[HN Gopher] My home network observes bedtime with OpenBSD and pf
___________________________________________________________________
My home network observes bedtime with OpenBSD and pf
Author : ibobev
Score : 106 points
Date : 2026-03-23 13:56 UTC (3 days ago)
(HTM) web link (ratfactor.com)
(TXT) w3m dump (ratfactor.com)
| pak9rabid wrote:
| Cool post, I love a good firewall story.
|
| One suggestion though: rather than doing this all on a single LAN
| network and having to deal with adding exceptions for devices
| that still need access to the Internet during 'bedtime' periods,
| I suggest creating a separate VLAN for devices that need
| 'bedtime' enforcement and put those devices there, while leaving
| your 'always online' devices in your main VLAN where access to
| the Internet is always available. This way all you have to do is
| simply change your firewall rules for that VLAN to enforce
| bedtime, which removes the extra rules needed for exceptions.
| giobox wrote:
| This is also the approach I would have used - I was surprised
| the author didn't end up here. I used a separate VLAN to
| achieve same thing as author to shutdown internet access on the
| VLAN my kids devices use at bedtime, as well as another VLAN
| with no internet access at all for IoT devices, security
| cameras etc.
|
| Blocking all UDP traffic by default is something I would never
| have even attempted for a domestic setup either. As the author
| discovers with Discord and Roblox, a great many common
| applications and games rely upon it. A UDP block on my kid's
| VLAN would last about 5 seconds before they attacked me for
| breaking their online Minecraft games.
| mtlmtlmtlmtl wrote:
| The next(I think? It's in -CURRENT now anyway.) version of
| OpenBSD will be adding VLAN awareness to veb(4). Should make my
| OpenBSD home router experience much easier.
| deanputney wrote:
| Love your watercolors! What a fun addition to a technical article
| :)
| freedomben wrote:
| Me too! It was a fantastic addition that I would not have
| expected. I wish I was artistic enough to do something like
| that. It had the interesting technical content, with the
| coziness of a children's book. Really a great piece that the
| author should be proud of
| prmoustache wrote:
| Not digging the desired outcome but yes the watercolors are
| great addition to an interesting technical article.
| panavinsingh wrote:
| The anchor-based approach for time-dependent rules is elegant.
| Most people would reach for a cron job that rewrites firewall
| rules on a schedule, but using pf anchors keeps the state
| management inside the packet filter where it belongs. The key
| advantage of pf over iptables for this kind of use case is that
| rule evaluation is deterministic and the syntax stays readable
| enough to audit six months later without documentation
| archaeology. Nice to see OpenBSD used for practical home network
| management instead of just theoretical security posturing.
| toast0 wrote:
| > The key advantage of pf over iptables for this kind of use
| case is that rule evaluation is deterministic and the syntax
| stays readable enough to audit six months later without
| documentation archaeology.
|
| Is iptables not deterministic? Don't the packets look at each
| rule in numerical order until something matches? If you have
| two rules with the same number, shame on you.
|
| Re archaeology, OpenBSD changed the rules syntax for some
| reason and the other platforms with pf kept the existing
| syntax, so that's always a fun game to play.
| rcxdude wrote:
| I think the issue is if you are dynamically updating the
| rules then you might have an intermediate state where some
| packages are processed according to some set of rules which
| is neither the set of rules at the start nor at the end.
| Wheras with anchors you can flip between different sets of
| rules atomically. (though I suspect you can do the same with
| iptables but it'll called something different)
| somat wrote:
| I had to make something like this at work once (allow access
| during some hours deny it at other times. and they wanted it
| enforced at the packet level) and I was a new sys-admin and all
| I had was an old linux box with iptables. It was ending up as
| the normal iptables mess until I asked myself "self: how would
| pf do it?", "anchors. I said, pf would do it with anchors" and
| I did it that way. well as much as possible. It was by far my
| cleanest work with iptables.
|
| It has been a while since I have had to mess with iptables but
| if I remember correctly(quickly reads the iptables man page)
| the equivalent to pf anchors in iptables is to use named chains
| then you can faf about loading and unloading the dynamic rules
| from the chains without messing with the static rules.
|
| The whole thing really made me appreciate the design of pf. I
| think, strictly speaking, iptables is more capable than pf, but
| pf and openbsd in general, is far more ergonomic.
| toast0 wrote:
| > However, I ran into trouble with the RealTek ethernet hardware
| support in OpenBSD, which had been running fine with Linux for
| years.
|
| I've run into problems with realtek gigE nics on Linux, FreeBSD,
| and Windows. I'm convinced their hardware/firmware has a timing
| issue where if the wrong things happen, the descriptor indexes
| get unsyncronized. This can lead to network stalls, but also wild
| writes. IIRC, reset behavior is weird too; vague because it's
| been a while since I looked, but I think if you get a network
| stall and do a reset, the card may receive and DMA a packet into
| RAM in the process ... something like that anyway.
|
| I have systems where the FreeBSD base driver consistently stalls,
| but the realtek provided driver works mostly ok; but the realtek
| driver is full of undocumented flag setting, so who knows what
| it's doing... it also sets the NIC to emit pause frames when it
| runs out of RX buffers which I never want; things will be much
| better if packets are dropped when RX buffers are full.
|
| I would love to have the equipment and time to figure out what's
| going on, but a) realtek probably should be the ones to do it, b)
| switching drivers usually works at no cost, and swapping to intel
| almost always works but you need slots and cards (ebay gets you
| multiport 1g for $10, 10g for $20-$30 though). I've heard realtek
| is good at 2.5g and intel isn't; but I haven't run enough realtek
| 2.5g to know.
| foobarian wrote:
| Only allowing TCP will break a lot of stuff. I was wondering why
| even bother with the transport layer, instead of just focusing on
| IP directly
| OGWhales wrote:
| Fun article! I like your watercolors too, especially the one of
| them going into the pufferfish's mouth :D
| proteal wrote:
| Thank you for sharing! What are your thoughts on intentionally
| degrading service over the course of an hour instead of a hard
| cutoff? Like implementing an increasingly restrictive cap on
| download speeds/intentionally dropping a % of packets over the
| hour. Might be a little less jarring than a hard stop.
| WhyNotHugo wrote:
| Would be trivial to block new connections first, and kill
| existing ones a while later.
| drnick1 wrote:
| That little PC should be able to run a lot of additional stuff in
| addition to the packet filter. My setup is similar, but I use an
| old gaming PC instead, and run dozens of services including
| email, nginx and various game servers on it. It does not break a
| sweat.
| bluGill wrote:
| I tried something like this. my kids just turned off wifi and I
| can't control the cell signals. Phone parent controls are not
| powerful enough for what I need
| whalesalad wrote:
| faraday cage
| toast0 wrote:
| Move to a house with exterior stucco. Faraday cage built in!
| gonzalohm wrote:
| Redirect their DNS through pihole
| somat wrote:
| That will not fix changing networks which will change your
| dns provider.
| jimmcslim wrote:
| THIS. Incredibly frustrating that iOS (I'm not sure about
| Android) doesn't provide a way to disable mobile data or
| Personal Hotspot as part of Screen Time settings.
| prmoustache wrote:
| I am just asking mines after dinner to leave the phone after
| dinner to my office where all electronic devices charge during
| the night.
| bluGill wrote:
| I usualy do that but I sometimes forget.
| netik wrote:
| Yet another "I cant't parent so I'll show my kids what a
| surveillance state looks like" post.
| nesarkvechnep wrote:
| Waiting for the "pf is garbage, use Linux" comments.
| WhyNotHugo wrote:
| pf is beautiful
| alexpotato wrote:
| This reminds me of the old SuperUser post where the asker wanted
| the computer screen to go blank when their kids were playing a
| game and yelling:
|
| https://superuser.com/questions/545329/how-do-i-make-a-machi...
| maccard wrote:
| > The computer is a Qotom Q305p 3205u. > Total price with power
| adaptor: $60
|
| I'd love to have a handful of tiny computers that I could do fun
| stuff on, but there is absolutely nothing available in the UK for
| less than double that price.
| renw0rp wrote:
| it's a 2015 computer, surly we can (or at least used to be able
| until recently) get cheap computers in the UK
| maccard wrote:
| We can get cheap computers, but we can't get $50/PS40
| passively cooled low power PC's.
___________________________________________________________________
(page generated 2026-03-26 23:00 UTC)