft.net
Received: from [10.10.10.160] (nl.netnl.net [194.145.195.57])
	(using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)
	 key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384
	 client-signature RSA-PSS (4096 bits) client-digest SHA256)
	(Client CN "", Issuer "Sectigo RSA Client Authentication and Secure Email CA" (verified OK))
	by nl.netnl.net (Postfix) with ESMTPSA id 4E28310EFD
	for <questions@freebsd.org>; Thu, 03 Apr 2025 23:55:41 +0200 (CEST)
X-Virus-Status: Clean
X-Virus-Scanned: clamav-milter 1.4.2 at nl.netnl.net
Message-ID: <781b8841-a08b-4eb4-9df6-5bcf683f7e7d@jarasoft.net>
Date: Thu, 3 Apr 2025 23:55:35 +0200
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Reply-To: mlist@jarasoft.net
Content-Language: nl
To: questions@freebsd.org
From: Jack Raats <mlist@jarasoft.net>
Subject: ipv6 over an ipv4 tunnel
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
X-Spamd-Result: default: False [1.83 / 15.00];
	NEURAL_SPAM_LONG(1.00)[1.000];
	NEURAL_SPAM_MEDIUM(1.00)[1.000];
	DMARC_POLICY_ALLOW(-0.50)[jarasoft.net,reject];
	NEURAL_SPAM_SHORT(0.43)[0.435];
	ONCE_RECEIVED(0.20)[];
	R_SPF_ALLOW(-0.20)[+mx];
	MIME_GOOD(-0.10)[text/plain];
	RCVD_VIA_SMTP_AUTH(0.00)[];
	ASN(0.00)[asn:206238, ipnet:194.145.194.0/23, country:NL];
	RCVD_COUNT_ONE(0.00)[1];
	RCPT_COUNT_ONE(0.00)[1];
	ARC_NA(0.00)[];
	MIME_TRACE(0.00)[0:+];
	RCVD_TLS_ALL(0.00)[];
	R_DKIM_NA(0.00)[];
	HAS_REPLYTO(0.00)[mlist@jarasoft.net];
	REPLYTO_ADDR_EQ_FROM(0.00)[];
	FROM_EQ_ENVFROM(0.00)[];
	FROM_HAS_DN(0.00)[];
	MID_RHS_MATCH_FROM(0.00)[];
	TO_DN_NONE(0.00)[];
	PREVIOUSLY_DELIVERED(0.00)[questions@freebsd.org];
	TO_MATCH_ENVRCPT_ALL(0.00)[];
	MLMMJ_DEST(0.00)[questions@freebsd.org];
	REPLYTO_DOM_NEQ_TO_DOM(0.00)[]
X-Rspamd-Queue-Id: 4ZTFsr1wDHz40Cp
X-Spamd-Bar: +

Hi,

I have two servers, both running FreeBSD 14.2

Server A has only one ipv4 address, no ipv6.

Server B has one ipv4 address and an ipv6 subnet.

Is it possible to give Server A an ipv6 address from server B ipv6 
subnet and ipv6 connectivity and how?

Gr.,
Jack Raats


From nobody Fri Apr  4 00:16:25 2025
X-Original-To: questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZTJy40rNGz5sjBZ
	for <questions@mlmmj.nyi.freebsd.org>; Fri, 04 Apr 2025 00:14:36 +0000 (UTC)
	(envelope-from security@csrc.com)
Received: from mtasvr.csrc.com (mtasvr.csrc.com [98.115.148.228])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256)
	(Client did not present a certificate)
	by mx1.freebsd.org (Postfix) with ESMTPS id 4ZTJy32zlPz3Cb2
	for <questions@freebsd.org>; Fri, 04 Apr 2025 00:14:35 +0000 (UTC)
	(envelope-from security@csrc.com)
Authentication-Results: mx1.freebsd.org;
	none
Date: Thu, 3 Apr 2025 18:16:25 -0600
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=csrc.com; s=CSRC;
	t=1743725669; bh=b0erGeiZe2deGmz4AAe5lgtunor5sqit7ReRkG3ntPo=;
	h=Date:From:To:Cc:Subject:In-Reply-To:References;
	b=QVKKYRC2CxTpMnnIKr+4cClZPFH7VDnrTR8sTePdXoSNH7+e+he9LSC6ochGC3C1y
	 a94n3biSVY/wDHHLmt3wNiXfHr1eiLoMraKFvE/ebeKkkKouMLhXq0VGQ2W2Qj1/26
	 EhyKETagJt0lQD8AwxgZhTVaiakvHUQkAL/AvkHg=
From: katphish <security@csrc.com>
To: mlist@jarasoft.net
Cc: questions@freebsd.org
Subject: Re: ipv6 over an ipv4 tunnel
Message-Id: <20250403181625.6f95006ce4335c017a3a1281@csrc.com>
In-Reply-To: <781b8841-a08b-4eb4-9df6-5bcf683f7e7d@jarasoft.net>
References: <781b8841-a08b-4eb4-9df6-5bcf683f7e7d@jarasoft.net>
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
X-Spam-Score: -0.10
X-Spam-Status: No, score=-0.10
X-Rspamd-Pre-Result: action=no action;
	module=replies;
	Message is reply to one we originated
X-Spamd-Result: default: False [-4.00 / 15.00];
	REPLY(-4.00)[];
	ASN(0.00)[asn:701, ipnet:98.115.0.0/16, country:US]
X-Rspamd-Queue-Id: 4ZTJy32zlPz3Cb2
X-Spamd-Bar: ----

Hi Jack,

6in4, that was the hotness back in the day. On FreeBSD the gif[1] interface is purpose built to tunnel the IP protocols.

I don't know if/how it still applies but here are plenty of guides[2] and of course the handbook[3] to get you started:


Have fun!

[1] https://man.freebsd.org/cgi/man.cgi?gif(4)

[2] https://hack.org/mc/blog/ipv6-tunnel-dynamic.html

[3] https://docs.freebsd.org/en/books/developers-handbook/ipv6/

On Thu, 3 Apr 2025 23:55:35 +0200
Jack Raats <mlist@jarasoft.net> wrote:

> Hi,
> 
> I have two servers, both running FreeBSD 14.2
> 
> Server A has only one ipv4 address, no ipv6.
> 
> Server B has one ipv4 address and an ipv6 subnet.
> 
> Is it possible to give Server A an ipv6 address from server B ipv6 
> subnet and ipv6 connectivity and how?
> 
> Gr.,
> Jack Raats
> 
> 


-- 
Security <security@csrc.com>

From nobody Fri Apr  4 15:42:26 2025
X-Original-To: freebsd-questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZTjXr3Mfwz5ryWg
	for <freebsd-questions@mlmmj.nyi.freebsd.org>; Fri, 04 Apr 2025 15:42:36 +0000 (UTC)
	(envelope-from ml@netfence.it)
Received: from soth.netfence.it (mailserver.netfence.it [78.134.96.152])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mailserver.netfence.it", Issuer "R10" (verified OK))
	by mx1.freebsd.org (Postfix) with ESMTPS id 4ZTjXq2dxfz4Jc7
	for <freebsd-questions@freebsd.org>; Fri, 04 Apr 2025 15:42:35 +0000 (UTC)
	(envelope-from ml@netfence.it)
Authentication-Results: mx1.freebsd.org;
	dkim=none;
	dmarc=pass (policy=none) header.from=netfence.it;
	spf=pass (mx1.freebsd.org: domain of ml@netfence.it designates 78.134.96.152 as permitted sender) smtp.mailfrom=ml@netfence.it
Received: from [10.1.2.18] (alamar.local.netfence.it [10.1.2.18])
	(authenticated bits=0)
	by soth.netfence.it (8.18.1/8.17.2) with ESMTPSA id 534FgQmL042608
	(version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NO)
	for <freebsd-questions@freebsd.org>; Fri, 4 Apr 2025 17:42:27 +0200 (CEST)
	(envelope-from ml@netfence.it)
X-Authentication-Warning: soth.netfence.it: Host alamar.local.netfence.it [10.1.2.18] claimed to be [10.1.2.18]
Message-ID: <6aeb488d-b3c3-4393-80ca-0b89c1ebc446@netfence.it>
Date: Fri, 4 Apr 2025 17:42:26 +0200
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Content-Language: en-US
To: freebsd-questions@freebsd.org
From: Andrea Venturoli <ml@netfence.it>
Subject: Sudden zpool checksums errors
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
X-Spamd-Result: default: False [-1.63 / 15.00];
	NEURAL_HAM_LONG(-0.98)[-0.977];
	NEURAL_SPAM_MEDIUM(0.86)[0.864];
	NEURAL_HAM_SHORT(-0.72)[-0.720];
	DMARC_POLICY_ALLOW(-0.50)[netfence.it,none];
	R_SPF_ALLOW(-0.20)[+ip4:78.134.96.152];
	MIME_GOOD(-0.10)[text/plain];
	RCVD_VIA_SMTP_AUTH(0.00)[];
	ASN(0.00)[asn:35612, ipnet:78.134.0.0/17, country:IT];
	RCVD_COUNT_ONE(0.00)[1];
	RCPT_COUNT_ONE(0.00)[1];
	MIME_TRACE(0.00)[0:+];
	MID_RHS_MATCH_FROM(0.00)[];
	R_DKIM_NA(0.00)[];
	MLMMJ_DEST(0.00)[freebsd-questions@freebsd.org];
	FROM_HAS_DN(0.00)[];
	HAS_XAW(0.00)[];
	ARC_NA(0.00)[];
	FROM_EQ_ENVFROM(0.00)[];
	TO_MATCH_ENVRCPT_ALL(0.00)[];
	TO_DN_NONE(0.00)[];
	PREVIOUSLY_DELIVERED(0.00)[freebsd-questions@freebsd.org];
	RCVD_TLS_ALL(0.00)[]
X-Rspamd-Queue-Id: 4ZTjXq2dxfz4Jc7
X-Spamd-Bar: -

Hello.

I've got a box with two zpools:
_ 1 mirror on 2 SSDs;
_ 1 raidz1 on 12 HDDs.

Suddenly one daily run showed the following:
>  pool: backup
>  state: ONLINE
> status: One or more devices has experienced an unrecoverable error.  An
> 	attempt was made to correct the error.  Applications are unaffected.
> action: Determine if the device needs to be replaced, and clear the errors
> 	using 'zpool clear' or replace the device with 'zpool replace'.
>    see: https://openzfs.github.io/openzfs-docs/msg/ZFS-8000-9P
>   scan: scrub repaired 3.18M in 16:53:16 with 0 errors on Tue Apr  1 20:16:55 2025
> config:
> 
> 	NAME        STATE     READ WRITE CKSUM
> 	backup      ONLINE       0     0     0
> 	  raidz1-0  ONLINE       0     0     0
> 	    da4     ONLINE       0     0     0
> 	    da10    ONLINE       0     0     0
> 	    da5     ONLINE       0     0    57
> 	    da2     ONLINE       0     0     0
> 	    da8     ONLINE       0     0    25
> 	    da0     ONLINE       0     0     0
> 	    da1     ONLINE       0     0    49
> 	    da12    ONLINE       0     0     8
> 	    da6     ONLINE       0     0     6
> 	    da11    ONLINE       0     0     0
> 	    da9     ONLINE       0     0    56
> 	    da13    ONLINE       0     0    73
> 
> errors: No known data errors

I'm finding it hard to believe that 7 disks out of 12 are failing or 
just happened to misbehave all on the same day.
BTW, SMART says they are OK.

I'm reluctant to blame RAM (since it's ECC) and power supply (as it's 
redundant 2x800W).
Disks are 16TB TOSHIBA MG09ACA1 connected to a MegaRAID SAS-3 3108 (of 
course not operating as RAID and with mrsas driver).

% freebsd-version
14.2-RELEASE-p2
% zfs --version
zfs-2.2.6-FreeBSD_g33174af15
zfs-kmod-2.2.6-FreeBSD_g33174af15


Is there a known ZFS bug that could explain this?

I've "zpool clear"ed the errors and waiting to see if they come up again.

  bye & Thanks
	av.

P.S.
Also, I'm quite sure no "administrator accidentally wrote over a portion 
of the disk using another program" :)

From nobody Fri Apr  4 16:05:37 2025
X-Original-To: freebsd-questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZTk3Z34bXz5s18q
	for <freebsd-questions@mlmmj.nyi.freebsd.org>; Fri, 04 Apr 2025 16:05:46 +0000 (UTC)
	(envelope-from mike@sentex.net)
Received: from smarthost1.sentex.ca (smarthost1.sentex.ca [IPv6:2607:f3e0:0:1::12])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "smarthost1.sentex.ca", Issuer "R10" (verified OK))
	by mx1.freebsd.org (Postfix) with ESMTPS id 4ZTk3Y3TqLz4NdG
	for <freebsd-questions@freebsd.org>; Fri, 04 Apr 2025 16:05:45 +0000 (UTC)
	(envelope-from mike@sentex.net)
Authentication-Results: mx1.freebsd.org;
	none
Received: from pyroxene2a.sentex.ca (pyroxene19.sentex.ca [199.212.134.19])
	by smarthost1.sentex.ca (8.18.1/8.18.1) with ESMTPS id 534G5dtZ001799
	(version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=FAIL);
	Fri, 4 Apr 2025 12:05:39 -0400 (EDT)
	(envelope-from mike@sentex.net)
Received: from [IPV6:2607:f3e0:0:4:a057:b7c2:3f78:a2fe] ([IPv6:2607:f3e0:0:4:a057:b7c2:3f78:a2fe])
	by pyroxene2a.sentex.ca (8.18.1/8.15.2) with ESMTPS id 534G5bLM063809
	(version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NO);
	Fri, 4 Apr 2025 12:05:39 -0400 (EDT)
	(envelope-from mike@sentex.net)
Message-ID: <e326b205-7c01-4467-9238-4e67e0e3ed33@sentex.net>
Date: Fri, 4 Apr 2025 12:05:37 -0400
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: Sudden zpool checksums errors
To: Andrea Venturoli <ml@netfence.it>, freebsd-questions@freebsd.org
References: <6aeb488d-b3c3-4393-80ca-0b89c1ebc446@netfence.it>
Content-Language: en-US
From: mike tancsa <mike@sentex.net>
Autocrypt: addr=mike@sentex.net; keydata=
 xsBNBFywzOMBCACoNFpwi5MeyEREiCeHtbm6pZJI/HnO+wXdCAWtZkS49weOoVyUj5BEXRZP
 xflV2ib2hflX4nXqhenaNiia4iaZ9ft3I1ebd7GEbGnsWCvAnob5MvDZyStDAuRxPJK1ya/s
 +6rOvr+eQiXYNVvfBhrCfrtR/esSkitBGxhUkBjOti8QwzD71JVF5YaOjBAs7jZUKyLGj0kW
 yDg4jUndudWU7G2yc9GwpHJ9aRSUN8e/mWdIogK0v+QBHfv/dsI6zVB7YuxCC9Fx8WPwfhDH
 VZC4kdYCQWKXrm7yb4TiVdBh5kgvlO9q3js1yYdfR1x8mjK2bH2RSv4bV3zkNmsDCIxjABEB
 AAHNHW1pa2UgdGFuY3NhIDxtaWtlQHNlbnRleC5uZXQ+wsCOBBMBCAA4FiEEmuvCXT0aY6hs
 4SbWeVOEFl5WrMgFAl+pQfkCGwMFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQeVOEFl5W
 rMiN6ggAk3H5vk8QnbvGbb4sinxZt/wDetgk0AOR9NRmtTnPaW+sIJEfGBOz47Xih+f7uWJS
 j+uvc9Ewn2Z7n8z3ZHJlLAByLVLtcNXGoRIGJ27tevfOaNqgJHBPbFOcXCBBFTx4MYMM4iAZ
 cDT5vsBTSaM36JZFtHZBKkuFEItbA/N8ZQSHKdTYMIA7A3OCLGbJBqloQ8SlW4MkTzKX4u7R
 yefAYQ0h20x9IqC5Ju8IsYRFacVZconT16KS81IBceO42vXTN0VexbVF2rZIx3v/NT75r6Vw
 0FlXVB1lXOHKydRA2NeleS4NEG2vWqy/9Boj0itMfNDlOhkrA/0DcCurMpnpbM7ATQRcsMzk
 AQgA1Dpo/xWS66MaOJLwA28sKNMwkEk1Yjs+okOXDOu1F+0qvgE8sVmrOOPvvWr4axtKRSG1
 t2QUiZ/ZkW/x/+t0nrM39EANV1VncuQZ1ceIiwTJFqGZQ8kb0+BNkwuNVFHRgXm1qzAJweEt
 RdsCMohB+H7BL5LGCVG5JaU0lqFU9pFP40HxEbyzxjsZgSE8LwkI6wcu0BLv6K6cLm0EiHPO
 l5G8kgRi38PS7/6s3R8QDsEtbGsYy6O82k3zSLIjuDBwA9GRaeigGppTxzAHVjf5o9KKu4O7
 gC2KKVHPegbXS+GK7DU0fjzX57H5bZ6komE5eY4p3oWT/CwVPSGfPs8jOwARAQABwsB2BBgB
 CAAgFiEEmuvCXT0aY6hs4SbWeVOEFl5WrMgFAl+pQfkCGwwACgkQeVOEFl5WrMiVqwf9GwU8
 c6cylknZX8QwlsVudTC8xr/L17JA84wf03k3d4wxP7bqy5AYy7jboZMbgWXngAE/HPQU95NM
 aukysSnknzoIpC96XZJ0okLBXVS6Y0ylZQ+HrbIhMpuQPoDweoF5F9wKrsHRoDaUK1VR706X
 rwm4HUzh7Jk+auuMYfuCh0FVlFBEuiJWMLhg/5WCmcRfiuB6F59ZcUQrwLEZeNhF2XJV4KwB
 Tlg7HCWO/sy1foE5noaMyACjAtAQE9p5kGYaj+DuRhPdWUTsHNuqrhikzIZd2rrcMid+ktb0
 NvtvswzMO059z1YGMtGSqQ4srCArju+XHIdTFdiIYbd7+jeehg==
In-Reply-To: <6aeb488d-b3c3-4393-80ca-0b89c1ebc446@netfence.it>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
X-Scanned-By: MIMEDefang 2.86
X-Rspamd-Pre-Result: action=no action;
	module=replies;
	Message is reply to one we originated
X-Spamd-Result: default: False [-4.00 / 15.00];
	REPLY(-4.00)[];
	ASN(0.00)[asn:11647, ipnet:2607:f3e0::/32, country:CA]
X-Rspamd-Queue-Id: 4ZTk3Y3TqLz4NdG
X-Spamd-Bar: ----

On 4/4/2025 11:42 AM, Andrea Venturoli wrote:
> Hello.
>
> I've got a box with two zpools:
> _ 1 mirror on 2 SSDs;
> _ 1 raidz1 on 12 HDDs.
>
> Suddenly one daily run showed the following:
>>  pool: backup
>>  state: ONLINE
>> status: One or more devices has experienced an unrecoverable error.  An
>>     attempt was made to correct the error.  Applications are unaffected.
>> action: Determine if the device needs to be replaced, and clear the 
>> errors
>>     using 'zpool clear' or replace the device with 'zpool replace'.
>>    see: https://openzfs.github.io/openzfs-docs/msg/ZFS-8000-9P
>>   scan: scrub repaired 3.18M in 16:53:16 with 0 errors on Tue Apr  1 
>> 20:16:55 2025
>> config:


I have had marginal power supplies, backplane issues or break out cables 
from the controller manifest errors like that.  I would check the power 
supply first, backplane next, controller 3rd. Common firmware bugs can 
cause issues too, but thats relatively rare and usually with SSDs, not 
HDDs from what I have seen in the past.

     ---Mike




From nobody Fri Apr  4 17:13:36 2025
X-Original-To: freebsd-questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZTlYy13Mqz5s5td
	for <freebsd-questions@mlmmj.nyi.freebsd.org>; Fri, 04 Apr 2025 17:13:42 +0000 (UTC)
	(envelope-from Albert.Shih@obspm.fr)
Received: from mx-p1.obspm.fr (mx-p1.obspm.fr [145.238.193.20])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "*.obspm.fr", Issuer "GEANT OV RSA CA 4" (verified OK))
	by mx1.freebsd.org (Postfix) with ESMTPS id 4ZTlYx1xgQz3Ltj
	for <freebsd-questions@freebsd.org>; Fri, 04 Apr 2025 17:13:41 +0000 (UTC)
	(envelope-from Albert.Shih@obspm.fr)
Authentication-Results: mx1.freebsd.org;
	dkim=pass header.d=obspm.fr header.s=mail header.b=FzZlHJZ+;
	dmarc=pass (policy=none) header.from=obspm.fr;
	spf=pass (mx1.freebsd.org: domain of Albert.Shih@obspm.fr designates 145.238.193.20 as permitted sender) smtp.mailfrom=Albert.Shih@obspm.fr
X-AuthUser: jas
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=obspm.fr; s=mail;
	t=1743786817; bh=2LC/jYmsvYajVvg3eUs9uKty79qnEKMJe2zML7draAU=;
	h=Date:From:To:Subject:From;
	b=FzZlHJZ+foX7Iv34mIaBgf4QgcGMl5aAs5E3Y41V8IyqnwjcN6f4BNS0/1cl3+2b/
	 bw08Y1sVWbbnYeYAAI0TGEcsauC6FflQBUtSAO/MelyfgOgPmkNOkz8kT6TJfLEAbg
	 pACKmjxQuqRIceZoIsgeCpepd2B3shO5RN7xN5W84cgXbMs2Tm89YDtkbCG62NzACg
	 cZfaU92rZ781XmdkG+7RxWM+DG/z0ryBr+ziY+nDdZg+Y1EzA2YOdgNR4pbXtTn7qN
	 1SOKzzOWd/5hxoMku+iqqVl6mP3Dm8hXUzMPV7im3undmJkoTCPSLeDNbT/SZjHF2M
	 6953R3ZoJ7+kw==
Received: from io.chezmoi.fr (vpn.obspm.fr [145.238.186.39])
	(authenticated bits=0)
	by mx-p1.obspm.fr (8.15.2/8.15.2/DIO Observatoire de Paris - 15/04/10) with ESMTPSA id 534HDak23368112
	(version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT)
	for <freebsd-questions@freebsd.org>; Fri, 4 Apr 2025 19:13:37 +0200
Date: Fri, 4 Apr 2025 19:13:36 +0200
From: Albert Shih <Albert.Shih@obspm.fr>
To: freebsd-questions@freebsd.org
Subject: Securing FreeBSD.
Message-ID: <Z_ATQA2k-3umIaLo@io.chezmoi.fr>
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.6.2 (mx-p1.obspm.fr [145.238.193.20]); Fri, 04 Apr 2025 19:13:37 +0200 (CEST)
X-Virus-Scanned: clamav-milter 1.0.7 at mx-p1
X-Virus-Status: Clean
X-Spamd-Result: default: False [-3.75 / 15.00];
	DWL_DNSWL_LOW(-1.00)[obspm.fr:dkim];
	NEURAL_HAM_LONG(-1.00)[-1.000];
	NEURAL_HAM_SHORT(-0.99)[-0.993];
	NEURAL_SPAM_MEDIUM(0.94)[0.944];
	RCVD_DKIM_ARC_DNSWL_MED(-0.50)[];
	DMARC_POLICY_ALLOW(-0.50)[obspm.fr,none];
	RCVD_IN_DNSWL_MED(-0.40)[145.238.193.20:from,145.238.186.39:received];
	ONCE_RECEIVED(0.20)[];
	R_SPF_ALLOW(-0.20)[+ip4:145.238.193.20];
	R_DKIM_ALLOW(-0.20)[obspm.fr:s=mail];
	MIME_GOOD(-0.10)[text/plain];
	TO_MATCH_ENVRCPT_ALL(0.00)[];
	RCPT_COUNT_ONE(0.00)[1];
	MIME_TRACE(0.00)[0:+];
	ARC_NA(0.00)[];
	RCVD_TLS_ALL(0.00)[];
	PREVIOUSLY_DELIVERED(0.00)[freebsd-questions@freebsd.org];
	TO_DN_NONE(0.00)[];
	FROM_EQ_ENVFROM(0.00)[];
	MLMMJ_DEST(0.00)[freebsd-questions@freebsd.org];
	DKIM_TRACE(0.00)[obspm.fr:+];
	RCVD_VIA_SMTP_AUTH(0.00)[];
	RCVD_COUNT_ONE(0.00)[1];
	ASN(0.00)[asn:2200, ipnet:145.238.0.0/16, country:FR];
	MISSING_XM_UA(0.00)[];
	FROM_HAS_DN(0.00)[]
X-Rspamd-Queue-Id: 4ZTlYx1xgQz3Ltj
X-Spamd-Bar: ---

Hi everyone. 

Is they are any way to secure a FreeBSD to prevent destroying data ? 

I find out even with 

  kern.securelevel=2 

root can still do something like 

  umount /data
  gpart delete -i 1 dev_under_data

then create something different with for example

  gpart add -t something -a somethingdifferentfrominit dev_under_data

I also try zfs, but zpool can still be use to destroy every pool.

Currently the only solution I find is to create a huge / and store data
under / (no a partition), because I'm guessing it would be hard to umount /

Any other solution ? 

For example, I see with securelevel=2 the «bad guy» would be unable to
create a new filesystem, so is they are any way to backup the «partition
table» ? And put them back after he create another ? 

Regards

-- 
Albert SHIH 🦫 🐸
Heure locale/Local time:
ven. 04 avril 2025 19:06:58 CEST

From nobody Fri Apr  4 17:23:38 2025
X-Original-To: freebsd-questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZTlng5PFQz5s7Jy
	for <freebsd-questions@mlmmj.nyi.freebsd.org>; Fri, 04 Apr 2025 17:23:51 +0000 (UTC)
	(envelope-from pprocacci@gmail.com)
Received: from mail-ed1-x535.google.com (mail-ed1-x535.google.com [IPv6:2a00:1450:4864:20::535])
	(using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)
	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "smtp.gmail.com", Issuer "WR4" (verified OK))
	by mx1.freebsd.org (Postfix) with ESMTPS id 4ZTlnf5Lcmz3Nt5
	for <freebsd-questions@freebsd.org>; Fri, 04 Apr 2025 17:23:50 +0000 (UTC)
	(envelope-from pprocacci@gmail.com)
Authentication-Results: mx1.freebsd.org;
	none
Received: by mail-ed1-x535.google.com with SMTP id 4fb4d7f45d1cf-5eb5ecf3217so4014577a12.3
        for <freebsd-questions@freebsd.org>; Fri, 04 Apr 2025 10:23:50 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20230601; t=1743787429; x=1744392229; darn=freebsd.org;
        h=content-transfer-encoding:cc:to:subject:message-id:date:from
         :in-reply-to:references:mime-version:from:to:cc:subject:date
         :message-id:reply-to;
        bh=wynw3FBj1i4ogFzBR06AOOnbMmpu6Zu/e6SBzV9u7O0=;
        b=JTd6eDpfcafO9GNGP60K5fhEhZONO41wrIjPbdoyP96V+gcaQeXuD2NSRQr1eWw1ji
         xQH4dkzQZb09Zc/HVDq2zKKdFVpwmpmQN61StViR7sW55Bn5OluHoataPTVJyJw6s5DD
         1rFZLR/V44rwVDy0GcdHcUKHNQcGjp+eZj376lcXIbJQyoB5XLxogj3CNfYSwOzO0ALf
         Vyub5s+2y4r12DNLT+69xz+QV2wY79VDGt58oTswNp19ATxVB2fB2XIk8T5QaWwgLfNL
         iKc/t1JtBwE6E36+N0aJIUYzqMPqqHB2dugas7y5keo64nSHuKG2X89QGGFUsNhYyQMC
         OEnA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20230601; t=1743787429; x=1744392229;
        h=content-transfer-encoding:cc:to:subject:message-id:date:from
         :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc
         :subject:date:message-id:reply-to;
        bh=wynw3FBj1i4ogFzBR06AOOnbMmpu6Zu/e6SBzV9u7O0=;
        b=l1mHmtW1vGjuP7AmnjIYmFxd3eH/AT3Iox9AFfhLJDwMXMqaK+Vi2ez7bnbO3XBtdy
         BM3/v+GCZSTHbZsEFeKZUaquqvoDBPOZZm0jwonXyAoUd7CGxp157K/R7EL8qInMFEkb
         dIZJMO1lq+Qi0EF9UVhthuuEGzPdHUWASsE5ufukrDfwMJzBx4bifgWWvXKu9pwn0kI6
         jmpWPvjJCalJJOIv7OEKog7aYxcbUF8JN//B+4B4V4H0od8xpxz7vl4vVqFhkPYSuVCk
         pVyDpRtjHur6Fl1a5ChcbAErbHy37aycDefC/jBuzdD8eqnoItY0yL6aJlOK4DlIL/88
         8rww==
X-Gm-Message-State: AOJu0Yz3IeXj4W3g6CLqmjBxi5rryenisJ7JD4a+O5ub5d7bHgiYqWeQ
	riDfbyBzmDwmXKuZ3JbWqJLaMwzlIFEs/qHoKkode+y+Yc13JsIvu1XcfNLjkNZbaa5c2FkTb/u
	IcPA2q1+jntDc/8B8UmRJNsIYXA==
X-Gm-Gg: ASbGncsfsSJ86b+KTEv3znTNa4NsFDmim+w4isPOxxFUucHgcdMvScEx6ysYCzbChv4
	dgfsTryF9aSaEBIRXizUOqv9lK6LMd9+AK6I0ZYjQBk/MTceMQzFHv4YGF2sPgFZWIN1RNJtTVS
	9BnCsuu1F72qsOKgim8kg2AgGb
X-Google-Smtp-Source: AGHT+IGisLGjDloqjYVw+s1+9zVD5qXqctB1ZpTEkAMM6eGfPbeKEbK4CxqnklrFSlyBschkcJfWJHS8RMFe69e5mow=
X-Received: by 2002:a17:907:97c3:b0:ac1:fb27:d3a2 with SMTP id
 a640c23a62f3a-ac7d1859bcbmr403784966b.5.1743787428832; Fri, 04 Apr 2025
 10:23:48 -0700 (PDT)
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
MIME-Version: 1.0
References: <Z_ATQA2k-3umIaLo@io.chezmoi.fr>
In-Reply-To: <Z_ATQA2k-3umIaLo@io.chezmoi.fr>
From: Paul Procacci <pprocacci@gmail.com>
Date: Fri, 4 Apr 2025 13:23:38 -0400
X-Gm-Features: ATxdqUGX3l6j7BXbMmZ5oTFKkheu4hXyg2a0bghAxJMsUopcoMoyMcJZza2lw9s
Message-ID: <CAFbbPugC7PfK__+4_vbHOtPSeMdU2XO3FU5AdSkpsi9taq=7rQ@mail.gmail.com>
Subject: Re: Securing FreeBSD.
To: Albert Shih <Albert.Shih@obspm.fr>
Cc: freebsd-questions@freebsd.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Rspamd-Pre-Result: action=no action;
	module=replies;
	Message is reply to one we originated
X-Spamd-Result: default: False [-4.00 / 15.00];
	REPLY(-4.00)[];
	ASN(0.00)[asn:15169, ipnet:2a00:1450::/32, country:US]
X-Rspamd-Queue-Id: 4ZTlnf5Lcmz3Nt5
X-Spamd-Bar: ----

On Fri, Apr 4, 2025 at 1:14=E2=80=AFPM Albert Shih <Albert.Shih@obspm.fr> w=
rote:
>
> Hi everyone.
>
> Is they are any way to secure a FreeBSD to prevent destroying data ?
>
> I find out even with
>
>   kern.securelevel=3D2
>
> root can still do something like
>
>   umount /data
>   gpart delete -i 1 dev_under_data
>
> then create something different with for example
>
>   gpart add -t something -a somethingdifferentfrominit dev_under_data
>
> I also try zfs, but zpool can still be use to destroy every pool.
>
> Currently the only solution I find is to create a huge / and store data
> under / (no a partition), because I'm guessing it would be hard to umount=
 /
>
> Any other solution ?
>
> For example, I see with securelevel=3D2 the =C2=ABbad guy=C2=BB would be =
unable to
> create a new filesystem, so is they are any way to backup the =C2=ABparti=
tion
> table=C2=BB ? And put them back after he create another ?
>
> Regards
>
> --
> Albert SHIH =F0=9F=A6=AB =F0=9F=90=B8
> Heure locale/Local time:
> ven. 04 avril 2025 19:06:58 CEST
>

So you want to be root, without having the power of root.
Try logging into the system with a different user and the problem is
solved -- tongue and cheek.
Anything root can do, it can also undo.  There's no way around that.

~Paul

--=20
__________________

:(){ :|:& };:

From nobody Fri Apr  4 18:36:04 2025
X-Original-To: freebsd-questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZTnP531ydz5sD7f
	for <freebsd-questions@mlmmj.nyi.freebsd.org>; Fri, 04 Apr 2025 18:36:09 +0000 (UTC)
	(envelope-from Albert.Shih@obspm.fr)
Received: from mx-p1.obspm.fr (mx-p1.obspm.fr [145.238.193.20])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "*.obspm.fr", Issuer "GEANT OV RSA CA 4" (verified OK))
	by mx1.freebsd.org (Postfix) with ESMTPS id 4ZTnP45Xryz3btm
	for <freebsd-questions@freebsd.org>; Fri, 04 Apr 2025 18:36:08 +0000 (UTC)
	(envelope-from Albert.Shih@obspm.fr)
Authentication-Results: mx1.freebsd.org;
	none
X-AuthUser: jas
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=obspm.fr; s=mail;
	t=1743791766; bh=gaBNaW95gPVUi77CENU3KT5pC28pcckfYnZr2RSa8fA=;
	h=Date:From:To:Cc:Subject:References:In-Reply-To:From;
	b=hQhnAy6x2Ght3rrqwylD5pDzaldJ1GcNFsMdiux5YIsuquGkighkPnduWGEVIY4fL
	 IfJ8PqBCyle7+oJ1d3iw1KfjVm1x+YeVFeQihFppmErvUQqXxfyGnanQF/mPmEaP+y
	 LEm2/hWDfqBH1ezsynPBANJUTgAgrRSdu0UXZO0NamFLz024K6Y0P6djJd23wHbtX3
	 sIDoZbCNncj3vSt6eJooGn1T7TKstriG2467E5cTN+yVgqS7ZDHc2e7qCWN6zUy01A
	 u2fTfwx6StnvBU3NyJT5XYAG/PXixud1mtaa4jUPevz+lRN0pGCdCvODac/Qa8bCGU
	 GTvrqDOebxOOQ==
Received: from io.chezmoi.fr (vpn.obspm.fr [145.238.186.39])
	(authenticated bits=0)
	by mx-p1.obspm.fr (8.15.2/8.15.2/DIO Observatoire de Paris - 15/04/10) with ESMTPSA id 534Ia41L3382842
	(version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT);
	Fri, 4 Apr 2025 20:36:06 +0200
Date: Fri, 4 Apr 2025 20:36:04 +0200
From: Albert Shih <Albert.Shih@obspm.fr>
To: Paul Procacci <pprocacci@gmail.com>
Cc: freebsd-questions@freebsd.org
Subject: Re: Securing FreeBSD.
Message-ID: <Z_AmlH-_jA0Advng@io.chezmoi.fr>
References: <Z_ATQA2k-3umIaLo@io.chezmoi.fr>
 <CAFbbPugC7PfK__+4_vbHOtPSeMdU2XO3FU5AdSkpsi9taq=7rQ@mail.gmail.com>
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <CAFbbPugC7PfK__+4_vbHOtPSeMdU2XO3FU5AdSkpsi9taq=7rQ@mail.gmail.com>
X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.6.2 (mx-p1.obspm.fr [145.238.193.20]); Fri, 04 Apr 2025 20:36:06 +0200 (CEST)
X-Virus-Scanned: clamav-milter 1.0.7 at mx-p1
X-Virus-Status: Clean
X-Rspamd-Pre-Result: action=no action;
	module=replies;
	Message is reply to one we originated
X-Spamd-Result: default: False [-4.00 / 15.00];
	REPLY(-4.00)[];
	ASN(0.00)[asn:2200, ipnet:145.238.0.0/16, country:FR]
X-Rspamd-Queue-Id: 4ZTnP45Xryz3btm
X-Spamd-Bar: ----

Le 04/04/2025 à 13:23:38-0400, Paul Procacci a écrit
> On Fri, Apr 4, 2025 at 1:14 PM Albert Shih <Albert.Shih@obspm.fr> wrote:
> >
> >
> 
> So you want to be root, without having the power of root.
> Try logging into the system with a different user and the problem is
> solved -- tongue and cheek.

No, I want to make the system in a state where root *cannot* remove some
file. 

If I put a file under / with adhoc chflags, put the system in securelevel 2
you cannot (or I really like to know how) easily remove the file. 

In other term I would like to create a system where it's impossible (I'm
not talking about a security problem) to remove file without be physically
in the front of the server. 

Regards


-- 
Albert SHIH 🦫 🐸
France
Heure locale/Local time:
ven. 04 avril 2025 20:31:58 CEST

From nobody Fri Apr  4 18:40:28 2025
X-Original-To: freebsd-questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZTnVK4n3Kz5sDns
	for <freebsd-questions@mlmmj.nyi.freebsd.org>; Fri, 04 Apr 2025 18:40:41 +0000 (UTC)
	(envelope-from aryeh.friedman@gmail.com)
Received: from mail-ua1-x92b.google.com (mail-ua1-x92b.google.com [IPv6:2607:f8b0:4864:20::92b])
	(using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)
	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "smtp.gmail.com", Issuer "WR4" (verified OK))
	by mx1.freebsd.org (Postfix) with ESMTPS id 4ZTnVK0nfBz3cqd
	for <freebsd-questions@freebsd.org>; Fri, 04 Apr 2025 18:40:41 +0000 (UTC)
	(envelope-from aryeh.friedman@gmail.com)
Authentication-Results: mx1.freebsd.org;
	none
Received: by mail-ua1-x92b.google.com with SMTP id a1e0cc1a2514c-86d42f08135so1093108241.0
        for <freebsd-questions@freebsd.org>; Fri, 04 Apr 2025 11:40:41 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20230601; t=1743792040; x=1744396840; darn=freebsd.org;
        h=content-transfer-encoding:cc:to:subject:message-id:date:from
         :in-reply-to:references:mime-version:from:to:cc:subject:date
         :message-id:reply-to;
        bh=Cy+MK1vJzUMlZXj3srTX9DzHUX08vNrciW6O6AAF9dA=;
        b=MP0YRItWxeAvFveF9UZUIuW6EwmX/KxfBNJOmGcL/TECE9L44UZ+2o0VDKPfE0/r2y
         9LWkL6nDRg2Vz2Opr1IPuiFI6ty0ptvKdoY9pNMzW2M/c/Z6yX7thP0nyOFr885CKA5C
         vb4YeKCXg4vN33YHwAyDV9oHwl2x/jAzepqFVMkKUt1Cr96xuIC8KOaib5v+wEm1kXx9
         Y08geleHcr1Wn5j/sEdqMGWIHFLkTuJ6QvepeKO4SCFb5OSBO4A3T5B5iEnnqjlK/WUB
         DdL901+UP980pwncxebOOcE9JP57EU0vDgtCHBT5qkHNMvNtuYhK5DfXALCRubxzvRKX
         Fh5A==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20230601; t=1743792040; x=1744396840;
        h=content-transfer-encoding:cc:to:subject:message-id:date:from
         :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc
         :subject:date:message-id:reply-to;
        bh=Cy+MK1vJzUMlZXj3srTX9DzHUX08vNrciW6O6AAF9dA=;
        b=q//lHta7JWoOymPnAbacD4cH338Vlp5ax226mnb+wCBhTQuZV0bBdUalRDcUIJe52p
         jBaKXo0TAUcvQST62w1g3NoE9y0bzP3R/yeNh53VyNmVSyEG/ZvoOvzAH/WsHHt7RdFc
         tKBI2BiMel89nMPGEhJqKbeNwIIE9Pns+A1EiWB0wSPv3ltBaXvZhxw5J3X2TSRFFw5l
         fP3+Y08AkjGbGP3pJ/HHTZ4kTA/Ji6i6OpxEvotvv5egVYuhH+QiIXbSunvY1OvuM9P/
         Juv4yl1byH4bpnEQZ/mWriEUqhfrHp4qKDHAz434HyDWos2rCuPXF0b0MkgXLy9dQv05
         91mA==
X-Forwarded-Encrypted: i=1; AJvYcCVgeVZsG3qE9fsD6qk8UWwM44hcfBEPMgbBCNDt0wQmuvjq8t7nsqngvKyNsLFV567a7PXYOBM8mRAg4gAUovO//w==@freebsd.org
X-Gm-Message-State: AOJu0YysxEO6Gb1FAv3dJSgwNQdG+Anw65KxYEmdrDjWIDmtfCUcLCQ5
	p/6JWolMOQlBYAlalcGyOpW5So36Y6BcoV5KxAzhKnUezxbN5q0CA3gS3DU8IT1MCQj6YZqhfxF
	lqp6GRPF81pAPe8ApOTtWG4Ljr4Q=
X-Gm-Gg: ASbGncvob7UiLUb7bPlX3RSFmyXV/wnK9L2f+N5azLO/+dpqBSkqoG0ZkKcQonNCWvT
	dYe57TLF8WqBRYS5aczEo/OnYlNYoGYoC7lFgfg5bjTcm5LI+g/gcWFqEk8EZX5p4gZfSL5fG7x
	4scv4QWCX1ZZCgx99E9cFXlEDmXX0nqLhpemIsxUA=
X-Google-Smtp-Source: AGHT+IG7fn4RKfUx3HEivuFQhKa/IsPj0D6Pw/8Dr1M/2la9O5YO3mj2o8c/lsvVrfSEMbNqrmbRiL6nZAgmFcBZ11g=
X-Received: by 2002:a05:6102:91c:b0:4c1:801e:deb2 with SMTP id
 ada2fe7eead31-4c86365fe4emr623882137.7.1743792040022; Fri, 04 Apr 2025
 11:40:40 -0700 (PDT)
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
MIME-Version: 1.0
References: <Z_ATQA2k-3umIaLo@io.chezmoi.fr> <CAFbbPugC7PfK__+4_vbHOtPSeMdU2XO3FU5AdSkpsi9taq=7rQ@mail.gmail.com>
 <Z_AmlH-_jA0Advng@io.chezmoi.fr>
In-Reply-To: <Z_AmlH-_jA0Advng@io.chezmoi.fr>
From: Aryeh Friedman <aryeh.friedman@gmail.com>
Date: Fri, 4 Apr 2025 14:40:28 -0400
X-Gm-Features: ATxdqUHZL9l2OkZvj1QQamR-rlAbHhFXykSR4d0FaPIFI0Bdv3OQFcnQMxCkn0A
Message-ID: <CAGBxaXk819uEkV2fvJV0v3Eewr7YM29yMrqZJ8eewOerG5OSVQ@mail.gmail.com>
Subject: Re: Securing FreeBSD.
To: Albert Shih <Albert.Shih@obspm.fr>
Cc: Paul Procacci <pprocacci@gmail.com>, freebsd-questions@freebsd.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Rspamd-Pre-Result: action=no action;
	module=replies;
	Message is reply to one we originated
X-Spamd-Result: default: False [-4.00 / 15.00];
	REPLY(-4.00)[];
	TAGGED_FROM(0.00)[];
	ASN(0.00)[asn:15169, ipnet:2607:f8b0::/32, country:US]
X-Rspamd-Queue-Id: 4ZTnVK0nfBz3cqd
X-Spamd-Bar: ----

On Fri, Apr 4, 2025 at 2:36=E2=80=AFPM Albert Shih <Albert.Shih@obspm.fr> w=
rote:
>
> Le 04/04/2025 =C3=A0 13:23:38-0400, Paul Procacci a =C3=A9crit
> > On Fri, Apr 4, 2025 at 1:14=E2=80=AFPM Albert Shih <Albert.Shih@obspm.f=
r> wrote:
> > >
> > >
> >
> > So you want to be root, without having the power of root.
> > Try logging into the system with a different user and the problem is
> > solved -- tongue and cheek.
>
> No, I want to make the system in a state where root *cannot* remove some
> file.

Isn't the very definition of root (superuser) is that they can do *ANYTHING=
*?

--=20
Aryeh M. Friedman, Lead Developer, http://www.PetiteCloud.org

From nobody Fri Apr  4 18:45:16 2025
X-Original-To: questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZTnc25FKCz5sF4s
	for <questions@mlmmj.nyi.freebsd.org>; Fri, 04 Apr 2025 18:45:38 +0000 (UTC)
	(envelope-from dpchrist@holgerdanske.com)
Received: from holgerdanske.com (holgerdanske.com [184.105.128.27])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange ECDHE (prime256v1) server-signature RSA-PSS (4096 bits) server-digest SHA256
	 client-signature RSA-PSS (4096 bits) client-digest SHA256)
	(Client CN "holgerdanske.com", Issuer "R10" (verified OK))
	by mx1.freebsd.org (Postfix) with ESMTPS id 4ZTnbz1JSnz3fKT
	for <questions@freebsd.org>; Fri, 04 Apr 2025 18:45:35 +0000 (UTC)
	(envelope-from dpchrist@holgerdanske.com)
Authentication-Results: mx1.freebsd.org;
	dkim=pass header.d=holgerdanske.com header.s=nov-20210719-112354 header.b=RFYSJ55B;
	dmarc=pass (policy=none) header.from=holgerdanske.com;
	spf=pass (mx1.freebsd.org: domain of dpchrist@holgerdanske.com designates 184.105.128.27 as permitted sender) smtp.mailfrom=dpchrist@holgerdanske.com
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=holgerdanske.com;
	s=nov-20210719-112354; t=1743792325;
	bh=IdHCHtfnssjjNqrA5vsq0Pn6xQYbe7OmPAKairIs7fY=;
	h=Received:Message-ID:Date:MIME-Version:User-Agent:Subject:To:
	 References:Content-Language:From:In-Reply-To:Content-Type:
	 Content-Transfer-Encoding;
	b=RFYSJ55BqDWQhP5+B1ZoPDXPRnhAopK0S98Lz8thjKoErdyvFcV6/YYfB6JNF89Zs
	 uvBZPYlMCzFLvsBV6IpGyKdmxw9OyrhhVNfUs21VWb8w2PV930/Nn7FQahxiN5u5nt
	 DjBYayntDfukNJ1PQS5nqEELd3WJYqbt+wGumJiVwiqBxfurvHElEDfZjnavA9ekew
	 eKCHVWy7IrsquE73EfnuD/IfRaZPYgX9Lmxo1w6Iez2VT3jK7vRiDyU84u0atweAYU
	 EuUnyPRlayNITRnoQ52Zqg5n4Ro7d7TQuouQhxG3cfDIAQis9iIwiyjcz/zNMK74V/
	 My/qgSCSCi3xeR2CqwLrfGUiF4H9pHrpWaVsdz7ne9pW8O44T06DAy3axMgnlWmaVc
	 tDyYzz1eS8osmn1La/unJK/iwebqvQkV8rRgdA7fv/c03HN8efr5tzQWTTr9PuDYCT
	 Ccd56LxFTBFNZVBr5v46wCB2+tk4S1CjpfYGJ2yE7mCbmLjH/o6Hi1Zf5ReToq4qsY
	 GXi3mKjiEXd7GLfAxowGny3wPAMBco18nxO4YslBC6IFf95w1FIcD26Ccq+HHa9PIW
	 5SLvDrnNN6JbeqL1J46P/sHqoClQYTxQBp+eapafjxOxBDRyuwkRYtywfV+zGdCtiB
	 hI/8h2YlnIPkJp6uVw1ZO90U=
Received: from 99.100.19.101 (99-100-19-101.lightspeed.frokca.sbcglobal.net [99.100.19.101])
	by holgerdanske.com with ESMTPSA (TLS_AES_128_GCM_SHA256:TLSv1.3:Kx=any:Au=any:Enc=AESGCM(128):Mac=AEAD) (SMTP-AUTH username dpchrist@holgerdanske.com, mechanism PLAIN)
	for <questions@freebsd.org>; Fri, 4 Apr 2025 11:45:25 -0700
Message-ID: <bb89a12f-0d73-411f-a34f-8a8224c30744@holgerdanske.com>
Date: Fri, 4 Apr 2025 11:45:16 -0700
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: Securing FreeBSD.
To: questions@freebsd.org
References: <Z_ATQA2k-3umIaLo@io.chezmoi.fr>
Content-Language: en-US
From: David Christensen <dpchrist@holgerdanske.com>
In-Reply-To: <Z_ATQA2k-3umIaLo@io.chezmoi.fr>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
X-Spamd-Result: default: False [-3.15 / 15.00];
	NEURAL_HAM_LONG(-1.00)[-1.000];
	NEURAL_HAM_SHORT(-0.74)[-0.736];
	NEURAL_HAM_MEDIUM(-0.61)[-0.613];
	DMARC_POLICY_ALLOW(-0.50)[holgerdanske.com,none];
	R_DKIM_ALLOW(-0.20)[holgerdanske.com:s=nov-20210719-112354];
	R_SPF_ALLOW(-0.20)[+a];
	ONCE_RECEIVED(0.20)[];
	MIME_GOOD(-0.10)[text/plain];
	ARC_NA(0.00)[];
	RCPT_COUNT_ONE(0.00)[1];
	RCVD_COUNT_ONE(0.00)[1];
	RCVD_VIA_SMTP_AUTH(0.00)[];
	MIME_TRACE(0.00)[0:+];
	ASN(0.00)[asn:6939, ipnet:184.104.0.0/15, country:US];
	MID_RHS_MATCH_FROM(0.00)[];
	PREVIOUSLY_DELIVERED(0.00)[questions@freebsd.org];
	FROM_EQ_ENVFROM(0.00)[];
	FROM_HAS_DN(0.00)[];
	MLMMJ_DEST(0.00)[questions@freebsd.org];
	RCVD_TLS_ALL(0.00)[];
	TO_MATCH_ENVRCPT_ALL(0.00)[];
	TO_DN_NONE(0.00)[];
	DKIM_TRACE(0.00)[holgerdanske.com:+]
X-Rspamd-Queue-Id: 4ZTnbz1JSnz3fKT
X-Spamd-Bar: ---

On 4/4/25 10:13, Albert Shih wrote:
> Hi everyone.
> 
> Is they are any way to secure a FreeBSD to prevent destroying data ?
> 
> I find out even with
> 
>    kern.securelevel=2
> 
> root can still do something like
> 
>    umount /data
>    gpart delete -i 1 dev_under_data
> 
> then create something different with for example
> 
>    gpart add -t something -a somethingdifferentfrominit dev_under_data
> 
> I also try zfs, but zpool can still be use to destroy every pool.
> 
> Currently the only solution I find is to create a huge / and store data
> under / (no a partition), because I'm guessing it would be hard to umount /
> 
> Any other solution ?
> 
> For example, I see with securelevel=2 the «bad guy» would be unable to
> create a new filesystem, so is they are any way to backup the «partition
> table» ? And put them back after he create another ?
> 
> Regards


It sounds like you want read-only storage media (?).


Burning your data to a CD-R/DVD-R/BD-R disc comes to mind.


Another option is a USB flash drive with a physical write-protect switch:

https://www.kanguru.com/products/defender-elite30-usb-3-0-hardware-encrypted-flash-drive

https://www.kanguru.com/products/kanguru-defender-elite300-fips-140-2-certified-secure-superspeed-usb-3-0-hardware-encrypted-flash-drive?variant=41077736833139


Searching Amazon, I found external disk drive enclosures with various 
features; including write-protect:

https://www.iodd.shop/all-products


David


From nobody Fri Apr  4 18:56:05 2025
X-Original-To: questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZTnrB03Cvz5sFyd
	for <questions@mlmmj.nyi.freebsd.org>; Fri, 04 Apr 2025 18:56:10 +0000 (UTC)
	(envelope-from infoomatic@gmx.at)
Received: from mout.gmx.net (mout.gmx.net [212.227.15.15])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange ECDHE (prime256v1) server-signature RSA-PSS (4096 bits) server-digest SHA256
	 client-signature RSA-PSS (3072 bits) client-digest SHA256)
	(Client CN "mout.gmx.net", Issuer "Telekom Security ServerID OV Class 2 CA" (verified OK))
	by mx1.freebsd.org (Postfix) with ESMTPS id 4ZTnr85YKzz3jR1
	for <questions@freebsd.org>; Fri, 04 Apr 2025 18:56:08 +0000 (UTC)
	(envelope-from infoomatic@gmx.at)
Authentication-Results: mx1.freebsd.org;
	dkim=pass header.d=gmx.at header.s=s31663417 header.b="aATDP/Rp";
	dmarc=pass (policy=quarantine) header.from=gmx.at;
	spf=pass (mx1.freebsd.org: domain of infoomatic@gmx.at designates 212.227.15.15 as permitted sender) smtp.mailfrom=infoomatic@gmx.at
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmx.at;
	s=s31663417; t=1743792967; x=1744397767; i=infoomatic@gmx.at;
	bh=CSid9kI8gU00PzyQLw8gQw6BfhfufW7Ujodpzd746co=;
	h=X-UI-Sender-Class:Message-ID:Date:MIME-Version:Subject:To:
	 References:From:In-Reply-To:Content-Type:
	 Content-Transfer-Encoding:cc:content-transfer-encoding:
	 content-type:date:from:message-id:mime-version:reply-to:subject:
	 to;
	b=aATDP/RptWlIh1u4DgkJr9/ek4a5i7lnBJmzXuMIz2u/9N6GLL3m0o9pdV24niEs
	 cq03/xzINKgXnMMIVPL5Svgey+1o2EbyCys1xpy+c154X+h5Q9Hg1en6hWTXoL9De
	 poyv1x9qEVGwImHisP+X1XUZvv/CiQn9dG3aLXlhS/WeRludfWmX7aW3sa0H4T2G3
	 9R2ZKyZlAgjNZTjTks/aAkO+xYUGI65M5DAXqJ9YQ/9UgfFrxPeKP4rUfzs9fJ/Lq
	 N619EBxtpBa9zJIF3Wp9ZqIrH06Zpfq4cg+2ZJikTHoeWyrTwmb7bc2k+DUqXqrFK
	 2MhzMdxNorL38tLHFg==
X-UI-Sender-Class: 724b4f7f-cbec-4199-ad4e-598c01a50d3a
Received: from [10.0.1.209] ([178.114.191.61]) by mail.gmx.net (mrgmx005
 [212.227.17.190]) with ESMTPSA (Nemesis) id 1Mqb1W-1tEV6c4772-00gvqt for
 <questions@freebsd.org>; Fri, 04 Apr 2025 20:56:07 +0200
Message-ID: <0c320b2b-b65f-4223-bfaf-a06af5ca8136@gmx.at>
Date: Fri, 4 Apr 2025 20:56:05 +0200
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: Securing FreeBSD.
To: questions@freebsd.org
References: <Z_ATQA2k-3umIaLo@io.chezmoi.fr>
 <CAFbbPugC7PfK__+4_vbHOtPSeMdU2XO3FU5AdSkpsi9taq=7rQ@mail.gmail.com>
 <Z_AmlH-_jA0Advng@io.chezmoi.fr>
Content-Language: en-US
From: infoomatic <infoomatic@gmx.at>
In-Reply-To: <Z_AmlH-_jA0Advng@io.chezmoi.fr>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
X-Provags-ID: V03:K1:Z/Ns8ql7KF53e1IetPK+IHTzA0rb6yAcQYbICkKUwpo6q7pklrF
 X+7tLzhvdPGzC0zxhpzvFdl7dIDnheFCdg2c8FJxWplYdgTnN85beudh2cfR+rWekhVoODg
 z18VV7Lb1H14MBkuFa4OF5Kb1PL5MKymDIYm9zzM3ouIIeMefO+tPjSwpyfhVfcvUmB2AIj
 QTIHqclYHaaj3igW7kYKQ==
X-Spam-Flag: NO
UI-OutboundReport: notjunk:1;M01:P0:MJYxshg21TA=;jY8WVFbENEM2xU/QfQ7MQyWdS51
 mMmnLDSfnlxWaTFl4G3aYzlPmgXGJI+LNf5+k8oMH1bUiVex7yehSI3Aa/2jwGA/G0UbPGAgM
 LAIojBzUdjL1tOSpnh9r3BDEw45Z/MjI0bSXIOS9TGOPEtdDDF8lBvDVQC66VKxL98zipsFji
 TJmu86UXTNsZU61o08an2yActNRcftZv7/TvM/BEWidRSU4p3mnH3S83C8uqcgrTjFIF2o2j+
 8YtpwQtm3mQBxMOpo8K+lVRa+izvoVEsg+bjAREcvsOieebEKmg7Ha2xMGcYGH94QRnJEUCpP
 qzY1ixz6OIXrA6krNNt27KzzCFBmvLQjXCWeINCCLkudwRoDjl900g5Rq5e8CMX5TUDMEmUia
 onaKVLmWXRQzJth28yU9ndmSHAdoqWas/EkK46egc6IS+bfTB2ucZxjGWZDY5iY4AtqctvfsZ
 yur9GgbbghQMnweL+lk23wIzfIbyUH6ZXBXCjpWqqSXUq7Y+vFoZ/iZaWJPL4Nw6/SP7rFLtJ
 VH8i/57VsKNAbNmvBEdSTpBGNV20gyAJ9jECaZ9VHtixHv1+pdtq8QB276gZD5DP0tHxwlXo6
 p00rH+/9vUFmXCiZTL+MypHJbFsrQBYfd15c0gBP4QCfJvLK/9p+tbGq47GhO1iCCrtBgAyT4
 CBU7Jyn5VYeBSsnPijhZZoGe8Os46YkRLg3o4sj0JOlaAtYcTJkj/HzJkGo+maN4Yo8lujzsR
 80ufCVKr+yhItY3edwVU+0sqvwT9FNHc0b8KaAtdRdKzM5qYKteptDMnud4lhr66QxYGG6XnN
 AcA6A9N/B4zLv5LdRFoDaEfTmEAcEMByBdDIO7hp4Z1wRywWI9oo69cSM3n8Vy0tts3TPDFl6
 jurGeGO581POEyV7UDfjMk7E4KqfF4eA+9E5iKROCkNLjaTJSLSmy4x3rHpsHThzxXTpYlcRN
 P55mVir5fMWz8hgwecv91Pl49T3wlLrh8htqmAmCT8Xnyf7RrKfH+XRrCUMRmOWP3ETWPNWLn
 iyMzW6dXIYjp8T0mBo65yZVpsU7l1yBZOd863pgx2a6l767e1jTQ8dhCZSTVs7kVg+LfrIsJu
 Xfln++1/u+h3FAn+G1/jA+Q+I9pwuCS/ERgm9axauXyeZFW7rIU3CLn1C2wBm1fXxLMYIs4hM
 mmYvrns/b8XiTNpX+fsOx00eql0baAJs4Hvy55B9Iyij8y9gL2u4qM6qH8F2+0IZtn3GOL7Hn
 UgsESbMkuy0R8VbxnsRVEhSQySVCQSWCerz132/gjgARTsrwCA2dcB5TkXQ/eeEYZURetwnVX
 tRbd0vYYa85GEEk5OsjocW3yG6J+6uUJcEzLXBrz+gpdjg9nG8zCykbrv9GyZlNUWqdvmnre7
 7czn5USGVUajWZRQ6BIQU0MS6Rf00HadNhUz8kDLPJspz0+ay29k0+1WOQlCknc7WdcZSuqKH
 lTC/3yd2tfhB2etOeQd+wfu9JTPQ=
X-Spamd-Result: default: False [1.55 / 15.00];
	NEURAL_SPAM_MEDIUM(1.00)[1.000];
	NEURAL_SPAM_SHORT(0.93)[0.927];
	NEURAL_SPAM_LONG(0.72)[0.722];
	DMARC_POLICY_ALLOW(-0.50)[gmx.at,quarantine];
	ONCE_RECEIVED(0.20)[];
	R_DKIM_ALLOW(-0.20)[gmx.at:s=s31663417];
	R_SPF_ALLOW(-0.20)[+a:mout.gmx.net];
	RWL_MAILSPIKE_VERYGOOD(-0.20)[212.227.15.15:from];
	RCVD_IN_DNSWL_LOW(-0.10)[212.227.15.15:from];
	MIME_GOOD(-0.10)[text/plain];
	FROM_EQ_ENVFROM(0.00)[];
	TO_MATCH_ENVRCPT_ALL(0.00)[];
	RCVD_VIA_SMTP_AUTH(0.00)[];
	ARC_NA(0.00)[];
	MIME_TRACE(0.00)[0:+];
	RCPT_COUNT_ONE(0.00)[1];
	FREEMAIL_FROM(0.00)[gmx.at];
	TO_DN_NONE(0.00)[];
	PREVIOUSLY_DELIVERED(0.00)[questions@freebsd.org];
	RCVD_TLS_ALL(0.00)[];
	RCVD_COUNT_ONE(0.00)[1];
	ASN(0.00)[asn:8560, ipnet:212.227.0.0/16, country:DE];
	MID_RHS_MATCH_FROM(0.00)[];
	MLMMJ_DEST(0.00)[questions@freebsd.org];
	DKIM_TRACE(0.00)[gmx.at:+];
	FREEMAIL_ENVFROM(0.00)[gmx.at];
	FROM_HAS_DN(0.00)[]
X-Rspamd-Queue-Id: 4ZTnr85YKzz3jR1
X-Spamd-Bar: +


> In other term I would like to create a system where it's impossible (I'm
> not talking about a security problem) to remove file without be physically
> in the front of the server.

You can just disable the network interfaces


From nobody Fri Apr  4 18:59:35 2025
X-Original-To: freebsd-questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZTnwZ6YdTz5sFxQ
	for <freebsd-questions@mlmmj.nyi.freebsd.org>; Fri, 04 Apr 2025 18:59:58 +0000 (UTC)
	(envelope-from dch@skunkwerks.at)
Received: from fout-b7-smtp.messagingengine.com (fout-b7-smtp.messagingengine.com [202.12.124.150])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256)
	(Client did not present a certificate)
	by mx1.freebsd.org (Postfix) with ESMTPS id 4ZTnwZ47MNz3kgx
	for <freebsd-questions@freebsd.org>; Fri, 04 Apr 2025 18:59:58 +0000 (UTC)
	(envelope-from dch@skunkwerks.at)
Authentication-Results: mx1.freebsd.org;
	none
Received: from phl-compute-12.internal (phl-compute-12.phl.internal [10.202.2.52])
	by mailfout.stl.internal (Postfix) with ESMTP id 5971B114018F;
	Fri,  4 Apr 2025 14:59:57 -0400 (EDT)
Received: from phl-imap-15 ([10.202.2.104])
  by phl-compute-12.internal (MEProxy); Fri, 04 Apr 2025 14:59:57 -0400
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=skunkwerks.at;
	 h=cc:cc:content-transfer-encoding:content-type:content-type
	:date:date:from:from:in-reply-to:in-reply-to:message-id
	:mime-version:references:reply-to:subject:subject:to:to; s=fm3;
	 t=1743793197; x=1743879597; bh=pfK3m3eiJwfs7D/igHKPotxr0FizeLcY
	4H9rFQwfHF0=; b=A8FnxvvKKcC6CIzvESi0YMZajPUjjP820yxHobpe1prcLG/V
	4RJrzI9knRNilQ4PKVH52K88R23OQJb79cqAUN8DelOGsrIyuCwFRcB1tUMtCN9H
	5lz5UI3I8VpsW0dubshIRX3CxoQCC615j+p+c984u/ccYA0gU8XqR98wEcw6p8h/
	e56PpTEUKwzHUWCZ/8UBBKTbJd86r3ZdGaXGBW7MVu0/1SBeaKtW7vNuRDrP1WCM
	8/6bCluCiZwxndzpixVuLMFfEW3YlGBQZyxc12Ensjz/NBtERS9rLNLR5OCXNfmJ
	N4RjMl+92iXbrpwHP1mg6hfEOk14cBTmeRyjmQ==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=
	messagingengine.com; h=cc:cc:content-transfer-encoding
	:content-type:content-type:date:date:feedback-id:feedback-id
	:from:from:in-reply-to:in-reply-to:message-id:mime-version
	:references:reply-to:subject:subject:to:to:x-me-proxy
	:x-me-sender:x-me-sender:x-sasl-enc; s=fm2; t=1743793197; x=
	1743879597; bh=pfK3m3eiJwfs7D/igHKPotxr0FizeLcY4H9rFQwfHF0=; b=A
	qAGsSVXUMsHTVGrFDUxCtDMnXB6Tm8XzrRTdsKAtidwH7wHszQ8RtnXfgxhvB1SI
	ydwY0EQduGdav+r8/XcxLWg+6B/T2kdSPBTdz9K3hQ7BM4vJehJTPQTAmAzmm655
	g0N26cQ2JWur6dPRIzoACVQtAYEuI+SRzZsgOlpVtb0HP+7HbyoKu3owjQ5qR+Xp
	3rmbCVyu0Okk8vGDQ1FhKwG5p0sSYHd/ni50WYnLAAJ7MPx8wVAh6iIUusjLXNA6
	XZpkWvqIxx86CLP0ocC54MIaDA39dMgnLpZInB4gSD+0QYwEGcWVdueZZhzffAao
	P2wzgi/mTjkhpxv5Vq69Q==
X-ME-Sender: <xms:LCzwZ1M8s42tQ0WujoRuHlz7RDOT5qJgbZWbRa9A4vSYqYSqsuTSOA>
    <xme:LCzwZ39d_Tv3hUKFm9zjj2yYAAF-1qYMPN2QSxUHAhWTvZTPkT9XKp-_p2t6n0QpM
    OFyYQhUEbAKR5SYDg>
X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeefvddrtddtgdduledvvddvucetufdoteggodetrf
    dotffvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdggtfgfnhhsuhgsshgtrhhisggv
    pdfurfetoffkrfgpnffqhgenuceurghilhhouhhtmecufedttdenucenucfjughrpefogg
    ffhffvvefkjghfufgtgfesthejredtredttdenucfhrhhomhepfdffrghvvgcuvehothht
    lhgvhhhusggvrhdfuceouggthhesshhkuhhnkhifvghrkhhsrdgrtheqnecuggftrfgrth
    htvghrnhepieffhfdujeelieekueehgfeigeekleeljeeigefgudeuheetgfdtgeffieev
    uedvnecuffhomhgrihhnpehfrhgvvggsshgurdhorhhgnecuvehluhhsthgvrhfuihiivg
    eptdenucfrrghrrghmpehmrghilhhfrhhomhepuggthhesshhkuhhnkhifvghrkhhsrdgr
    thdpnhgspghrtghpthhtohepvddpmhhouggvpehsmhhtphhouhhtpdhrtghpthhtohepfh
    hrvggvsghsugdqqhhuvghsthhiohhnshesfhhrvggvsghsugdrohhrghdprhgtphhtthho
    pehmlhesnhgvthhfvghntggvrdhith
X-ME-Proxy: <xmx:LCzwZ0RBVXeGuDk0sCKD-IdXOaFUTZaXrfR8GbUFoY3cW4lpENqVyw>
    <xmx:LCzwZxtOg88HoabpKDSDGxOJAX2O-t_fhrO8A69Nqh65C0TFZRcSLw>
    <xmx:LCzwZ9dHPPrXyIl4V_eMPebmKYfWbBX1XLizwxsCD7_5zuBQEro8Jg>
    <xmx:LCzwZ91cUOHUvHRTG1IUPeKjgefR3PYahIP8iL-TOTGM_e-9y6qcew>
    <xmx:LSzwZ-CQurcHAynIchtDGX2o47uDJilrLkRJ6-ng_1dSHA5AHVxl_p5Z>
Feedback-ID: ic0e84090:Fastmail
Received: by mailuser.phl.internal (Postfix, from userid 501)
	id 5152078006B; Fri,  4 Apr 2025 14:59:56 -0400 (EDT)
X-Mailer: MessagingEngine.com Webmail Interface
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
MIME-Version: 1.0
X-ThreadId: T35d1ea0024b92151
Date: Fri, 04 Apr 2025 18:59:35 +0000
From: "Dave Cottlehuber" <dch@skunkwerks.at>
To: "Andrea Venturoli" <ml@netfence.it>
Cc: freebsd-questions <freebsd-questions@freebsd.org>
Message-Id: <3ddfecf7-2cb3-472c-bfce-93356e57b898@app.fastmail.com>
In-Reply-To: <6aeb488d-b3c3-4393-80ca-0b89c1ebc446@netfence.it>
References: <6aeb488d-b3c3-4393-80ca-0b89c1ebc446@netfence.it>
Subject: Re: Sudden zpool checksums errors
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
X-Rspamd-Pre-Result: action=no action;
	module=replies;
	Message is reply to one we originated
X-Spamd-Result: default: False [-4.00 / 15.00];
	REPLY(-4.00)[];
	ASN(0.00)[asn:151847, ipnet:202.12.124.0/24, country:AU]
X-Rspamd-Queue-Id: 4ZTnwZ47MNz3kgx
X-Spamd-Bar: ----

On Fri, 4 Apr 2025, at 15:42, Andrea Venturoli wrote:
> Hello.
> I'm finding it hard to believe that 7 disks out of 12 are failing or 
> just happened to misbehave all on the same day.
> BTW, SMART says they are OK.

Not saying its not zfs, but its probably not zfs.... fingers crossed!

> I'm reluctant to blame RAM (since it's ECC) and power supply (as it's 
> redundant 2x800W).

If its memory, and your mainboard supports it, you'll see failures in dmesg,
MCA ... some good examples:

https://lists.freebsd.org/pipermail/freebsd-hackers/2015-January/046878.html
https://forums.freebsd.org/threads/mca-errors.88909/
https://forums.freebsd.org/threads/solved-weird-mca-errors.94800/

> Disks are 16TB TOSHIBA MG09ACA1 connected to a MegaRAID SAS-3 3108 (of 
> course not operating as RAID and with mrsas driver).

Look for SCSI or CAM errors in your logs too, disconnects.
 
I have seen storms of checksum errors in at least these situations:

- faulty or failing storage / scsi controller
- insufficient power (or failing power supplies) under load
- overclocking
- overheating on mainboard, or controller, or drives
- actually really bad ECC memory
- drive cables that have worked loose over time
- over 50 disks failing within 2 days in a 200+ disk array
- all disks failing within 20 days of deployment in 24 disk chassis

Sometimes, vendors produce batches of Bad Disks - firmware bugs, physical
defects, unexpected dust inside the sealed platters. Failures are far more
correlated than you'd want to believe. External vibrations can cause
problems.

A slow process of upgrading firmware & checking each component, resetting
all cables, is the best way to deal with this.

A+
Dave

From nobody Fri Apr  4 19:05:45 2025
X-Original-To: freebsd-questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZTp3R1Ftxz5sGbd
	for <freebsd-questions@mlmmj.nyi.freebsd.org>; Fri, 04 Apr 2025 19:05:55 +0000 (UTC)
	(envelope-from mike@sentex.net)
Received: from smarthost1.sentex.ca (smarthost1.sentex.ca [IPv6:2607:f3e0:0:1::12])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "smarthost1.sentex.ca", Issuer "R10" (verified OK))
	by mx1.freebsd.org (Postfix) with ESMTPS id 4ZTp3P2D42z3mHp
	for <freebsd-questions@freebsd.org>; Fri, 04 Apr 2025 19:05:53 +0000 (UTC)
	(envelope-from mike@sentex.net)
Authentication-Results: mx1.freebsd.org;
	dkim=none;
	dmarc=none;
	spf=pass (mx1.freebsd.org: domain of mike@sentex.net designates 2607:f3e0:0:1::12 as permitted sender) smtp.mailfrom=mike@sentex.net
Received: from pyroxene2a.sentex.ca (pyroxene19.sentex.ca [199.212.134.19])
	by smarthost1.sentex.ca (8.18.1/8.18.1) with ESMTPS id 534J5lxK074740
	(version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=FAIL);
	Fri, 4 Apr 2025 15:05:47 -0400 (EDT)
	(envelope-from mike@sentex.net)
Received: from [IPV6:2607:f3e0:0:4:a057:b7c2:3f78:a2fe] ([IPv6:2607:f3e0:0:4:a057:b7c2:3f78:a2fe])
	by pyroxene2a.sentex.ca (8.18.1/8.15.2) with ESMTPS id 534J5jdU014436
	(version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NO);
	Fri, 4 Apr 2025 15:05:47 -0400 (EDT)
	(envelope-from mike@sentex.net)
Message-ID: <45f4188c-d8ac-4ebe-ba84-d20fc84c9ce9@sentex.net>
Date: Fri, 4 Apr 2025 15:05:45 -0400
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: Sudden zpool checksums errors
To: Andrea Venturoli <ml@netfence.it>
Cc: freebsd-questions <freebsd-questions@freebsd.org>
References: <6aeb488d-b3c3-4393-80ca-0b89c1ebc446@netfence.it>
 <3ddfecf7-2cb3-472c-bfce-93356e57b898@app.fastmail.com>
Content-Language: en-US
From: mike tancsa <mike@sentex.net>
Autocrypt: addr=mike@sentex.net; keydata=
 xsBNBFywzOMBCACoNFpwi5MeyEREiCeHtbm6pZJI/HnO+wXdCAWtZkS49weOoVyUj5BEXRZP
 xflV2ib2hflX4nXqhenaNiia4iaZ9ft3I1ebd7GEbGnsWCvAnob5MvDZyStDAuRxPJK1ya/s
 +6rOvr+eQiXYNVvfBhrCfrtR/esSkitBGxhUkBjOti8QwzD71JVF5YaOjBAs7jZUKyLGj0kW
 yDg4jUndudWU7G2yc9GwpHJ9aRSUN8e/mWdIogK0v+QBHfv/dsI6zVB7YuxCC9Fx8WPwfhDH
 VZC4kdYCQWKXrm7yb4TiVdBh5kgvlO9q3js1yYdfR1x8mjK2bH2RSv4bV3zkNmsDCIxjABEB
 AAHNHW1pa2UgdGFuY3NhIDxtaWtlQHNlbnRleC5uZXQ+wsCOBBMBCAA4FiEEmuvCXT0aY6hs
 4SbWeVOEFl5WrMgFAl+pQfkCGwMFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQeVOEFl5W
 rMiN6ggAk3H5vk8QnbvGbb4sinxZt/wDetgk0AOR9NRmtTnPaW+sIJEfGBOz47Xih+f7uWJS
 j+uvc9Ewn2Z7n8z3ZHJlLAByLVLtcNXGoRIGJ27tevfOaNqgJHBPbFOcXCBBFTx4MYMM4iAZ
 cDT5vsBTSaM36JZFtHZBKkuFEItbA/N8ZQSHKdTYMIA7A3OCLGbJBqloQ8SlW4MkTzKX4u7R
 yefAYQ0h20x9IqC5Ju8IsYRFacVZconT16KS81IBceO42vXTN0VexbVF2rZIx3v/NT75r6Vw
 0FlXVB1lXOHKydRA2NeleS4NEG2vWqy/9Boj0itMfNDlOhkrA/0DcCurMpnpbM7ATQRcsMzk
 AQgA1Dpo/xWS66MaOJLwA28sKNMwkEk1Yjs+okOXDOu1F+0qvgE8sVmrOOPvvWr4axtKRSG1
 t2QUiZ/ZkW/x/+t0nrM39EANV1VncuQZ1ceIiwTJFqGZQ8kb0+BNkwuNVFHRgXm1qzAJweEt
 RdsCMohB+H7BL5LGCVG5JaU0lqFU9pFP40HxEbyzxjsZgSE8LwkI6wcu0BLv6K6cLm0EiHPO
 l5G8kgRi38PS7/6s3R8QDsEtbGsYy6O82k3zSLIjuDBwA9GRaeigGppTxzAHVjf5o9KKu4O7
 gC2KKVHPegbXS+GK7DU0fjzX57H5bZ6komE5eY4p3oWT/CwVPSGfPs8jOwARAQABwsB2BBgB
 CAAgFiEEmuvCXT0aY6hs4SbWeVOEFl5WrMgFAl+pQfkCGwwACgkQeVOEFl5WrMiVqwf9GwU8
 c6cylknZX8QwlsVudTC8xr/L17JA84wf03k3d4wxP7bqy5AYy7jboZMbgWXngAE/HPQU95NM
 aukysSnknzoIpC96XZJ0okLBXVS6Y0ylZQ+HrbIhMpuQPoDweoF5F9wKrsHRoDaUK1VR706X
 rwm4HUzh7Jk+auuMYfuCh0FVlFBEuiJWMLhg/5WCmcRfiuB6F59ZcUQrwLEZeNhF2XJV4KwB
 Tlg7HCWO/sy1foE5noaMyACjAtAQE9p5kGYaj+DuRhPdWUTsHNuqrhikzIZd2rrcMid+ktb0
 NvtvswzMO059z1YGMtGSqQ4srCArju+XHIdTFdiIYbd7+jeehg==
In-Reply-To: <3ddfecf7-2cb3-472c-bfce-93356e57b898@app.fastmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
X-Scanned-By: MIMEDefang 2.86
X-Spamd-Result: default: False [0.70 / 15.00];
	NEURAL_SPAM_LONG(1.00)[0.999];
	NEURAL_SPAM_MEDIUM(0.98)[0.976];
	NEURAL_HAM_SHORT(-0.88)[-0.879];
	R_SPF_ALLOW(-0.20)[+ip6:2607:f3e0::/32];
	RCVD_IN_DNSWL_LOW(-0.10)[2607:f3e0:0:1::12:from];
	MIME_GOOD(-0.10)[text/plain];
	ARC_NA(0.00)[];
	FREEFALL_USER(0.00)[mike];
	MIME_TRACE(0.00)[0:+];
	ASN(0.00)[asn:11647, ipnet:2607:f3e0::/32, country:CA];
	RCVD_IN_DNSWL_NONE(0.00)[199.212.134.19:received];
	RCPT_COUNT_TWO(0.00)[2];
	R_DKIM_NA(0.00)[];
	MLMMJ_DEST(0.00)[freebsd-questions@freebsd.org];
	FROM_EQ_ENVFROM(0.00)[];
	FROM_HAS_DN(0.00)[];
	MID_RHS_MATCH_FROM(0.00)[];
	RCVD_COUNT_TWO(0.00)[2];
	TO_DN_ALL(0.00)[];
	TO_MATCH_ENVRCPT_SOME(0.00)[];
	DMARC_NA(0.00)[sentex.net];
	RCVD_TLS_ALL(0.00)[]
X-Rspamd-Queue-Id: 4ZTp3P2D42z3mHp
X-Spamd-Bar: /

On 4/4/2025 2:59 PM, Dave Cottlehuber wrote:
> On Fri, 4 Apr 2025, at 15:42, Andrea Venturoli wrote:
>> Hello.
>> I'm finding it hard to believe that 7 disks out of 12 are failing or
>> just happened to misbehave all on the same day.
>> BTW, SMART says they are OK.

does ipmitool sel list show anything btw ? (kldload ipmi and pkg install 
ipmitools if you dont have it already)

     ---Mike


From nobody Fri Apr  4 19:55:56 2025
X-Original-To: freebsd-questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZTq9G2pm5z5sLRr
	for <freebsd-questions@mlmmj.nyi.freebsd.org>; Fri, 04 Apr 2025 19:56:02 +0000 (UTC)
	(envelope-from Albert.Shih@obspm.fr)
Received: from mx-p1.obspm.fr (mx-p1.obspm.fr [145.238.193.20])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "*.obspm.fr", Issuer "GEANT OV RSA CA 4" (verified OK))
	by mx1.freebsd.org (Postfix) with ESMTPS id 4ZTq9F2DL6z3wK2
	for <freebsd-questions@freebsd.org>; Fri, 04 Apr 2025 19:56:01 +0000 (UTC)
	(envelope-from Albert.Shih@obspm.fr)
Authentication-Results: mx1.freebsd.org;
	dkim=pass header.d=obspm.fr header.s=mail header.b=OURKJSJ8;
	dmarc=pass (policy=none) header.from=obspm.fr;
	spf=pass (mx1.freebsd.org: domain of Albert.Shih@obspm.fr designates 145.238.193.20 as permitted sender) smtp.mailfrom=Albert.Shih@obspm.fr
X-AuthUser: jas
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=obspm.fr; s=mail;
	t=1743796558; bh=Yb4OKTqJXvs1BxLpCv+O9hVwaNIi5uxQx+0sNoK6lXA=;
	h=Date:From:To:Cc:Subject:References:In-Reply-To:From;
	b=OURKJSJ8Gc2vV4di1vFv3eU/aTuvTQ61YNXUjGnXnt2sYM3nfc72EJ7mHlRVjsFJ9
	 ckOdCIBjhgN9Uz8Uh6l9A6ONOftxwjB2pImt2aAqJ2KvisPnU/DH0/SwpBys1b0prO
	 61Q+SXu1qqsDQdghIHyMfouolddRa4xEcfv5lUz2PXDbi9ltCirpXNgFvV0IHsM5pa
	 YMPPagP+KxTUHues1pm8ByHV/gCvL0rrnwmb8ZKIBQHlhMWjp0Gjz7fH7zB4j69cwh
	 rBjduoYUXwMRFJud4UY+z7jdluaQThgntNO9pKe9H5JtPH6P9nYlhxbOkSJyai7A6M
	 +yI8GJ20KWPEw==
Received: from io.chezmoi.fr (vpn.obspm.fr [145.238.186.39])
	(authenticated bits=0)
	by mx-p1.obspm.fr (8.15.2/8.15.2/DIO Observatoire de Paris - 15/04/10) with ESMTPSA id 534JtuXb3397793
	(version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT);
	Fri, 4 Apr 2025 21:55:58 +0200
Date: Fri, 4 Apr 2025 21:55:56 +0200
From: Albert Shih <Albert.Shih@obspm.fr>
To: Aryeh Friedman <aryeh.friedman@gmail.com>
Cc: Paul Procacci <pprocacci@gmail.com>, freebsd-questions@freebsd.org
Subject: Re: Securing FreeBSD.
Message-ID: <Z_A5THon7ol-nNA8@io.chezmoi.fr>
References: <Z_ATQA2k-3umIaLo@io.chezmoi.fr>
 <CAFbbPugC7PfK__+4_vbHOtPSeMdU2XO3FU5AdSkpsi9taq=7rQ@mail.gmail.com>
 <Z_AmlH-_jA0Advng@io.chezmoi.fr>
 <CAGBxaXk819uEkV2fvJV0v3Eewr7YM29yMrqZJ8eewOerG5OSVQ@mail.gmail.com>
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <CAGBxaXk819uEkV2fvJV0v3Eewr7YM29yMrqZJ8eewOerG5OSVQ@mail.gmail.com>
X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.6.2 (mx-p1.obspm.fr [145.238.193.20]); Fri, 04 Apr 2025 21:55:58 +0200 (CEST)
X-Virus-Scanned: clamav-milter 1.0.7 at mx-p1
X-Virus-Status: Clean
X-Spamd-Result: default: False [-5.69 / 15.00];
	DWL_DNSWL_LOW(-1.00)[obspm.fr:dkim];
	NEURAL_HAM_LONG(-1.00)[-1.000];
	NEURAL_HAM_MEDIUM(-1.00)[-1.000];
	NEURAL_HAM_SHORT(-0.99)[-0.986];
	RCVD_DKIM_ARC_DNSWL_MED(-0.50)[];
	DMARC_POLICY_ALLOW(-0.50)[obspm.fr,none];
	RCVD_IN_DNSWL_MED(-0.40)[145.238.193.20:from,145.238.186.39:received];
	ONCE_RECEIVED(0.20)[];
	R_DKIM_ALLOW(-0.20)[obspm.fr:s=mail];
	R_SPF_ALLOW(-0.20)[+ip4:145.238.193.20];
	MIME_GOOD(-0.10)[text/plain];
	RCVD_TLS_ALL(0.00)[];
	FREEMAIL_TO(0.00)[gmail.com];
	FREEMAIL_CC(0.00)[gmail.com,freebsd.org];
	ARC_NA(0.00)[];
	MIME_TRACE(0.00)[0:+];
	DKIM_TRACE(0.00)[obspm.fr:+];
	RCVD_COUNT_ONE(0.00)[1];
	MISSING_XM_UA(0.00)[];
	MLMMJ_DEST(0.00)[freebsd-questions@freebsd.org];
	TO_MATCH_ENVRCPT_SOME(0.00)[];
	FROM_EQ_ENVFROM(0.00)[];
	RCPT_COUNT_THREE(0.00)[3];
	TAGGED_RCPT(0.00)[];
	ASN(0.00)[asn:2200, ipnet:145.238.0.0/16, country:FR];
	RCVD_VIA_SMTP_AUTH(0.00)[];
	TO_DN_SOME(0.00)[];
	FROM_HAS_DN(0.00)[]
X-Rspamd-Queue-Id: 4ZTq9F2DL6z3wK2
X-Spamd-Bar: -----

Le 04/04/2025 à 14:40:28-0400, Aryeh Friedman a écrit
> On Fri, Apr 4, 2025 at 2:36 PM Albert Shih <Albert.Shih@obspm.fr> wrote:
> >
> > Le 04/04/2025 à 13:23:38-0400, Paul Procacci a écrit
> > > On Fri, Apr 4, 2025 at 1:14 PM Albert Shih <Albert.Shih@obspm.fr> wrote:
> > > >
> > > >
> > >
> > > So you want to be root, without having the power of root.
> > > Try logging into the system with a different user and the problem is
> > > solved -- tongue and cheek.
> >
> > No, I want to make the system in a state where root *cannot* remove some
> > file.
> 
> Isn't the very definition of root (superuser) is that they can do *ANYTHING*?

Well....not always...try this :

  echo 'kern.securelevel=2' >> /etc/sysctl.conf
  chflags schg /etc/sysctl.conf
  sysctl kern.securelevel=2
  touch /root/file
  chflags schg /root/file

and tell me how you will remove the file

  /root/file

without be in the front of the server (no IPMI, no drac etc.)

Regards
-- 
Albert SHIH 🦫 🐸
France
Heure locale/Local time:
ven. 04 avril 2025 21:20:38 CEST

From nobody Fri Apr  4 20:01:42 2025
X-Original-To: questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZTqHv0J4Lz5sLR0
	for <questions@mlmmj.nyi.freebsd.org>; Fri, 04 Apr 2025 20:01:47 +0000 (UTC)
	(envelope-from Albert.Shih@obspm.fr)
Received: from mx-p1.obspm.fr (mx-p1.obspm.fr [145.238.193.20])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "*.obspm.fr", Issuer "GEANT OV RSA CA 4" (verified OK))
	by mx1.freebsd.org (Postfix) with ESMTPS id 4ZTqHt64MVz3xtG
	for <questions@freebsd.org>; Fri, 04 Apr 2025 20:01:46 +0000 (UTC)
	(envelope-from Albert.Shih@obspm.fr)
Authentication-Results: mx1.freebsd.org;
	none
X-AuthUser: jas
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=obspm.fr; s=mail;
	t=1743796904; bh=pHTgSyU3zrwqiDX3L1Z3qJFZtIIQNvdwZaHbAnz6zjc=;
	h=Date:From:To:Cc:Subject:References:In-Reply-To:From;
	b=BFSYvGtv8SzROaKMfh8AaDjRo6JjKnEznIHWFQwRVeKE6kb0eYHJ35f/bzUWoctFU
	 eBtRoP260MpewMnSNNmO8TsnJdBCy6l3hwhUjGefnTe9ZshqIasM2laP3CtfI/qkq+
	 TXakxm1uJ9NQjph2FH26WGitGtHvqp/+e570Xw+1gAdCrQjHhgxPLYmRt5r5SHlx2c
	 zcV7LdDk2AeOvzkkvOcQe4IubklYBCuI7n4RvtU8l59GC8AaCdydtzWhP2zzQ3B1Ir
	 ljhSaQqMA+PGR183EWqgug+MhgCWYs6wrcX75oivHEHmQQimEeALS0j7b/ri+3ICcu
	 C8BCEK0/SmNqA==
Received: from io.chezmoi.fr (vpn.obspm.fr [145.238.186.39])
	(authenticated bits=0)
	by mx-p1.obspm.fr (8.15.2/8.15.2/DIO Observatoire de Paris - 15/04/10) with ESMTPSA id 534K1gjD3398387
	(version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT);
	Fri, 4 Apr 2025 22:01:44 +0200
Date: Fri, 4 Apr 2025 22:01:42 +0200
From: Albert Shih <Albert.Shih@obspm.fr>
To: David Christensen <dpchrist@holgerdanske.com>
Cc: questions@freebsd.org
Subject: Re: Securing FreeBSD.
Message-ID: <Z_A6pmQPuZU5lTEW@io.chezmoi.fr>
References: <Z_ATQA2k-3umIaLo@io.chezmoi.fr>
 <bb89a12f-0d73-411f-a34f-8a8224c30744@holgerdanske.com>
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <bb89a12f-0d73-411f-a34f-8a8224c30744@holgerdanske.com>
X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.6.2 (mx-p1.obspm.fr [145.238.193.20]); Fri, 04 Apr 2025 22:01:44 +0200 (CEST)
X-Virus-Scanned: clamav-milter 1.0.7 at mx-p1
X-Virus-Status: Clean
X-Rspamd-Pre-Result: action=no action;
	module=replies;
	Message is reply to one we originated
X-Spamd-Result: default: False [-4.00 / 15.00];
	REPLY(-4.00)[];
	ASN(0.00)[asn:2200, ipnet:145.238.0.0/16, country:FR]
X-Rspamd-Queue-Id: 4ZTqHt64MVz3xtG
X-Spamd-Bar: ----

Le 04/04/2025 à 11:45:16-0700, David Christensen a écrit
> On 4/4/25 10:13, Albert Shih wrote:
> > Hi everyone.
> > 
> > Is they are any way to secure a FreeBSD to prevent destroying data ?
> > 
> > I find out even with
> > 
> >    kern.securelevel=2
> > 
> 
> It sounds like you want read-only storage media (?).

Yeah...exactly. The purpose is to recycle some old server to create some
«non erasable» backup in addition to our «normal» backup. 

They are two thing I will not consider in the equation :

  Security problem in FreeBSD. 
  Physical access to the server. 

beside that I want to make the server safest as possible. 
 
> Burning your data to a CD-R/DVD-R/BD-R disc comes to mind.

well....not possible. Too many To. And the data change daily. 

> Another option is a USB flash drive with a physical write-protect switch:
> 
> https://www.kanguru.com/products/defender-elite30-usb-3-0-hardware-encrypted-flash-drive
> 
> https://www.kanguru.com/products/kanguru-defender-elite300-fips-140-2-certified-secure-superspeed-usb-3-0-hardware-encrypted-flash-drive?variant=41077736833139
> 

Same issue. Not possible. 

Regards.

-- 
Albert SHIH 🦫 🐸
France
Heure locale/Local time:
ven. 04 avril 2025 21:56:07 CEST

From nobody Fri Apr  4 21:56:00 2025
X-Original-To: questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZTsr34Vr5z5sTqY
	for <questions@mlmmj.nyi.freebsd.org>; Fri, 04 Apr 2025 21:56:19 +0000 (UTC)
	(envelope-from dpchrist@holgerdanske.com)
Received: from holgerdanske.com (holgerdanske.com [IPv6:2001:470:0:19b::b869:801b])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange ECDHE (prime256v1) server-signature RSA-PSS (4096 bits) server-digest SHA256
	 client-signature RSA-PSS (4096 bits) client-digest SHA256)
	(Client CN "holgerdanske.com", Issuer "R10" (verified OK))
	by mx1.freebsd.org (Postfix) with ESMTPS id 4ZTsr16xtWz3J19
	for <questions@freebsd.org>; Fri, 04 Apr 2025 21:56:17 +0000 (UTC)
	(envelope-from dpchrist@holgerdanske.com)
Authentication-Results: mx1.freebsd.org;
	dkim=pass header.d=holgerdanske.com header.s=nov-20210719-112354 header.b=s0PbjNcM;
	dmarc=pass (policy=none) header.from=holgerdanske.com;
	spf=pass (mx1.freebsd.org: domain of dpchrist@holgerdanske.com designates 2001:470:0:19b::b869:801b as permitted sender) smtp.mailfrom=dpchrist@holgerdanske.com
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=holgerdanske.com;
	s=nov-20210719-112354; t=1743803769;
	bh=fwgDlJNWzIc3AgRFuNvz2BCtLpGzuhS8xVOJYeMsj1Y=;
	h=Received:Message-ID:Date:MIME-Version:User-Agent:Subject:To:
	 References:Content-Language:From:In-Reply-To:Content-Type:
	 Content-Transfer-Encoding;
	b=s0PbjNcM1bQlIQ5mrdoV4znIAT1hlTtuJTyuaAyas/N/dDx1sgJ2+5XIVQE/Aw93f
	 UG1Qtt4GJv96lyjVcri8sL1gOl5LkdLfy+Y04Bc8PVeTsGNmA98RaiHwLvz7+VP5Xi
	 J1DahbVPoXo9tDGXvDdkqiR1JkCXMWIl4O8SwpzMUVso6qZrboGzAcQpUsX3Js8lBw
	 nXV5b07VCmlshgtkSHNf6xKQ7xOUyJLd7dqSlvKHPnJNnoaaN/0llrPNx8XkYoG6Nc
	 aXW2Ptp+R+SwNvQ8IqtVzbPf0Ris0915cOyUzb6+IdqiRTfL6CiiTTzkcpG+M0FnFf
	 CO8ZC4IEDiuJ8Nsk0kMH4/hT01UMjUb9e37IwMmeD/rYjjWuh9O5TyiQ+t0mq1QeNi
	 hwrlEriae5KxspaoSfrLRZYTsPZu5yXA435fLkGKosoBCbFdVO6JKmL1Lfc+o04X+k
	 sZS6Y/6nBFs4IxaYD/OAaNsi92Oe9/iw5C9OeK0OdBNE47HVKSM9wcykvmYqngHsNt
	 Tak8FJCrHPtXITXLpMnskhEXQZ4PTzCnN+D+HnZzVvzKrOYxTZhQ4F9n2974Z9Uqfy
	 IcLM5SqRa8WC+Biyubcpb5oRCXvOVpis2R++7x7ywgA4iHsxXejDPmeFMoJYNQuIbZ
	 DNNHExhHkqQIJGBXWcgKYLYo=
Received: from 99.100.19.101 (99-100-19-101.lightspeed.frokca.sbcglobal.net [99.100.19.101])
	by holgerdanske.com with ESMTPSA (TLS_AES_128_GCM_SHA256:TLSv1.3:Kx=any:Au=any:Enc=AESGCM(128):Mac=AEAD) (SMTP-AUTH username dpchrist@holgerdanske.com, mechanism PLAIN)
	for <questions@freebsd.org>; Fri, 4 Apr 2025 14:56:09 -0700
Message-ID: <419a92a3-6d5b-44cb-8edf-6e65373ae72d@holgerdanske.com>
Date: Fri, 4 Apr 2025 14:56:00 -0700
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: Securing FreeBSD.
To: questions@freebsd.org
References: <Z_ATQA2k-3umIaLo@io.chezmoi.fr>
 <bb89a12f-0d73-411f-a34f-8a8224c30744@holgerdanske.com>
 <Z_A6pmQPuZU5lTEW@io.chezmoi.fr>
Content-Language: en-US
From: David Christensen <dpchrist@holgerdanske.com>
In-Reply-To: <Z_A6pmQPuZU5lTEW@io.chezmoi.fr>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
X-Spamd-Result: default: False [-3.42 / 15.00];
	NEURAL_HAM_LONG(-1.00)[-1.000];
	NEURAL_HAM_SHORT(-0.99)[-0.989];
	NEURAL_HAM_MEDIUM(-0.63)[-0.631];
	DMARC_POLICY_ALLOW(-0.50)[holgerdanske.com,none];
	R_DKIM_ALLOW(-0.20)[holgerdanske.com:s=nov-20210719-112354];
	ONCE_RECEIVED(0.20)[];
	R_SPF_ALLOW(-0.20)[+a:november.he.net];
	MIME_GOOD(-0.10)[text/plain];
	RCVD_VIA_SMTP_AUTH(0.00)[];
	RCPT_COUNT_ONE(0.00)[1];
	RCVD_COUNT_ONE(0.00)[1];
	MIME_TRACE(0.00)[0:+];
	ASN(0.00)[asn:6939, ipnet:2001:470::/32, country:US];
	RCVD_TLS_ALL(0.00)[];
	MID_RHS_MATCH_FROM(0.00)[];
	MLMMJ_DEST(0.00)[questions@freebsd.org];
	FROM_EQ_ENVFROM(0.00)[];
	FROM_HAS_DN(0.00)[];
	ARC_NA(0.00)[];
	TO_DN_NONE(0.00)[];
	PREVIOUSLY_DELIVERED(0.00)[questions@freebsd.org];
	TO_MATCH_ENVRCPT_ALL(0.00)[];
	DKIM_TRACE(0.00)[holgerdanske.com:+]
X-Rspamd-Queue-Id: 4ZTsr16xtWz3J19
X-Spamd-Bar: ---

On 4/4/25 13:01, Albert Shih wrote:
> Le 04/04/2025 à 11:45:16-0700, David Christensen a écrit
>> On 4/4/25 10:13, Albert Shih wrote:
>>> Is they are any way to secure a FreeBSD to prevent destroying data ?
>>
>> It sounds like you want read-only storage media (?).
> 
> Yeah...exactly. The purpose is to recycle some old server to create some
> «non erasable» backup in addition to our «normal» backup.


Please clarify how you will create the "«non erasable» backup" and how 
you will use it.


> They are two thing I will not consider in the equation :
> 
>    Security problem in FreeBSD.


If you wish to defend against security problems in FreeBSD, then I 
suggest that you run the oldest supported release of FreeBSD -- 
13.4-RELEASE.


>    Physical access to the server.


If you wish to defend against an intruder who has physical access to the 
server, then I suggest that you select drives that have self-encryption 
(in addition to write-protection).


> beside that I want to make the server safest as possible.
>   
>> Burning your data to a CD-R/DVD-R/BD-R disc comes to mind.
> 
> well....not possible. Too many To. 


What is the size of the "«non erasable» backup"?


What devices is it currently stored on?


Do you want to keep using those device(s)?  If not, what are your 
expectations for new devices?


> And the data change daily.


"non erasable" and "change daily" are contradictory goals.  Please clarify.


>> Another option is a USB flash drive with a physical write-protect switch:
>>
>> https://www.kanguru.com/products/defender-elite30-usb-3-0-hardware-encrypted-flash-drive
>>
>> https://www.kanguru.com/products/kanguru-defender-elite300-fips-140-2-certified-secure-superspeed-usb-3-0-hardware-encrypted-flash-drive?variant=41077736833139
>>
> 
> Same issue. Not possible.
> 
> Regards.


What about the IODD external drive enclosures?


On 4/4/25 11:45, David Christensen wrote:
 > Searching Amazon, I found external disk drive enclosures with various
 > features; including write-protect:
 >
 > https://www.iodd.shop/all-products


David


From nobody Sat Apr  5 01:40:53 2025
X-Original-To: questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZTysb0qzLz5sm66
	for <questions@mlmmj.nyi.freebsd.org>; Sat, 05 Apr 2025 01:42:59 +0000 (UTC)
	(envelope-from dewayne@heuristicsystems.com.au)
Received: from heuristicsystems.com.au (hermes.heuristicsystems.com.au [203.41.22.115])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256
	 client-signature RSA-PSS (2560 bits) client-digest SHA256)
	(Client CN "hermes.heuristicsystems.com.au", Issuer "Heuristic Systems Type 4 Host CA" (not verified))
	by mx1.freebsd.org (Postfix) with ESMTPS id 4ZTysV6VDpz3xf1
	for <questions@freebsd.org>; Sat, 05 Apr 2025 01:42:54 +0000 (UTC)
	(envelope-from dewayne@heuristicsystems.com.au)
Authentication-Results: mx1.freebsd.org;
	dkim=pass header.d=heuristicsystems.com.au header.s=hsa header.b="SyGhpi/4";
	dmarc=none;
	spf=pass (mx1.freebsd.org: domain of dewayne@heuristicsystems.com.au designates 203.41.22.115 as permitted sender) smtp.mailfrom=dewayne@heuristicsystems.com.au
Received: from [10.0.5.4] (bigears.hs [10.0.5.4])
	(authenticated bits=0)
	by heuristicsystems.com.au (8.15.2/8.15.2) with ESMTPA id 5351eqAd047756
	for <questions@freebsd.org>; Sat, 5 Apr 2025 12:40:55 +1100 (AEDT)
	(envelope-from dewayne@heuristicsystems.com.au)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple;
	d=heuristicsystems.com.au; s=hsa; t=1743817255; x=1744422056;
	bh=R3H6VarA64pAwWJjHBEr2YO1/3ztNQhKw6DEL1b1JsM=;
	h=Message-ID:Date:Subject:To:From;
	b=SyGhpi/4VhWMEwNvZ/RR0l605PPkqxWdAOO/ujAL6arL6daT3RF49b8sLesYud36Z
	 UMm+tcG2Y1rhy4JxpVnxjle+z8ZoCBMtQloqsvzvwY8iJNCn+QcEeIEcKLfK/x240W
	 3AmHvpERxqs4HQcb1hasZDCjDAPEM3W2Bxks3SNFRdpFT6cvs20P6
X-Authentication-Warning: b3.hs: Host bigears.hs [10.0.5.4] claimed to be [10.0.5.4]
Message-ID: <71d82eaf-40dd-46ab-9baf-5cf1a438d49d@heuristicsystems.com.au>
Date: Sat, 5 Apr 2025 12:40:53 +1100
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: Securing FreeBSD.
To: questions@freebsd.org
References: <Z_ATQA2k-3umIaLo@io.chezmoi.fr>
 <CAFbbPugC7PfK__+4_vbHOtPSeMdU2XO3FU5AdSkpsi9taq=7rQ@mail.gmail.com>
 <Z_AmlH-_jA0Advng@io.chezmoi.fr>
 <CAGBxaXk819uEkV2fvJV0v3Eewr7YM29yMrqZJ8eewOerG5OSVQ@mail.gmail.com>
 <Z_A5THon7ol-nNA8@io.chezmoi.fr>
Content-Language: en-GB
From: Dewayne Geraghty <dewayne@heuristicsystems.com.au>
In-Reply-To: <Z_A5THon7ol-nNA8@io.chezmoi.fr>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
X-Spamd-Result: default: False [-5.95 / 15.00];
	DWL_DNSWL_MED(-2.00)[heuristicsystems.com.au:dkim];
	NEURAL_HAM_LONG(-1.00)[-1.000];
	NEURAL_HAM_MEDIUM(-1.00)[-1.000];
	NEURAL_HAM_SHORT(-0.95)[-0.947];
	RCVD_DKIM_ARC_DNSWL_MED(-0.50)[];
	R_DKIM_ALLOW(-0.20)[heuristicsystems.com.au:s=hsa];
	ONCE_RECEIVED(0.20)[];
	R_SPF_ALLOW(-0.20)[+mx];
	RCVD_IN_DNSWL_MED(-0.20)[203.41.22.115:from];
	MIME_GOOD(-0.10)[text/plain];
	TO_MATCH_ENVRCPT_ALL(0.00)[];
	DKIM_TRACE(0.00)[heuristicsystems.com.au:+];
	RCVD_TLS_LAST(0.00)[];
	RCPT_COUNT_ONE(0.00)[1];
	MIME_TRACE(0.00)[0:+];
	DMARC_NA(0.00)[heuristicsystems.com.au];
	RCVD_COUNT_ONE(0.00)[1];
	ASN(0.00)[asn:1221, ipnet:203.40.0.0/13, country:AU];
	TO_DN_NONE(0.00)[];
	FROM_EQ_ENVFROM(0.00)[];
	FROM_HAS_DN(0.00)[];
	ARC_NA(0.00)[];
	PREVIOUSLY_DELIVERED(0.00)[questions@freebsd.org];
	MID_RHS_MATCH_FROM(0.00)[];
	MLMMJ_DEST(0.00)[questions@freebsd.org];
	RCVD_VIA_SMTP_AUTH(0.00)[];
	HAS_XAW(0.00)[]
X-Rspamd-Queue-Id: 4ZTysV6VDpz3xf1
X-Spamd-Bar: -----

Good advise Albert.  If you really want to prevent root access then, the 
next step is
kldload mac_bsdextended
and use ugidfw.

Refer to handbook example:
https://docs.freebsd.org/en/books/handbook/book/#mac-bsdextended
I use this for some files.

>> Isn't the very definition of root (superuser) is that they can do *ANYTHING*?
> 
> Well....not always...try this :
> 
>    echo 'kern.securelevel=2' >> /etc/sysctl.conf
>    chflags schg /etc/sysctl.conf
>    sysctl kern.securelevel=2
>    touch /root/file
>    chflags schg /root/file
> 
> and tell me how you will remove the file
> 
>    /root/file
> 
> without be in the front of the server (no IPMI, no drac etc.)
> 
> Regards


From nobody Sat Apr  5 07:24:10 2025
X-Original-To: questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZV6RN6KPkz5rRTY
	for <questions@mlmmj.nyi.freebsd.org>; Sat, 05 Apr 2025 07:24:16 +0000 (UTC)
	(envelope-from Albert.Shih@obspm.fr)
Received: from mx-p1.obspm.fr (mx-p1.obspm.fr [145.238.193.20])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "*.obspm.fr", Issuer "GEANT OV RSA CA 4" (verified OK))
	by mx1.freebsd.org (Postfix) with ESMTPS id 4ZV6RN2Dsbz43Hf
	for <questions@freebsd.org>; Sat, 05 Apr 2025 07:24:16 +0000 (UTC)
	(envelope-from Albert.Shih@obspm.fr)
Authentication-Results: mx1.freebsd.org;
	none
X-AuthUser: jas
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=obspm.fr; s=mail;
	t=1743837852; bh=Nqc4Yj8beFSMs1wFQvE//lXPebP8xugzgP8TOYNDwA8=;
	h=Date:From:To:Cc:Subject:References:In-Reply-To:From;
	b=Hw/TNlljQgbEgmvv9NzndYgEE3eryOSJ5efWIhg8dK2tG7v+ajtH8ISoEpmh8piIE
	 GEM1dLJW1Ef/YKoAq8+bY+WTKz0gIoXV+HO/Ipz0XqNs9MTAZWrgvVkJu2cUaL6Aam
	 jnn0xVH5LcwR8Syax+jqbnBXrRoK1Bk0jeiWm2XJIef2tAVY8BF3EmkV2ifn69clKj
	 7r7a3JToG9s9x9tuMVx0wd/5ppZEMvIpif8Nr71yqM/ntyKZmZcDC5w5GhiwfGKkM3
	 SwPzGfV+W0a/i4mtpr31uUobNJvgVDdgL396/6et4FUTp/7fnLMHNvfkZ56TFZwnWh
	 u1uJd/LrsLZLg==
Received: from io.chezmoi.fr (vpn.obspm.fr [145.238.186.39])
	(authenticated bits=0)
	by mx-p1.obspm.fr (8.15.2/8.15.2/DIO Observatoire de Paris - 15/04/10) with ESMTPSA id 5357OAuE3518597
	(version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT);
	Sat, 5 Apr 2025 09:24:12 +0200
Date: Sat, 5 Apr 2025 09:24:10 +0200
From: Albert Shih <Albert.Shih@obspm.fr>
To: Dewayne Geraghty <dewayne@heuristicsystems.com.au>
Cc: questions@freebsd.org
Subject: Re: Securing FreeBSD.
Message-ID: <Z_Damj2cwLPLMomK@io.chezmoi.fr>
References: <Z_ATQA2k-3umIaLo@io.chezmoi.fr>
 <CAFbbPugC7PfK__+4_vbHOtPSeMdU2XO3FU5AdSkpsi9taq=7rQ@mail.gmail.com>
 <Z_AmlH-_jA0Advng@io.chezmoi.fr>
 <CAGBxaXk819uEkV2fvJV0v3Eewr7YM29yMrqZJ8eewOerG5OSVQ@mail.gmail.com>
 <Z_A5THon7ol-nNA8@io.chezmoi.fr>
 <71d82eaf-40dd-46ab-9baf-5cf1a438d49d@heuristicsystems.com.au>
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <71d82eaf-40dd-46ab-9baf-5cf1a438d49d@heuristicsystems.com.au>
X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.6.2 (mx-p1.obspm.fr [145.238.193.20]); Sat, 05 Apr 2025 09:24:12 +0200 (CEST)
X-Virus-Scanned: clamav-milter 1.0.7 at mx-p1
X-Virus-Status: Clean
X-Rspamd-Pre-Result: action=no action;
	module=replies;
	Message is reply to one we originated
X-Spamd-Result: default: False [-4.00 / 15.00];
	REPLY(-4.00)[];
	ASN(0.00)[asn:2200, ipnet:145.238.0.0/16, country:FR]
X-Rspamd-Queue-Id: 4ZV6RN2Dsbz43Hf
X-Spamd-Bar: ----

Le 05/04/2025 à 12:40:53+1100, Dewayne Geraghty a écrit
Hi, 

> Good advise Albert.  If you really want to prevent root access then, the
> next step is
> kldload mac_bsdextended
> and use ugidfw.
> 
> Refer to handbook example:
> https://docs.freebsd.org/en/books/handbook/book/#mac-bsdextended
> I use this for some files.

Thanks

I know that exist...but never read it. Do you think with that I can prevent
root to destroy a zpool (or format a disk) ? 

Regards

> > > Isn't the very definition of root (superuser) is that they can do *ANYTHING*?
> > 
> > Well....not always...try this :
> > 
> >    echo 'kern.securelevel=2' >> /etc/sysctl.conf
> >    chflags schg /etc/sysctl.conf
> >    sysctl kern.securelevel=2
> >    touch /root/file
> >    chflags schg /root/file
> > 
> > and tell me how you will remove the file
> > 
> >    /root/file
> > 
> > without be in the front of the server (no IPMI, no drac etc.)
> > 
> > Regards
> 
> 
-- 
Albert SHIH 🦫 🐸
France
Heure locale/Local time:
sam. 05 avril 2025 09:22:30 CEST

From nobody Sat Apr  5 07:38:31 2025
X-Original-To: questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZV6lt4Tk5z5rSDL
	for <questions@mlmmj.nyi.freebsd.org>; Sat, 05 Apr 2025 07:38:34 +0000 (UTC)
	(envelope-from Albert.Shih@obspm.fr)
Received: from mx-p1.obspm.fr (mx-p1.obspm.fr [145.238.193.20])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "*.obspm.fr", Issuer "GEANT OV RSA CA 4" (verified OK))
	by mx1.freebsd.org (Postfix) with ESMTPS id 4ZV6lt2YrNz45GP
	for <questions@freebsd.org>; Sat, 05 Apr 2025 07:38:34 +0000 (UTC)
	(envelope-from Albert.Shih@obspm.fr)
Authentication-Results: mx1.freebsd.org;
	none
X-AuthUser: jas
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=obspm.fr; s=mail;
	t=1743838712; bh=7H3lBUphZijuR0LNfkXWRqpeGiMV3Ao0iqQMi072Iq4=;
	h=Date:From:To:Cc:Subject:References:In-Reply-To:From;
	b=jX4R2KHLljMrTGqI7btD+pong7k5CWFkV3Dow1tpUw9EDFnZ0xgH38bj603/1Le83
	 fE355eB6Q8OrXGDD5TE2nmKPutR5jFClpovBqAOaPWatsnwUd8mJb3loPbOSl26XaV
	 s1olf1rFuo6lN0DkuzcBsYRgPPf6DVQj0yw9mHnEu/V2JEY2q93t3gHrUk/5MWw7in
	 7/0R0lF6sYkRmJGSROUdVplnc9xxGAt4lORslfJcHH1zWelN1dmu/4+0wAU0vs1mXA
	 7ZYU32ww7mhgsvQLrqb1wz7zsNAfC518+mQ3LxM1t8xtojpy7cX7ecQaaaC6sCHFl7
	 LuiYiLMbHlEKQ==
Received: from io.chezmoi.fr (vpn.obspm.fr [145.238.186.39])
	(authenticated bits=0)
	by mx-p1.obspm.fr (8.15.2/8.15.2/DIO Observatoire de Paris - 15/04/10) with ESMTPSA id 5357cVKn3520059
	(version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT);
	Sat, 5 Apr 2025 09:38:32 +0200
Date: Sat, 5 Apr 2025 09:38:31 +0200
From: Albert Shih <Albert.Shih@obspm.fr>
To: David Christensen <dpchrist@holgerdanske.com>
Cc: questions@freebsd.org
Subject: Re: Securing FreeBSD.
Message-ID: <Z_Dd918DyCHhq1Hb@io.chezmoi.fr>
References: <Z_ATQA2k-3umIaLo@io.chezmoi.fr>
 <bb89a12f-0d73-411f-a34f-8a8224c30744@holgerdanske.com>
 <Z_A6pmQPuZU5lTEW@io.chezmoi.fr>
 <419a92a3-6d5b-44cb-8edf-6e65373ae72d@holgerdanske.com>
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <419a92a3-6d5b-44cb-8edf-6e65373ae72d@holgerdanske.com>
X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.6.2 (mx-p1.obspm.fr [145.238.193.20]); Sat, 05 Apr 2025 09:38:32 +0200 (CEST)
X-Virus-Scanned: clamav-milter 1.0.7 at mx-p1
X-Virus-Status: Clean
X-Rspamd-Pre-Result: action=no action;
	module=replies;
	Message is reply to one we originated
X-Spamd-Result: default: False [-4.00 / 15.00];
	REPLY(-4.00)[];
	ASN(0.00)[asn:2200, ipnet:145.238.0.0/16, country:FR]
X-Rspamd-Queue-Id: 4ZV6lt2YrNz45GP
X-Spamd-Bar: ----

Le 04/04/2025 à 14:56:00-0700, David Christensen a écrit

Hi
> > > It sounds like you want read-only storage media (?).
> > 
> > Yeah...exactly. The purpose is to recycle some old server to create some
> > «non erasable» backup in addition to our «normal» backup.
> 
> 
> Please clarify how you will create the "«non erasable» backup" and how you
> will use it.

The initial idea is to 

  1/ Put the server in kern.securelevel=2
  2/ cron + rsync + find . -type f -exec chflags schg {} \; for the data

For the use : 

  1/ Pray not have to ;-)

  2/ rsync in the other way ;-)

> > They are two thing I will not consider in the equation :
> > 
> >    Security problem in FreeBSD.
> 
> 
> If you wish to defend against security problems in FreeBSD, then I suggest
> that you run the oldest supported release of FreeBSD -- 13.4-RELEASE.

Well I say I will «not» consider. 
 
> 
> If you wish to defend against an intruder who has physical access to the
> server, then I suggest that you select drives that have self-encryption (in
> addition to write-protection).
> 

Yes. I know that. But the assumption is : 

  FreeBSD don't have security problem
  The physical access is safe. 

> > 
> > well....not possible. Too many To.
> 
> 
> What is the size of the "«non erasable» backup"?

Currently I got around 8 To of data to backup (every day) in this «backup safe». And 
the server for this «backup safe» would have «lot of To» (around 450 To). 

So no problem to just daily 

  mkdir  `date +%Y%M%d`
  rsync data  `date +%Y%M%d`
  find  `date +%Y%M%d` -type f -exec chflags schg {}\;

and each 6 months (or before if need a run of freebsd-update) to boot in
single, change the securelevel and erase manually the oldest backup
 
> 
> What devices is it currently stored on?
> 

Standard HDD. 

> 
> > And the data change daily.
> 
> 
> "non erasable" and "change daily" are contradictory goals.  Please clarify.

Yeah....I mean the data I need to backup change daily. So it's not humanly
possible to write that optical device. 

We already think about WORM tapes (we have LTO-8 library) but that's is
very expansive. And the point is to use some old server who run perfectly
but no longer under warranty to do this «backup safe» because we already
have standard backup. 

> > Same issue. Not possible.
> > 
> > Regards.
> 
> 
> What about the IODD external drive enclosures?
>
> 
Didn't know that thing. I will check that. 

Thanks

Regards
-- 
Albert SHIH 🦫 🐸
France
Heure locale/Local time:
sam. 05 avril 2025 09:24:20 CEST

From nobody Sat Apr  5 09:01:15 2025
X-Original-To: freebsd-questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZV8bM46rLz5rYxX
	for <freebsd-questions@mlmmj.nyi.freebsd.org>; Sat, 05 Apr 2025 09:01:19 +0000 (UTC)
	(envelope-from ml@netfence.it)
Received: from soth.netfence.it (mailserver.netfence.it [78.134.96.152])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mailserver.netfence.it", Issuer "R10" (verified OK))
	by mx1.freebsd.org (Postfix) with ESMTPS id 4ZV8bL2ssWz3Jlj
	for <freebsd-questions@freebsd.org>; Sat, 05 Apr 2025 09:01:18 +0000 (UTC)
	(envelope-from ml@netfence.it)
Authentication-Results: mx1.freebsd.org;
	dkim=none;
	dmarc=pass (policy=none) header.from=netfence.it;
	spf=pass (mx1.freebsd.org: domain of ml@netfence.it designates 78.134.96.152 as permitted sender) smtp.mailfrom=ml@netfence.it
Received: from [10.1.2.18] (alamar.local.netfence.it [10.1.2.18])
	(authenticated bits=0)
	by soth.netfence.it (8.18.1/8.17.2) with ESMTPSA id 53591FaU049628
	(version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NO)
	for <freebsd-questions@freebsd.org>; Sat, 5 Apr 2025 11:01:15 +0200 (CEST)
	(envelope-from ml@netfence.it)
X-Authentication-Warning: soth.netfence.it: Host alamar.local.netfence.it [10.1.2.18] claimed to be [10.1.2.18]
Message-ID: <032776db-a8a1-4134-a395-a59effbc4c30@netfence.it>
Date: Sat, 5 Apr 2025 11:01:15 +0200
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: Sudden zpool checksums errors
Content-Language: en-US
To: freebsd-questions <freebsd-questions@freebsd.org>
References: <6aeb488d-b3c3-4393-80ca-0b89c1ebc446@netfence.it>
 <3ddfecf7-2cb3-472c-bfce-93356e57b898@app.fastmail.com>
From: Andrea Venturoli <ml@netfence.it>
In-Reply-To: <3ddfecf7-2cb3-472c-bfce-93356e57b898@app.fastmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
X-Spamd-Result: default: False [0.26 / 15.00];
	NEURAL_SPAM_MEDIUM(0.99)[0.988];
	NEURAL_SPAM_LONG(0.95)[0.953];
	NEURAL_HAM_SHORT(-0.88)[-0.884];
	DMARC_POLICY_ALLOW(-0.50)[netfence.it,none];
	R_SPF_ALLOW(-0.20)[+ip4:78.134.96.152];
	MIME_GOOD(-0.10)[text/plain];
	RCVD_VIA_SMTP_AUTH(0.00)[];
	ASN(0.00)[asn:35612, ipnet:78.134.0.0/17, country:IT];
	RCVD_COUNT_ONE(0.00)[1];
	RCPT_COUNT_ONE(0.00)[1];
	MIME_TRACE(0.00)[0:+];
	MID_RHS_MATCH_FROM(0.00)[];
	R_DKIM_NA(0.00)[];
	MLMMJ_DEST(0.00)[freebsd-questions@freebsd.org];
	FROM_HAS_DN(0.00)[];
	HAS_XAW(0.00)[];
	ARC_NA(0.00)[];
	FROM_EQ_ENVFROM(0.00)[];
	TO_DN_ALL(0.00)[];
	TO_MATCH_ENVRCPT_ALL(0.00)[];
	PREVIOUSLY_DELIVERED(0.00)[freebsd-questions@freebsd.org];
	RCVD_TLS_ALL(0.00)[]
X-Rspamd-Queue-Id: 4ZV8bL2ssWz3Jlj
X-Spamd-Bar: /

On 4/4/25 20:59, Dave Cottlehuber wrote:


Thanks to all.
I'll answer here collectively.





> I have had marginal power supplies, backplane issues or break out cables from the controller manifest errors like that.  I would check the power supply first, backplane next, controller 3rd.

How would I go about this? How do I check these components?
Does IPMI provide something useful?





> If its memory, and your mainboard supports it, you'll see failures in dmesg,
> MCA ... some good examples:

No such things.
Either the MB does not support it (is it possible? likely?) or it's not RAM.

> Look for SCSI or CAM errors in your logs too, disconnects.

No such thing either.

> - overclocking

No overclocking.

> - overheating on mainboard, or controller, or drives

I monitor temperature with Nagios and received no alarm.

> - actually really bad ECC memory

Any way to test?

> - drive cables that have worked loose over time

Server is quite new (not even an year), but I can eventually check.

> External vibrations can cause problems.

This is possible, since the building is being expanded and construction 
of a new block is underway.
However, there are four servers which still have hard disks and only 
this one showed the problem.

> A slow process of upgrading firmware

I checked on Toshiba website and found no download; I'll eventually 
check with the supplier.

Is there a way I can check the controller firmware version via software?
I mean in FreeBSD, without rebooting?
dmesg.boot doesn't say.





> does ipmitool sel list show anything btw ? (kldload ipmi and pkg install ipmitools if you dont have it already) 

> # ipmitool sel list
>    1 | 05/06/24 | 18:16:23 CEST | Temperature #0xcc | Upper Non-critical going high | Asserted
>    2 | 05/06/24 | 21:25:42 CEST | Temperature #0xcc | Upper Critical going high | Asserted
>    3 | 05/07/24 | 15:49:00 CEST | Temperature #0xcc | Upper Critical going high | Deasserted
>    4 | 05/07/24 | 16:00:43 CEST | Temperature #0xcc | Upper Non-critical going high | Deasserted
>    5 | 06/13/24 | 11:54:52 CEST | Drive Slot / Bay #0x77 | Drive Present | Asserted
>    6 | 06/13/24 | 11:55:24 CEST | Drive Slot / Bay #0x73 | Drive Present | Asserted
>    7 | 06/13/24 | 14:21:04 CEST | Drive Slot / Bay #0x73 | Drive Present | Deasserted
>    8 | 06/13/24 | 14:21:04 CEST | Drive Slot / Bay #0x77 | Drive Present | Deasserted

Logs are from May/June, but the problem I'm talking about appeared some 
days ago, so it's not related.



  bye & Thanks
	av.

From nobody Sat Apr  5 09:27:21 2025
X-Original-To: freebsd-questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZV99q4XyBz5rcPX
	for <freebsd-questions@mlmmj.nyi.freebsd.org>; Sat, 05 Apr 2025 09:27:43 +0000 (UTC)
	(envelope-from dch@skunkwerks.at)
Received: from fhigh-a4-smtp.messagingengine.com (fhigh-a4-smtp.messagingengine.com [103.168.172.155])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256)
	(Client did not present a certificate)
	by mx1.freebsd.org (Postfix) with ESMTPS id 4ZV99q1mmQz3N0m
	for <freebsd-questions@freebsd.org>; Sat, 05 Apr 2025 09:27:43 +0000 (UTC)
	(envelope-from dch@skunkwerks.at)
Authentication-Results: mx1.freebsd.org;
	none
Received: from phl-compute-12.internal (phl-compute-12.phl.internal [10.202.2.52])
	by mailfhigh.phl.internal (Postfix) with ESMTP id EB72E114018F;
	Sat,  5 Apr 2025 05:27:41 -0400 (EDT)
Received: from phl-imap-15 ([10.202.2.104])
  by phl-compute-12.internal (MEProxy); Sat, 05 Apr 2025 05:27:41 -0400
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=skunkwerks.at;
	 h=cc:content-transfer-encoding:content-type:content-type:date
	:date:from:from:in-reply-to:in-reply-to:message-id:mime-version
	:references:reply-to:subject:subject:to:to; s=fm3; t=1743845261;
	 x=1743931661; bh=yN8kqk+O24PeMmEj6YbZk9HyH0gB0gWGviAjlFSiaWc=; b=
	K5BWJs+DEZK0jBiUfjdmVz18Ri3wNzAKfSq9D/x8XUVxGuWcDyvQC8HQMTa0fWUe
	IbMeVuBq86IBal3oCxprE6Vn1RP17guK/Lte9WIqo4yrLr0/05RnS4NWF0r+5+Om
	QccPlKS+Kj1sJ6DhSlgDQk0u6A+MIWNQfmpveGpRCVKslBchSrUBy9mJpkLc+rJn
	gDmd3O+uC1x+vyDPKAye5bi9Sd6moqGD9lAOtC3V8FLoqDYXUkV1jN8h+5rLvA90
	ErLgmPPbvm+tFI5IHnuz1KtowmvJLo9dGZ6uE8Esa5gevZqkOVoRZ2BUIsjn7p/Q
	vNjwWgtmXwx3PiJyj7oS8A==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=
	messagingengine.com; h=cc:content-transfer-encoding:content-type
	:content-type:date:date:feedback-id:feedback-id:from:from
	:in-reply-to:in-reply-to:message-id:mime-version:references
	:reply-to:subject:subject:to:to:x-me-proxy:x-me-sender
	:x-me-sender:x-sasl-enc; s=fm2; t=1743845261; x=1743931661; bh=y
	N8kqk+O24PeMmEj6YbZk9HyH0gB0gWGviAjlFSiaWc=; b=w8BBM43qaglNuBO+p
	lU55u0tK8jxnBcACEjow2HsIYz9+YB6nwq897JeB6N1R5IL1b0SX7ihxW//vz3IF
	ZITK7PoD2jKc7hmOjOlKPVIIIZkk2SUOb0bgGGL7Y6WR77X0RKfUnGjNy0+2UvIr
	Uc5sKyhWT2DvomuXEY+kdm6q/bkabf3IuP9vLPYJddtfj+YocK8XyXTZZvR6GL2V
	ElDIcTYg1UTNM97vJtaxmYl0G1LNsgXaKFk/CdLLnPSOutsBPSDbE+m+zheadCuH
	SMIGb7ymAbeLVN8ogHJ2Z2QsijPaH8EeBKbtU5HzpB06bdScO3lXbpPvkxmlBS+7
	LRBaA==
X-ME-Sender: <xms:jffwZylv5iwmSwOViW5pps4HUVx_hEn2n_sHUO7yUFqm8AgSllhphg>
    <xme:jffwZ51GvnWiiA12FNvWp5nVq1pK1xiuMFKXtWSl0Lmo0RB4b2aQCKEqEkEW8zyLn
    x0BxMQeUnfLgbSvpw>
X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeefvddrtddtgdduleefleekucetufdoteggodetrf
    dotffvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdggtfgfnhhsuhgsshgtrhhisggv
    pdfurfetoffkrfgpnffqhgenuceurghilhhouhhtmecufedttdenucenucfjughrpefogg
    ffhffvkfgjfhfutgfgsehtqhertdertdejnecuhfhrohhmpedfffgrvhgvucevohhtthhl
    vghhuhgsvghrfdcuoegutghhsehskhhunhhkfigvrhhkshdrrghtqeenucggtffrrghtth
    gvrhhnpeehhfeuffevgfeiffelleethefgvdeffeehveduvddtgeelvedtvdffgeelgeej
    ueenucffohhmrghinhepmhgvmhhtvghsthdrohhrghdpmhgvmhhtvghsthekiedrtghomh
    enucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepmhgrihhlfhhrohhmpegutghh
    sehskhhunhhkfigvrhhkshdrrghtpdhnsggprhgtphhtthhopedvpdhmohguvgepshhmth
    hpohhuthdprhgtphhtthhopehfrhgvvggsshguqdhquhgvshhtihhonhhssehfrhgvvggs
    shgurdhorhhgpdhrtghpthhtohepmhhlsehnvghtfhgvnhgtvgdrihht
X-ME-Proxy: <xmx:jffwZwp3kUve-qexOxzfEHZ2rYBH5LsJspd4FKnuxZP46x6eIl-I8g>
    <xmx:jffwZ2kX_ovwxzXb3miwwnyD6Z5EPjgj_m9LHhzz1EsQG_vOQ36_hw>
    <xmx:jffwZw0SSMPFAjfmuG6qgnIBXwOjllwUjhb9iyzfp3hOxP-b72JRrg>
    <xmx:jffwZ9v5yVBhTi0gonpcHl39i6a-BwinjAgj4JCjWCwWYcJt5Hhuuw>
    <xmx:jffwZx679AIhSpCcKHPVyFC-TOIfCWDtTcEdhg1D_CEU5nDDlfVThA0C>
Feedback-ID: ic0e84090:Fastmail
Received: by mailuser.phl.internal (Postfix, from userid 501)
	id 58DBE78006B; Sat,  5 Apr 2025 05:27:41 -0400 (EDT)
X-Mailer: MessagingEngine.com Webmail Interface
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
MIME-Version: 1.0
X-ThreadId: T35d1ea0024b92151
Date: Sat, 05 Apr 2025 11:27:21 +0200
From: "Dave Cottlehuber" <dch@skunkwerks.at>
To: "Andrea Venturoli" <ml@netfence.it>,
 freebsd-questions <freebsd-questions@freebsd.org>
Message-Id: <d26362e3-9dfe-4c73-a529-05ffe6ec0a9a@app.fastmail.com>
In-Reply-To: <032776db-a8a1-4134-a395-a59effbc4c30@netfence.it>
References: <6aeb488d-b3c3-4393-80ca-0b89c1ebc446@netfence.it>
 <3ddfecf7-2cb3-472c-bfce-93356e57b898@app.fastmail.com>
 <032776db-a8a1-4134-a395-a59effbc4c30@netfence.it>
Subject: Re: Sudden zpool checksums errors
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
X-Rspamd-Pre-Result: action=no action;
	module=replies;
	Message is reply to one we originated
X-Spamd-Result: default: False [-4.00 / 15.00];
	REPLY(-4.00)[];
	ASN(0.00)[asn:209242, ipnet:103.168.172.0/24, country:US]
X-Rspamd-Queue-Id: 4ZV99q1mmQz3N0m
X-Spamd-Bar: ----

On Sat, 5 Apr 2025, at 11:01, Andrea Venturoli wrote:
> Either the MB does not support it (is it possible? likely?) or it's no=
t RAM.

 consumer grade hardware might not have the necessary firmware to inform=
 FreeBSD about ECC corrections even if the ram supports it; I=E2=80=99m =
not very confident on this info though.

>> - actually really bad ECC memory
> Any way to test?


https://memtest.org/ or https://www.memtest86.com/download.htm I forget =
but I think I used the latter free version and booted via uefi. It can t=
ake a few days on larger systems to check memory.

Dave

From nobody Sat Apr  5 10:40:16 2025
X-Original-To: questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZVBnx6h2Mz5rxpD
	for <questions@mlmmj.nyi.freebsd.org>; Sat, 05 Apr 2025 10:40:37 +0000 (UTC)
	(envelope-from freebsd-doc@fjl.co.uk)
Received: from bs1.fjl.org.uk (bs1.fjl.org.uk [84.45.41.196])
	by mx1.freebsd.org (Postfix) with ESMTP id 4ZVBnw3Ytbz3YCr
	for <questions@freebsd.org>; Sat, 05 Apr 2025 10:40:36 +0000 (UTC)
	(envelope-from freebsd-doc@fjl.co.uk)
Authentication-Results: mx1.freebsd.org;
	dkim=none;
	dmarc=none;
	spf=pass (mx1.freebsd.org: domain of freebsd-doc@fjl.co.uk designates 84.45.41.196 as permitted sender) smtp.mailfrom=freebsd-doc@fjl.co.uk
Received: from [192.168.1.109] (host86-173-148-176.range86-173.btcentralplus.com [86.173.148.176])
	(authenticated bits=0)
	by bs1.fjl.org.uk (8.14.4/8.14.4) with ESMTP id 535AeSx9063340
	for <questions@freebsd.org>; Sat, 5 Apr 2025 11:40:28 +0100 (BST)
	(envelope-from freebsd-doc@fjl.co.uk)
Message-ID: <0fbd2584-6e07-40bf-b0e0-8d9198db100b@fjl.co.uk>
Date: Sat, 5 Apr 2025 11:40:16 +0100
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: Sudden zpool checksums errors
Content-Language: en-GB
To: questions@freebsd.org
References: <6aeb488d-b3c3-4393-80ca-0b89c1ebc446@netfence.it>
From: Frank Leonhardt <freebsd-doc@fjl.co.uk>
In-Reply-To: <6aeb488d-b3c3-4393-80ca-0b89c1ebc446@netfence.it>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
X-Spamd-Result: default: False [0.55 / 15.00];
	RBL_SENDERSCORE_REPUT_9(-1.00)[84.45.41.196:from];
	NEURAL_SPAM_LONG(1.00)[1.000];
	NEURAL_SPAM_MEDIUM(1.00)[1.000];
	NEURAL_HAM_SHORT(-0.45)[-0.451];
	ONCE_RECEIVED(0.20)[];
	R_SPF_ALLOW(-0.20)[+ip4:84.45.41.196];
	MIME_GOOD(-0.10)[text/plain];
	RCVD_NO_TLS_LAST(0.10)[];
	RCPT_COUNT_ONE(0.00)[1];
	ASN(0.00)[asn:25577, ipnet:84.45.0.0/17, country:GB];
	RCVD_COUNT_ONE(0.00)[1];
	MIME_TRACE(0.00)[0:+];
	FROM_EQ_ENVFROM(0.00)[];
	FROM_HAS_DN(0.00)[];
	ARC_NA(0.00)[];
	TO_MATCH_ENVRCPT_ALL(0.00)[];
	TO_DN_NONE(0.00)[];
	MID_RHS_MATCH_FROM(0.00)[];
	PREVIOUSLY_DELIVERED(0.00)[questions@freebsd.org];
	MLMMJ_DEST(0.00)[questions@freebsd.org];
	DMARC_NA(0.00)[fjl.co.uk];
	R_DKIM_NA(0.00)[]
X-Rspamd-Queue-Id: 4ZVBnw3Ytbz3YCr
X-Spamd-Bar: /

On 04/04/2025 16:42, Andrea Venturoli wrote:
> Hello.
>
> I've got a box with two zpools:
> _ 1 mirror on 2 SSDs;
> _ 1 raidz1 on 12 HDDs.
>
> Suddenly one daily run showed the following:
>>  pool: backup
>>  state: ONLINE
>> status: One or more devices has experienced an unrecoverable error.  An
>>     attempt was made to correct the error.  Applications are unaffected.
>> action: Determine if the device needs to be replaced, and clear the 
>> errors
>>     using 'zpool clear' or replace the device with 'zpool replace'.
>>    see: https://openzfs.github.io/openzfs-docs/msg/ZFS-8000-9P
>>   scan: scrub repaired 3.18M in 16:53:16 with 0 errors on Tue Apr  1 
>> 20:16:55 2025
>> config:
>>
>>     NAME        STATE     READ WRITE CKSUM
>>     backup      ONLINE       0     0     0
>>       raidz1-0  ONLINE       0     0     0
>>         da4     ONLINE       0     0     0
>>         da10    ONLINE       0     0     0
>>         da5     ONLINE       0     0    57
>>         da2     ONLINE       0     0     0
>>         da8     ONLINE       0     0    25
>>         da0     ONLINE       0     0     0
>>         da1     ONLINE       0     0    49
>>         da12    ONLINE       0     0     8
>>         da6     ONLINE       0     0     6
>>         da11    ONLINE       0     0     0
>>         da9     ONLINE       0     0    56
>>         da13    ONLINE       0     0    73
>>
>> errors: No known data errors
>
>
Assuming you've checked the logs etc as you say I'd be suspicious of the 
HBA and cabling, and presumably a SAS expander. But IME it's well worth 
testing the drives. Just dd them to /dev/null and see if anything 
sqwalks. There's nothing stopping you doing this on a live ZFS pool, 
although maybe do them one at a time if the array is busy :-)

Given the nature of SCSI you may find the only indication that a drive 
isn't 100% is an unusually slow read rate.

I agree it would be a coincidence 50% of the drives were flaky but it 
does happen, or it might be there're on one flaky HBA connecting half of 
them. I can't help being drawn to the fact it's exactly half that are 
throwing errors.

Anyway, checking the drives out by reading is minimal effort before 
diving into more esoteric reasons.

ZFS isn't as good as people think about detecting failing drives until 
they're actually on fire (see my posts passim on this matter).

Regards, Frank.





From nobody Sat Apr  5 14:40:28 2025
X-Original-To: questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZVJ6t0FJzz5sGkt
	for <questions@mlmmj.nyi.freebsd.org>; Sat, 05 Apr 2025 14:40:38 +0000 (UTC)
	(envelope-from jason@infinitebubble.com)
Received: from forward501b.mail.yandex.net (forward501b.mail.yandex.net [178.154.239.145])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256)
	(Client did not present a certificate)
	by mx1.freebsd.org (Postfix) with ESMTPS id 4ZVJ6r2d1Mz46tw
	for <questions@freebsd.org>; Sat, 05 Apr 2025 14:40:36 +0000 (UTC)
	(envelope-from jason@infinitebubble.com)
Authentication-Results: mx1.freebsd.org;
	dkim=none;
	dmarc=none;
	spf=pass (mx1.freebsd.org: domain of jason@infinitebubble.com designates 178.154.239.145 as permitted sender) smtp.mailfrom=jason@infinitebubble.com
Received: from mail-nwsmtp-smtp-production-main-55.sas.yp-c.yandex.net (mail-nwsmtp-smtp-production-main-55.sas.yp-c.yandex.net [IPv6:2a02:6b8:c23:2db2:0:640:9334:0])
	by forward501b.mail.yandex.net (Yandex) with ESMTPS id 9558261010
	for <questions@freebsd.org>; Sat,  5 Apr 2025 17:40:32 +0300 (MSK)
Received: by mail-nwsmtp-smtp-production-main-55.sas.yp-c.yandex.net (smtp/Yandex) with ESMTPSA id TebgH0JLguQ0-7llYT2XB;
	Sat, 05 Apr 2025 17:40:31 +0300
X-Yandex-Fwd: 1
Message-ID: <a115c9cb-54fb-4f4a-a447-f3db54114625@infinitebubble.com>
Date: Sat, 5 Apr 2025 10:40:28 -0400
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
MIME-Version: 1.0
User-Agent: Betterbird (Windows)
Subject: Re: Securing FreeBSD.
To: questions@freebsd.org
References: <Z_ATQA2k-3umIaLo@io.chezmoi.fr>
 <bb89a12f-0d73-411f-a34f-8a8224c30744@holgerdanske.com>
 <Z_A6pmQPuZU5lTEW@io.chezmoi.fr>
 <419a92a3-6d5b-44cb-8edf-6e65373ae72d@holgerdanske.com>
 <Z_Dd918DyCHhq1Hb@io.chezmoi.fr>
From: Jason Taylor <jason@infinitebubble.com>
Content-Language: en-US
In-Reply-To: <Z_Dd918DyCHhq1Hb@io.chezmoi.fr>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
X-Spamd-Result: default: False [0.82 / 15.00];
	RBL_SENDERSCORE_REPUT_9(-1.00)[178.154.239.145:from];
	NEURAL_SPAM_MEDIUM(0.98)[0.978];
	NEURAL_SPAM_LONG(0.93)[0.928];
	NEURAL_SPAM_SHORT(0.20)[0.202];
	R_SPF_ALLOW(-0.20)[+ip4:178.154.239.144/28];
	MIME_GOOD(-0.10)[text/plain];
	XM_UA_NO_VERSION(0.01)[];
	ARC_NA(0.00)[];
	RCVD_VIA_SMTP_AUTH(0.00)[];
	RWL_MAILSPIKE_POSSIBLE(0.00)[178.154.239.145:from];
	MIME_TRACE(0.00)[0:+];
	FREEFALL_USER(0.00)[jason];
	ASN(0.00)[asn:200350, ipnet:178.154.224.0/19, country:RU];
	MID_RHS_MATCH_FROM(0.00)[];
	MLMMJ_DEST(0.00)[questions@freebsd.org];
	RCPT_COUNT_ONE(0.00)[1];
	RCVD_COUNT_TWO(0.00)[2];
	FROM_EQ_ENVFROM(0.00)[];
	FROM_HAS_DN(0.00)[];
	R_DKIM_NA(0.00)[];
	TO_DN_NONE(0.00)[];
	PREVIOUSLY_DELIVERED(0.00)[questions@freebsd.org];
	TO_MATCH_ENVRCPT_ALL(0.00)[];
	DMARC_NA(0.00)[infinitebubble.com];
	RCVD_TLS_ALL(0.00)[]
X-Rspamd-Queue-Id: 4ZVJ6r2d1Mz46tw
X-Spamd-Bar: /

If offsite/cloud storage is an option, Ootbi has immutable storage. AWS, 
Azure, and Google all supposedly (I haven't verifid) offer immutable 
storage options.

On 2025-04-05 03:38, Albert Shih wrote:
> Le 04/04/2025 à 14:56:00-0700, David Christensen a écrit
>
> Hi
>>>> It sounds like you want read-only storage media (?).
>>> Yeah...exactly. The purpose is to recycle some old server to create some
>>> «non erasable» backup in addition to our «normal» backup.
>>
>> Please clarify how you will create the "«non erasable» backup" and how you
>> will use it.
> The initial idea is to
>
>    1/ Put the server in kern.securelevel=2
>    2/ cron + rsync + find . -type f -exec chflags schg {} \; for the data
>
> For the use :
>
>    1/ Pray not have to ;-)
>
>    2/ rsync in the other way ;-)
>
>>> They are two thing I will not consider in the equation :
>>>
>>>     Security problem in FreeBSD.
>>
>> If you wish to defend against security problems in FreeBSD, then I suggest
>> that you run the oldest supported release of FreeBSD -- 13.4-RELEASE.
> Well I say I will «not» consider.
>   
>> If you wish to defend against an intruder who has physical access to the
>> server, then I suggest that you select drives that have self-encryption (in
>> addition to write-protection).
>>
> Yes. I know that. But the assumption is :
>
>    FreeBSD don't have security problem
>    The physical access is safe.
>
>>> well....not possible. Too many To.
>>
>> What is the size of the "«non erasable» backup"?
> Currently I got around 8 To of data to backup (every day) in this «backup safe». And
> the server for this «backup safe» would have «lot of To» (around 450 To).
>
> So no problem to just daily
>
>    mkdir  `date +%Y%M%d`
>    rsync data  `date +%Y%M%d`
>    find  `date +%Y%M%d` -type f -exec chflags schg {}\;
>
> and each 6 months (or before if need a run of freebsd-update) to boot in
> single, change the securelevel and erase manually the oldest backup
>   
>> What devices is it currently stored on?
>>
> Standard HDD.
>
>>> And the data change daily.
>>
>> "non erasable" and "change daily" are contradictory goals.  Please clarify.
> Yeah....I mean the data I need to backup change daily. So it's not humanly
> possible to write that optical device.
>
> We already think about WORM tapes (we have LTO-8 library) but that's is
> very expansive. And the point is to use some old server who run perfectly
> but no longer under warranty to do this «backup safe» because we already
> have standard backup.
>
>>> Same issue. Not possible.
>>>
>>> Regards.
>>
>> What about the IODD external drive enclosures?
>>
>>
> Didn't know that thing. I will check that.
>
> Thanks
>
> Regards


From nobody Sat Apr  5 18:02:07 2025
X-Original-To: questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZVNbX4H9Gz5sYDx
	for <questions@mlmmj.nyi.freebsd.org>; Sat, 05 Apr 2025 18:02:16 +0000 (UTC)
	(envelope-from martin.m@suddenlink.net)
Received: from altprdrgo01.altice.prod.cloud.openwave.ai (altprdrgo01.altice.prod.cloud.openwave.ai [65.20.63.171])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256)
	(Client did not present a certificate)
	by mx1.freebsd.org (Postfix) with ESMTPS id 4ZVNbW4pgkz3ZV6
	for <questions@freebsd.org>; Sat, 05 Apr 2025 18:02:15 +0000 (UTC)
	(envelope-from martin.m@suddenlink.net)
Authentication-Results: mx1.freebsd.org;
	dkim=pass header.d=suddenlink.net header.s=dkim-001 header.b="LERI/eHr";
	dmarc=pass (policy=none) header.from=suddenlink.net;
	spf=pass (mx1.freebsd.org: domain of martin.m@suddenlink.net designates 65.20.63.171 as permitted sender) smtp.mailfrom=martin.m@suddenlink.net
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suddenlink.net; s=dkim-001; t=1743876135; 
        bh=OKsMbdEDynYdcWDF1KGhP+PyGjNRF1Gja+qh4skfvwk=;
        h=From:To:Subject:MIME-Version:Content-Type:Date:Message-Id;
        b=LERI/eHrR19bIGjUeUC9c8TmGGhcfjM+3rAevF4tZ1jzeQ+cHfHQUArjXb2zWeKOCcYt7bf9n7qnT4RM8SGkj1TdulGdBfIOpn1935LEfJiPji/+21p9kv9QpfzbdoPo9YjLM/06h+cU8vemner9WjaBLHNLu2OWSUL/UaDy4eBnh8P/a/4Arj5NAU7ewEaRdhnOpPD/bvphSI1E98PtxmZB4aPHCBO1oKyqSDfBZeo3H75sSI0zflAKE9baSwU2GElhdwlm9MDRyknlac3VuvyPh1ISF6W5X3kTfspmIegQRpuYYjH2HmxoSqbVFrpq+tSl/Ua+jRnrEwUMVAfIHQ==
X-RG-VS-CS: clean
X-RG-VS-SC: 0
X-RG-VS: Clean
X-Originating-IP: [47.217.105.81]
X-RG-Env-Sender: martin.m@suddenlink.net
X-RG-Rigid: 67B7373C06AFE3B8
X-RazorGate-Vade: dmFkZTGcAzooq3xOYdBIGhblI5Dz04s6fjIPDFRmfWXFHuUzLcurSjHqxRdH8ywJmPqdiB8p3Qk5GuHT5vbot3iVdID7ikk7oeqy1AoeWFa64YwqlbApArvaBpf2Ug8ScxM0Lo+n7R98ZpWFXhZ0pHl0UuSY+U4vcaBgE4+pD5XW3F7lkuU+zpR2O3ApGpsksn1J3Taxwi/Ycyx0scMco9EXbvlk1yUvN99RWUSGLKZW+76AG+9ynyZY9BBcFhOROxEbQkz7QX54lrA2tLrOH6kmHDoVx+v3OuA3jK/TBqUktlANbKB0kJrCokFR7ic96oY+ItEZy64920W07cwZHxHWAiqdfRNq6ZPKrpanUHgGHjmLo/A+RUI/7UkWeOm5UoriKtR3hEm0OUS5LW0cQzIsR71dnlbEDz+4WMVx6VDajRoKO0QY0UOrBxiu15r0hC5XTPaWzmAaYd9GyEYsr83AA/pWMoSk+55cHs9+kakemWTk4TcfF5L6GXwmF65jmzDwMb4H4D9eQDk2Bmg/6gbxPZ3HD9adCKpVkmqkzgWKCJnnIG4cr+aFM981yCjJkFGNz3eUSZHiv8L8ha9ybGiD5X+KAEB31li9voanPZjwqMj0qJvUmQ9ztVxFOvSapeb3+jsmzRgLvy6AgA6mVd7uHPfiL81KvxDexppaaTf5jHDGkQ
X-RazorGate-Vade-Verdict: clean 0
X-RazorGate-Vade-Classification: clean
Received: from wb5agz (47.217.105.81) by altprdrgo01.altice.prod.cloud.openwave.ai (5.8.812) (authenticated as martin.m@suddenlink.net)
        id 67B7373C06AFE3B8 for questions@freebsd.org; Sat, 5 Apr 2025 14:02:13 -0400
Received: from martin by wb5agz with local (Exim 4.96)
	(envelope-from <martin.m@suddenlink.net>)
	id 1u17qJ-000CWa-1L
	for questions@freebsd.org;
	Sat, 05 Apr 2025 13:02:07 -0500
From: "Martin McCormick" <martin.m@suddenlink.net>
To: questions@freebsd.org
Subject: A FreeBSD-based Router
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <48146.1743876127.1@wb5agz.lan>
Date: Sat, 05 Apr 2025 13:02:07 -0500
Message-Id: <E1u17qJ-000CWa-1L@wb5agz>
X-Spamd-Result: default: False [-2.19 / 15.00];
	RBL_SENDERSCORE_REPUT_6(1.00)[65.20.63.171:from];
	DWL_DNSWL_LOW(-1.00)[suddenlink.net:dkim];
	NEURAL_HAM_SHORT(-0.96)[-0.956];
	NEURAL_HAM_MEDIUM(-0.94)[-0.943];
	NEURAL_HAM_LONG(-0.79)[-0.793];
	MID_RHS_NOT_FQDN(0.50)[];
	MIME_GOOD(-0.10)[text/plain];
	BAD_REP_POLICIES(0.10)[];
	SUSPICIOUS_AUTH_ORIGIN(0.00)[];
	DMARC_POLICY_ALLOW(0.00)[suddenlink.net,none];
	DKIM_TRACE(0.00)[suddenlink.net:+];
	R_DKIM_ALLOW(0.00)[suddenlink.net:s=dkim-001];
	ARC_NA(0.00)[];
	RCVD_TLS_LAST(0.00)[];
	TO_MATCH_ENVRCPT_ALL(0.00)[];
	RCPT_COUNT_ONE(0.00)[1];
	FROM_HAS_DN(0.00)[];
	ASN(0.00)[asn:31898, ipnet:65.20.63.0/24, country:US];
	MIME_TRACE(0.00)[0:+];
	TO_DN_NONE(0.00)[];
	RCVD_COUNT_TWO(0.00)[2];
	FROM_EQ_ENVFROM(0.00)[];
	MISSING_XM_UA(0.00)[];
	HAS_XOIP(0.00)[];
	RWL_MAILSPIKE_POSSIBLE(0.00)[65.20.63.171:from];
	MLMMJ_DEST(0.00)[questions@freebsd.org];
	R_SPF_ALLOW(0.00)[+ip4:65.20.63.0/24];
	RCVD_IN_DNSWL_NONE(0.00)[65.20.63.171:from]
X-Rspamd-Queue-Id: 4ZVNbW4pgkz3ZV6
X-Spamd-Bar: --

We have been using a Netgear wndr3400v2 router since February of
2013 and it is probably time to take advantage of newer
technology especially since there have been no new software updates for
it in years.  It also has a web GUI interface that must have, at
one time, worked for somebody, but nobody here because I have
thrown every browser at it I can get my hands on and the best way
to describe it is that each browser does okay with some web pages
on it but not others and anything related to passwords or the
changing there of seems to always make the most destructive
changes but never any beneficial adjustments so one doesn't
really know what got changed until later when this or that
function no longer works.

	If I do the factory default reset, that will certainly
set things back to originals while also deleting the dhcp table
so I don't really want to do that.

	What I really want is a modern router with a command-line
method of control which allows for good old text-base
configuration files for changing router settings as well as the
dhcpd server which it would also be running.

	My idea is to load a mini PC with FreeBSD and a router
engine which means that the mini PC would need to have at least 2 NICS.

	Is there any particular mini PC  with a good track record
on running FreeBSD?  I just put our Netgear router on a UPS so
that the occasional power glitches aren't as easily passed
through to our home network and hopefully a mini PC would not run
the UPS battery down as quickly as a full-sized work station
might.

	Before I retired in 2015, I ran the FreeBSD-based bind
name servers along with ISC Dhcpd for my employer and we had
virtually no issues at all with that particular scheme so that's
why I want to use FreeBSD in our house for this purpose even
though I use debian Linux for most hobby activities so I can say
good things about both unixen (I believe that is a correct form
of speech.)

	Our router is still working, knock on wood, but we
recently had issues with our ISP that so choked the router that I
thought it had crashed only to find out that it came back to life
when whatever traffic the ISC was throwing on to their system
went away and things got back to what passes for normal.

	The FreeBSD/dhcp environment we had for over 20 years was
run on Dell servers and we had one FreeBSD box that ran continuously
without a reboot for over a year so I know FreeBSD gets things
done.

	Thanks for any suggestions.

Martin McCormick

From nobody Sat Apr  5 18:08:32 2025
X-Original-To: questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZVNky0GxNz5sYk9
	for <questions@mlmmj.nyi.freebsd.org>; Sat, 05 Apr 2025 18:08:42 +0000 (UTC)
	(envelope-from fatty.merchandise677@aceecat.org)
Received: from beesty.loosely.org (beesty.loosely.org [IPv6:2600:3c01:e000:4c0::2])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256)
	(Client did not present a certificate)
	by mx1.freebsd.org (Postfix) with ESMTPS id 4ZVNkw5hRRz3bdQ
	for <questions@freebsd.org>; Sat, 05 Apr 2025 18:08:40 +0000 (UTC)
	(envelope-from fatty.merchandise677@aceecat.org)
Authentication-Results: mx1.freebsd.org;
	dkim=none;
	dmarc=none;
	spf=pass (mx1.freebsd.org: domain of fatty.merchandise677@aceecat.org designates 2600:3c01:e000:4c0::2 as permitted sender) smtp.mailfrom=fatty.merchandise677@aceecat.org
Received: from localhost
	([::1] helo=beesty ident=itz)
	by beesty with esmtp (Exim 4.98.1-5-133ee3edc)
	(envelope-from <fatty.merchandise677@aceecat.org>)
	id 1u17wW-000000004AL-1vdG
	for questions@freebsd.org;
	Sat, 05 Apr 2025 11:08:33 -0700
Date: Sat, 5 Apr 2025 11:08:32 -0700
From: fatty.merchandise677@aceecat.org
To: questions@freebsd.org
Subject: Re: A FreeBSD-based Router
Message-ID: <fwY8bqPs9FjbCbnL@aceecat.org>
Mail-Followup-To: questions@freebsd.org
References: <E1u17qJ-000CWa-1L@wb5agz>
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <E1u17qJ-000CWa-1L@wb5agz>
X-Spamd-Result: default: False [1.72 / 15.00];
	NEURAL_SPAM_LONG(1.00)[1.000];
	NEURAL_SPAM_MEDIUM(1.00)[1.000];
	ONCE_RECEIVED(0.20)[];
	R_SPF_ALLOW(-0.20)[+mx];
	NEURAL_HAM_SHORT(-0.18)[-0.176];
	MIME_GOOD(-0.10)[text/plain];
	MIME_TRACE(0.00)[0:+];
	ARC_NA(0.00)[];
	ASN(0.00)[asn:63949, ipnet:2600:3c01::/32, country:SG];
	FROM_NO_DN(0.00)[];
	RCPT_COUNT_ONE(0.00)[1];
	RCVD_COUNT_ONE(0.00)[1];
	RECEIVED_HELO_LOCALHOST(0.00)[];
	MID_RHS_MATCH_FROM(0.00)[];
	TO_MATCH_ENVRCPT_ALL(0.00)[];
	TO_DN_NONE(0.00)[];
	MISSING_XM_UA(0.00)[];
	RCVD_TLS_LAST(0.00)[];
	MLMMJ_DEST(0.00)[questions@freebsd.org];
	DMARC_NA(0.00)[aceecat.org];
	R_DKIM_NA(0.00)[];
	FROM_EQ_ENVFROM(0.00)[]
X-Rspamd-Queue-Id: 4ZVNkw5hRRz3bdQ
X-Spamd-Bar: +

On Sat, Apr 05, 2025 at 01:02:07PM -0500, Martin McCormick wrote:

> My idea is to load a mini PC with FreeBSD and a router engine which
> means that the mini PC would need to have at least 2 NICS.

There are ARM based SBCs (smaller than a mini PC) purposely built
as routers ie. with multiple ethernet ports. Since FreeBSD can run
on ARM (in theory), I would look into those. Very low power :-)

-- 
Ian

From nobody Sat Apr  5 18:47:01 2025
X-Original-To: questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZVPbP24gGz5sbwB
	for <questions@mlmmj.nyi.freebsd.org>; Sat, 05 Apr 2025 18:47:13 +0000 (UTC)
	(envelope-from polarian@polarian.dev)
Received: from mail.polarian.dev (mail.polarian.dev [IPv6:2001:8b0:57a:2385::8])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256)
	(Client did not present a certificate)
	by mx1.freebsd.org (Postfix) with ESMTPS id 4ZVPbM5D4hz3jNm
	for <questions@freebsd.org>; Sat, 05 Apr 2025 18:47:11 +0000 (UTC)
	(envelope-from polarian@polarian.dev)
Authentication-Results: mx1.freebsd.org;
	dkim=pass header.d=polarian.dev header.s=polarian header.b=CubfmIQV;
	dmarc=pass (policy=reject) header.from=polarian.dev;
	spf=pass (mx1.freebsd.org: domain of polarian@polarian.dev designates 2001:8b0:57a:2385::8 as permitted sender) smtp.mailfrom=polarian@polarian.dev
Received: from Hydrogen (_gateway [192.168.2.1])
	by mail.polarian.dev (Postfix) with ESMTPSA id 1034B10A004C
	for <questions@freebsd.org>; Sat, 05 Apr 2025 18:47:03 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/relaxed; d=polarian.dev;
	s=polarian; t=1743878823;
	bh=I2zHL9KAAmbFbq3B3TUV74BBIaht4RDSc5R+eu/LlTo=;
	h=Date:From:To:Subject:In-Reply-To:References;
	b=CubfmIQVOjUrNXDPv7iKT6Z9baTskso9OoshSpmvtfU4ssGcbO5knxtAM0QD9q932
	 mA5c5Ql5Lex+215oa2vQcxQG26bwhlwoZYkUUYOSVaHlhT56VvUU1wlCb5CRKOcYUI
	 XWBWYnJ/39RAK+AOeBv8xjnvjZxYgXkD8Vv3tEM0=
Date: Sat, 5 Apr 2025 19:47:01 +0100
From: Polarian <polarian@polarian.dev>
To: questions@freebsd.org
Subject: Re: A FreeBSD-based Router
Message-ID: <20250405194701.6432e956@Hydrogen>
In-Reply-To: <fwY8bqPs9FjbCbnL@aceecat.org>
References: <E1u17qJ-000CWa-1L@wb5agz>
	<fwY8bqPs9FjbCbnL@aceecat.org>
X-Mailer: Claws Mail 3.21.0 (GTK+ 2.24.33; amd64-portbld-freebsd14.1)
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
X-Spamd-Result: default: False [-2.95 / 15.00];
	NEURAL_HAM_LONG(-1.00)[-1.000];
	NEURAL_HAM_MEDIUM(-1.00)[-1.000];
	DMARC_POLICY_ALLOW(-0.50)[polarian.dev,reject];
	MID_RHS_NOT_FQDN(0.50)[];
	NEURAL_HAM_SHORT(-0.45)[-0.448];
	R_SPF_ALLOW(-0.20)[+ip6:2001:8b0:57a:2385::8];
	R_DKIM_ALLOW(-0.20)[polarian.dev:s=polarian];
	MIME_GOOD(-0.10)[text/plain];
	TO_MATCH_ENVRCPT_ALL(0.00)[];
	ASN(0.00)[asn:20712, ipnet:2001:8b0::/34, country:GB];
	ARC_NA(0.00)[];
	RCVD_COUNT_ONE(0.00)[1];
	FROM_HAS_DN(0.00)[];
	MIME_TRACE(0.00)[0:+];
	PREVIOUSLY_DELIVERED(0.00)[questions@freebsd.org];
	RCVD_VIA_SMTP_AUTH(0.00)[];
	RCVD_TLS_ALL(0.00)[];
	TO_DN_NONE(0.00)[];
	FROM_EQ_ENVFROM(0.00)[];
	RCPT_COUNT_ONE(0.00)[1];
	MLMMJ_DEST(0.00)[questions@freebsd.org];
	DKIM_TRACE(0.00)[polarian.dev:+]
X-Rspamd-Queue-Id: 4ZVPbM5D4hz3jNm
X-Spamd-Bar: --

Hello,

> There are ARM based SBCs (smaller than a mini PC) purposely built
> as routers ie. with multiple ethernet ports. Since FreeBSD can run
> on ARM (in theory), I would look into those. Very low power :-)

There is a limited number of supported ARM boards. [1] provides a list
of them, but this page has not been updated in years so I am not too
sure about the status of it, maybe ask the arm mailing list if you are
interested in an ARM router?

If you are willing to take some additional energy usage for modularity
picking up old desktops such as optiplex's can provide you something
which can be upgraded very easily. SFF Optiplex's despite being small
(not as small as some of the arm options) can fit 1 or 2 network cards
in it, which can have up to 4-6 ports on a single card giving you more
than enough ports to make as many subnets as you like. Old desktops
tend to be cheap on ebay too, along with order gigabit network cards,
and the more beefy cpu gives you more than enough compute headroom for
anything you can think of. It does come at a power cost though, which
in the long run could be experience.

You could also look at protectli [2] which provide minipc sized
routers, however these come at a big cost, and will only save a small
amount of energy using newer more efficient chips than old desktops,
but they do pack a punch. I am not sure how well they support FreeBSD
however.

At the end of the day, you need to decide on how much performance you
need. If you only need a few hundred mbps of throughput then a
raspberry pi 4 with a usb NIC can provide you that performance for a
very low power draw, and reasonable cost. If you want something
performance which can do gigabit (or more in the future) then old
desktops or protectli boards might be the better way to go.

Take care,
-- 
Polarian
GPG signature: 0770E5312238C760
Jabber/XMPP: polarian@icebound.dev

[1] https://www.freebsd.org/platforms/arm/
[2] https://eu.protectli.com/

From nobody Sat Apr  5 18:47:21 2025
X-Original-To: questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZVPbl2SKyz5sbsL
	for <questions@mlmmj.nyi.freebsd.org>; Sat, 05 Apr 2025 18:47:31 +0000 (UTC)
	(envelope-from dpchrist@holgerdanske.com)
Received: from holgerdanske.com (holgerdanske.com [IPv6:2001:470:0:19b::b869:801b])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange ECDHE (prime256v1) server-signature RSA-PSS (4096 bits) server-digest SHA256
	 client-signature RSA-PSS (4096 bits) client-digest SHA256)
	(Client CN "holgerdanske.com", Issuer "R10" (verified OK))
	by mx1.freebsd.org (Postfix) with ESMTPS id 4ZVPbj4lq2z3jsy
	for <questions@freebsd.org>; Sat, 05 Apr 2025 18:47:29 +0000 (UTC)
	(envelope-from dpchrist@holgerdanske.com)
Authentication-Results: mx1.freebsd.org;
	dkim=pass header.d=holgerdanske.com header.s=nov-20210719-112354 header.b=IT882u6j;
	dmarc=pass (policy=none) header.from=holgerdanske.com;
	spf=pass (mx1.freebsd.org: domain of dpchrist@holgerdanske.com designates 2001:470:0:19b::b869:801b as permitted sender) smtp.mailfrom=dpchrist@holgerdanske.com
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=holgerdanske.com;
	s=nov-20210719-112354; t=1743878846;
	bh=XWCitun8ibfX6EBRmfRn0dwJto+hlEd3DwpBX72uk3Q=;
	h=Received:Message-ID:Date:MIME-Version:User-Agent:Subject:To:
	 References:Content-Language:From:In-Reply-To:Content-Type:
	 Content-Transfer-Encoding;
	b=IT882u6jypd8xEIua8aUFDX/nC7LSgx7XcCZ5pFNdwvSPV9SbP7+78GxxbYKyA5PD
	 gJ6YpOvw6T8c9b0HDiSjA76qviagrIamc93dUyOj8hQvKKLwxVcltrcunq4hb8MEWX
	 OHQVXK4lZUE2KBtfBT247rCm3K93LB7ZG3ncNMq+3Ra0ZBw6SsKfqo1zRPc6VGYbIn
	 oxypqxzvbZal53BHEEUrf/rDxP5hD/+Keph0YXT0Ci/BKcPc95nCXYfaZyVHgGIvxf
	 PYVgnS+591f8SujrljQTThtke27zhuP39eXT7Tld1UjTU1XgcmbqWAI7PpW/ozK8ls
	 Tu4fklUCjnHhK1Um649i1vDhFVKWybdMRqtJ5z+na5Vei3dW+98xIYbYD1mY22pI1v
	 S8IZXxt78qlpQOUH/dcp80z+HidhFUbQKDkAtYaFvkEYgpPCMT+ceqgzI2KIHa5N5M
	 NZCQS2JOWhvq9KV+6EinOSTQBH2I0lLO4Cfu2q5HV4FIuPbk+/1d8qo79a5v/X9XQT
	 Fkt+BaTgyUUHaslQuvWBbrT+DzHjBSX0I7q7OShNvzYyv/KHWw9LLn7l9dyw6/wC7C
	 RJChJ2I09zU+nD2ub6LBPsGp2xDiZwYXQj8vFo7WLRdgALhUowQk8QvtQGUtXxPPK+
	 wU2fppYkpaqsW/iJMYJ1uzQo=
Received: from 99.100.19.101 (99-100-19-101.lightspeed.frokca.sbcglobal.net [99.100.19.101])
	by holgerdanske.com with ESMTPSA (TLS_AES_128_GCM_SHA256:TLSv1.3:Kx=any:Au=any:Enc=AESGCM(128):Mac=AEAD) (SMTP-AUTH username dpchrist@holgerdanske.com, mechanism PLAIN)
	for <questions@freebsd.org>; Sat, 5 Apr 2025 11:47:26 -0700
Message-ID: <b888d2f8-75d5-48bd-b2ed-1f7e4df543c4@holgerdanske.com>
Date: Sat, 5 Apr 2025 11:47:21 -0700
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: Sudden zpool checksums errors
To: questions@freebsd.org
References: <6aeb488d-b3c3-4393-80ca-0b89c1ebc446@netfence.it>
 <3ddfecf7-2cb3-472c-bfce-93356e57b898@app.fastmail.com>
 <032776db-a8a1-4134-a395-a59effbc4c30@netfence.it>
Content-Language: en-US
From: David Christensen <dpchrist@holgerdanske.com>
In-Reply-To: <032776db-a8a1-4134-a395-a59effbc4c30@netfence.it>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
X-Spamd-Result: default: False [-2.18 / 15.00];
	NEURAL_HAM_LONG(-1.00)[-0.999];
	NEURAL_HAM_MEDIUM(-0.96)[-0.956];
	NEURAL_SPAM_SHORT(0.58)[0.575];
	DMARC_POLICY_ALLOW(-0.50)[holgerdanske.com,none];
	ONCE_RECEIVED(0.20)[];
	R_SPF_ALLOW(-0.20)[+a];
	R_DKIM_ALLOW(-0.20)[holgerdanske.com:s=nov-20210719-112354];
	MIME_GOOD(-0.10)[text/plain];
	RCVD_VIA_SMTP_AUTH(0.00)[];
	ASN(0.00)[asn:6939, ipnet:2001:470::/32, country:US];
	RCVD_COUNT_ONE(0.00)[1];
	RCPT_COUNT_ONE(0.00)[1];
	MIME_TRACE(0.00)[0:+];
	RCVD_TLS_ALL(0.00)[];
	MLMMJ_DEST(0.00)[questions@freebsd.org];
	ARC_NA(0.00)[];
	FROM_EQ_ENVFROM(0.00)[];
	FROM_HAS_DN(0.00)[];
	MID_RHS_MATCH_FROM(0.00)[];
	TO_DN_NONE(0.00)[];
	PREVIOUSLY_DELIVERED(0.00)[questions@freebsd.org];
	TO_MATCH_ENVRCPT_ALL(0.00)[];
	DKIM_TRACE(0.00)[holgerdanske.com:+]
X-Rspamd-Queue-Id: 4ZVPbj4lq2z3jsy
X-Spamd-Bar: --

On 4/5/25 02:01, Andrea Venturoli wrote:
> On 4/4/25 20:59, Dave Cottlehuber wrote:
>> I have had marginal power supplies, backplane issues or break out 
>> cables from the controller manifest errors like that.  I would check 
>> the power supply first, backplane next, controller 3rd.
> 
> How would I go about this? How do I check these components?
> Does IPMI provide something useful?


Buy and use a hardware power supply tester.  ATX testers are inexpensive 
and readily available.  If your PSU's are not ATX, please post relevant 
server, PSU, etc., details if you cannot find a tester.


Run memory test and/or system test suite in motherboard firmware Setup 
utility.  Alternatively, download and burn Memtest86+ to a bootable USB 
stick and run it:

https://memtest.org/


Disconnect and reconnect the HBA from the motherboard, all power cables 
related to the HBA, backplanes, disks, etc., and all data cables related 
to the HBA, backplanes, disks, etc., clear the zpool errors, and test.


If none of the above fix the CKSUM errors, move the OS disc and data 
disks to a known good server and try again.


David


From nobody Sat Apr  5 18:59:41 2025
X-Original-To: freebsd-questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZVPss2l4Hz5s7pQ
	for <freebsd-questions@mlmmj.nyi.freebsd.org>; Sat, 05 Apr 2025 18:59:45 +0000 (UTC)
	(envelope-from johnl@iecc.com)
Received: from gal.iecc.com (gal.iecc.com [IPv6:2001:470:1f07:1126:0:43:6f73:7461])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "gal.iecc.com", Issuer "Let's Encrypt Authority X3" (not verified))
	by mx1.freebsd.org (Postfix) with ESMTPS id 4ZVPsr57sgz3mWm
	for <freebsd-questions@freebsd.org>; Sat, 05 Apr 2025 18:59:44 +0000 (UTC)
	(envelope-from johnl@iecc.com)
Authentication-Results: mx1.freebsd.org;
	none
Received: (qmail 53072 invoked from network); 5 Apr 2025 18:59:42 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed; d=iecc.com; h=date:message-id:from:to:cc:subject:in-reply-to:references:mime-version:content-type:content-transfer-encoding:cleverness; s=cf4e67f17d9e.k2504; t=1743879572; x=1744225172; bh=Ob3/Jjh7F0yx+W99tlFOH+zWufoci2Ua4I732Dklyxs=; b=qxi5RY7h/1+uXJmYDLLz+kIrh6bnRSk/NK+ys4SEu6KHNLASQC7HgDvsRFi3BPLcLw/rpHyWNx+EdY+iTM0PU+qiMJUn0eJgLo/h8yxjC4MrhPpd1Z7jEqa9lVfJ0rND9NvUm50OBYhcP247kjjtjpmQX02/2IlCPPu5l8OkGTSyhfrNJ+SusJZ5eQGomrxaMNnU02X7l15rFewkKvY2S30aCaHF93BK8HQFHjuhYv4P5LMkrsJbsI31gg+f7Hs6bA1wumCA8cACKoygIsekmnC+IzfWFq84QRXPuhWBL1/+GRLZzca6qAjuFtYMHNJ+HCVqlm7uilsrCW7XCgb8/A==
Received: from ary.qy ([IPv6:2001:470:1f07:1126:0:78:696d:6170])
  by imap.iecc.com ([IPv6:2001:470:1f07:1126:0:78:696d:6170])
 with ESMTPS (TLS1.3 ECDHE-RSA CHACHA20-POLY1305 AEAD) via TCP6; 05 Apr 2025 18:59:42 -0000
Received: by ary.qy (Postfix, from userid 501)
	id 21830C31AADE; Sat,  5 Apr 2025 14:59:41 -0400 (EDT)
Date: 5 Apr 2025 14:59:41 -0400
Message-Id: <20250405185942.21830C31AADE@ary.qy>
From: "John Levine" <johnl@iecc.com>
To: freebsd-questions@freebsd.org
Cc: martin.m@suddenlink.net
Subject: Re: A FreeBSD-based Router
In-Reply-To: <E1u17qJ-000CWa-1L@wb5agz>
Organization: Taughannock Networks
References:  <E1u17qJ-000CWa-1L@wb5agz>
X-Headerized: yes
Cleverness: minimal
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
Mime-Version: 1.0
Content-type: text/plain; charset=utf-8
Content-transfer-encoding: 8bit
X-Rspamd-Pre-Result: action=no action;
	module=replies;
	Message is reply to one we originated
X-Spamd-Result: default: False [-4.00 / 15.00];
	REPLY(-4.00)[];
	ASN(0.00)[asn:6939, ipnet:2001:470::/32, country:US]
X-Rspamd-Queue-Id: 4ZVPsr57sgz3mWm
X-Spamd-Bar: ----

It appears that Martin McCormick <martin.m@suddenlink.net> said:
>	What I really want is a modern router with a command-line
>method of control which allows for good old text-base
>configuration files for changing router settings as well as the
>dhcpd server which it would also be running.
>
>	My idea is to load a mini PC with FreeBSD and a router
>engine which means that the mini PC would need to have at least 2 NICS.

If you go that route I'd look for a mini PC that's advertised to run linux.
I got this one for about $300 which runs FreeBSD OK:

https://cybergeekpc.com/collections/linux/products/cybergeek-mini-pc-nano-l1?variant=44291219128567

But I don't use it as a router. I have a Ubiqiti Edgerouter X. It has five
ethernet ports, hardware acceleration, a usable GUI, and you can ssh to a shell
and configure it with commands. It does all the stuff you'd expect a router to
do including DHCP, NAT, and tunnels.

Oh, and it costs all of $60.  They're out of stock at Ubiqiti but you can find lots
of them on eBay.

https://store.ui.com/us/en/products/er-x

R's,
John

From nobody Sat Apr  5 19:08:59 2025
X-Original-To: questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZVQ4n3v7zz5s8TH
	for <questions@mlmmj.nyi.freebsd.org>; Sat, 05 Apr 2025 19:09:13 +0000 (UTC)
	(envelope-from jmpalacios@gmail.com)
Received: from mail-qv1-xf2a.google.com (mail-qv1-xf2a.google.com [IPv6:2607:f8b0:4864:20::f2a])
	(using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)
	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "smtp.gmail.com", Issuer "WR4" (verified OK))
	by mx1.freebsd.org (Postfix) with ESMTPS id 4ZVQ4m1bjjz3pc2
	for <questions@freebsd.org>; Sat, 05 Apr 2025 19:09:12 +0000 (UTC)
	(envelope-from jmpalacios@gmail.com)
Authentication-Results: mx1.freebsd.org;
	dkim=pass header.d=gmail.com header.s=20230601 header.b=UOzpjxKd;
	dmarc=pass (policy=none) header.from=gmail.com;
	spf=pass (mx1.freebsd.org: domain of jmpalacios@gmail.com designates 2607:f8b0:4864:20::f2a as permitted sender) smtp.mailfrom=jmpalacios@gmail.com
Received: by mail-qv1-xf2a.google.com with SMTP id 6a1803df08f44-6f0c30a1ca3so1518566d6.1
        for <questions@freebsd.org>; Sat, 05 Apr 2025 12:09:12 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20230601; t=1743880151; x=1744484951; darn=freebsd.org;
        h=message-id:in-reply-to:to:references:date:subject:mime-version
         :content-transfer-encoding:from:from:to:cc:subject:date:message-id
         :reply-to;
        bh=jq1B58bHWQN1QsF/5UgYOxGEl1xrHy96kroG+nHPj4o=;
        b=UOzpjxKdySLvl3DQEDsO54O8v1nV8WNg0sNCmj5Xz7qdFhj3weVYPZ5lUkBOtlH2SW
         S4CjYqr/dJTB6pzg6jWWnilN19/jcSeIclK4JwYtL3VCy86Ylafezd8lkXIccyKeP0GN
         IwG+4owFbnxiaL4lVtn739ov2AqP1900o8c2JLoBp8P7l8lsO+YfQxQG3t6zhDdyfPj5
         2g5fwqE6ShR9LcFGWFpRt4WJehwKbYEjR6WYno2bocRlMfYvT2+/dJc+r9xXuCtFo3pb
         +CpNu5U5xg5PSjPIUPCWbwuklQ/3pbvYPai/n1N5KvmCv5Hicdro6EojajGHGcLnypzw
         svhQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20230601; t=1743880151; x=1744484951;
        h=message-id:in-reply-to:to:references:date:subject:mime-version
         :content-transfer-encoding:from:x-gm-message-state:from:to:cc
         :subject:date:message-id:reply-to;
        bh=jq1B58bHWQN1QsF/5UgYOxGEl1xrHy96kroG+nHPj4o=;
        b=j8TvdYV46nFC5C47jcQfGr0/HqQ4WUhYirW2Cyp7FeGpwH2vs5V9ZCcfpyV9cLSULw
         L9YHh/m2ud0ecbP3BTJnJu86D0iqpSCXgmQ6bXfoYJnxsCiZHkS8XgQCn+/HBEGA9brf
         BQURoaNR7QVLvrI5vqwPozXbs0Zz6MPx83SrtcQlStCrPh/FzXxODole4XnQmLrmrm9w
         iYdFDC34qclqeCNy1O9Xttr4c6ReOlGghM3h2rX3uHJNbW5YCvWtaS4phYOb8MdZQ0gL
         qXtyB6rZBZK7xud+b1tbf6XdFal1dOK/+6k9BQdBDZX9damZKItp/BIJG6ji1sCls4Z5
         XyEA==
X-Gm-Message-State: AOJu0YzmOGFCLkwDU1O49xAWTUR8GYHsoTqQSW1M3ywIQPo8TIJ3+Woy
	PO0EslTg2No9dLDThF8aOZvf8hbDkcznPfzYWDKk8uM22SGW/QDNdBb1vCps
X-Gm-Gg: ASbGncuiHnFndgGWpxpk7Z+q6UTYT7I/T6Uhz+4ok7Mr2qIpsHmOz7pkjOHl+63VeEq
	rA/F8pvXbdB1TPVK6RQkX/RXVv4RJ50D4Ltx6z9JzGOXa6yfKReaSifX19GgOHEk8SpYVTPeGZo
	D0cPPs4gXitRwjBjDBtJ6bK2JJW29NUFTFjXnehuviMlNWCEWbe6AlZRJC9VXVMcHbz242O6oX1
	kVKSD0eVye+V9S/MhutBDuukHfvwuzzVfsG4VWwWSsq1mDYpbwo4cuiKjqOgMNBlqgwj9bKyruC
	++PQXIvCzK0DvsJvS/3HVxl7QDdKiTDlNjEG6t6TRhHIiad4I8QFLpe3W93m1WQAzmt0wQ4jUjk
	cRbP4TGaG
X-Google-Smtp-Source: AGHT+IGtkPDZHP/KDph5B095m7WnWgOvvwHQs4DegeIS05icEB0CVD9WXlN1aJ6yIFiFAvW9bDGIPw==
X-Received: by 2002:a05:6214:2466:b0:6e4:6ee1:a282 with SMTP id 6a1803df08f44-6f00deedf9fmr110669746d6.18.1743880150767;
        Sat, 05 Apr 2025 12:09:10 -0700 (PDT)
Received: from smtpclient.apple ([2600:4041:7970:8b10:d048:3743:d011:4dfb])
        by smtp.gmail.com with ESMTPSA id 6a1803df08f44-6ef0f0469a7sm36860796d6.51.2025.04.05.12.09.09
        for <questions@freebsd.org>
        (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);
        Sat, 05 Apr 2025 12:09:10 -0700 (PDT)
From: Juan Manuel Palacios <jmpalacios@gmail.com>
Content-Type: text/plain;
	charset=utf-8
Content-Transfer-Encoding: quoted-printable
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3826.500.181.1.5\))
Subject: Re: A FreeBSD-based Router
Date: Sat, 5 Apr 2025 15:08:59 -0400
References: <E1u17qJ-000CWa-1L@wb5agz> <fwY8bqPs9FjbCbnL@aceecat.org>
 <20250405194701.6432e956@Hydrogen>
To: questions@freebsd.org
In-Reply-To: <20250405194701.6432e956@Hydrogen>
Message-Id: <B0B8BA53-2A43-4DF2-A837-DAD627B4C723@gmail.com>
X-Mailer: Apple Mail (2.3826.500.181.1.5)
X-Spamd-Result: default: False [-3.00 / 15.00];
	NEURAL_HAM_LONG(-1.00)[-1.000];
	NEURAL_HAM_MEDIUM(-0.97)[-0.973];
	NEURAL_HAM_SHORT(-0.53)[-0.526];
	DMARC_POLICY_ALLOW(-0.50)[gmail.com,none];
	MV_CASE(0.50)[];
	R_SPF_ALLOW(-0.20)[+ip6:2607:f8b0:4000::/36];
	R_DKIM_ALLOW(-0.20)[gmail.com:s=20230601];
	MIME_GOOD(-0.10)[text/plain];
	RCVD_TLS_LAST(0.00)[];
	TO_MATCH_ENVRCPT_ALL(0.00)[];
	RCPT_COUNT_ONE(0.00)[1];
	FREEMAIL_ENVFROM(0.00)[gmail.com];
	ARC_NA(0.00)[];
	MIME_TRACE(0.00)[0:+];
	FREEMAIL_FROM(0.00)[gmail.com];
	FROM_HAS_DN(0.00)[];
	ASN(0.00)[asn:15169, ipnet:2607:f8b0::/32, country:US];
	DWL_DNSWL_NONE(0.00)[gmail.com:dkim];
	TO_DN_NONE(0.00)[];
	RCVD_COUNT_TWO(0.00)[2];
	FROM_EQ_ENVFROM(0.00)[];
	DKIM_TRACE(0.00)[gmail.com:+];
	PREVIOUSLY_DELIVERED(0.00)[questions@freebsd.org];
	MID_RHS_MATCH_FROM(0.00)[];
	MLMMJ_DEST(0.00)[questions@freebsd.org];
	RCVD_VIA_SMTP_AUTH(0.00)[];
	RCVD_IN_DNSWL_NONE(0.00)[2607:f8b0:4864:20::f2a:from]
X-Rspamd-Queue-Id: 4ZVQ4m1bjjz3pc2
X-Spamd-Bar: --

Other than talking about the appropriate hardware for the task at hand, =
I find it rather odd that no one has yet mentioned either the pfSense or =
OPNsense distributions. They=E2=80=99re both router-oriented, =
FreeBSD-based, web-administered, text-based-managed, and, above all, =
extremely versatile.

Mind you, I=E2=80=99m not talking to any degree against rolling out raw =
FreeBSD plus packages plus some orchestration solution to manage =
changes, I absolutely love that approach. But if what you want is a =
turn-key, ready-made solution to provide router-related functionality to =
your home network, then either of those two more than fit the bill.

I=E2=80=99ve been running pfSense here at home for the last=E2=80=A6 =
what, 6 years already? And it=E2=80=99s been rock solid! And on that =
router I run a DCHP server, DHCP6, radvd, unbound, HAProxy with a few =
ACME certificates, OpenVPN, a whole bunch of VLANs, plus of course pf =
with a bunch of rules for each of those VLANs, and probably other things =
I might be forgetting.

Furthermore, that pfSense router runs in a VM, sitting atop a Supermicro =
MOBO & a not super powerful Intel CPU, leveraging PCI passthrough for =
three NICs, and sometimes I just get bored at having almost nothing to =
worry about because it just works 24/7/365 without skipping a bit.

Again, other than discussing what would be the appropriate hardware for =
your setup, an appliance-like solution like that is definitely what =
I=E2=80=99d recommend.

HTH!

> On Apr 5, 2025, at 2:47=E2=80=AFPM, Polarian <polarian@polarian.dev> =
wrote:
>=20
> Hello,
>=20
>> There are ARM based SBCs (smaller than a mini PC) purposely built
>> as routers ie. with multiple ethernet ports. Since FreeBSD can run
>> on ARM (in theory), I would look into those. Very low power :-)
>=20
> There is a limited number of supported ARM boards. [1] provides a list
> of them, but this page has not been updated in years so I am not too
> sure about the status of it, maybe ask the arm mailing list if you are
> interested in an ARM router?
>=20
> If you are willing to take some additional energy usage for modularity
> picking up old desktops such as optiplex's can provide you something
> which can be upgraded very easily. SFF Optiplex's despite being small
> (not as small as some of the arm options) can fit 1 or 2 network cards
> in it, which can have up to 4-6 ports on a single card giving you more
> than enough ports to make as many subnets as you like. Old desktops
> tend to be cheap on ebay too, along with order gigabit network cards,
> and the more beefy cpu gives you more than enough compute headroom for
> anything you can think of. It does come at a power cost though, which
> in the long run could be experience.
>=20
> You could also look at protectli [2] which provide minipc sized
> routers, however these come at a big cost, and will only save a small
> amount of energy using newer more efficient chips than old desktops,
> but they do pack a punch. I am not sure how well they support FreeBSD
> however.
>=20
> At the end of the day, you need to decide on how much performance you
> need. If you only need a few hundred mbps of throughput then a
> raspberry pi 4 with a usb NIC can provide you that performance for a
> very low power draw, and reasonable cost. If you want something
> performance which can do gigabit (or more in the future) then old
> desktops or protectli boards might be the better way to go.
>=20
> Take care,
> --=20
> Polarian
> GPG signature: 0770E5312238C760
> Jabber/XMPP: polarian@icebound.dev
>=20
> [1] https://www.freebsd.org/platforms/arm/
> [2] https://eu.protectli.com/
>=20


From nobody Sat Apr  5 21:43:00 2025
X-Original-To: questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZVTVN4hDSz5sN78
	for <questions@mlmmj.nyi.freebsd.org>; Sat, 05 Apr 2025 21:43:08 +0000 (UTC)
	(envelope-from martin.m@suddenlink.net)
Received: from altprdrgo04.altice.prod.cloud.openwave.ai (altprdrgo04.altice.prod.cloud.openwave.ai [65.20.63.159])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256)
	(Client did not present a certificate)
	by mx1.freebsd.org (Postfix) with ESMTPS id 4ZVTVM3sB8z3NHq
	for <questions@freebsd.org>; Sat, 05 Apr 2025 21:43:07 +0000 (UTC)
	(envelope-from martin.m@suddenlink.net)
Authentication-Results: mx1.freebsd.org;
	dkim=pass header.d=suddenlink.net header.s=dkim-001 header.b=ICit+uRJ;
	dmarc=pass (policy=none) header.from=suddenlink.net;
	spf=pass (mx1.freebsd.org: domain of martin.m@suddenlink.net designates 65.20.63.159 as permitted sender) smtp.mailfrom=martin.m@suddenlink.net
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suddenlink.net; s=dkim-001; t=1743889387; 
        bh=JPGduG9WoDnlI/3HqNGnUsd5m0q7wBjXLtwraSbD4hk=;
        h=From:To:Subject:MIME-Version:Content-Type:Date:Message-Id;
        b=ICit+uRJzxxrWauq556LYnrr9bl48tzcX90yHNobm1vBI8Ow9d/X6IZBmilEJduW23NC1fLgRrepczgDt9AJ0kohPUDwcaMkNHSlsVa12BONqiMoqBuZwsjBv5iJeJdDu4aweL0JEB3HvNgyR14ZRniyLRXxV0VoxOxKaxzFeo2ZKrkrsEKQiMcJ/gLkvJ05kmjtjel2tnuPFdGSW5R2CumCxC1M3gB5y5qnOliB0QtEqJfIH3S18SOv9CNiHRRluNjj0LfZrVfVZg5BDO4KUZXmRDprvnIl42WQfnlGcMzL9PkZLU26A8oJ0aqgr5/mN1W101GkGjs/ioesSIluTA==
X-RG-VS-CS: clean
X-RG-VS-SC: 0
X-RG-VS: Clean
X-Originating-IP: [47.217.105.81]
X-RG-Env-Sender: martin.m@suddenlink.net
X-RG-Rigid: 67D9738301E14D98
X-RazorGate-Vade: dmFkZTGJ6CcVY47/el0oGUcnjHoPuhZ+48GvG5JWA+HfCpyVKABOrBkivEKE/6tmc/RqoSUr3sFkXTIwmghfyynL5qyN7x9PLpPjBIuc0sy54ik9wuOLu08KdG8ZDx4sie4sMslPb1CXKOGgQbeBqLs3iKsS1s+38L2uDzoWymy+DCbGwoFpfrSpfiaMCE/3CWXO3at003gDZsd0W7tQ16Ba8YKJb25dMXf688sc4Wyt6h5UokWZLz4zjEFmqy8E798sWNxkdfFxwd8s2tucxzzb8AP/yaoqr3ScaUWl22IEapxUIZhYnOjc8IwzenHMrmGj4KuXtoaUVzAH1Jo8TW94Ax40Wbq7cqldSS6Hgfvhk8g3SAPGcaBWwGu0+aHchgq8IqDlkzMn7DNPnpzDArIW8yRVPhIy2QwBc8W4+nW8j87sIkoCKUkR1Y7+42CHP4Pjv780kPSfBc3tlOXA4IApwFSOsngo0AQGkjL842Vod/nA8QPnZF5XR6IokLP87lmevFYyUwKQgRGg5wLArz515potkq6heXxI0ZDW5DyelU4RrX9xHGE6iFQLI5WpMgVX3c7ROw/txEXCv8n/QMuUcR4K3zXRDObJsVJXcJ6zRNrHl7BFnTxJ7z8q3tyEbbCvv5PSDmBpDbelkOn/1N2pp7nakUkzado7EuH2kU8suYq5Ow
X-RazorGate-Vade-Verdict: clean 0
X-RazorGate-Vade-Classification: clean
Received: from wb5agz (47.217.105.81) by altprdrgo04.altice.prod.cloud.openwave.ai (5.8.812) (authenticated as martin.m@suddenlink.net)
        id 67D9738301E14D98 for questions@freebsd.org; Sat, 5 Apr 2025 17:43:06 -0400
Received: from martin by wb5agz with local (Exim 4.96)
	(envelope-from <martin.m@suddenlink.net>)
	id 1u1BI4-0001sm-1R
	for questions@freebsd.org;
	Sat, 05 Apr 2025 16:43:00 -0500
From: "Martin McCormick" <martin.m@suddenlink.net>
To: questions@freebsd.org
Subject: Re: A FreeBSD-based Router
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-ID: <7238.1743889380.1@wb5agz.lan>
Content-Transfer-Encoding: 8bit
Date: Sat, 05 Apr 2025 16:43:00 -0500
Message-Id: <E1u1BI4-0001sm-1R@wb5agz>
X-Spamd-Result: default: False [0.90 / 15.00];
	ABUSE_FROM_INJECTOR(2.00)[];
	DWL_DNSWL_LOW(-1.00)[suddenlink.net:dkim];
	FAKE_REPLY(1.00)[];
	NEURAL_HAM_SHORT(-0.99)[-0.986];
	NEURAL_HAM_MEDIUM(-0.90)[-0.896];
	MID_RHS_NOT_FQDN(0.50)[];
	RBL_SENDERSCORE_REPUT_7(0.50)[65.20.63.159:from];
	NEURAL_HAM_LONG(-0.22)[-0.220];
	BAD_REP_POLICIES(0.10)[];
	MIME_GOOD(-0.10)[text/plain];
	ARC_NA(0.00)[];
	TO_MATCH_ENVRCPT_ALL(0.00)[];
	R_DKIM_ALLOW(0.00)[suddenlink.net:s=dkim-001];
	RCVD_TLS_LAST(0.00)[];
	SUSPICIOUS_AUTH_ORIGIN(0.00)[];
	RCPT_COUNT_ONE(0.00)[1];
	DMARC_POLICY_ALLOW(0.00)[suddenlink.net,none];
	FROM_HAS_DN(0.00)[];
	MIME_TRACE(0.00)[0:+];
	TO_DN_NONE(0.00)[];
	RCVD_COUNT_TWO(0.00)[2];
	FROM_EQ_ENVFROM(0.00)[];
	DKIM_TRACE(0.00)[suddenlink.net:+];
	HAS_XOIP(0.00)[];
	R_SPF_ALLOW(0.00)[+ip4:65.20.63.0/24];
	MLMMJ_DEST(0.00)[questions@freebsd.org];
	MISSING_XM_UA(0.00)[];
	ASN(0.00)[asn:31898, ipnet:65.20.63.0/24, country:US];
	RCVD_IN_DNSWL_NONE(0.00)[65.20.63.159:from]
X-Rspamd-Queue-Id: 4ZVTVM3sB8z3NHq
X-Spamd-Bar: /

Thanks to everyone who has replied.  This is the sort of
information I was hoping for and the idea of an appliance-like
approach is attractive.  I am an amateur radio operator and some
of the gear we use consists of Raspberry Pi's and so-called
top-hats which are circuit boards that run software written for
the application such as a hotspot or a hotspot that converts one
digital voice protocol in to another but one can run in to
trouble with perfectly good new equipment in which somebody buys
or tries to use a Raspberry Pi of the wrong hardware revision or
some other esoteric detail like that and ends up with a lot of
nothing after wasting a huge amount of time and resources/money
making this discovery.

	Maybe I am a bit lazy, but I feel better about getting
something like the distributions you describe, here because I am
not interested in reinventing the wheel, just getting one that is
more comfortable to use and probably has more up-to-date security
features as well.

	Some years ago, I saw a log of an attack directed at one
of the computers where I worked and the intruder knew just what
to send to the login process and he was in in the blink of an eye
with a root kit.  All he did was setup an IRC chat on that system
and he was discovered almost immediately but we were just lucky
that time.

	I run fail2ban on my out-facing Linux box and it is
amazing to see traffic from all over the world mostly using
scripts trying to gnaw their way in as root or test or something
similar and, fortunately, not getting in but it's just a reminder
that the morons really are out there, pounding away from
somewhere on Earth 24/7.

	Anyway, thanks again.

Martin

Juan Manuel Palacios <jmpalacios@gmail.com> writes:
> Other than talking about the appropriate hardware for the task at hand, I 
> find it rather odd that no one has yet mentioned either the pfSense or 
> OPNsense distributions. They’re both router-oriented, FreeBSD-based, 
> web-administered, text-based-managed, and, above all, extremely versatile.
> 
> Mind you, I’m not talking to any degree against rolling out raw FreeBSD 
> plus packages plus some orchestration solution to manage changes, I 
> absolutely love that approach. But if what you want is a turn-key, 
> ready-made solution to provide router-related functionality to your home 
> network, then either of those two more than fit the bill.
> 
> I’ve been running pfSense here at home for the last… what, 6 years 
> already? And it’s been rock solid! And on that router I run a DCHP 
> server, DHCP6, radvd, unbound, HAProxy with a few ACME certificates, 
> OpenVPN, a whole bunch of VLANs, plus of course pf with a bunch of rules 
> for each of those VLANs, and probably other things I might be forgetting.
> 
> Furthermore, that pfSense router runs in a VM, sitting atop a Supermicro 
> MOBO & a not super powerful Intel CPU, leveraging PCI passthrough for 
> three NICs, and sometimes I just get bored at having almost nothing to 
> worry about because it just works 24/7/365 without skipping a bit.
> 
> Again, other than discussing what would be the appropriate hardware for 
> your setup, an appliance-like solution like that is definitely what I’d 
> recommend.
> 
> HTH!

From nobody Sat Apr  5 23:22:14 2025
X-Original-To: freebsd-questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZVWj10Ykbz5sVnJ
	for <freebsd-questions@mlmmj.nyi.freebsd.org>; Sat, 05 Apr 2025 23:22:29 +0000 (UTC)
	(envelope-from paulbeard@gmail.com)
Received: from mail-ed1-x534.google.com (mail-ed1-x534.google.com [IPv6:2a00:1450:4864:20::534])
	(using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)
	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "smtp.gmail.com", Issuer "WR4" (verified OK))
	by mx1.freebsd.org (Postfix) with ESMTPS id 4ZVWj00LzPz3hH0
	for <freebsd-questions@freebsd.org>; Sat, 05 Apr 2025 23:22:28 +0000 (UTC)
	(envelope-from paulbeard@gmail.com)
Authentication-Results: mx1.freebsd.org;
	dkim=pass header.d=gmail.com header.s=20230601 header.b=N+7cAnV7;
	dmarc=pass (policy=none) header.from=gmail.com;
	spf=pass (mx1.freebsd.org: domain of paulbeard@gmail.com designates 2a00:1450:4864:20::534 as permitted sender) smtp.mailfrom=paulbeard@gmail.com
Received: by mail-ed1-x534.google.com with SMTP id 4fb4d7f45d1cf-5e60cfef9cfso5157444a12.2
        for <freebsd-questions@freebsd.org>; Sat, 05 Apr 2025 16:22:28 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20230601; t=1743895346; x=1744500146; darn=freebsd.org;
        h=to:subject:message-id:date:from:in-reply-to:references:mime-version
         :from:to:cc:subject:date:message-id:reply-to;
        bh=EwaYIbaxQ+l5Za6jgA+GpkPdxcuZdtiaSgEwZNK3rrY=;
        b=N+7cAnV76WirqChFbDpDn4Tnwug7rjoHCF1iK/Lg80r65h6rXEJnV8m76M/BGTG4f4
         rn0owhtjIrQxKhiC/uG6dUovF0bcNfJix75JHstlg1UB1Jw8Fvls2RbL5fZX+mE+KW72
         6WOvOKrywN3FrmP7pMHiQDpzt0Fg/FvNy7UrEMR2TvT1L/+6bJtd57UoCon3HZ3y2dBh
         adgGq37JpRBmx3iHe8bZ6bVt987i7/B3Klgg2VfiLFEVISKkZAn2fx7VAiwW+CC/rlvm
         ehtcKg1SQYOTBixuAvqUYMYkcNABaLJRfm+v8UeL2ReRnD1R2eLc3R/S77uSJpgaO1YP
         49UQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20230601; t=1743895346; x=1744500146;
        h=to:subject:message-id:date:from:in-reply-to:references:mime-version
         :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
        bh=EwaYIbaxQ+l5Za6jgA+GpkPdxcuZdtiaSgEwZNK3rrY=;
        b=P0yPhRgmF3a0GlpvrdFQFeyH/NzDpy0igDWpmXIMRrn7t7IXclZxOJswAYgRd+OxmV
         EgabU2k7LYw2xRfE4PWGg+n4k5l45p+zabMdo4Aomtgj65LcOPj3QhK4J8qTJO9/6yMq
         He0Lkv4otdwQMPqP2BneEYhF9H7Cu6ApUX5STCUQCGmbsjjVxtlJptKsDMbKEJrZO/YD
         Oyu2EHxz07pdTbn/q7yUQMoWoC7/ZUCVw6TO7Fms+Rdw7NFjSP92+Y/59CAkYUOvh8LX
         8kWmyuaOAUEDxMvIwgY1ezqqpE+3Ay5QToNUnqoAlIQ6VJm1gTwWlY1xVIuTh2ez2tXD
         LNdA==
X-Gm-Message-State: AOJu0YwgE7hOVRzeOM53dORdgHAV7K+onU3AeYJNqvBvgs+6hA5Sb1c3
	vKrrHpIqPPyHSG1wXJt05o+8wH0REFIgwf2CCXjLgABRtSgKfoqUG4zMMxNUiPHIFDxDkDPyQ8B
	1rLdN+4J4luZVhhaMmcoOl8gsDoeUFYgi
X-Gm-Gg: ASbGncugFMPaq7UkIFPACxQzVVfi3oaNZmIag20f1MpXhK/J+Y0LIJlGlVAx2KWzIqg
	qmYZqZIqcPKu3yp2Bxj0ARRNLBDmx79kdgffJj26RMag/sUeMKtvFMGgmIpaf5YGEOFNd6IR755
	4tCbTIbsZopXA0K0rU7RAnry7xq2Y=
X-Google-Smtp-Source: AGHT+IFZBQPIQuJ8e7LFNRELHepKCw+Dq2s6GQ3NKpywTSif2yK21grU/VMtueAii8/LfW9df3SNI2f5jvEaFj4Fh2Q=
X-Received: by 2002:a17:906:6a14:b0:ac3:3f84:4055 with SMTP id
 a640c23a62f3a-ac7e71702ddmr364468566b.4.1743895346065; Sat, 05 Apr 2025
 16:22:26 -0700 (PDT)
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
MIME-Version: 1.0
References: <E1u1BI4-0001sm-1R@wb5agz>
In-Reply-To: <E1u1BI4-0001sm-1R@wb5agz>
From: paul beard <paulbeard@gmail.com>
Date: Sat, 5 Apr 2025 16:22:14 -0700
X-Gm-Features: ATxdqUGfjqHmw8gOTC4cZqVC9zP-g-MUb05OaY0ZAohilv_mtTtxmM5o47S5le8
Message-ID: <CAMtcK2rWZ3_rwbF8PxqgpwBm2pTKLJ_bqKpJuvubOUqvowTbrA@mail.gmail.com>
Subject: Re: A FreeBSD-based Router
To: FreeBSD-questions <freebsd-questions@freebsd.org>
Content-Type: multipart/alternative; boundary="000000000000a0bde4063210467b"
X-Spamd-Result: default: False [-3.91 / 15.00];
	NEURAL_HAM_LONG(-1.00)[-0.999];
	NEURAL_HAM_MEDIUM(-0.99)[-0.991];
	NEURAL_HAM_SHORT(-0.92)[-0.917];
	DMARC_POLICY_ALLOW(-0.50)[gmail.com,none];
	R_DKIM_ALLOW(-0.20)[gmail.com:s=20230601];
	R_SPF_ALLOW(-0.20)[+ip6:2a00:1450:4000::/36:c];
	MIME_GOOD(-0.10)[multipart/alternative,text/plain];
	TO_DN_ALL(0.00)[];
	RCVD_TLS_LAST(0.00)[];
	RCPT_COUNT_ONE(0.00)[1];
	FROM_HAS_DN(0.00)[];
	MIME_TRACE(0.00)[0:+,1:+,2:~];
	ARC_NA(0.00)[];
	FREEMAIL_ENVFROM(0.00)[gmail.com];
	FREEMAIL_FROM(0.00)[gmail.com];
	TO_MATCH_ENVRCPT_ALL(0.00)[];
	MISSING_XM_UA(0.00)[];
	DWL_DNSWL_NONE(0.00)[gmail.com:dkim];
	PREVIOUSLY_DELIVERED(0.00)[freebsd-questions@freebsd.org];
	FROM_EQ_ENVFROM(0.00)[];
	DKIM_TRACE(0.00)[gmail.com:+];
	MID_RHS_MATCH_FROMTLD(0.00)[];
	ASN(0.00)[asn:15169, ipnet:2a00:1450::/32, country:US];
	MLMMJ_DEST(0.00)[freebsd-questions@freebsd.org];
	RCVD_COUNT_ONE(0.00)[1];
	RCVD_IN_DNSWL_NONE(0.00)[2a00:1450:4864:20::534:from]
X-Rspamd-Queue-Id: 4ZVWj00LzPz3hH0
X-Spamd-Bar: ---

--000000000000a0bde4063210467b
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Far be it from me to discourage tinkering but there are a lot of routers
that support FOSS firmware. You can even buy them flashed to some of the
flavors of OpenWRT. I run an ASUS unit that I chose specifically because it
supported open firmware. Mine is updated 4/5 times a year so there is
active development as well.

On Sat, Apr 5, 2025 at 2:44=E2=80=AFPM Martin McCormick <martin.m@suddenlin=
k.net>
wrote:

> Thanks to everyone who has replied.  This is the sort of
> information I was hoping for and the idea of an appliance-like
> approach is attractive.  I am an amateur radio operator and some
> of the gear we use consists of Raspberry Pi's and so-called
> top-hats which are circuit boards that run software written for
> the application such as a hotspot or a hotspot that converts one
> digital voice protocol in to another but one can run in to
> trouble with perfectly good new equipment in which somebody buys
> or tries to use a Raspberry Pi of the wrong hardware revision or
> some other esoteric detail like that and ends up with a lot of
> nothing after wasting a huge amount of time and resources/money
> making this discovery.
>
>         Maybe I am a bit lazy, but I feel better about getting
> something like the distributions you describe, here because I am
> not interested in reinventing the wheel, just getting one that is
> more comfortable to use and probably has more up-to-date security
> features as well.
>
>         Some years ago, I saw a log of an attack directed at one
> of the computers where I worked and the intruder knew just what
> to send to the login process and he was in in the blink of an eye
> with a root kit.  All he did was setup an IRC chat on that system
> and he was discovered almost immediately but we were just lucky
> that time.
>
>         I run fail2ban on my out-facing Linux box and it is
> amazing to see traffic from all over the world mostly using
> scripts trying to gnaw their way in as root or test or something
> similar and, fortunately, not getting in but it's just a reminder
> that the morons really are out there, pounding away from
> somewhere on Earth 24/7.
>
>         Anyway, thanks again.
>
> Martin
>
> Juan Manuel Palacios <jmpalacios@gmail.com> writes:
> > Other than talking about the appropriate hardware for the task at hand,
> I
> > find it rather odd that no one has yet mentioned either the pfSense or
> > OPNsense distributions. They=E2=80=99re both router-oriented, FreeBSD-b=
ased,
> > web-administered, text-based-managed, and, above all, extremely
> versatile.
> >
> > Mind you, I=E2=80=99m not talking to any degree against rolling out raw=
 FreeBSD
> > plus packages plus some orchestration solution to manage changes, I
> > absolutely love that approach. But if what you want is a turn-key,
> > ready-made solution to provide router-related functionality to your hom=
e
> > network, then either of those two more than fit the bill.
> >
> > I=E2=80=99ve been running pfSense here at home for the last=E2=80=A6 wh=
at, 6 years
> > already? And it=E2=80=99s been rock solid! And on that router I run a D=
CHP
> > server, DHCP6, radvd, unbound, HAProxy with a few ACME certificates,
> > OpenVPN, a whole bunch of VLANs, plus of course pf with a bunch of rule=
s
> > for each of those VLANs, and probably other things I might be forgettin=
g.
> >
> > Furthermore, that pfSense router runs in a VM, sitting atop a Supermicr=
o
> > MOBO & a not super powerful Intel CPU, leveraging PCI passthrough for
> > three NICs, and sometimes I just get bored at having almost nothing to
> > worry about because it just works 24/7/365 without skipping a bit.
> >
> > Again, other than discussing what would be the appropriate hardware for
> > your setup, an appliance-like solution like that is definitely what I=
=E2=80=99d
> > recommend.
> >
> > HTH!
>
>

--=20
Paul Beard / www.paulbeard.org/

--000000000000a0bde4063210467b
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Far be it from me to discourage tinkering but there are a =
lot of routers that support FOSS firmware. You can even buy them flashed to=
 some of the flavors of OpenWRT. I run an ASUS unit that I chose specifical=
ly=C2=A0because=C2=A0it supported open firmware. Mine is updated 4/5 times =
a year so there is active=C2=A0development as well.=C2=A0</div><br><div cla=
ss=3D"gmail_quote gmail_quote_container"><div dir=3D"ltr" class=3D"gmail_at=
tr">On Sat, Apr 5, 2025 at 2:44=E2=80=AFPM Martin McCormick &lt;<a href=3D"=
mailto:martin.m@suddenlink.net">martin.m@suddenlink.net</a>&gt; wrote:<br><=
/div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;bo=
rder-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,2=
04);padding-left:1ex">Thanks to everyone who has replied.=C2=A0 This is the=
 sort of<br>
information I was hoping for and the idea of an appliance-like<br>
approach is attractive.=C2=A0 I am an amateur radio operator and some<br>
of the gear we use consists of Raspberry Pi&#39;s and so-called<br>
top-hats which are circuit boards that run software written for<br>
the application such as a hotspot or a hotspot that converts one<br>
digital voice protocol in to another but one can run in to<br>
trouble with perfectly good new equipment in which somebody buys<br>
or tries to use a Raspberry Pi of the wrong hardware revision or<br>
some other esoteric detail like that and ends up with a lot of<br>
nothing after wasting a huge amount of time and resources/money<br>
making this discovery.<br>
<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Maybe I am a bit lazy, but I feel better about =
getting<br>
something like the distributions you describe, here because I am<br>
not interested in reinventing the wheel, just getting one that is<br>
more comfortable to use and probably has more up-to-date security<br>
features as well.<br>
<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Some years ago, I saw a log of an attack direct=
ed at one<br>
of the computers where I worked and the intruder knew just what<br>
to send to the login process and he was in in the blink of an eye<br>
with a root kit.=C2=A0 All he did was setup an IRC chat on that system<br>
and he was discovered almost immediately but we were just lucky<br>
that time.<br>
<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 I run fail2ban on my out-facing Linux box and i=
t is<br>
amazing to see traffic from all over the world mostly using<br>
scripts trying to gnaw their way in as root or test or something<br>
similar and, fortunately, not getting in but it&#39;s just a reminder<br>
that the morons really are out there, pounding away from<br>
somewhere on Earth 24/7.<br>
<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Anyway, thanks again.<br>
<br>
Martin<br>
<br>
Juan Manuel Palacios &lt;<a href=3D"mailto:jmpalacios@gmail.com" target=3D"=
_blank">jmpalacios@gmail.com</a>&gt; writes:<br>
&gt; Other than talking about the appropriate hardware for the task at hand=
, I <br>
&gt; find it rather odd that no one has yet mentioned either the pfSense or=
 <br>
&gt; OPNsense distributions. They=E2=80=99re both router-oriented, FreeBSD-=
based, <br>
&gt; web-administered, text-based-managed, and, above all, extremely versat=
ile.<br>
&gt; <br>
&gt; Mind you, I=E2=80=99m not talking to any degree against rolling out ra=
w FreeBSD <br>
&gt; plus packages plus some orchestration solution to manage changes, I <b=
r>
&gt; absolutely love that approach. But if what you want is a turn-key, <br=
>
&gt; ready-made solution to provide router-related functionality to your ho=
me <br>
&gt; network, then either of those two more than fit the bill.<br>
&gt; <br>
&gt; I=E2=80=99ve been running pfSense here at home for the last=E2=80=A6 w=
hat, 6 years <br>
&gt; already? And it=E2=80=99s been rock solid! And on that router I run a =
DCHP <br>
&gt; server, DHCP6, radvd, unbound, HAProxy with a few ACME certificates, <=
br>
&gt; OpenVPN, a whole bunch of VLANs, plus of course pf with a bunch of rul=
es <br>
&gt; for each of those VLANs, and probably other things I might be forgetti=
ng.<br>
&gt; <br>
&gt; Furthermore, that pfSense router runs in a VM, sitting atop a Supermic=
ro <br>
&gt; MOBO &amp; a not super powerful Intel CPU, leveraging PCI passthrough =
for <br>
&gt; three NICs, and sometimes I just get bored at having almost nothing to=
 <br>
&gt; worry about because it just works 24/7/365 without skipping a bit.<br>
&gt; <br>
&gt; Again, other than discussing what would be the appropriate hardware fo=
r <br>
&gt; your setup, an appliance-like solution like that is definitely what I=
=E2=80=99d <br>
&gt; recommend.<br>
&gt; <br>
&gt; HTH!<br>
<br>
</blockquote></div><div><br clear=3D"all"></div><div><br></div><span class=
=3D"gmail_signature_prefix">-- </span><br><div dir=3D"ltr" class=3D"gmail_s=
ignature">Paul Beard / <a href=3D"http://www.paulbeard.org/" target=3D"_bla=
nk">www.paulbeard.org/</a><br></div>

--000000000000a0bde4063210467b--

From nobody Sat Apr  5 23:40:59 2025
X-Original-To: questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZVX6h2yqnz5sXC3
	for <questions@mlmmj.nyi.freebsd.org>; Sat, 05 Apr 2025 23:41:16 +0000 (UTC)
	(envelope-from dpchrist@holgerdanske.com)
Received: from holgerdanske.com (holgerdanske.com [184.105.128.27])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange ECDHE (prime256v1) server-signature RSA-PSS (4096 bits) server-digest SHA256
	 client-signature RSA-PSS (4096 bits) client-digest SHA256)
	(Client CN "holgerdanske.com", Issuer "R10" (verified OK))
	by mx1.freebsd.org (Postfix) with ESMTPS id 4ZVX6f6qnHz3ldG
	for <questions@freebsd.org>; Sat, 05 Apr 2025 23:41:14 +0000 (UTC)
	(envelope-from dpchrist@holgerdanske.com)
Authentication-Results: mx1.freebsd.org;
	dkim=pass header.d=holgerdanske.com header.s=nov-20210719-112354 header.b=iW5watua;
	dmarc=pass (policy=none) header.from=holgerdanske.com;
	spf=pass (mx1.freebsd.org: domain of dpchrist@holgerdanske.com designates 184.105.128.27 as permitted sender) smtp.mailfrom=dpchrist@holgerdanske.com
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=holgerdanske.com;
	s=nov-20210719-112354; t=1743896468;
	bh=w8+uE9UZ4Jp2DcVmtZTFRVDwgs6Zq4TEK10A4OlowfM=;
	h=Received:Message-ID:Date:MIME-Version:User-Agent:Subject:To:
	 References:Content-Language:From:In-Reply-To:Content-Type:
	 Content-Transfer-Encoding;
	b=iW5watuaov7t5BXeEsynR0oePjPpiO+/Fi5NOsDm1HyQc/BfJ6JqAxpzJ8O4i3pb3
	 9u4yiq5GHgmweKrvXr1Hc3lmY3e8Mc5lZ0TXRUDQag46jszgFHv8gWLHfThBpvjpYY
	 O/cnXgvlVM/NtCsCu4lS7lI96K0+oH0fb07dPZUI7FnXqO5uEdxLoxj0RV8hXhKZUn
	 XdNJOyzzzcNnF9O1aj9eqa4fLOgLjEUjvv2FsYIkiTDhrWviPTR2bqliYz1rgGz7JT
	 Ctiq3+Xj8zFJfZAjHXOIL1QRfRHb/RUlpezfVKYVQzCvJDIg5lO87c28Wyrcxh6+FL
	 stGlIFf6lo6jn2Gg3pYdhFp8oiUVh3onkGCQH4bbvOGEN/D0WzSsDeFZXUgU/S81bT
	 IV1Fjsvy6Nm5bb56lIYXU5XtW4zOXNOnUb0cbb/XC33qLG/l3b5c4DY8XctIz3osWP
	 X0Ig3JijyTsvpUASpHmWPZzsA8Bssvj9ORLJPm5c8qoQZbR/LHXkQ/zsdupsuN2P5H
	 7s7TL1Ia7MLrav0Tqq4zWgo8/F2UuZpRIbwdc8o+ssqAZwdMjQnfnfElIeRf6wvKKl
	 nFpg+WuaHiBNm8PBiQLSJR1/wzkHny4N6Z2jLkehEcqWMuOez7pM5UyXAxGGHA16a1
	 tqekF+4rz1hwUWjKLEP5fPv0=
Received: from 99.100.19.101 (99-100-19-101.lightspeed.frokca.sbcglobal.net [99.100.19.101])
	by holgerdanske.com with ESMTPSA (TLS_AES_128_GCM_SHA256:TLSv1.3:Kx=any:Au=any:Enc=AESGCM(128):Mac=AEAD) (SMTP-AUTH username dpchrist@holgerdanske.com, mechanism PLAIN)
	for <questions@freebsd.org>; Sat, 5 Apr 2025 16:41:08 -0700
Message-ID: <e692e82f-a3c9-48d1-b1da-119664a629fb@holgerdanske.com>
Date: Sat, 5 Apr 2025 16:40:59 -0700
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: A FreeBSD-based Router
To: questions@freebsd.org
References: <E1u17qJ-000CWa-1L@wb5agz>
Content-Language: en-US
From: David Christensen <dpchrist@holgerdanske.com>
In-Reply-To: <E1u17qJ-000CWa-1L@wb5agz>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
X-Spamd-Result: default: False [-2.05 / 15.00];
	NEURAL_HAM_LONG(-1.00)[-0.999];
	NEURAL_HAM_MEDIUM(-0.89)[-0.893];
	NEURAL_SPAM_SHORT(0.65)[0.647];
	DMARC_POLICY_ALLOW(-0.50)[holgerdanske.com,none];
	ONCE_RECEIVED(0.20)[];
	R_SPF_ALLOW(-0.20)[+a];
	R_DKIM_ALLOW(-0.20)[holgerdanske.com:s=nov-20210719-112354];
	MIME_GOOD(-0.10)[text/plain];
	RCVD_VIA_SMTP_AUTH(0.00)[];
	ASN(0.00)[asn:6939, ipnet:184.104.0.0/15, country:US];
	RCVD_COUNT_ONE(0.00)[1];
	RCPT_COUNT_ONE(0.00)[1];
	MIME_TRACE(0.00)[0:+];
	RCVD_TLS_ALL(0.00)[];
	MLMMJ_DEST(0.00)[questions@freebsd.org];
	ARC_NA(0.00)[];
	FROM_EQ_ENVFROM(0.00)[];
	FROM_HAS_DN(0.00)[];
	MID_RHS_MATCH_FROM(0.00)[];
	TO_DN_NONE(0.00)[];
	PREVIOUSLY_DELIVERED(0.00)[questions@freebsd.org];
	TO_MATCH_ENVRCPT_ALL(0.00)[];
	DKIM_TRACE(0.00)[holgerdanske.com:+]
X-Rspamd-Queue-Id: 4ZVX6f6qnHz3ldG
X-Spamd-Bar: --

On 4/5/25 11:02, Martin McCormick wrote:
> We have been using a Netgear wndr3400v2 router since February of
> 2013 and it is probably time to take advantage of newer
> technology especially since there have been no new software updates for
> it in years.  It also has a web GUI interface that must have, at
> one time, worked for somebody, but nobody here because I have
> thrown every browser at it I can get my hands on and the best way
> to describe it is that each browser does okay with some web pages
> on it but not others and anything related to passwords or the
> changing there of seems to always make the most destructive
> changes but never any beneficial adjustments so one doesn't
> really know what got changed until later when this or that
> function no longer works.
> 
> 	If I do the factory default reset, that will certainly
> set things back to originals while also deleting the dhcp table
> so I don't really want to do that.
> 
> 	What I really want is a modern router with a command-line
> method of control which allows for good old text-base
> configuration files for changing router settings as well as the
> dhcpd server which it would also be running.
> 
> 	My idea is to load a mini PC with FreeBSD and a router
> engine which means that the mini PC would need to have at least 2 NICS.
> 
> 	Is there any particular mini PC  with a good track record
> on running FreeBSD?  I just put our Netgear router on a UPS so
> that the occasional power glitches aren't as easily passed
> through to our home network and hopefully a mini PC would not run
> the UPS battery down as quickly as a full-sized work station
> might.
> 
> 	Before I retired in 2015, I ran the FreeBSD-based bind
> name servers along with ISC Dhcpd for my employer and we had
> virtually no issues at all with that particular scheme so that's
> why I want to use FreeBSD in our house for this purpose even
> though I use debian Linux for most hobby activities so I can say
> good things about both unixen (I believe that is a correct form
> of speech.)
> 
> 	Our router is still working, knock on wood, but we
> recently had issues with our ISP that so choked the router that I
> thought it had crashed only to find out that it came back to life
> when whatever traffic the ISC was throwing on to their system
> went away and things got back to what passes for normal.
> 
> 	The FreeBSD/dhcp environment we had for over 20 years was
> run on Dell servers and we had one FreeBSD box that ran continuously
> without a reboot for over a year so I know FreeBSD gets things
> done.
> 
> 	Thanks for any suggestions.
> 
> Martin McCormick


Network engineering in the age of the Internet is a never-ending 
learning curve with potentially disastrous consequences if it is done 
incorrectly (including not keeping it up-to-date).


I have a SOHO network with a file server, various client devices, and 
residential Internet service.  I want a safe and reliable network, but 
am not a network engineer.


Back in the day, I started with a homebrew dial-up firewall router using 
a desktop PC, dual NIC's, and Red Hat Linux.  It was a useful learning 
exercise.  Later, I tried purpose-built FOSS distributions.  pfSense was 
too powerful and complex for my needs.  IPCop was a good fit and I used 
it for years.  But, the PC was bulky, made noise, produced heat, and 
consumed power.  Compact energy-efficient PC's have always come at a 
premium price.  I tried a few Netgear products, but also had problems 
with the web user interface (WUI).  More importantly, the devices tended 
to crash every few months; especially in summer.  FOSS firmware (DD-WRT) 
helped with the WUI, but I bricked at least one device attempting to 
upgrade.  When I added a Wi-Fi access point (AP), I soon discovery the 
hassle of trying to keep configuration settings synchronized across 
multiple network devices.


Then I discovered Ubiquitti Networks and their UniFi lineup of products. 
  The killer feature is the UniFi Network Application -- centralized 
high-level network command and control with one WUI to "rule them all". 
I bought a UniFi Security Gateway, a UniFi AP AC-Lite, rented a Linode 
VPS, installed Debian and the UniFi Network Application (via a Linode 
StackScript), configured everything, and have been up and running 24x7 
ever since.  The UniFi Network Application WUI has evolved over the 
years, but has always been very polished.  Upgrades have been 
uneventful.  Backup is achieved by downloading a configuration file. 
Restore is achieved by uploading a configuration file.  I easily added 
incoming firewall pinholes and forwarding rules to allow remote SSH 
access from the Internet.  At one point, I set up a VPN to allow remote 
Samba access from the Internet.  I easily added two more AP's to my LAN. 
  Technical support was excellent when I needed it.  UniFi devices are 
Linux on the inside, so I can look; but I dare not touch.


David


From nobody Sat Apr  5 23:44:33 2025
X-Original-To: questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZVXBm6W84z5sXPP
	for <questions@mlmmj.nyi.freebsd.org>; Sat, 05 Apr 2025 23:44:48 +0000 (UTC)
	(envelope-from jmpalacios@gmail.com)
Received: from mail-qv1-xf35.google.com (mail-qv1-xf35.google.com [IPv6:2607:f8b0:4864:20::f35])
	(using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)
	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "smtp.gmail.com", Issuer "WR4" (verified OK))
	by mx1.freebsd.org (Postfix) with ESMTPS id 4ZVXBl524Gz3p7s
	for <questions@freebsd.org>; Sat, 05 Apr 2025 23:44:47 +0000 (UTC)
	(envelope-from jmpalacios@gmail.com)
Authentication-Results: mx1.freebsd.org;
	dkim=pass header.d=gmail.com header.s=20230601 header.b=jc3J9n4h;
	dmarc=pass (policy=none) header.from=gmail.com;
	spf=pass (mx1.freebsd.org: domain of jmpalacios@gmail.com designates 2607:f8b0:4864:20::f35 as permitted sender) smtp.mailfrom=jmpalacios@gmail.com
Received: by mail-qv1-xf35.google.com with SMTP id 6a1803df08f44-6e8f8657f29so26151496d6.3
        for <questions@freebsd.org>; Sat, 05 Apr 2025 16:44:47 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20230601; t=1743896686; x=1744501486; darn=freebsd.org;
        h=to:references:message-id:content-transfer-encoding:cc:date
         :in-reply-to:from:subject:mime-version:from:to:cc:subject:date
         :message-id:reply-to;
        bh=bRfP/swnvlNLm6JLwVBQWhQsg9S9Fnaqu86rgv+JNsc=;
        b=jc3J9n4h2lVv/FHG0LPUMviabfGhr7+CjUJGWAzVJVfNRdjybGTD3NErl3zHJmenDI
         r+QF4JDzReHYlSTi5ekUOLi6B/LCjNGcZEvSPOV0L+DY9nkL0hZV3tYYB8D8uolbDqHD
         HBPmugA2Uaw5jQdtfGN9ugz68H9+qwj4mTVpt8UtqWLJiBPwv2qdr8M9NKo53eiY88as
         Pv9r8OcXtT7Wnxj305sx8H1YKTPageObKvz/A5Zt/Ep3D0RorAp1dzVXgAkS+6g+VbwP
         THA5JptApC4323UNS9wXB7QDiERXvXDpPhFgu4nPK+AjY+Wqs/B+tj7undEwjuSrWsIo
         0N9A==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20230601; t=1743896686; x=1744501486;
        h=to:references:message-id:content-transfer-encoding:cc:date
         :in-reply-to:from:subject:mime-version:x-gm-message-state:from:to:cc
         :subject:date:message-id:reply-to;
        bh=bRfP/swnvlNLm6JLwVBQWhQsg9S9Fnaqu86rgv+JNsc=;
        b=HwqoioWt6L9b6Klt/GYF7mVhD0xZF86xwl5w6s9h5QnHnLDamxT1gcdAEpLlGl0t59
         q89rOPzjpvLloeOV8m0sSCR3KyCw1haMxzSXAbcX0RLB53hcfv9Z2bpk02yqif4/XUKn
         dIEcd6VeHwc5kWEm2R7Uh+Fhw4b669FkMq/wZ/GVpT9xd1MWDKR9vmD5Y2oq+pso4Lwj
         N3/zFrgO0Z2eVk8BEZZhCbQ+FuQmNnsWGFnlZZQKkMFi8AXsIEnuM3Vl4OQUwiSqLD6k
         4Kwig6BF8+7F7nBjrsrwUdy1BP/EjE70FowfhMamBfSJumuyDzUruGRIPpRXQmEkCEkH
         DJ2w==
X-Gm-Message-State: AOJu0YyoP5TLC0eI8/Cc3FuZCawtHSu6faeh3m+4DMEpFllfa3XBnWTc
	+rc0hRQGY3lbhk8Xsh1ERZPKMBacXDvtEhKpzJbVQomaLeIFu6Sb
X-Gm-Gg: ASbGncvuehHSyFEhh8DItNgD1aUGMqn66jc4qSJ4GpvkeRRrAFXrHh7IDOBs6i734Pg
	LulY0c3JDRanLZldAoHvHqm1MzBsaNYdAcBlhE/WMKx3A4lKFqeOOq+NMe2GVOgCwdXkyxhPH1f
	lGXKS2HH4Bat+FxDltClONet/WXAc+cXU8tS6/i3CG8japsUsUWQWbkWs6AlzgYNXsWAahk3kt0
	GyOl6SsSSsfFnM89ZP7O3V570Ni20hS+Mg07MkKWpdb20cpcOkuFXXWhoEf/1Xumv07qpqx+R/Y
	Ub4jquM6zDAZ2PmfVN5CL1Ih+i+2C9CmkUckcGikwShgHXF15hhbqffcc5uln24nQXJBXI+qsA=
	=
X-Google-Smtp-Source: AGHT+IEGCKij1IAjhNQj+k8tij0u/zqYWQcwrbOXhJNg+RkNlOPzLC0o4fFtEd54V0VJ5RNmuAjDNw==
X-Received: by 2002:a05:6214:224c:b0:6d8:b115:76a6 with SMTP id 6a1803df08f44-6f00214dc36mr136386196d6.0.1743896685654;
        Sat, 05 Apr 2025 16:44:45 -0700 (PDT)
Received: from smtpclient.apple ([2600:4041:7970:8b10:d048:3743:d011:4dfb])
        by smtp.gmail.com with ESMTPSA id 6a1803df08f44-6ef0f0480f4sm40000486d6.66.2025.04.05.16.44.43
        (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);
        Sat, 05 Apr 2025 16:44:44 -0700 (PDT)
Content-Type: text/plain;
	charset=utf-8
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3826.500.181.1.5\))
Subject: Re: A FreeBSD-based Router
From: Juan Manuel Palacios <jmpalacios@gmail.com>
In-Reply-To: <MN0PR84MB3024642C4C59EBA13E805390D3A82@MN0PR84MB3024.NAMPRD84.PROD.OUTLOOK.COM>
Date: Sat, 5 Apr 2025 19:44:33 -0400
Cc: "questions@freebsd.org" <questions@freebsd.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <EFD77E10-C668-47FC-8DEB-9A42BFF15522@gmail.com>
References: <B0B8BA53-2A43-4DF2-A837-DAD627B4C723@gmail.com>
 <MN0PR84MB3024642C4C59EBA13E805390D3A82@MN0PR84MB3024.NAMPRD84.PROD.OUTLOOK.COM>
To: John Howie <jhowie@msn.com>
X-Mailer: Apple Mail (2.3826.500.181.1.5)
X-Spamd-Result: default: False [-3.08 / 15.00];
	NEURAL_HAM_LONG(-1.00)[-1.000];
	NEURAL_HAM_MEDIUM(-1.00)[-0.996];
	NEURAL_HAM_SHORT(-0.58)[-0.584];
	MV_CASE(0.50)[];
	DMARC_POLICY_ALLOW(-0.50)[gmail.com,none];
	R_SPF_ALLOW(-0.20)[+ip6:2607:f8b0:4000::/36];
	R_DKIM_ALLOW(-0.20)[gmail.com:s=20230601];
	MIME_GOOD(-0.10)[text/plain];
	FREEMAIL_TO(0.00)[msn.com];
	RCPT_COUNT_TWO(0.00)[2];
	MIME_TRACE(0.00)[0:+];
	FREEMAIL_ENVFROM(0.00)[gmail.com];
	TO_DN_EQ_ADDR_SOME(0.00)[];
	TO_DN_SOME(0.00)[];
	FREEMAIL_FROM(0.00)[gmail.com];
	RCVD_TLS_LAST(0.00)[];
	ARC_NA(0.00)[];
	FROM_HAS_DN(0.00)[];
	DWL_DNSWL_NONE(0.00)[gmail.com:dkim];
	TO_MATCH_ENVRCPT_SOME(0.00)[];
	RCVD_COUNT_TWO(0.00)[2];
	FROM_EQ_ENVFROM(0.00)[];
	DKIM_TRACE(0.00)[gmail.com:+];
	PREVIOUSLY_DELIVERED(0.00)[questions@freebsd.org];
	MID_RHS_MATCH_FROM(0.00)[];
	MLMMJ_DEST(0.00)[questions@freebsd.org];
	ASN(0.00)[asn:15169, ipnet:2607:f8b0::/32, country:US];
	RCVD_VIA_SMTP_AUTH(0.00)[];
	RCVD_IN_DNSWL_NONE(0.00)[2607:f8b0:4864:20::f35:from]
X-Rspamd-Queue-Id: 4ZVXBl524Gz3p7s
X-Spamd-Bar: ---

Fully agree. A high-end processor will surely be a bit of a waste for a =
router/firewall, unless you=E2=80=99re moving around tons of traffic =
with tons of firewall rules, traffic shaping, VPNs, and intrusion =
detection; and, on the other hand, a low-end processor will simply not =
let you scale up if at first you=E2=80=99re not doing any of those =
things, but then you develop a need to.

One of the biggest benefits of running my router in a VM has been having =
the ability to almost magically tune its resources to its evolving =
responsibilities, affording me a simple reboot of the VM to adjust the =
amount of threads/cores/ram the underlying host allocates to it =
(provided, of course, the latter has to spare). The downside is of =
course putting too many eggs in one basket, resulting in the full loss =
of all my custom networking whenever the host needs to undergo any kind =
of maintenance. One strategy against the latter is gauging over some =
time what your hardware router should look like, then multiplying the =
resulting resources by some factor for scalability and growth purposes =
(e.g. four NICs instead of three, 4GiB of RAM instead of 2, 10Gbps =
instead of 1, etc.), and then fleshing it out to real hardware.

Regards,

> On Apr 5, 2025, at 5:39=E2=80=AFPM, John Howie <jhowie@msn.com> wrote:
>=20
> Hi Juan,
>=20
> Any cheap PC will do,  but I would stay away from those with low-end =
processors. No point buying one with a high-end processor either. You =
will never get the performance that you would have with a purpose-built =
router using special hardware.
>=20
> Best regards,
>=20
> John
>=20
> Sent from my iPhone
>=20
>> On Apr 5, 2025, at 12:09, Juan Manuel Palacios <jmpalacios@gmail.com> =
wrote:
>>=20
>> =EF=BB=BFOther than talking about the appropriate hardware for the =
task at hand, I find it rather odd that no one has yet mentioned either =
the pfSense or OPNsense distributions. They=E2=80=99re both =
router-oriented, FreeBSD-based, web-administered, text-based-managed, =
and, above all, extremely versatile.
>>=20
>> Mind you, I=E2=80=99m not talking to any degree against rolling out =
raw FreeBSD plus packages plus some orchestration solution to manage =
changes, I absolutely love that approach. But if what you want is a =
turn-key, ready-made solution to provide router-related functionality to =
your home network, then either of those two more than fit the bill.
>>=20
>> I=E2=80=99ve been running pfSense here at home for the last=E2=80=A6 =
what, 6 years already? And it=E2=80=99s been rock solid! And on that =
router I run a DCHP server, DHCP6, radvd, unbound, HAProxy with a few =
ACME certificates, OpenVPN, a whole bunch of VLANs, plus of course pf =
with a bunch of rules for each of those VLANs, and probably other things =
I might be forgetting.
>>=20
>> Furthermore, that pfSense router runs in a VM, sitting atop a =
Supermicro MOBO & a not super powerful Intel CPU, leveraging PCI =
passthrough for three NICs, and sometimes I just get bored at having =
almost nothing to worry about because it just works 24/7/365 without =
skipping a bit.
>>=20
>> Again, other than discussing what would be the appropriate hardware =
for your setup, an appliance-like solution like that is definitely what =
I=E2=80=99d recommend.
>>=20
>> HTH!
>>=20
>>> On Apr 5, 2025, at 2:47=E2=80=AFPM, Polarian <polarian@polarian.dev> =
wrote:
>>>=20
>>> Hello,
>>>=20
>>>> There are ARM based SBCs (smaller than a mini PC) purposely built
>>>> as routers ie. with multiple ethernet ports. Since FreeBSD can run
>>>> on ARM (in theory), I would look into those. Very low power :-)
>>>=20
>>> There is a limited number of supported ARM boards. [1] provides a =
list
>>> of them, but this page has not been updated in years so I am not too
>>> sure about the status of it, maybe ask the arm mailing list if you =
are
>>> interested in an ARM router?
>>>=20
>>> If you are willing to take some additional energy usage for =
modularity
>>> picking up old desktops such as optiplex's can provide you something
>>> which can be upgraded very easily. SFF Optiplex's despite being =
small
>>> (not as small as some of the arm options) can fit 1 or 2 network =
cards
>>> in it, which can have up to 4-6 ports on a single card giving you =
more
>>> than enough ports to make as many subnets as you like. Old desktops
>>> tend to be cheap on ebay too, along with order gigabit network =
cards,
>>> and the more beefy cpu gives you more than enough compute headroom =
for
>>> anything you can think of. It does come at a power cost though, =
which
>>> in the long run could be experience.
>>>=20
>>> You could also look at protectli [2] which provide minipc sized
>>> routers, however these come at a big cost, and will only save a =
small
>>> amount of energy using newer more efficient chips than old desktops,
>>> but they do pack a punch. I am not sure how well they support =
FreeBSD
>>> however.
>>>=20
>>> At the end of the day, you need to decide on how much performance =
you
>>> need. If you only need a few hundred mbps of throughput then a
>>> raspberry pi 4 with a usb NIC can provide you that performance for a
>>> very low power draw, and reasonable cost. If you want something
>>> performance which can do gigabit (or more in the future) then old
>>> desktops or protectli boards might be the better way to go.
>>>=20
>>> Take care,
>>> --
>>> Polarian
>>> GPG signature: 0770E5312238C760
>>> Jabber/XMPP: polarian@icebound.dev
>>>=20
>>> [1] https://www.freebsd.org/platforms/arm/
>>> [2] https://eu.protectli.com/
>>>=20
>>=20
>>=20


From nobody Sun Apr  6 03:37:50 2025
X-Original-To: questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZVdMk4Zc2z5sq9X
	for <questions@mlmmj.nyi.freebsd.org>; Sun, 06 Apr 2025 03:37:54 +0000 (UTC)
	(envelope-from fatty.merchandise677@aceecat.org)
Received: from beesty.loosely.org (beesty.loosely.org [IPv6:2600:3c01:e000:4c0::2])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256)
	(Client did not present a certificate)
	by mx1.freebsd.org (Postfix) with ESMTPS id 4ZVdMj0nJXz3ccM
	for <questions@freebsd.org>; Sun, 06 Apr 2025 03:37:52 +0000 (UTC)
	(envelope-from fatty.merchandise677@aceecat.org)
Authentication-Results: mx1.freebsd.org;
	dkim=none;
	dmarc=none;
	spf=pass (mx1.freebsd.org: domain of fatty.merchandise677@aceecat.org designates 2600:3c01:e000:4c0::2 as permitted sender) smtp.mailfrom=fatty.merchandise677@aceecat.org
Received: from localhost
	([::1] helo=beesty ident=itz)
	by beesty with esmtp (Exim 4.98.1-5-133ee3edc)
	(envelope-from <fatty.merchandise677@aceecat.org>)
	id 1u1GpS-000000004U2-2wUT
	for questions@freebsd.org;
	Sat, 05 Apr 2025 20:37:51 -0700
Date: Sat, 5 Apr 2025 20:37:50 -0700
From: fatty.merchandise677@aceecat.org
To: questions@freebsd.org
Subject: Re: A FreeBSD-based Router
Message-ID: <y49jMGFFwgBGvq4v@aceecat.org>
Mail-Followup-To: questions@freebsd.org
References: <E1u17qJ-000CWa-1L@wb5agz>
 <fwY8bqPs9FjbCbnL@aceecat.org>
 <20250405194701.6432e956@Hydrogen>
 <B0B8BA53-2A43-4DF2-A837-DAD627B4C723@gmail.com>
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <B0B8BA53-2A43-4DF2-A837-DAD627B4C723@gmail.com>
X-Spamd-Result: default: False [0.90 / 15.00];
	NEURAL_SPAM_LONG(1.00)[1.000];
	NEURAL_SPAM_MEDIUM(0.94)[0.945];
	NEURAL_HAM_SHORT(-0.94)[-0.941];
	ONCE_RECEIVED(0.20)[];
	R_SPF_ALLOW(-0.20)[+mx];
	MIME_GOOD(-0.10)[text/plain];
	RCPT_COUNT_ONE(0.00)[1];
	ARC_NA(0.00)[];
	MISSING_XM_UA(0.00)[];
	ASN(0.00)[asn:63949, ipnet:2600:3c01::/32, country:SG];
	RCVD_COUNT_ONE(0.00)[1];
	FROM_NO_DN(0.00)[];
	MIME_TRACE(0.00)[0:+];
	DMARC_NA(0.00)[aceecat.org];
	R_DKIM_NA(0.00)[];
	TO_MATCH_ENVRCPT_ALL(0.00)[];
	TO_DN_NONE(0.00)[];
	MID_RHS_MATCH_FROM(0.00)[];
	RCVD_TLS_LAST(0.00)[];
	MLMMJ_DEST(0.00)[questions@freebsd.org];
	RECEIVED_HELO_LOCALHOST(0.00)[];
	FROM_EQ_ENVFROM(0.00)[]
X-Rspamd-Queue-Id: 4ZVdMj0nJXz3ccM
X-Spamd-Bar: /

On Sat, Apr 05, 2025 at 03:08:59PM -0400, Juan Manuel Palacios wrote:

> Other than talking about the appropriate hardware for the task at
> hand, I find it rather odd that no one has yet mentioned either the
> pfSense or OPNsense distributions. They’re both router-oriented,
> FreeBSD-based, web-administered, text-based-managed, and, above all,
> extremely versatile.

Right now I don't need a specialized router machine, but when I was
considering one, I remember being turned away from OPNsense by some
thread in a mailing list or a forum -- maybe even this list -- noting
that its binary distribution was compiled for a particular amd64 ISA
sub/superset, and wouldn't run on others.

Sorry I don't remember more details, maybe others will instantly know
what I mean?

-- 
Ian

From nobody Sun Apr  6 07:05:30 2025
X-Original-To: questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZVjzj2lWdz5t4Zc
	for <questions@mlmmj.nyi.freebsd.org>; Sun, 06 Apr 2025 07:05:53 +0000 (UTC)
	(envelope-from pat@patmaddox.com)
Received: from fhigh-b5-smtp.messagingengine.com (fhigh-b5-smtp.messagingengine.com [202.12.124.156])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256)
	(Client did not present a certificate)
	by mx1.freebsd.org (Postfix) with ESMTPS id 4ZVjzh21Vvz3FKm
	for <questions@freebsd.org>; Sun, 06 Apr 2025 07:05:52 +0000 (UTC)
	(envelope-from pat@patmaddox.com)
Authentication-Results: mx1.freebsd.org;
	dkim=pass header.d=patmaddox.com header.s=fm1 header.b=TvIk+kZw;
	dkim=pass header.d=messagingengine.com header.s=fm2 header.b=KI6TM2uH;
	dmarc=pass (policy=none) header.from=patmaddox.com;
	spf=pass (mx1.freebsd.org: domain of pat@patmaddox.com designates 202.12.124.156 as permitted sender) smtp.mailfrom=pat@patmaddox.com
Received: from phl-compute-08.internal (phl-compute-08.phl.internal [10.202.2.48])
	by mailfhigh.stl.internal (Postfix) with ESMTP id 4457F25401B4;
	Sun,  6 Apr 2025 03:05:51 -0400 (EDT)
Received: from phl-imap-15 ([10.202.2.104])
  by phl-compute-08.internal (MEProxy); Sun, 06 Apr 2025 03:05:51 -0400
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=patmaddox.com;
	 h=cc:content-transfer-encoding:content-type:content-type:date
	:date:from:from:in-reply-to:in-reply-to:message-id:mime-version
	:references:reply-to:subject:subject:to:to; s=fm1; t=1743923151;
	 x=1744009551; bh=18DxjjfjLTw+UVWncKK7qH4gCi1ONUB0mvlKZQNKv1I=; b=
	TvIk+kZwdyxiUweAk9KmHmekUTLzgfYzyNkhxByXc5H+dKPgWd/h9rGuGWsmUFGM
	dJOUp6aQgsFkJqjsoIv7S3yCYp1pIY4t3lsqXsv1qTVQY92rrKs2uU44yyNTOuYR
	AT7CBE7wHlfMdRLd5Y60WCCC30iYqjYQszOZ4xbbSLQ+2zLjw8AIo0Y7acJ4X7OE
	VXXTp97ATLaG5x2C1HuDu0JHrKzu3RUuibJB+JUju8VDNYD/v0fW5qMUTRAhUY4h
	EffO+JV4f6Xm4OtpnPm/iSP35vf0Ri9ATTj8+4L60+oX1o11lFVBa6gpdwKt1Nk6
	cgQr36YES/gDFp0DTUrcYg==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=
	messagingengine.com; h=cc:content-transfer-encoding:content-type
	:content-type:date:date:feedback-id:feedback-id:from:from
	:in-reply-to:in-reply-to:message-id:mime-version:references
	:reply-to:subject:subject:to:to:x-me-proxy:x-me-sender
	:x-me-sender:x-sasl-enc; s=fm2; t=1743923151; x=1744009551; bh=1
	8DxjjfjLTw+UVWncKK7qH4gCi1ONUB0mvlKZQNKv1I=; b=KI6TM2uHV1CREGR32
	jYV03jMb1c3x3JknhqStTj3ASEXi952PHuTlne+3LmMYQfa31j8yDH6Hw5yeERq8
	fDhIfdtFnVxCLWL4IZgisU2U1V4z0+WgYVZQnBXuJJxo4NnBJ5rGMmS+Bznp7DPA
	XfFH0BPGr9Mmy7V3PWxd8Ev+tBoUDxSh3VlbreUvFzyidPwDJpaZTCtAepWep4X/
	aIvZsYKsS5l8BM8yXBg7nIhkr4fr49I0CdnBV1SKKlM6zgCheGjOzreOfbVcX6vM
	BihvNsWZtDTa3l2I/IYkfYK5aZjooeB76+/5SZbGAb5jC5rdjhIvKsboygCaaqrn
	Y0AVw==
X-ME-Sender: <xms:zifyZ2esIibKEOxXrhfirax1tVoiqw7IqMRE4tS6lAEkFD77g5WI5w>
    <xme:zifyZwMOkuxvkvI2SJEGMN1SrpSL5qRy-yB5YfB9-r0jsvAXl-Knw0W17JGDJveUD
    vA9L9PWtc3ot6ooHg>
X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeefvddrtddtgdduleeiiedvucetufdoteggodetrf
    dotffvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdggtfgfnhhsuhgsshgtrhhisggv
    pdfurfetoffkrfgpnffqhgenuceurghilhhouhhtmecufedttdenucenucfjughrpefogg
    ffhffvkfgjfhfutgfgsehtqhertdertdejnecuhfhrohhmpedfrfgrthcuofgrugguohig
    fdcuoehprghtsehprghtmhgrugguohigrdgtohhmqeenucggtffrrghtthgvrhhnpefhvd
    dvkedtleetheefkefgjeehleefgeefjeehgefhgfdtvdfggfevgffhleejheenucevlhhu
    shhtvghrufhiiigvpedtnecurfgrrhgrmhepmhgrihhlfhhrohhmpehprghtsehprghtmh
    grugguohigrdgtohhmpdhnsggprhgtphhtthhopedupdhmohguvgepshhmthhpohhuthdp
    rhgtphhtthhopehquhgvshhtihhonhhssehfrhgvvggsshgurdhorhhg
X-ME-Proxy: <xmx:zifyZ3gB6275gm0Lj2qpfnWOI_nBjN4yHM0DfgP16DAUwTknR8amLg>
    <xmx:zifyZz_c5AygsSMSSJvfG-5reQbdmix5SUB1KLXyvaUes041CYMFtA>
    <xmx:zifyZyslqgNcdQXx_DCNj7oKCMX-_8sBGKENTgcsRZgiGAdoXkMnLA>
    <xmx:zifyZ6ERYXtIAtUVTF8UaBjpqsKEa0VP2YV3xDXTZRQWGj4SwuAa5A>
    <xmx:zyfyZzEkHen81BfphLBHyFfwbQdqL7ZG2UCHhIp1ZU59VIBLBieWU0KE>
Feedback-ID: i8b6c40f9:Fastmail
Received: by mailuser.phl.internal (Postfix, from userid 501)
	id D199878006B; Sun,  6 Apr 2025 03:05:50 -0400 (EDT)
X-Mailer: MessagingEngine.com Webmail Interface
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
MIME-Version: 1.0
X-ThreadId: T11479b1a9407e976
Date: Sun, 06 Apr 2025 00:05:30 -0700
From: "Pat Maddox" <pat@patmaddox.com>
To: questions@freebsd.org
Message-Id: <ece3eb88-0d31-441d-98be-e4917033311d@app.fastmail.com>
In-Reply-To: <20250405194701.6432e956@Hydrogen>
References: <E1u17qJ-000CWa-1L@wb5agz> <fwY8bqPs9FjbCbnL@aceecat.org>
 <20250405194701.6432e956@Hydrogen>
Subject: Re: A FreeBSD-based Router
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
X-Spamd-Result: default: False [-4.66 / 15.00];
	RBL_SENDERSCORE_REPUT_9(-1.00)[202.12.124.156:from];
	NEURAL_HAM_LONG(-0.96)[-0.960];
	NEURAL_HAM_SHORT(-0.94)[-0.941];
	NEURAL_HAM_MEDIUM(-0.66)[-0.664];
	DMARC_POLICY_ALLOW(-0.50)[patmaddox.com,none];
	R_DKIM_ALLOW(-0.20)[patmaddox.com:s=fm1,messagingengine.com:s=fm2];
	R_SPF_ALLOW(-0.20)[+ip4:202.12.124.128/27];
	RCVD_IN_DNSWL_LOW(-0.10)[202.12.124.156:from];
	MIME_GOOD(-0.10)[text/plain];
	XM_UA_NO_VERSION(0.01)[];
	ASN(0.00)[asn:151847, ipnet:202.12.124.0/24, country:AU];
	FREEFALL_USER(0.00)[pat];
	MIME_TRACE(0.00)[0:+];
	RCPT_COUNT_ONE(0.00)[1];
	DWL_DNSWL_NONE(0.00)[messagingengine.com:dkim];
	ARC_NA(0.00)[];
	MLMMJ_DEST(0.00)[questions@freebsd.org];
	RCVD_COUNT_THREE(0.00)[3];
	FROM_EQ_ENVFROM(0.00)[];
	FROM_HAS_DN(0.00)[];
	RWL_MAILSPIKE_POSSIBLE(0.00)[202.12.124.156:from];
	TO_DN_NONE(0.00)[];
	RCVD_TLS_LAST(0.00)[];
	TO_MATCH_ENVRCPT_ALL(0.00)[];
	DKIM_TRACE(0.00)[patmaddox.com:+,messagingengine.com:+]
X-Rspamd-Queue-Id: 4ZVjzh21Vvz3FKm
X-Spamd-Bar: ----

On Sat, Apr 5, 2025, at 11:47 AM, Polarian wrote:
>
> You could also look at protectli [2] which provide minipc sized
> routers, however these come at a big cost, and will only save a small
> amount of energy using newer more efficient chips than old desktops,
> but they do pack a punch. I am not sure how well they support FreeBSD
> however.

I use a protectli with vanilla FreeBSD. I set up some VLANs in rc.conf, =
pf to block all incoming traffic from internet port, pf to allow certain=
 VLANs to access specific servers, and dhcpd. Other than needing the occ=
asional freebsd-update, I don=E2=80=99t think about the router at all.

I have at times considered setting up wireguard for remote access, but h=
aven=E2=80=99t gotten around to it.

I think it=E2=80=99s great. Solid, silent, and fast.

Pat

From nobody Sun Apr  6 10:09:59 2025
X-Original-To: questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZVp4R3WbZz5tH52
	for <questions@mlmmj.nyi.freebsd.org>; Sun, 06 Apr 2025 10:10:15 +0000 (UTC)
	(envelope-from freebsd-doc@fjl.co.uk)
Received: from bs1.fjl.org.uk (bs1.fjl.org.uk [84.45.41.196])
	by mx1.freebsd.org (Postfix) with ESMTP id 4ZVp4Q58FQz3nn9
	for <questions@freebsd.org>; Sun, 06 Apr 2025 10:10:14 +0000 (UTC)
	(envelope-from freebsd-doc@fjl.co.uk)
Authentication-Results: mx1.freebsd.org;
	dkim=none;
	dmarc=none;
	spf=pass (mx1.freebsd.org: domain of freebsd-doc@fjl.co.uk designates 84.45.41.196 as permitted sender) smtp.mailfrom=freebsd-doc@fjl.co.uk
Received: from [192.168.1.109] (host86-173-148-176.range86-173.btcentralplus.com [86.173.148.176])
	(authenticated bits=0)
	by bs1.fjl.org.uk (8.14.4/8.14.4) with ESMTP id 536AACes024839
	for <questions@freebsd.org>; Sun, 6 Apr 2025 11:10:13 +0100 (BST)
	(envelope-from freebsd-doc@fjl.co.uk)
Content-Type: multipart/alternative;
 boundary="------------yLPBDN8PRpBSO3dyUOR061JH"
Message-ID: <fec4c45f-3060-4b79-a9f4-89b827f0d56f@fjl.co.uk>
Date: Sun, 6 Apr 2025 11:09:59 +0100
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: A FreeBSD-based Router
Content-Language: en-GB
To: questions@freebsd.org
References: <E1u17qJ-000CWa-1L@wb5agz>
From: Frank Leonhardt <freebsd-doc@fjl.co.uk>
In-Reply-To: <E1u17qJ-000CWa-1L@wb5agz>
X-Spamd-Result: default: False [1.67 / 15.00];
	RBL_SENDERSCORE_REPUT_9(-1.00)[84.45.41.196:from];
	NEURAL_SPAM_LONG(1.00)[1.000];
	NEURAL_SPAM_MEDIUM(0.99)[0.993];
	NEURAL_SPAM_SHORT(0.68)[0.681];
	R_SPF_ALLOW(-0.20)[+ip4:84.45.41.196:c];
	ONCE_RECEIVED(0.20)[];
	RCVD_NO_TLS_LAST(0.10)[];
	MIME_GOOD(-0.10)[multipart/alternative,text/plain];
	ARC_NA(0.00)[];
	RCVD_COUNT_ONE(0.00)[1];
	MIME_TRACE(0.00)[0:+,1:+,2:~];
	ASN(0.00)[asn:25577, ipnet:84.45.0.0/17, country:GB];
	FROM_HAS_DN(0.00)[];
	MID_RHS_MATCH_FROM(0.00)[];
	R_DKIM_NA(0.00)[];
	TO_MATCH_ENVRCPT_ALL(0.00)[];
	TO_DN_NONE(0.00)[];
	FROM_EQ_ENVFROM(0.00)[];
	PREVIOUSLY_DELIVERED(0.00)[questions@freebsd.org];
	RCPT_COUNT_ONE(0.00)[1];
	DMARC_NA(0.00)[fjl.co.uk];
	MLMMJ_DEST(0.00)[questions@freebsd.org]
X-Rspamd-Queue-Id: 4ZVp4Q58FQz3nn9
X-Spamd-Bar: +

This is a multi-part message in MIME format.
--------------yLPBDN8PRpBSO3dyUOR061JH
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

On 05/04/2025 19:02, Martin McCormick wrote:
> We have been using a Netgear wndr3400v2 router since February of
> 2013 and it is probably time to take advantage of newer
> technology especially since there have been no new software updates for
> it in years.

I do this as a matter of course whenever possible, as FreeBSD doesn't 
crash whereas most router appliances do (I sometimes use a Cisco ASA, 
which are okay).

It's really straightforward, and I have a couple of FreeBSD boxes doing 
it along with other tasks, with one in hot standby. So my approach is 
different to the small SBCs.

My favourite box is an HP Microserver GEN8+. For routing they have a 
reasonable pair of Broadcom Ethernet cards built in (Gen8), and space 
for something more powerful if needed. The Gen 10 have very nice Intel 
Ethernet. You can pick up HP Gen 8 Microservers for around £100 on eBay, 
and the Gen 8 are really quiet.

The software is FreeBSD out of the box with BIND and DHCPD added. 
Possibly OpenVPN Stick with the (pre-installed) PF because it just works 
better and is easy to understand, and it handles NAT without messing 
with special kernels. There's also a great book on PF if you want to go 
into it deeper. These have straightforward configuration files and are 
easy to set up.

Is running a whole Microserver overkill? I don't think so because in 
reality it can do so much more - e.g. Mail server, NAS or both. They 
have four drive slots that are SAS compatible if you don't want the 
built in SATA.

It's a different approach, perhaps, but I've been doing it for years on 
several sites and I'd never go back to the plastic boxes. I was fed up 
of phoning someone ask them to "turn if off and on again for me please".

Incidentally, WiFi - it's possible to run AP software on FreeBSD but I 
don't. Proper dedicated WAPs just work better - they have the hardware 
for it and you can position them in the best place.

Regards, Frank.

2E0FJL

--------------yLPBDN8PRpBSO3dyUOR061JH
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit

<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  </head>
  <body>
    <div class="moz-cite-prefix">On 05/04/2025 19:02, Martin McCormick
      wrote:<br>
    </div>
    <blockquote type="cite" cite="mid:E1u17qJ-000CWa-1L@wb5agz">
      <pre class="moz-quote-pre" wrap="">We have been using a Netgear wndr3400v2 router since February of
2013 and it is probably time to take advantage of newer
technology especially since there have been no new software updates for
it in years.</pre>
    </blockquote>
    <p>I do this as a matter of course whenever possible, as FreeBSD
      doesn't crash whereas most router appliances do (I sometimes use a
      Cisco ASA, which are okay).</p>
    <p>It's really straightforward, and I have a couple of FreeBSD boxes
      doing it along with other tasks, with one in hot standby. So my
      approach is different to the small SBCs.</p>
    <p>My favourite box is an HP Microserver GEN8+. For routing they
      have a reasonable pair of Broadcom Ethernet cards built in (Gen8),
      and space for something more powerful if needed. The Gen 10 have
      very nice Intel Ethernet. You can pick up HP Gen 8 Microservers
      for around £100 on eBay, and the Gen 8 are really quiet.</p>
    <p>The software is FreeBSD out of the box with BIND and DHCPD added.
      Possibly OpenVPN Stick with the (pre-installed) PF because it just
      works better and is easy to understand, and it handles NAT without
      messing with special kernels. There's also a great book on PF if
      you want to go into it deeper. These have straightforward
      configuration files and are easy to set up.<br>
    </p>
    <p>Is running a whole Microserver overkill? I don't think so because
      in reality it can do so much more - e.g. Mail server, NAS or both.
      They have four drive slots that are SAS compatible if you don't
      want the built in SATA.</p>
    <p>It's a different approach, perhaps, but I've been doing it for
      years on several sites and I'd never go back to the plastic boxes.
      I was fed up of phoning someone ask them to "turn if off and on
      again for me please".</p>
    <p>Incidentally, WiFi - it's possible to run AP software on FreeBSD
      but I don't. Proper dedicated WAPs just work better - they have
      the hardware for it and you can position them in the best place.</p>
    <p>Regards, Frank.<br>
    </p>
    <p>2E0FJL<span style="white-space: pre-wrap">
</span></p>
  </body>
</html>

--------------yLPBDN8PRpBSO3dyUOR061JH--

From nobody Sun Apr  6 10:11:24 2025
X-Original-To: freebsd-questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZVp6350Qwz5tJ23
	for <freebsd-questions@mlmmj.nyi.freebsd.org>; Sun, 06 Apr 2025 10:11:39 +0000 (UTC)
	(envelope-from freebsd-doc@fjl.co.uk)
Received: from bs1.fjl.org.uk (bs1.fjl.org.uk [84.45.41.196])
	by mx1.freebsd.org (Postfix) with ESMTP id 4ZVp631GMHz3pnD
	for <freebsd-questions@freebsd.org>; Sun, 06 Apr 2025 10:11:39 +0000 (UTC)
	(envelope-from freebsd-doc@fjl.co.uk)
Authentication-Results: mx1.freebsd.org;
	dkim=none;
	dmarc=none;
	spf=pass (mx1.freebsd.org: domain of freebsd-doc@fjl.co.uk designates 84.45.41.196 as permitted sender) smtp.mailfrom=freebsd-doc@fjl.co.uk
Received: from [192.168.1.109] (host86-173-148-176.range86-173.btcentralplus.com [86.173.148.176])
	(authenticated bits=0)
	by bs1.fjl.org.uk (8.14.4/8.14.4) with ESMTP id 536ABcuw025245
	for <freebsd-questions@freebsd.org>; Sun, 6 Apr 2025 11:11:38 +0100 (BST)
	(envelope-from freebsd-doc@fjl.co.uk)
Content-Type: multipart/alternative;
 boundary="------------NGddJx8oVvcrvOltLmvHNOVe"
Message-ID: <a9b56020-9004-48d3-8f61-a9b02e58bbdf@fjl.co.uk>
Date: Sun, 6 Apr 2025 11:11:24 +0100
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
From: Frank Leonhardt <freebsd-doc@fjl.co.uk>
Subject: Re: Securing FreeBSD.
To: freebsd-questions@freebsd.org
References: <Z_ATQA2k-3umIaLo@io.chezmoi.fr>
 <bb89a12f-0d73-411f-a34f-8a8224c30744@holgerdanske.com>
 <Z_A6pmQPuZU5lTEW@io.chezmoi.fr>
 <419a92a3-6d5b-44cb-8edf-6e65373ae72d@holgerdanske.com>
 <Z_Dd918DyCHhq1Hb@io.chezmoi.fr>
Content-Language: en-GB
In-Reply-To: <Z_Dd918DyCHhq1Hb@io.chezmoi.fr>
X-Spamd-Result: default: False [1.67 / 15.00];
	RBL_SENDERSCORE_REPUT_9(-1.00)[84.45.41.196:from];
	NEURAL_SPAM_LONG(1.00)[1.000];
	NEURAL_SPAM_MEDIUM(0.99)[0.994];
	NEURAL_SPAM_SHORT(0.68)[0.676];
	R_SPF_ALLOW(-0.20)[+ip4:84.45.41.196:c];
	ONCE_RECEIVED(0.20)[];
	RCVD_NO_TLS_LAST(0.10)[];
	MIME_GOOD(-0.10)[multipart/alternative,text/plain];
	ARC_NA(0.00)[];
	RCVD_COUNT_ONE(0.00)[1];
	MIME_TRACE(0.00)[0:+,1:+,2:~];
	ASN(0.00)[asn:25577, ipnet:84.45.0.0/17, country:GB];
	FROM_HAS_DN(0.00)[];
	MID_RHS_MATCH_FROM(0.00)[];
	R_DKIM_NA(0.00)[];
	TO_MATCH_ENVRCPT_ALL(0.00)[];
	TO_DN_NONE(0.00)[];
	FROM_EQ_ENVFROM(0.00)[];
	PREVIOUSLY_DELIVERED(0.00)[freebsd-questions@freebsd.org];
	RCPT_COUNT_ONE(0.00)[1];
	DMARC_NA(0.00)[fjl.co.uk];
	MLMMJ_DEST(0.00)[freebsd-questions@freebsd.org]
X-Rspamd-Queue-Id: 4ZVp631GMHz3pnD
X-Spamd-Bar: +

This is a multi-part message in MIME format.
--------------NGddJx8oVvcrvOltLmvHNOVe
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

On 05/04/2025 08:38, Albert Shih wrote:
> Le 04/04/2025 à 14:56:00-0700, David Christensen a écrit
>
> Hi
>>>> It sounds like you want read-only storage media (?).
>>> Yeah...exactly. The purpose is to recycle some old server to create some
>>> «non erasable» backup in addition to our «normal» backup.
>> Please clarify how you will create the "«non erasable» backup" and how you
>> will use it.
> The initial idea is to
>
>    1/ Put the server in kern.securelevel=2
>    2/ cron + rsync + find . -type f -exec chflags schg {} \; for the data
>
> For the use :
>
>    1/ Pray not have to ;-)
>
>    2/ rsync in the other way ;-)
>
>>> They are two thing I will not consider in the equation :
>>>
>>>     Security problem in FreeBSD.
>> If you wish to defend against security problems in FreeBSD, then I suggest
>> that you run the oldest supported release of FreeBSD -- 13.4-RELEASE.
> Well I say I will «not» consider.
>   
>> If you wish to defend against an intruder who has physical access to the
>> server, then I suggest that you select drives that have self-encryption (in
>> addition to write-protection).
>>
> Yes. I know that. But the assumption is :
>
>    FreeBSD don't have security problem
>    The physical access is safe.
>
>>> well....not possible. Too many To.
>> What is the size of the "«non erasable» backup"?
> Currently I got around 8 To of data to backup (every day) in this «backup safe». And
> the server for this «backup safe» would have «lot of To» (around 450 To).
>
> So no problem to just daily
>
>    mkdir  `date +%Y%M%d`
>    rsync data  `date +%Y%M%d`
>    find  `date +%Y%M%d` -type f -exec chflags schg {}\;
>
> and each 6 months (or before if need a run of freebsd-update) to boot in
> single, change the securelevel and erase manually the oldest backup
>   
>> What devices is it currently stored on?
>>
> Standard HDD.
>
>>> And the data change daily.
>> "non erasable" and "change daily" are contradictory goals.  Please clarify.
> Yeah....I mean the data I need to backup change daily. So it's not humanly
> possible to write that optical device.
>
> We already think about WORM tapes (we have LTO-8 library) but that's is
> very expansive. And the point is to use some old server who run perfectly
> but no longer under warranty to do this «backup safe» because we already
> have standard backup.
>
>>> Same issue. Not possible.
>>>
>>> Regards.
>> What about the IODD external drive enclosures?
>>
>>
> Didn't know that thing. I will check that.
>
A few of thoughts having followed this discussion.

1) If you lock down the backup server completely (no open ports) then it 
would be very hard for it to be compromised.

2) zfs send/receive is often a lot more efficient than rsync, and you 
can keep snapshots on the backup server which is an extra security 
feature. Just have one port open for replication.

3) Sending a zfs dataset to LTO and then removing the tape from the 
drive is very secure. Of course you need to be in the same place as the 
drive. If the dataset deltas are relatively small it's reasonable to do 
this over the Internet but I don't know how much of your data is really 
changed. It's usually less than people thing.

Just in case you're not familiar with zfs send, you can have a complete 
image of your enormous zpool - offline (unplug the disks) and then send 
a delta for everythig that's changed between snapshots. This delta may 
be quite small and easily fit on an LTO, which can then be removed and 
put in a safe place. To get your data back, reconnect the image and 
apply the delta or deltas from tape.

--------------NGddJx8oVvcrvOltLmvHNOVe
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit

<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  </head>
  <body>
    <div class="moz-cite-prefix">On 05/04/2025 08:38, Albert Shih wrote:<br>
    </div>
    <blockquote type="cite" cite="mid:Z_Dd918DyCHhq1Hb@io.chezmoi.fr">
      <pre class="moz-quote-pre" wrap="">Le 04/04/2025 à 14:56:00-0700, David Christensen a écrit

Hi
</pre>
      <blockquote type="cite">
        <blockquote type="cite">
          <blockquote type="cite">
            <pre class="moz-quote-pre" wrap="">It sounds like you want read-only storage media (?).
</pre>
          </blockquote>
          <pre class="moz-quote-pre" wrap="">Yeah...exactly. The purpose is to recycle some old server to create some
«non erasable» backup in addition to our «normal» backup.
</pre>
        </blockquote>
        <pre class="moz-quote-pre" wrap="">Please clarify how you will create the "«non erasable» backup" and how you
will use it.
</pre>
      </blockquote>
      <pre class="moz-quote-pre" wrap="">The initial idea is to 

  1/ Put the server in kern.securelevel=2
  2/ cron + rsync + find . -type f -exec chflags schg {} \; for the data

For the use : 

  1/ Pray not have to ;-)

  2/ rsync in the other way ;-)

</pre>
      <blockquote type="cite">
        <blockquote type="cite">
          <pre class="moz-quote-pre" wrap="">They are two thing I will not consider in the equation :

   Security problem in FreeBSD.
</pre>
        </blockquote>
        <pre class="moz-quote-pre" wrap="">If you wish to defend against security problems in FreeBSD, then I suggest
that you run the oldest supported release of FreeBSD -- 13.4-RELEASE.
</pre>
      </blockquote>
      <pre class="moz-quote-pre" wrap="">Well I say I will «not» consider. 
 
</pre>
      <blockquote type="cite">
        <pre class="moz-quote-pre" wrap="">If you wish to defend against an intruder who has physical access to the
server, then I suggest that you select drives that have self-encryption (in
addition to write-protection).

</pre>
      </blockquote>
      <pre class="moz-quote-pre" wrap="">Yes. I know that. But the assumption is : 

  FreeBSD don't have security problem
  The physical access is safe. 

</pre>
      <blockquote type="cite">
        <blockquote type="cite">
          <pre class="moz-quote-pre" wrap="">well....not possible. Too many To.
</pre>
        </blockquote>
        <pre class="moz-quote-pre" wrap="">What is the size of the "«non erasable» backup"?
</pre>
      </blockquote>
      <pre class="moz-quote-pre" wrap="">Currently I got around 8 To of data to backup (every day) in this «backup safe». And 
the server for this «backup safe» would have «lot of To» (around 450 To). 

So no problem to just daily 

  mkdir  `date +%Y%M%d`
  rsync data  `date +%Y%M%d`
  find  `date +%Y%M%d` -type f -exec chflags schg {}\;

and each 6 months (or before if need a run of freebsd-update) to boot in
single, change the securelevel and erase manually the oldest backup
 
</pre>
      <blockquote type="cite">
        <pre class="moz-quote-pre" wrap="">What devices is it currently stored on?

</pre>
      </blockquote>
      <pre class="moz-quote-pre" wrap="">Standard HDD. 

</pre>
      <blockquote type="cite">
        <blockquote type="cite">
          <pre class="moz-quote-pre" wrap="">And the data change daily.
</pre>
        </blockquote>
        <pre class="moz-quote-pre" wrap="">"non erasable" and "change daily" are contradictory goals.  Please clarify.
</pre>
      </blockquote>
      <pre class="moz-quote-pre" wrap="">Yeah....I mean the data I need to backup change daily. So it's not humanly
possible to write that optical device. 

We already think about WORM tapes (we have LTO-8 library) but that's is
very expansive. And the point is to use some old server who run perfectly
but no longer under warranty to do this «backup safe» because we already
have standard backup. 

</pre>
      <blockquote type="cite">
        <blockquote type="cite">
          <pre class="moz-quote-pre" wrap="">Same issue. Not possible.

Regards.
</pre>
        </blockquote>
        <pre class="moz-quote-pre" wrap="">What about the IODD external drive enclosures?


</pre>
      </blockquote>
      <pre class="moz-quote-pre" wrap="">Didn't know that thing. I will check that. 

</pre>
    </blockquote>
    <p>A few of thoughts having followed this discussion.<span
      style="white-space: pre-wrap">
</span></p>
    <p><span style="white-space: pre-wrap">1) If you lock down the backup server completely (no open ports) then it would be very hard for it to be compromised.</span></p>
    <p><span style="white-space: pre-wrap">2) zfs send/receive is often a lot more efficient than rsync, and you can keep snapshots on the backup server which is an extra security feature. Just have one port open for replication.</span></p>
    <p><span style="white-space: pre-wrap">3) Sending a zfs dataset to LTO and then removing the tape from the drive is very secure. Of course you need to be in the same place as the drive. If the dataset deltas are relatively small it's reasonable to do this over the Internet but I don't know how much of your data is really changed. It's usually less than people thing.</span></p>
    <p><span style="white-space: pre-wrap">Just in case you're not familiar with zfs send, you can have a complete image of your enormous zpool - offline (unplug the disks) and then send a delta for everythig that's changed between snapshots. This delta may be quite small and easily fit on an LTO, which can then be removed and put in a safe place. To get your data back, reconnect the image and apply the delta or deltas from tape.</span></p>
    <p><span style="white-space: pre-wrap">
</span></p>
    <p><span style="white-space: pre-wrap">
</span></p>
  </body>
</html>

--------------NGddJx8oVvcrvOltLmvHNOVe--

From nobody Sun Apr  6 10:27:24 2025
X-Original-To: questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZVpST0rBDz5tJY7
	for <questions@mlmmj.nyi.freebsd.org>; Sun, 06 Apr 2025 10:27:37 +0000 (UTC)
	(envelope-from jmpalacios@gmail.com)
Received: from mail-qk1-x730.google.com (mail-qk1-x730.google.com [IPv6:2607:f8b0:4864:20::730])
	(using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)
	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "smtp.gmail.com", Issuer "WR4" (verified OK))
	by mx1.freebsd.org (Postfix) with ESMTPS id 4ZVpSS66D7z3tCN
	for <questions@freebsd.org>; Sun, 06 Apr 2025 10:27:36 +0000 (UTC)
	(envelope-from jmpalacios@gmail.com)
Authentication-Results: mx1.freebsd.org;
	none
Received: by mail-qk1-x730.google.com with SMTP id af79cd13be357-7c592764e24so389338585a.0
        for <questions@freebsd.org>; Sun, 06 Apr 2025 03:27:36 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20230601; t=1743935256; x=1744540056; darn=freebsd.org;
        h=to:references:message-id:content-transfer-encoding:cc:date
         :in-reply-to:from:subject:mime-version:from:to:cc:subject:date
         :message-id:reply-to;
        bh=PEJZN3I7hKoUqlNXcLonFUnHSFx1Luvvvjduu1InDmg=;
        b=muMBoNp28wKVnxoR+jIfym8EFB5Mzoq0F7jNy057t97wVk5mQx1ik+kS/QyPE1iMg0
         HLzhTBMhR3ogiFl/8Xp9doLmeSixns8ScLFGI5C4QHQTEMog8tyiicvovry98csWxdup
         OJPEtZWBp1o5V5Q3eVMDal+a/p9Q7/iFZ5BitnErheHee/fFp4vSyXJYMVkIrMvyMI7c
         HWbcUQKCT/U1+rT4Pa3YKk2w/IlHKiEhLWtpNqAYi1tpE6WwnY3SFhQlFYIq9TT4vq40
         5NHKNHgkqcepx1HjIPBl4BK8KDL9mhgGnDhG2Ttc/Thy5FPPpxngFxvXS4hCvOtfPsJg
         NCjg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20230601; t=1743935256; x=1744540056;
        h=to:references:message-id:content-transfer-encoding:cc:date
         :in-reply-to:from:subject:mime-version:x-gm-message-state:from:to:cc
         :subject:date:message-id:reply-to;
        bh=PEJZN3I7hKoUqlNXcLonFUnHSFx1Luvvvjduu1InDmg=;
        b=aGzD3ezboQSmeIFW9FDhtNCqZT0S6p8evupoMP2nkkG+yaHoYNV6LXKGbrqZnjq4ok
         UZvenEKHJkUfI/6dCDM/FSZkMnXugF3TEC9BjVgTnuEQ99diu63f7fDm6bZn96T1mqVX
         8i9lDhSRe44mM4lRgrxL8QvPQIDAuxKGrI5L+GDouC81BAl4N/aicK9RUB4CwmxATmjp
         3s9oeUbLSSrk6Uymqpj5hBF0kSXKYYVOym8li9w6TmbQnoxjWk/QFb4gGBrd1iw2ookh
         UTDaqYokr3OJ1ec0YvqVWCteQkB0EJPd8vlhdTBpo6FIlBaA1F6GpIgzoNFxAPtT41i1
         hngg==
X-Gm-Message-State: AOJu0Yx3eNBkqLcQ/F8xZORW0hFPfZNOabD0C4+PRtUhR7u89fMYc9+Q
	k16zQLev5TftHI1vCB0Z0DdA0qdE4i9T8i3dYCAJiUso9DyYEaHwxnIOiHlN
X-Gm-Gg: ASbGnctvpZFLSMCBbeL1HBBfyxeG5veo+jbTadQIp42B0XuOXHQsqOzaWZuybtNf+sZ
	ageo2EUKc+7TR7uph7wHb3RKzLxLUfotfrxLDZNuYKc2O+O4roDG9O28wxxyKoLGL1CbQhGA5y+
	f2RsH9Ow2tqXwPigFJVCwLmnHrrQv/K2e34q/es9UNu1Zjy+U6yHphXo6eSiR47iIgIK6VZAfox
	w5dRNG+Xl2/7RejG0Lx9Y9NbJEdAjkvCucgNQ6ONmLy7lEqiI7JuumNQQqwG8G0I8BUZZ/IGBRt
	z48YBvaTeo7gyluc6PLw7MBwLX5uV8unMuw/2aLHVEAV4tytilWMsAw5Y0GQYaO1rrMV/PijJlY
	WbfaWhuCQ
X-Google-Smtp-Source: AGHT+IE9htutoC+Daiuc7AiD6mSr+pVIBnBJ+Pbsvld3yXA0cNC+RqNUMAQlWD6F4CMlOwBT5sR+mQ==
X-Received: by 2002:a05:620a:430e:b0:7c5:6a40:6a7a with SMTP id af79cd13be357-7c76c96c404mr2001329985a.6.1743935255675;
        Sun, 06 Apr 2025 03:27:35 -0700 (PDT)
Received: from smtpclient.apple ([2600:4041:7970:8b10:d048:3743:d011:4dfb])
        by smtp.gmail.com with ESMTPSA id af79cd13be357-7c76e738063sm461412685a.9.2025.04.06.03.27.34
        (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);
        Sun, 06 Apr 2025 03:27:34 -0700 (PDT)
Content-Type: text/plain;
	charset=utf-8
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3826.500.181.1.5\))
Subject: Re: A FreeBSD-based Router
From: Juan Manuel Palacios <jmpalacios@gmail.com>
In-Reply-To: <e692e82f-a3c9-48d1-b1da-119664a629fb@holgerdanske.com>
Date: Sun, 6 Apr 2025 06:27:24 -0400
Cc: questions@freebsd.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <DE2DC70E-F03C-4C02-8DE2-F847CC3B5A70@gmail.com>
References: <E1u17qJ-000CWa-1L@wb5agz>
 <e692e82f-a3c9-48d1-b1da-119664a629fb@holgerdanske.com>
To: David Christensen <dpchrist@holgerdanske.com>
X-Mailer: Apple Mail (2.3826.500.181.1.5)
X-Rspamd-Pre-Result: action=no action;
	module=replies;
	Message is reply to one we originated
X-Spamd-Result: default: False [-4.00 / 15.00];
	REPLY(-4.00)[];
	ASN(0.00)[asn:15169, ipnet:2607:f8b0::/32, country:US]
X-Rspamd-Queue-Id: 4ZVpSS66D7z3tCN
X-Spamd-Bar: ----

I personally appreciate UniFi quite a bit, I have a few devices here at =
home, and even control them via a UniFi Controller instance that I run =
locally in a FreeBSD jail.

But I=E2=80=99d never ever trade pfSense for a UniFi router! Sure, not a =
single pane-of-glass with a single backup & restore button for =
everything, but the power and versatility of pfSense is just unmatched =
(perhaps only by OPNSense, but I strive to steer clear from that =
particular flamewar), and that certainly justifies two backup & restore =
buttons ;) (or, well, three if you count my TrueNAS rig).

> On Apr 5, 2025, at 7:40=E2=80=AFPM, David Christensen =
<dpchrist@holgerdanske.com> wrote:
>=20
> On 4/5/25 11:02, Martin McCormick wrote:
>> We have been using a Netgear wndr3400v2 router since February of
>> 2013 and it is probably time to take advantage of newer
>> technology especially since there have been no new software updates =
for
>> it in years.  It also has a web GUI interface that must have, at
>> one time, worked for somebody, but nobody here because I have
>> thrown every browser at it I can get my hands on and the best way
>> to describe it is that each browser does okay with some web pages
>> on it but not others and anything related to passwords or the
>> changing there of seems to always make the most destructive
>> changes but never any beneficial adjustments so one doesn't
>> really know what got changed until later when this or that
>> function no longer works.
>> 	If I do the factory default reset, that will certainly
>> set things back to originals while also deleting the dhcp table
>> so I don't really want to do that.
>> 	What I really want is a modern router with a command-line
>> method of control which allows for good old text-base
>> configuration files for changing router settings as well as the
>> dhcpd server which it would also be running.
>> 	My idea is to load a mini PC with FreeBSD and a router
>> engine which means that the mini PC would need to have at least 2 =
NICS.
>> 	Is there any particular mini PC  with a good track record
>> on running FreeBSD?  I just put our Netgear router on a UPS so
>> that the occasional power glitches aren't as easily passed
>> through to our home network and hopefully a mini PC would not run
>> the UPS battery down as quickly as a full-sized work station
>> might.
>> 	Before I retired in 2015, I ran the FreeBSD-based bind
>> name servers along with ISC Dhcpd for my employer and we had
>> virtually no issues at all with that particular scheme so that's
>> why I want to use FreeBSD in our house for this purpose even
>> though I use debian Linux for most hobby activities so I can say
>> good things about both unixen (I believe that is a correct form
>> of speech.)
>> 	Our router is still working, knock on wood, but we
>> recently had issues with our ISP that so choked the router that I
>> thought it had crashed only to find out that it came back to life
>> when whatever traffic the ISC was throwing on to their system
>> went away and things got back to what passes for normal.
>> 	The FreeBSD/dhcp environment we had for over 20 years was
>> run on Dell servers and we had one FreeBSD box that ran continuously
>> without a reboot for over a year so I know FreeBSD gets things
>> done.
>> 	Thanks for any suggestions.
>> Martin McCormick
>=20
>=20
> Network engineering in the age of the Internet is a never-ending =
learning curve with potentially disastrous consequences if it is done =
incorrectly (including not keeping it up-to-date).
>=20
>=20
> I have a SOHO network with a file server, various client devices, and =
residential Internet service.  I want a safe and reliable network, but =
am not a network engineer.
>=20
>=20
> Back in the day, I started with a homebrew dial-up firewall router =
using a desktop PC, dual NIC's, and Red Hat Linux.  It was a useful =
learning exercise.  Later, I tried purpose-built FOSS distributions.  =
pfSense was too powerful and complex for my needs.  IPCop was a good fit =
and I used it for years.  But, the PC was bulky, made noise, produced =
heat, and consumed power.  Compact energy-efficient PC's have always =
come at a premium price.  I tried a few Netgear products, but also had =
problems with the web user interface (WUI).  More importantly, the =
devices tended to crash every few months; especially in summer.  FOSS =
firmware (DD-WRT) helped with the WUI, but I bricked at least one device =
attempting to upgrade.  When I added a Wi-Fi access point (AP), I soon =
discovery the hassle of trying to keep configuration settings =
synchronized across multiple network devices.
>=20
>=20
> Then I discovered Ubiquitti Networks and their UniFi lineup of =
products.  The killer feature is the UniFi Network Application -- =
centralized high-level network command and control with one WUI to "rule =
them all". I bought a UniFi Security Gateway, a UniFi AP AC-Lite, rented =
a Linode VPS, installed Debian and the UniFi Network Application (via a =
Linode StackScript), configured everything, and have been up and running =
24x7 ever since.  The UniFi Network Application WUI has evolved over the =
years, but has always been very polished.  Upgrades have been =
uneventful.  Backup is achieved by downloading a configuration file. =
Restore is achieved by uploading a configuration file.  I easily added =
incoming firewall pinholes and forwarding rules to allow remote SSH =
access from the Internet.  At one point, I set up a VPN to allow remote =
Samba access from the Internet.  I easily added two more AP's to my LAN. =
 Technical support was excellent when I needed it.  UniFi devices are =
Linux on the inside, so I can look; but I dare not touch.
>=20
>=20
> David
>=20
>=20


From nobody Sun Apr  6 14:23:19 2025
X-Original-To: freebsd-questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZVvhk200bz5rw7W
	for <freebsd-questions@mlmmj.nyi.freebsd.org>; Sun, 06 Apr 2025 14:23:34 +0000 (UTC)
	(envelope-from paulbeard@gmail.com)
Received: from mail-ed1-x52c.google.com (mail-ed1-x52c.google.com [IPv6:2a00:1450:4864:20::52c])
	(using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)
	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "smtp.gmail.com", Issuer "WR4" (verified OK))
	by mx1.freebsd.org (Postfix) with ESMTPS id 4ZVvhh6kK4z3SFc
	for <freebsd-questions@freebsd.org>; Sun, 06 Apr 2025 14:23:32 +0000 (UTC)
	(envelope-from paulbeard@gmail.com)
Authentication-Results: mx1.freebsd.org;
	dkim=pass header.d=gmail.com header.s=20230601 header.b=IogMtkrX;
	dmarc=pass (policy=none) header.from=gmail.com;
	spf=pass (mx1.freebsd.org: domain of paulbeard@gmail.com designates 2a00:1450:4864:20::52c as permitted sender) smtp.mailfrom=paulbeard@gmail.com
Received: by mail-ed1-x52c.google.com with SMTP id 4fb4d7f45d1cf-5e5e1a38c1aso4803275a12.2
        for <freebsd-questions@freebsd.org>; Sun, 06 Apr 2025 07:23:32 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20230601; t=1743949411; x=1744554211; darn=freebsd.org;
        h=to:subject:message-id:date:from:mime-version:from:to:cc:subject
         :date:message-id:reply-to;
        bh=1+18gpY7KxuqNacwkqXPreWWA8j3FvjAqhYrEcDKc1Q=;
        b=IogMtkrXnHJlRKzC8/4k6RKQN8F4RwqFOt8/MMGrsUJx7HDgaTaY/soGJNsYrCxxWZ
         jvjAvQCxg1iQ0qDmoTn/AaRMu3gwY6E2FsOMy0OhiCWupe7GNaQT/lQ3yiX5CJ24fXGg
         HPU00gL91TXxUw4d+M8FRKDNox+COxWJjhsET6B0IC8IGo1xd/jTtiSXOs2rbrw0Ms4z
         ARNZFOfhEqtkQ6Ipdop7Bord4HO1hpDvqAQM0b2JDRCuPTr7y/cPh3ZnRC2EhwVOxExx
         EriwNfdsiqv4h2g06u4coW24Raxvqj7kfswHOKQ7CA50u5SV6RDbqzEDqlqjWTD3Jw6H
         09rA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20230601; t=1743949411; x=1744554211;
        h=to:subject:message-id:date:from:mime-version:x-gm-message-state
         :from:to:cc:subject:date:message-id:reply-to;
        bh=1+18gpY7KxuqNacwkqXPreWWA8j3FvjAqhYrEcDKc1Q=;
        b=b2W++QaP4iqk4Rn6Hv8MfdSXYSiTMri+mM6s7uS/OnIm8hIvkN0dVkcWzqkdPSxtQu
         BZdcf7rNy4GOJYAS1aqWqt1GhEMILYqzJ0233BDVP41xA66w0mB0qyHF/JMliHiuaPb4
         PawqIy/WhAjXAMouR9EPuPAoFRFIh1LsUuMyI2VYGFNjnYMRouEDSKNIidQY8al0RXxx
         QsJOIbcj5ooWuww2CHU6WcvPG9s1jpwwydfOzfQKJibL44dXf9PP6dqXEmfaMdekhfLj
         2RK4gGxw99yId0BIgbdXP35+TR/4er5T0Smrn8lnjIyI2VX70m/srjMvJ2WMDMa/eFBW
         bw0w==
X-Gm-Message-State: AOJu0YxsG1ZFuLYvA7TLlhmX5wEOObbDgTvDQ077yJ6YDgXjzLbNBlQz
	cc+TQfzKi/S8EgCWiYEdArU41/7w7yru+30o2F7z0za5mMDSwasCAqnoDKhW8dFWto0Ld43nFzX
	XiJH2sbctSYApMWBmb2aPMOQ1SFDylam6bP4=
X-Gm-Gg: ASbGncs3ZPWis2YeYl2/XYp2GgTrRb72gGC/H+oGCYmnJKL82RhrZ7ciMMT+DUla48H
	fxzTIdkmuvtUHEtlzFwOXbN+tJTa2/DbgsKZIQyTodvl+DGfDI/s2L5ayzVAPr9nLrm7VI33oUJ
	ar88IbIMsQ7+AkQiLH/9hLkjaX8oE=
X-Google-Smtp-Source: AGHT+IE1b/AgJ88ahMMSOB2y4ts0aoO88FvOlNZrLo+R6D1Zvi6SRZ0GF+BJJqMoQE/VNeuw1HaqGJnWa4YPAMYt1Fg=
X-Received: by 2002:a17:907:969f:b0:ac3:eb29:2aef with SMTP id
 a640c23a62f3a-ac7d198ff61mr843002466b.41.1743949410528; Sun, 06 Apr 2025
 07:23:30 -0700 (PDT)
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
MIME-Version: 1.0
From: paul beard <paulbeard@gmail.com>
Date: Sun, 6 Apr 2025 07:23:19 -0700
X-Gm-Features: ATxdqUEjYz2FfFew9eh7IQgqTissOCA2Ii8ujClYSkBs66t2IfA87Ew_5G8TOnE
Message-ID: <CAMtcK2qhMpPUhwMjWqTTU6iwAn3-v3ee9To8=KuCJRQxZqCQ7Q@mail.gmail.com>
Subject: ntpd/ntpdate not setting time after upgrade to 14.2
To: FreeBSD-questions <freebsd-questions@freebsd.org>
Content-Type: multipart/alternative; boundary="0000000000001ef58d06321cdd1e"
X-Spamd-Result: default: False [-2.47 / 15.00];
	NEURAL_HAM_MEDIUM(-1.00)[-0.999];
	NEURAL_HAM_SHORT(-0.99)[-0.988];
	NEURAL_SPAM_LONG(0.51)[0.513];
	DMARC_POLICY_ALLOW(-0.50)[gmail.com,none];
	R_SPF_ALLOW(-0.20)[+ip6:2a00:1450:4000::/36:c];
	R_DKIM_ALLOW(-0.20)[gmail.com:s=20230601];
	MIME_GOOD(-0.10)[multipart/alternative,text/plain];
	TO_DN_ALL(0.00)[];
	RCVD_TLS_LAST(0.00)[];
	FROM_HAS_DN(0.00)[];
	ARC_NA(0.00)[];
	FREEMAIL_ENVFROM(0.00)[gmail.com];
	RCPT_COUNT_ONE(0.00)[1];
	FREEMAIL_FROM(0.00)[gmail.com];
	MIME_TRACE(0.00)[0:+,1:+,2:~];
	TO_MATCH_ENVRCPT_ALL(0.00)[];
	DKIM_TRACE(0.00)[gmail.com:+];
	MISSING_XM_UA(0.00)[];
	PREVIOUSLY_DELIVERED(0.00)[freebsd-questions@freebsd.org];
	FROM_EQ_ENVFROM(0.00)[];
	DWL_DNSWL_NONE(0.00)[gmail.com:dkim];
	MID_RHS_MATCH_FROMTLD(0.00)[];
	ASN(0.00)[asn:15169, ipnet:2a00:1450::/32, country:US];
	MLMMJ_DEST(0.00)[freebsd-questions@freebsd.org];
	RCVD_COUNT_ONE(0.00)[1];
	RCVD_IN_DNSWL_NONE(0.00)[2a00:1450:4864:20::52c:from]
X-Rspamd-Queue-Id: 4ZVvhh6kK4z3SFc
X-Spamd-Bar: --

--0000000000001ef58d06321cdd1e
Content-Type: text/plain; charset="UTF-8"

I reboot my freebsd system every sunday at 3AM (it runs in a VM on a
machine that needs a reboot every so often so I just do that and the
router/AP all at once). This was all good under 13.4 but now that I am on
14.2, I find the machine comes up in UTC and stays there until I set the
time by hand. I have ntpd and ntpdate both set to "on" in rc.conf, not sure
why or which makes more sense. ntpd is running but only sets the time if I
run it by hand. I only find this out when a cron job reports it can't
overwrite a file (backup from the day before).

Apr  5 20:02:19 <ntp.notice> www ntpd[767]: leapsecond file
('/var/db/ntpd.leap-seconds.list'): loaded, expire=2025-06-28T00:00:00Z
last=2017-01-01T00:00:00Z ofs=37
Apr  5 20:02:29 <ntp.err> www ntpd[767]: Clock offset exceeds panic
threshold.
Apr  5 20:02:29 <ntp.err> www ntpd[767]: Set system clock by hand.
Apr  6 07:14:05 <ntp.notice> www ntpd[3425]: ntpd 4.2.8p18-a (1): Starting
Apr  6 07:14:05 <ntp.notice> www ntpd[3425]: Command line: /usr/sbin/ntpd
-p /var/db/ntp/ntpd.pid -c /etc/ntp.conf -f /var/db/ntp/ntpd.drift

-- 
Paul Beard / www.paulbeard.org/

--0000000000001ef58d06321cdd1e
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>I reboot my freebsd system every sunday at 3AM (it ru=
ns in a VM on a machine that needs a reboot every=C2=A0so often=C2=A0so I j=
ust do that and the router/AP all at once). This was all good under 13.4 bu=
t now that I am on 14.2, I find=C2=A0the machine comes up in UTC and stays =
there until I set the time by hand. I have ntpd and ntpdate both set to &qu=
ot;on&quot; in rc.conf, not sure why or which makes more sense. ntpd is run=
ning but only sets the time if I run it by hand. I only find this out when =
a cron job reports it can&#39;t overwrite a file (backup from the day befor=
e).=C2=A0</div><div><br></div><font face=3D"monospace">Apr =C2=A05 20:02:19=
 &lt;ntp.notice&gt; www ntpd[767]: leapsecond file (&#39;/var/db/ntpd.leap-=
seconds.list&#39;): loaded, expire=3D2025-06-28T00:00:00Z last=3D2017-01-01=
T00:00:00Z ofs=3D37<br>Apr =C2=A05 20:02:29 &lt;ntp.err&gt; www ntpd[767]: =
Clock offset exceeds panic threshold.<br>Apr =C2=A05 20:02:29 &lt;ntp.err&g=
t; www ntpd[767]: Set system clock by hand.<br>Apr =C2=A06 07:14:05 &lt;ntp=
.notice&gt; www ntpd[3425]: ntpd 4.2.8p18-a (1): Starting<br>Apr =C2=A06 07=
:14:05 &lt;ntp.notice&gt; www ntpd[3425]: Command line: /usr/sbin/ntpd -p /=
var/db/ntp/ntpd.pid -c /etc/ntp.conf -f /var/db/ntp/ntpd.drift</font><div><=
span class=3D"gmail_signature_prefix"><br></span></div><div><span class=3D"=
gmail_signature_prefix">-- </span><br><div dir=3D"ltr" class=3D"gmail_signa=
ture" data-smartmail=3D"gmail_signature">Paul Beard / <a href=3D"http://www=
.paulbeard.org/" target=3D"_blank">www.paulbeard.org/</a><br></div></div></=
div>

--0000000000001ef58d06321cdd1e--

From nobody Sun Apr  6 15:07:29 2025
X-Original-To: freebsd-questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZVwgf4cdBz5s0Rw
	for <freebsd-questions@mlmmj.nyi.freebsd.org>; Sun, 06 Apr 2025 15:07:42 +0000 (UTC)
	(envelope-from sr@genyosha.net)
Received: from ns0.genyosha.net (ns0.genyosha.net [50.39.243.220])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "float.home.genyosha.net", Issuer "float.home.genyosha.net" (not verified))
	by mx1.freebsd.org (Postfix) with ESMTPS id 4ZVwgf0hf5z3csR
	for <freebsd-questions@freebsd.org>; Sun, 06 Apr 2025 15:07:41 +0000 (UTC)
	(envelope-from sr@genyosha.net)
Authentication-Results: mx1.freebsd.org;
	none
Received: from dragon.home.genyosha.net (ops0.genyosha.net [50.39.243.219])
	by ns0.genyosha.net (8.18.1/8.18.1) with ESMTPS id 536F7Y9h002998
	(version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO);
	Sun, 6 Apr 2025 08:07:34 -0700 (PDT)
	(envelope-from sr@genyosha.net)
Received: from dragon.home.genyosha.net (localhost [127.0.0.1])
	by dragon.home.genyosha.net (8.14.7/8.14.7) with ESMTP id 536F7Tfv019055;
	Sun, 6 Apr 2025 08:07:29 -0700
Received: (from sr@localhost)
	by dragon.home.genyosha.net (8.14.7/8.14.7/Submit) id 536F7THf019054;
	Sun, 6 Apr 2025 08:07:29 -0700
Date: Sun, 6 Apr 2025 08:07:29 -0700
From: Steve Rikli <sr@genyosha.net>
To: paul beard <paulbeard@gmail.com>
Cc: FreeBSD-questions <freebsd-questions@freebsd.org>
Subject: Re: ntpd/ntpdate not setting time after upgrade to 14.2
Message-ID: <Z/KYsZF42V3/Rn3f@dragon.home.genyosha.net>
References: <CAMtcK2qhMpPUhwMjWqTTU6iwAn3-v3ee9To8=KuCJRQxZqCQ7Q@mail.gmail.com>
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CAMtcK2qhMpPUhwMjWqTTU6iwAn3-v3ee9To8=KuCJRQxZqCQ7Q@mail.gmail.com>
X-Greylist: inspected by milter-greylist-4.6.4 (ns0.genyosha.net [50.39.243.220]); Sun, 06 Apr 2025 08:07:35 -0700 (PDT) for IP:'50.39.243.219' DOMAIN:'ops0.genyosha.net' HELO:'dragon.home.genyosha.net' FROM:'sr@genyosha.net' RCPT:''
X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.6.4 (ns0.genyosha.net [50.39.243.220]); Sun, 06 Apr 2025 08:07:35 -0700 (PDT)
X-Rspamd-Pre-Result: action=no action;
	module=replies;
	Message is reply to one we originated
X-Spamd-Result: default: False [-4.00 / 15.00];
	REPLY(-4.00)[];
	ASN(0.00)[asn:20055, ipnet:50.39.128.0/17, country:US]
X-Rspamd-Queue-Id: 4ZVwgf0hf5z3csR
X-Spamd-Bar: ----

On Sun, Apr 06, 2025 at 07:23:19AM -0700, paul beard wrote:
> I reboot my freebsd system every sunday at 3AM (it runs in a VM on a
> machine that needs a reboot every so often so I just do that and the
> router/AP all at once). This was all good under 13.4 but now that I am on
> 14.2, I find the machine comes up in UTC and stays there until I set the
> time by hand. I have ntpd and ntpdate both set to "on" in rc.conf, not sure
> why or which makes more sense. ntpd is running but only sets the time if I
> run it by hand. I only find this out when a cron job reports it can't
> overwrite a file (backup from the day before).
> 
> Apr  5 20:02:19 <ntp.notice> www ntpd[767]: leapsecond file ('/var/db/ntpd.leap-seconds.list'): loaded, expire=2025-06-28T00:00:00Z last=2017-01-01T00:00:00Z ofs=37
> Apr  5 20:02:29 <ntp.err> www ntpd[767]: Clock offset exceeds panic threshold.
> Apr  5 20:02:29 <ntp.err> www ntpd[767]: Set system clock by hand.
> Apr  6 07:14:05 <ntp.notice> www ntpd[3425]: ntpd 4.2.8p18-a (1): Starting
> Apr  6 07:14:05 <ntp.notice> www ntpd[3425]: Command line: /usr/sbin/ntpd -p /var/db/ntp/ntpd.pid -c /etc/ntp.conf -f /var/db/ntp/ntpd.drift

Typically you don't need ntpdate along with ntpd, since the ntpdate(8)
functionality is part of ntpd these days. E.g. I run like this:

$ grep ntp /etc/rc.conf
ntpd_enable="YES"
ntpd_sync_on_start="YES"

The sync_on_start option adds flag "-g" to ntpd which allows the initial
startup time adjustment to be large. The ntpd(8) man page mentions the
panic threshold you're seeing in the log, and the -g flag is intended to
address that.

Cheers,
sr.

From nobody Sun Apr  6 15:08:33 2025
X-Original-To: freebsd-questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZVwj46T52z5s0kq
	for <freebsd-questions@mlmmj.nyi.freebsd.org>; Sun, 06 Apr 2025 15:08:56 +0000 (UTC)
	(envelope-from humo3302@gmail.com)
Received: from mail-pj1-x1032.google.com (mail-pj1-x1032.google.com [IPv6:2607:f8b0:4864:20::1032])
	(using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)
	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "smtp.gmail.com", Issuer "WR4" (verified OK))
	by mx1.freebsd.org (Postfix) with ESMTPS id 4ZVwj3301rz3dpR
	for <freebsd-questions@freebsd.org>; Sun, 06 Apr 2025 15:08:55 +0000 (UTC)
	(envelope-from humo3302@gmail.com)
Authentication-Results: mx1.freebsd.org;
	dkim=pass header.d=gmail.com header.s=20230601 header.b=f8QVNHfJ;
	dmarc=pass (policy=none) header.from=gmail.com;
	spf=pass (mx1.freebsd.org: domain of humo3302@gmail.com designates 2607:f8b0:4864:20::1032 as permitted sender) smtp.mailfrom=humo3302@gmail.com
Received: by mail-pj1-x1032.google.com with SMTP id 98e67ed59e1d1-2ff6a98c638so3761088a91.0
        for <freebsd-questions@freebsd.org>; Sun, 06 Apr 2025 08:08:55 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20230601; t=1743952133; x=1744556933; darn=freebsd.org;
        h=to:subject:message-id:date:from:in-reply-to:references:mime-version
         :from:to:cc:subject:date:message-id:reply-to;
        bh=j7sAM9/tXTXCa3MZ9hrFHnbU0ds2MWb4oKwSBaXiE2Q=;
        b=f8QVNHfJ/FB1KyGKvlv6k+BIMz7hCzN8Ipn+ivLutLEyojPCiz0rodyIu5Xh/9XZMq
         iDQ1+VCb2N17n10DI0hw3O7fiYJDVefE8kDAjIHHh7RVhz+tZiM5Gf7+cIDQRTFAg0on
         sqQ6nb76bxofJZtHCdCeBbiQK8VFzunsnitH1nROuIArxTZnz2Pn1Onaf7ldpP+cPE60
         Exj2gifSTPq+bTZk94YCa15xExjLsW0Gx9BwjUYJuWs8Qcnz1eigAYxGghVWQIKQVlMI
         DcbBy2vpGl4ezPxKApYVbZ+7T1NlIwYNV2SCsdIbXHyO35GTxVeglRi5g2EWTHc7h2y2
         uw7Q==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20230601; t=1743952133; x=1744556933;
        h=to:subject:message-id:date:from:in-reply-to:references:mime-version
         :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
        bh=j7sAM9/tXTXCa3MZ9hrFHnbU0ds2MWb4oKwSBaXiE2Q=;
        b=kGydhyk8nL7aYKe31AbGXNp7Rznnj3Jxbx4blgnQm3YGnJYZYVDIQYXvyb9biX3vus
         Wu1e0ui1rFC+IHnUTlvPace00FZlOdYcihYnRlvcQ28BhyhIue9HqwS+/TbaMKJ9jcQL
         RaBye+GyfgNzRK+ACCfzvS58vAblR9/H13mWehmJPGT86Iy+OKUx8P1Ec6yNtmYwdclk
         oLua6mrmEQH0iUpJcTAxRo1kV271AoNfKrvvrt8ZYos60NByX3qOchp4ImlYLxDDBGep
         9B03juOp7uAcqQrlJ+NlSY+jmTTKTSOql24yL8wls08fDy0I07wI2rn3EmjK5WzheX86
         vMgg==
X-Gm-Message-State: AOJu0YykBgPeiiZ+9Ug1FiXgq7eeYXlBJ5DtePKynbqwXzHEbQ5fb+gC
	xYLvfJwWm9FWbsrYDkr+vA/oZbOTCuLxyoVIFxs+33pOXuhjcjZCwg3iDg9dVMSjOi9KsLrxCF4
	B/EUaJcPuOw5Q3iV8IQzDUuNOew0TmA==
X-Gm-Gg: ASbGncsFAbvhm+/ItkBkKPqd1YKPoUs8GyLJsfnsgeN90Iorkd9Ey0OwJ/MEDmGkVel
	gvE6R8/bRoTkV8XJ7qVTyUcQjPkvqXQbKnmXmKLLv7UDTc35G+ZMPc1CXACfkAFhadzuM5IMH0o
	/aFwcCpNhvs+FZWmOMrgrpfhVL1eY=
X-Google-Smtp-Source: AGHT+IEuOYyhRbbe/XfxMZJWPd6K/SsffQTmNAedcaj+9rxCkKO+HeZP9w9E9gG5e7dY92kXzL7GoQVzsAVF5sFYcmA=
X-Received: by 2002:a17:90b:53c7:b0:2ee:8ea0:6b9c with SMTP id
 98e67ed59e1d1-306a47e0664mr17297792a91.12.1743952133328; Sun, 06 Apr 2025
 08:08:53 -0700 (PDT)
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
MIME-Version: 1.0
References: <CAMsoGZ0Uj7bnYFYXrVi_VpXSZGBb98UdUHgFwsjiEa949GGf2A@mail.gmail.com>
 <093f0f3a-c9dc-4817-9be7-1d0c285f8e5c@app.fastmail.com> <CAMsoGZ2Y9uoXbasjoisWxNt7EeNMcrJsfD50rMyRVD3EAc48dw@mail.gmail.com>
 <d46b0ad1-0499-4d19-927c-ff4873cdc937@app.fastmail.com> <CAMsoGZ3o60PMoHhTjAwRz1vAVBdTuvQ9G82tC47w17YPHLdgHg@mail.gmail.com>
 <CAMsoGZ1cOmVKdo7FJhiwha0OYhX91iCk8tn7G2L2Am4vfbYKHg@mail.gmail.com>
In-Reply-To: <CAMsoGZ1cOmVKdo7FJhiwha0OYhX91iCk8tn7G2L2Am4vfbYKHg@mail.gmail.com>
From: Mauricio <humo3302@gmail.com>
Date: Sun, 6 Apr 2025 11:08:33 -0400
X-Gm-Features: ATxdqUFyyvcFkDIatJ8V60AIboOHZTii-yHgvvW00sH8qUjlzv_xE1WO8bfd1zU
Message-ID: <CAMsoGZ0AD9LSaVTKXdDmjoy+9z8K31GDwWYXF1UBetSWvZBngA@mail.gmail.com>
Subject: Fwd: Problems with WiFi networks - HP 255 G7, FreeBSD 14.2
To: freebsd-questions <freebsd-questions@freebsd.org>
Content-Type: multipart/alternative; boundary="00000000000069994106321d7ffe"
X-Spamd-Result: default: False [-1.89 / 15.00];
	NEURAL_HAM_MEDIUM(-1.00)[-0.999];
	NEURAL_SPAM_LONG(0.95)[0.953];
	NEURAL_HAM_SHORT(-0.85)[-0.845];
	DMARC_POLICY_ALLOW(-0.50)[gmail.com,none];
	R_SPF_ALLOW(-0.20)[+ip6:2607:f8b0:4000::/36];
	R_DKIM_ALLOW(-0.20)[gmail.com:s=20230601];
	MIME_GOOD(-0.10)[multipart/alternative,text/plain];
	TO_DN_ALL(0.00)[];
	RCVD_TLS_LAST(0.00)[];
	FROM_HAS_DN(0.00)[];
	RCPT_COUNT_ONE(0.00)[1];
	FREEMAIL_ENVFROM(0.00)[gmail.com];
	ARC_NA(0.00)[];
	FREEMAIL_FROM(0.00)[gmail.com];
	MIME_TRACE(0.00)[0:+,1:+,2:~];
	TO_MATCH_ENVRCPT_ALL(0.00)[];
	DKIM_TRACE(0.00)[gmail.com:+];
	MISSING_XM_UA(0.00)[];
	PREVIOUSLY_DELIVERED(0.00)[freebsd-questions@freebsd.org];
	FROM_EQ_ENVFROM(0.00)[];
	DWL_DNSWL_NONE(0.00)[gmail.com:dkim];
	MID_RHS_MATCH_FROMTLD(0.00)[];
	ASN(0.00)[asn:15169, ipnet:2607:f8b0::/32, country:US];
	MLMMJ_DEST(0.00)[freebsd-questions@freebsd.org];
	RCVD_COUNT_ONE(0.00)[1];
	RCVD_IN_DNSWL_NONE(0.00)[2607:f8b0:4864:20::1032:from]
X-Rspamd-Queue-Id: 4ZVwj3301rz3dpR
X-Spamd-Bar: -

--00000000000069994106321d7ffe
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

---------- Forwarded message ---------
From: Mauricio <humo3302@gmail.com>
Date: Sun, Apr 6, 2025 at 11:07=E2=80=AFAM
Subject: Re: Problems with WiFi networks - HP 255 G7, FreeBSD 14.2
To: Dave Cottlehuber <dch@skunkwerks.at>


Felt the need of clarifying that I still need to add the "

compat.linuxkpi.skb.mem_limit=3D1" line in /boot/loader.conf for the
WiFi card to work, actually.

If I did not add the mentioned line, the WiFi card would work, but
just for some minutes and then the connection will fail.


On Thu, Apr 3, 2025 at 4:36=E2=80=AFPM Mauricio <humo3302@gmail.com> wrote:

> The suggestion of trying FreeBSD 14 STABLE ended with success.
> I can use WiFi correctly now.
>
> One good thing i noticed is that i dont need to type anymore that
> "linuxkpi..." in /boot/loader.conf anymore for the WiFi card to work
> correctly.
>
> I'm really thankful for all your help.
> I want to keep digging on this system and now its more easy.
>
> By the way, thanks for made me know about the risks of one of my text
> files, however, i tought about it beforehand, and found that i had reason=
s
> to not care about that for now.
> Again, thanks for the help.
>
> El mi=C3=A9, 2 abr. 2025 7:30 p. m., Dave Cottlehuber <dch@skunkwerks.at>
> escribi=C3=B3:
>
>> > On Wed, Apr 2, 2025 at 4:30=E2=80=AFAM Dave Cottlehuber <dch@skunkwerk=
s.at>
>> wrote:
>> >> On Tue, 1 Apr 2025, at 17:33, Mauricio wrote:
>> >> > Hey! : )
>> >> >
>> >> > I have decided to install FreeBSD 14.2 in my laptop (HP 255 G7).
>> >> > This model use a WiFi card detected as rtw880 in the system.
>> >>
>> >> Welcome Mauricio!
>> >>
>> >> > I did the same for this 14.2 installation. And my WiFi card is
>> >> > recognized when looking at the ifconfig output.
>>
>> TLDR try installing 14-STABLE to see if this is resolved.
>>
>> I wrote most of the notes below before finding PR283142, so just
>> use it to refer to in future.
>>
>> https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D272145 seems relevan=
t
>> with https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D283903
>> as does https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D283142 which
>> looks like a fix may already be in 14-STABLE, my suggestion would be
>> to see if 14-STABLE works or not.
>>
>> > dmesg: https://pastebin.com/pYWAkSed
>>
>> rtw880: <rtw_8821ce> port 0x2000-0x20ff mem 0xc0600000-0xc060ffff at
>> device 0.0 on pci1
>> rtw880: successfully loaded firmware image 'rtw88/rtw8821c_fw.bin'
>> rtw880: Firmware version 24.8.0, H2C version 12
>>
>> > ifconfig: https://pastebin.com/JcETgrGU
>>
>> wlan0: flags=3D8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu
>> 1500
>>         options=3D0
>>         ether 00:e9:3a:db:06:fb
>>         groups: wlan
>>         ssid "" channel 11 (2462 MHz 11g). <---------
>>         regdomain FCC country US authmode WPA1+WPA2/802.11i privacy ON
>>         deftxkey UNDEF txpower 30 bmiss 7 scanvalid 60 protmode CTS wme
>>         roaming MANUAL
>>         parent interface: rtw880
>>         media: IEEE 802.11 Wireless Ethernet autoselect (autoselect)
>>         status: no carrier <-------------------------
>>
>> So you're not getting an IP address from DHCP server because no
>> connection is being established to the access point (no carrier).
>>
>> While I can't diagnose this, you should grab output of wifi scan,
>> and run wpa_supplicant in debug mode, and update one of the
>> tickets above if its still an issue on 14-STABLE.
>>
>> # ifconfig -v wlan0 list scan
>> # pkill -ilf wpa_supplicant
>> # wpa_supplicant -tddi wlan0 -c /etc/wpa_supplicant.conf
>>
>> You may need to sanitise this file, it may contain your wifi password
>>
>> A+
>> Dave
>>
>

--00000000000069994106321d7ffe
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><br><br><div class=3D"gmail_quote gmail_quote_container"><=
div dir=3D"ltr" class=3D"gmail_attr">---------- Forwarded message ---------=
<br>From: <b class=3D"gmail_sendername" dir=3D"auto">Mauricio</b> <span dir=
=3D"auto">&lt;<a href=3D"mailto:humo3302@gmail.com">humo3302@gmail.com</a>&=
gt;</span><br>Date: Sun, Apr 6, 2025 at 11:07=E2=80=AFAM<br>Subject: Re: Pr=
oblems with WiFi networks - HP 255 G7, FreeBSD 14.2<br>To: Dave Cottlehuber=
 &lt;<a href=3D"mailto:dch@skunkwerks.at">dch@skunkwerks.at</a>&gt;<br></di=
v><br><br><div dir=3D"ltr">Felt the need of clarifying that I still need to=
 add the &quot;<pre>compat.linuxkpi.skb.mem_limit=3D1&quot; line in /boot/l=
oader.conf for the WiFi card to work, actually.<br><br></pre><pre>If I did =
not add the mentioned line, the WiFi card would work, but just for some min=
utes and then the connection will fail.<br><br></pre></div><br><div class=
=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Thu, Apr 3, 2025 =
at 4:36=E2=80=AFPM Mauricio &lt;<a href=3D"mailto:humo3302@gmail.com" targe=
t=3D"_blank">humo3302@gmail.com</a>&gt; wrote:<br></div><blockquote class=
=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rg=
b(204,204,204);padding-left:1ex"><p dir=3D"ltr">The suggestion of trying Fr=
eeBSD 14 STABLE ended with success.<br>
I can use WiFi correctly now.</p>
<p dir=3D"ltr">One good thing i noticed is that i dont need to type anymore=
 that &quot;linuxkpi...&quot; in /boot/loader.conf anymore for the WiFi car=
d to work correctly.</p>
<p dir=3D"ltr">I&#39;m really thankful for all your help.<br>
I want to keep digging on this system and now its more easy.</p>
<p dir=3D"ltr">By the way, thanks for made me know about the risks of one o=
f my text files, however, i tought about it beforehand, and found that i ha=
d reasons to not care about that for now.<br>
Again, thanks for the help.</p>
<br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">El mi=
=C3=A9, 2 abr. 2025 7:30 p.=C2=A0m., Dave Cottlehuber &lt;<a href=3D"mailto=
:dch@skunkwerks.at" target=3D"_blank">dch@skunkwerks.at</a>&gt; escribi=C3=
=B3:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px=
 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">&gt; On Wed=
, Apr 2, 2025 at 4:30=E2=80=AFAM Dave Cottlehuber &lt;<a href=3D"mailto:dch=
@skunkwerks.at" rel=3D"noreferrer" target=3D"_blank">dch@skunkwerks.at</a>&=
gt; wrote:<br>
&gt;&gt; On Tue, 1 Apr 2025, at 17:33, Mauricio wrote:<br>
&gt;&gt; &gt; Hey! : )<br>
&gt;&gt; &gt;<br>
&gt;&gt; &gt; I have decided to install FreeBSD 14.2 in my laptop (HP 255 G=
7).<br>
&gt;&gt; &gt; This model use a WiFi card detected as rtw880 in the system.<=
br>
&gt;&gt; <br>
&gt;&gt; Welcome Mauricio!<br>
&gt;&gt; <br>
&gt;&gt; &gt; I did the same for this 14.2 installation. And my WiFi card i=
s <br>
&gt;&gt; &gt; recognized when looking at the ifconfig output.<br>
<br>
TLDR try installing 14-STABLE to see if this is resolved.<br>
<br>
I wrote most of the notes below before finding PR283142, so just<br>
use it to refer to in future.<br>
<br>
<a href=3D"https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D272145" rel=
=3D"noreferrer noreferrer" target=3D"_blank">https://bugs.freebsd.org/bugzi=
lla/show_bug.cgi?id=3D272145</a> seems relevant<br>
with <a href=3D"https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D283903"=
 rel=3D"noreferrer noreferrer" target=3D"_blank">https://bugs.freebsd.org/b=
ugzilla/show_bug.cgi?id=3D283903</a><br>
as does <a href=3D"https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D2831=
42" rel=3D"noreferrer noreferrer" target=3D"_blank">https://bugs.freebsd.or=
g/bugzilla/show_bug.cgi?id=3D283142</a> which<br>
looks like a fix may already be in 14-STABLE, my suggestion would be<br>
to see if 14-STABLE works or not.<br>
<br>
&gt; dmesg: <a href=3D"https://pastebin.com/pYWAkSed" rel=3D"noreferrer nor=
eferrer" target=3D"_blank">https://pastebin.com/pYWAkSed</a><br>
<br>
rtw880: &lt;rtw_8821ce&gt; port 0x2000-0x20ff mem 0xc0600000-0xc060ffff at =
device 0.0 on pci1<br>
rtw880: successfully loaded firmware image &#39;rtw88/rtw8821c_fw.bin&#39;<=
br>
rtw880: Firmware version 24.8.0, H2C version 12<br>
<br>
&gt; ifconfig: <a href=3D"https://pastebin.com/JcETgrGU" rel=3D"noreferrer =
noreferrer" target=3D"_blank">https://pastebin.com/JcETgrGU</a><br>
<br>
wlan0: flags=3D8843&lt;UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST&gt; metric 0 =
mtu 1500<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 options=3D0<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 ether 00:e9:3a:db:06:fb<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 groups: wlan<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 ssid &quot;&quot; channel 11 (2462 MHz 11g). &l=
t;---------<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 regdomain FCC country US authmode WPA1+WPA2/802=
.11i privacy ON<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 deftxkey UNDEF txpower 30 bmiss 7 scanvalid 60 =
protmode CTS wme<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 roaming MANUAL<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 parent interface: rtw880<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 media: IEEE 802.11 Wireless Ethernet autoselect=
 (autoselect)<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 status: no carrier &lt;------------------------=
-<br>
<br>
So you&#39;re not getting an IP address from DHCP server because no<br>
connection is being established to the access point (no carrier).<br>
<br>
While I can&#39;t diagnose this, you should grab output of wifi scan,<br>
and run wpa_supplicant in debug mode, and update one of the <br>
tickets above if its still an issue on 14-STABLE.<br>
<br>
# ifconfig -v wlan0 list scan<br>
# pkill -ilf wpa_supplicant<br>
# wpa_supplicant -tddi wlan0 -c /etc/wpa_supplicant.conf<br>
<br>
You may need to sanitise this file, it may contain your wifi password<br>
<br>
A+<br>
Dave<br>
</blockquote></div>
</blockquote></div>
</div></div>

--00000000000069994106321d7ffe--

From nobody Sun Apr  6 15:13:15 2025
X-Original-To: questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZVwpL09Vlz5s1Mx
	for <questions@mlmmj.nyi.freebsd.org>; Sun, 06 Apr 2025 15:13:30 +0000 (UTC)
	(envelope-from paulbeard@gmail.com)
Received: from mail-ed1-x52d.google.com (mail-ed1-x52d.google.com [IPv6:2a00:1450:4864:20::52d])
	(using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)
	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "smtp.gmail.com", Issuer "WR4" (verified OK))
	by mx1.freebsd.org (Postfix) with ESMTPS id 4ZVwpK23QFz3hGN
	for <questions@freebsd.org>; Sun, 06 Apr 2025 15:13:29 +0000 (UTC)
	(envelope-from paulbeard@gmail.com)
Authentication-Results: mx1.freebsd.org;
	dkim=pass header.d=gmail.com header.s=20230601 header.b=BKJROU+w;
	dmarc=pass (policy=none) header.from=gmail.com;
	spf=pass (mx1.freebsd.org: domain of paulbeard@gmail.com designates 2a00:1450:4864:20::52d as permitted sender) smtp.mailfrom=paulbeard@gmail.com
Received: by mail-ed1-x52d.google.com with SMTP id 4fb4d7f45d1cf-5e5deb6482cso8602352a12.1
        for <questions@freebsd.org>; Sun, 06 Apr 2025 08:13:29 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20230601; t=1743952407; x=1744557207; darn=freebsd.org;
        h=to:subject:message-id:date:from:in-reply-to:references:mime-version
         :from:to:cc:subject:date:message-id:reply-to;
        bh=ul4hR67xSS3QQgknvs8ZILcnnwTNFPuUrma4h3t1huA=;
        b=BKJROU+wSVaKiUZCcXs8J/buGWgA4MhGueXC09HAf266ffwRcS0hO7IpxvvkYzIbZm
         xveHMtjLRCdaO+RyUjcIB5QW/quaV3IFthWu8mtm3lQKCe0MET2NYB2Mca9RDjwPc34b
         zgEd3ltDaW9+2D3Om4tNO57WydsiUHqygJNc4sqKwPz+w85eHiTg+CHqumywMSJgGdxY
         n5vZb0XMsHX5IlfQMhTPeEplzyDf6UkhaWyBez8AFTZkH79TLqABsyXOH4S8qNonMhSz
         jYJNdA8MFSmORNNLXW23n5A0rTJXI1Kb0RtYnJ9WIHu4IHq7TVC4Ei1/xR6x1I9nykis
         MOEw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20230601; t=1743952407; x=1744557207;
        h=to:subject:message-id:date:from:in-reply-to:references:mime-version
         :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
        bh=ul4hR67xSS3QQgknvs8ZILcnnwTNFPuUrma4h3t1huA=;
        b=lap/+C5Z9BCoGFDCS+4+RI6EExBXRQhw+hUTU/ky7am7LhVLxdNyPg9eVkfRWTPimN
         5I2twbJZrm4kXpdSxnD+vKuCeWk++l7JNYaalYoXXtRm/KGEZfofmaqZdOtfw6YgqpYh
         6oiuIFf8KZ97/l5DZkdXyhVDEQUUbnKPccNbwoWmKLnC9HN3Jeccm6LDv1KPw6nvABtN
         8mNJU/B9+86X/yiLy/BkGv2TN9bNNcA4s8F9F94SEl25poql+RzRfHgpCGHYaRDGtZOI
         BjGCvCI+EP10m15pIT7PogTqeozysM3anZ5z5M4ELWaKUce0oZ307RybkfSLI6R06CB0
         0ONg==
X-Gm-Message-State: AOJu0YzUzDoRRazb/Cqxzqozl6IBi0nAvFQtJVwGiandCV4Z3BM/r5IV
	JnyH/MhdMg6U/9WpTLG+Af0V7GKFtkQBvr0XJzXh7NcmET4AEn0Kj7KSlurpWQ293CQYwVWlzp4
	mJvc+3DehGB1JhuOonUi23d0sg2Ck6uUl
X-Gm-Gg: ASbGncvx7n/XN3xYBAFQvfYtmprDsnRHkFFiVhcJ2NhJQ1cgweorddqLPm1R20etI5W
	ROJxrQbx47UKdhMYf9z6tzA3FjcgHsz3NKpwmybuxIlKsqy0UqruYQjD+QfsEzV2Dso2V7BNWEX
	Bf8vcEs2bD+c9KLllBeEOxFgjW1Aw=
X-Google-Smtp-Source: AGHT+IEJHXIjmNRXHTWuX+/VPEFd3xcJttp9RP6XRy2w1vBWNDvDP0VhThG9HMTNfKuy+6qTeFBvoa2sky85rqz9UuQ=
X-Received: by 2002:a17:907:72c9:b0:ac1:ecb0:ca98 with SMTP id
 a640c23a62f3a-ac7b7184e0dmr1225826166b.26.1743952406560; Sun, 06 Apr 2025
 08:13:26 -0700 (PDT)
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
MIME-Version: 1.0
References: <CAMtcK2qhMpPUhwMjWqTTU6iwAn3-v3ee9To8=KuCJRQxZqCQ7Q@mail.gmail.com>
 <Z/KYsZF42V3/Rn3f@dragon.home.genyosha.net>
In-Reply-To: <Z/KYsZF42V3/Rn3f@dragon.home.genyosha.net>
From: paul beard <paulbeard@gmail.com>
Date: Sun, 6 Apr 2025 08:13:15 -0700
X-Gm-Features: ATxdqUFxmnrIebP_FopW9_-hp6Yqz7m-3t-PD1cOT-CjfRQyu6ydei7Xd1RFlUw
Message-ID: <CAMtcK2o-+k5C5+1eG0TZOwp2cr843P6cQRaOi7jUNBhV0NrZgw@mail.gmail.com>
Subject: Re: ntpd/ntpdate not setting time after upgrade to 14.2
To: FreeBSD Questions List <questions@freebsd.org>
Content-Type: multipart/alternative; boundary="000000000000b2c7c306321d8f04"
X-Spamd-Result: default: False [-2.39 / 15.00];
	NEURAL_HAM_MEDIUM(-1.00)[-0.999];
	NEURAL_HAM_SHORT(-0.92)[-0.923];
	NEURAL_SPAM_LONG(0.54)[0.536];
	DMARC_POLICY_ALLOW(-0.50)[gmail.com,none];
	R_SPF_ALLOW(-0.20)[+ip6:2a00:1450:4000::/36:c];
	R_DKIM_ALLOW(-0.20)[gmail.com:s=20230601];
	MIME_GOOD(-0.10)[multipart/alternative,text/plain];
	TO_DN_ALL(0.00)[];
	RCVD_TLS_LAST(0.00)[];
	FROM_HAS_DN(0.00)[];
	ARC_NA(0.00)[];
	FREEMAIL_ENVFROM(0.00)[gmail.com];
	RCPT_COUNT_ONE(0.00)[1];
	FREEMAIL_FROM(0.00)[gmail.com];
	MIME_TRACE(0.00)[0:+,1:+,2:~];
	TO_MATCH_ENVRCPT_ALL(0.00)[];
	DKIM_TRACE(0.00)[gmail.com:+];
	MISSING_XM_UA(0.00)[];
	PREVIOUSLY_DELIVERED(0.00)[questions@freebsd.org];
	FROM_EQ_ENVFROM(0.00)[];
	DWL_DNSWL_NONE(0.00)[gmail.com:dkim];
	MID_RHS_MATCH_FROMTLD(0.00)[];
	ASN(0.00)[asn:15169, ipnet:2a00:1450::/32, country:US];
	MLMMJ_DEST(0.00)[questions@freebsd.org];
	RCVD_COUNT_ONE(0.00)[1];
	RCVD_IN_DNSWL_NONE(0.00)[2a00:1450:4864:20::52d:from]
X-Rspamd-Queue-Id: 4ZVwpK23QFz3hGN
X-Spamd-Bar: --

--000000000000b2c7c306321d8f04
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Ah. I didn't look for panic in the man page=E2=80=A6

Curious as to why this new behavior manifested after the upgrade but fixing
it is enough for me.

Thanks for the tip.

On Sun, Apr 6, 2025 at 8:07=E2=80=AFAM Steve Rikli <sr@genyosha.net> wrote:

> On Sun, Apr 06, 2025 at 07:23:19AM -0700, paul beard wrote:
> > I reboot my freebsd system every sunday at 3AM (it runs in a VM on a
> > machine that needs a reboot every so often so I just do that and the
> > router/AP all at once). This was all good under 13.4 but now that I am =
on
> > 14.2, I find the machine comes up in UTC and stays there until I set th=
e
> > time by hand. I have ntpd and ntpdate both set to "on" in rc.conf, not
> sure
> > why or which makes more sense. ntpd is running but only sets the time i=
f
> I
> > run it by hand. I only find this out when a cron job reports it can't
> > overwrite a file (backup from the day before).
> >
> > Apr  5 20:02:19 <ntp.notice> www ntpd[767]: leapsecond file
> ('/var/db/ntpd.leap-seconds.list'): loaded, expire=3D2025-06-28T00:00:00Z
> last=3D2017-01-01T00:00:00Z ofs=3D37
> > Apr  5 20:02:29 <ntp.err> www ntpd[767]: Clock offset exceeds panic
> threshold.
> > Apr  5 20:02:29 <ntp.err> www ntpd[767]: Set system clock by hand.
> > Apr  6 07:14:05 <ntp.notice> www ntpd[3425]: ntpd 4.2.8p18-a (1):
> Starting
> > Apr  6 07:14:05 <ntp.notice> www ntpd[3425]: Command line:
> /usr/sbin/ntpd -p /var/db/ntp/ntpd.pid -c /etc/ntp.conf -f
> /var/db/ntp/ntpd.drift
>
> Typically you don't need ntpdate along with ntpd, since the ntpdate(8)
> functionality is part of ntpd these days. E.g. I run like this:
>
> $ grep ntp /etc/rc.conf
> ntpd_enable=3D"YES"
> ntpd_sync_on_start=3D"YES"
>
> The sync_on_start option adds flag "-g" to ntpd which allows the initial
> startup time adjustment to be large. The ntpd(8) man page mentions the
> panic threshold you're seeing in the log, and the -g flag is intended to
> address that.
>
> Cheers,
> sr.
>


--=20
Paul Beard / www.paulbeard.org/

--000000000000b2c7c306321d8f04
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Ah. I didn&#39;t look for panic in the man page=E2=80=A6<d=
iv><br></div><div>Curious as to why this new behavior manifested after the =
upgrade but fixing it is enough for me.=C2=A0</div><div><br></div><div>Than=
ks for the tip.=C2=A0</div></div><br><div class=3D"gmail_quote gmail_quote_=
container"><div dir=3D"ltr" class=3D"gmail_attr">On Sun, Apr 6, 2025 at 8:0=
7=E2=80=AFAM Steve Rikli &lt;<a href=3D"mailto:sr@genyosha.net">sr@genyosha=
.net</a>&gt; wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"mar=
gin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-=
left-color:rgb(204,204,204);padding-left:1ex">On Sun, Apr 06, 2025 at 07:23=
:19AM -0700, paul beard wrote:<br>
&gt; I reboot my freebsd system every sunday at 3AM (it runs in a VM on a<b=
r>
&gt; machine that needs a reboot every so often so I just do that and the<b=
r>
&gt; router/AP all at once). This was all good under 13.4 but now that I am=
 on<br>
&gt; 14.2, I find the machine comes up in UTC and stays there until I set t=
he<br>
&gt; time by hand. I have ntpd and ntpdate both set to &quot;on&quot; in rc=
.conf, not sure<br>
&gt; why or which makes more sense. ntpd is running but only sets the time =
if I<br>
&gt; run it by hand. I only find this out when a cron job reports it can&#3=
9;t<br>
&gt; overwrite a file (backup from the day before).<br>
&gt; <br>
&gt; Apr=C2=A0 5 20:02:19 &lt;ntp.notice&gt; www ntpd[767]: leapsecond file=
 (&#39;/var/db/ntpd.leap-seconds.list&#39;): loaded, expire=3D2025-06-28T00=
:00:00Z last=3D2017-01-01T00:00:00Z ofs=3D37<br>
&gt; Apr=C2=A0 5 20:02:29 &lt;ntp.err&gt; www ntpd[767]: Clock offset excee=
ds panic threshold.<br>
&gt; Apr=C2=A0 5 20:02:29 &lt;ntp.err&gt; www ntpd[767]: Set system clock b=
y hand.<br>
&gt; Apr=C2=A0 6 07:14:05 &lt;ntp.notice&gt; www ntpd[3425]: ntpd 4.2.8p18-=
a (1): Starting<br>
&gt; Apr=C2=A0 6 07:14:05 &lt;ntp.notice&gt; www ntpd[3425]: Command line: =
/usr/sbin/ntpd -p /var/db/ntp/ntpd.pid -c /etc/ntp.conf -f /var/db/ntp/ntpd=
.drift<br>
<br>
Typically you don&#39;t need ntpdate along with ntpd, since the ntpdate(8)<=
br>
functionality is part of ntpd these days. E.g. I run like this:<br>
<br>
$ grep ntp /etc/rc.conf<br>
ntpd_enable=3D&quot;YES&quot;<br>
ntpd_sync_on_start=3D&quot;YES&quot;<br>
<br>
The sync_on_start option adds flag &quot;-g&quot; to ntpd which allows the =
initial<br>
startup time adjustment to be large. The ntpd(8) man page mentions the<br>
panic threshold you&#39;re seeing in the log, and the -g flag is intended t=
o<br>
address that.<br>
<br>
Cheers,<br>
sr.<br>
</blockquote></div><div><br clear=3D"all"></div><div><br></div><span class=
=3D"gmail_signature_prefix">-- </span><br><div dir=3D"ltr" class=3D"gmail_s=
ignature">Paul Beard / <a href=3D"http://www.paulbeard.org/" target=3D"_bla=
nk">www.paulbeard.org/</a><br></div>

--000000000000b2c7c306321d8f04--

From nobody Sun Apr  6 16:01:25 2025
X-Original-To: questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZVxsj4zdMz5s4q5
	for <questions@mlmmj.nyi.freebsd.org>; Sun, 06 Apr 2025 16:01:29 +0000 (UTC)
	(envelope-from mail@osfux.nl)
Received: from tilaa.osfux.nl (tilaa.osfux.nl [37.252.123.217])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256)
	(Client did not present a certificate)
	by mx1.freebsd.org (Postfix) with ESMTPS id 4ZVxsh0tLqz3rP9
	for <questions@freebsd.org>; Sun, 06 Apr 2025 16:01:28 +0000 (UTC)
	(envelope-from mail@osfux.nl)
Authentication-Results: mx1.freebsd.org;
	dkim=none;
	dmarc=pass (policy=reject) header.from=osfux.nl;
	spf=pass (mx1.freebsd.org: domain of mail@osfux.nl designates 37.252.123.217 as permitted sender) smtp.mailfrom=mail@osfux.nl
Received: from tilaa.osfux.nl (localhost [127.0.0.1])
	by tilaa.osfux.nl (Postfix) with ESMTP id 25708692850
	for <questions@freebsd.org>; Sun, 06 Apr 2025 18:01:26 +0200 (CEST)
Received: from tilaa.osfux.nl (localhost [127.0.0.1])
	by tilaa.osfux.nl (Postfix) with ESMTP id A95D469284F
	for <questions@freebsd.org>; Sun, 06 Apr 2025 18:01:25 +0200 (CEST)
X-Spam-Level: 
X-Spam-Status: No, score=-1.0 required=5.0 tests=ALL_TRUSTED shortcircuit=_SC_
X-Spam-Checker-Version: SpamAssassin 4.0.1
Received: from [192.168.20.225] (unknown [45.83.240.59])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256)
	(No client certificate requested)
	by tilaa.osfux.nl (Postfix) with ESMTPSA
	for <questions@freebsd.org>; Sun, 06 Apr 2025 18:01:25 +0200 (CEST)
Message-ID: <3b124ca0-4d34-46db-8f66-d16201e17964@osfux.nl>
Date: Sun, 6 Apr 2025 18:01:25 +0200
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: A FreeBSD-based Router
To: questions@freebsd.org
References: <E1u17qJ-000CWa-1L@wb5agz>
Content-Language: en-US
From: mailatosfux <mail@osfux.nl>
In-Reply-To: <E1u17qJ-000CWa-1L@wb5agz>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
X-Virus-Scanned: ClamAV using ClamSMTP
X-Spamd-Result: default: False [1.39 / 15.00];
	NEURAL_SPAM_LONG(1.00)[1.000];
	NEURAL_SPAM_MEDIUM(0.99)[0.995];
	DMARC_POLICY_ALLOW(-0.50)[osfux.nl,reject];
	R_SPF_ALLOW(-0.20)[+mx];
	NEURAL_SPAM_SHORT(0.19)[0.194];
	MIME_GOOD(-0.10)[text/plain];
	FROM_HAS_DN(0.00)[];
	RCVD_VIA_SMTP_AUTH(0.00)[];
	RCPT_COUNT_ONE(0.00)[1];
	ASN(0.00)[asn:196752, ipnet:37.252.120.0/21, country:NL];
	MID_RHS_MATCH_FROM(0.00)[];
	MIME_TRACE(0.00)[0:+];
	R_DKIM_NA(0.00)[];
	MLMMJ_DEST(0.00)[questions@freebsd.org];
	ARC_NA(0.00)[];
	TO_DN_NONE(0.00)[];
	FROM_EQ_ENVFROM(0.00)[];
	TO_MATCH_ENVRCPT_ALL(0.00)[];
	RCVD_TLS_LAST(0.00)[];
	PREVIOUSLY_DELIVERED(0.00)[questions@freebsd.org];
	RCVD_COUNT_THREE(0.00)[3]
X-Rspamd-Queue-Id: 4ZVxsh0tLqz3rP9
X-Spamd-Bar: +


On 4/5/25 20:02, Martin McCormick wrote:
> What I really want is a modern router with a command-line
> method of control which allows for good old text-base
> configuration files for changing router settings as well as the
> dhcpd server which it would also be running.
>
> 	My idea is to load a mini PC with FreeBSD and a router
> engine which means that the mini PC would need to have at least 2 NICS.
>
> 	Is there any particular mini PC  with a good track record
> on running FreeBSD?

Ill be closely watching this thread, since FreeBSD compatibility is very 
important to me and I'm also in the market for a new device.

Recently I've upgraded my FreeBSD "router" setup to IPv6 / switched to a 
different ppp-daemon (i got another internet provider after moving, one 
that provides additional capabilities/throughput), this was the first 
time I've put any effort in the setup (except for keeping it patched) 
since installing it on a pair of  Pc Engines (apu2e4 and apu1, in a 
redundant setup) 12 years ago.

  I'm in the market for a device that can handle considerably more 
traffic than the 250mbit i'm squeezing out of my apu's. Unfortunately, 
Pc Engines is not developing new platforms anymore. Anything reasonably 
compact, <25 watt power cunsumption, passively cooled and providing 1/2 
SFP+ slots + able to run "stock" FreeBSD, is what I'm aiming at.

I'm considering repurposing a few old NUC's until I find a "new" device 
I'm happy enough with to spend actual money on. Not in a hurry replacing 
my valued, trusty pcengines devices though, they've never let me down 
and running a pair of them allows for almost "on the fly" maintenance 
(interrupting internet functionality is not a popular theme where I live).




From nobody Sun Apr  6 21:23:28 2025
X-Original-To: freebsd-questions@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
	by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZW51H2Szlz5sWgT
	for <freebsd-questions@mlmmj.nyi.freebsd.org>; Sun, 06 Apr 2025 21:23:31 +0000 (UTC)
	(envelope-from che@bein.link)
Received: from mail.bein.link (bein.link [37.252.124.82])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(Client did not present a certificate)
	by mx1.freebsd.org (Postfix) with ESMTPS id 4ZW51G69KSz3x5r
	for <freebsd-questions@freebsd.org>; Sun, 06 Apr 2025 21:23:30 +0000 (UTC)
	(envelope-from che@bein.link)
Authentication-Results: mx1.freebsd.org;
	dkim=pass header.d=bein.link header.s=mail header.b=Q73UySrW;
	dmarc=none;
	spf=none (mx1.freebsd.org: domain of che@bein.link has no SPF policy when checking 37.252.124.82) smtp.mailfrom=che@bein.link
Received: from [192.168.1.11] (unknown [213.206.60.222])
	(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
	(No client certificate requested)
	by mail.bein.link (Postfix) with ESMTPSA id B811D238384
	for <freebsd-questions@freebsd.org>; Sun,  6 Apr 2025 21:22:41 +0000 (UTC)
Message-ID: <05376290-3ee7-47a4-ad7e-babdd68990f8@bein.link>
Date: Mon, 7 Apr 2025 02:23:28 +0500
List-Id: User questions <freebsd-questions.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/freebsd-questions
List-Help: <mailto:questions+help@freebsd.org>
List-Post: <mailto:questions@freebsd.org>
List-Subscribe: <mailto:questions+subscribe@freebsd.org>
List-Unsubscribe: <mailto:questions+unsubscribe@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
Sender: owner-freebsd-questions@FreeBSD.org
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Content-Language: en-US
To: freebsd-questions@freebsd.org
From: Maxim V Filimonov <che@bein.link>
Subject: CURRENT OCI Images don't push to registries
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=bein.link; s=mail; t=1743974561; bh=fPNlso4ESGti+oiNnpVrJWiXp2U=; h=Message-ID:Date:MIME-Version:To:From:Subject:Content-Type:Content-Transfer-Encoding; b=Q73UySrWrqA3jYk05F94sEAZjHvsVcLeMlo12PuGSgFNrrUE+9lFEJuNCUbU8ivaG7wvaSJvjYcjG18NT8nWbc+niVdjxY5tbPlV3pirlw4KD0TVbtACIDWg0I61D/INZE8R/eY70o8h51eRutWIPai8nt3wXFkFU46nnWaE3fU=
X-Spamd-Result: default: False [-2.70 / 15.00];
	NEURAL_HAM_LONG(-0.99)[-0.988];
	NEURAL_HAM_SHORT(-0.84)[-0.844];
	NEURAL_HAM_MEDIUM(-0.77)[-0.767];
	R_DKIM_ALLOW(-0.20)[bein.link:s=mail];
	ONCE_RECEIVED(0.20)[];
	MIME_GOOD(-0.10)[text/plain];
	RCVD_TLS_ALL(0.00)[];
	RCVD_VIA_SMTP_AUTH(0.00)[];
	RCPT_COUNT_ONE(0.00)[1];
	RCVD_COUNT_ONE(0.00)[1];
	ASN(0.00)[asn:196752, ipnet:37.252.120.0/21, country:NL];
	MIME_TRACE(0.00)[0:+];
	DMARC_NA(0.00)[bein.link];
	MID_RHS_MATCH_FROM(0.00)[];
	MLMMJ_DEST(0.00)[freebsd-questions@freebsd.org];
	FROM_EQ_ENVFROM(0.00)[];
	FROM_HAS_DN(0.00)[];
	ARC_NA(0.00)[];
	R_SPF_NA(0.00)[no SPF record];
	TO_MATCH_ENVRCPT_ALL(0.00)[];
	TO_DN_NONE(0.00)[];
	PREVIOUSLY_DELIVERED(0.00)[freebsd-questions@freebsd.org];
	DKIM_TRACE(0.00)[bein.link:+]
X-Rspamd-Queue-Id: 4ZW51G69KSz3x5r
X-Spamd-Bar: --

Hello list,

I have encountered the following error:

% sudo podman push freebsd-minimal:15.0-CURRENT-amd64 
docker:3000/oss/freebsd:15
Getting image source signatures
Copying blob be93261a2a96 done   |
Error: writing blob: Patch 
"http://docker:3000/v2/oss/freebsd/blobs/uploads/955gxv8ziqpwlargmbw8xy6jx": 
happened during read: Digest did not match, expected 
sha256:be93261a2a96b5d6a75724f7b970b281bda6cfeac8f5eeae9344b5af89f0863c, 
got sha256:a609a39b567e0a1073eb0b50475a38eecaa8be097bb8ce08bf52cc8d7d873100

That happens whenever I try to push an image of FreeBSD 15 to any 
registry in the known universe.

Whenever I try and push a 14.2-RELEASE image, tho, it works like a charm.
What could be the problem here? Can it be fixed? Thank you so much in 
advance.

-- 
wbr, Maxim Filimonov <che@bein.link>