Comparing Linux's network stack to that of BSD's? reddit / BSD ---------------------------------------------------------------------- brickdoge · 2022-04-05 01:43 I'm trying to make a home router and access point out of a bunch of mini PCs I have. OpenBSD seemed like it would've been the perfect choice since it's securely preconfigured out the box, but the network stack leaves a lot to be desired. FreeBSD seemed interesting, but their wireguard implementation seemed wonky. I was wondering if anyone who knows more than me knows which is better for performance and security. OpenWrt just seems to tick all the boxes, but I'd like to know if something equally good or better for BSD's exist. ---------------------------------------------------------------------- reddit_original · 2022-04-05 02:00 Juniper Networks makes products that serve the internet backbone and they run on FreeBSD. Netflix serves all their video, equaling 40% of all internet traffic using FreeBSD. So there's that. ---------------------------------------------------------------------- brickdoge · 2022-04-05 02:07 I have no idea how accurate this is, but I've heard Netflix migrated their servers to Linux if I recall correctly. I have no idea who Juniper Networks is. ---------------------------------------------------------------------- RandomXUsr · 2022-04-05 04:07 Maybe PFSense would be the way to go. It is based on FreeBSD, and tailored specifically as a Firewall/Router. Additionally; You could use a wifi card that supports hostap mode for wireless or pick up a stand alone AP to add wireless. ---------------------------------------------------------------------- freepackets · 2022-04-05 04:21 Junos is FreeBSD based. Junos-evolved willl be Linux based. For the forwarding plane line cards, they are all running real time Linux based systems. ---------------------------------------------------------------------- OtherJohnGray · 2022-04-05 04:47 Not as of December: https://youtu.be/_o-HcG8QxPc And in any case, the presenter states they can’t use linux for their on-premise streaming appliances as they aren’t GPL compatible. ---------------------------------------------------------------------- [deleted] · 2022-04-05 04:50 [deleted] ---------------------------------------------------------------------- deafphate · 2022-04-05 06:33 That doesn't make any sense to me. Using a GPL based OS doesn't require your product to be GPL. ---------------------------------------------------------------------- deafphate · 2022-04-05 06:37 If OpenWrt meets your needs, why keep looking? BSD and Linux network stacks are both great and work well. Since this is a home router, I doubt you'd be putting on enough load to tell the difference between the two. ---------------------------------------------------------------------- deafphate · 2022-04-05 06:38 Juniper is a network equipment vendor. They're a competitor to Cisco. ---------------------------------------------------------------------- OtherJohnGray · 2022-04-05 06:42 Apparently giving the boxes to ISPs could be construed as distributing the software that was on them, and Netflix didn’t want to be caught in a position of having to give up the source as well. ---------------------------------------------------------------------- QGRr2t · 2022-04-05 07:26 This. Plus OpenWrt has cake for combating bufferbloat. That aside, FreeBSD with IPFW would make a nice router up to 10Gb (pf can't go that high, on any OS). For servers, especially with high IO and lots of traffic, I reach for BSD every time. For home stuff and routers, it depends... I've run both extensively (OpenBSD, FreeBSD, Debian, all kinds). I wouldn't hesitate to run Linux if it fit the requirements better, especially if >10G (there are lots of places outside the US and AU where 10Gb WAN is readily available and cheap). ---------------------------------------------------------------------- motific · 2022-04-05 08:21 In what way do you believe BSDs network stack to be somehow inferior? The prevailing opinion is very much the opposite, it is generally considered vastly more efficient and sensible. ---------------------------------------------------------------------- brickdoge · 2022-04-05 08:57 Never said they were inferior, I like OpenBSD's approach to security a lot. It's just it's missing some critical features available in more modern network stacks. FreeBSD I heard mixed opinions about it. Apparently the Wireguard implementation was so bad, the founder of the protocol himself criticised it. ---------------------------------------------------------------------- reddit_original · 2022-04-05 09:41 Totally inaccurate and Netflix contributes code to FreeBSD. [https://openconnect.netflix.com/en/appliances/](https://openconnect.n etflix.com/en/appliances/) [https://people.freebsd.org/\~gallatin/talks/euro2021.pdf](https://peo ple.freebsd.org/~gallatin/talks/euro2021.pdf) >FreeBSD was selected for its balance of stability and features, a strong development community and staff expertise. All code improvements, feature additions, and bug fixes are contributed directly back to the open source community via the FreeBSD committers on our team. We also strive to stay at the front of the FreeBSD development process, allowing us to have a tight feedback loop with other community and partner developers. The result has been a positive open source ecosystem that lowers our development costs and multiplies the effectiveness of our efforts. ---------------------------------------------------------------------- reddit_original · 2022-04-05 09:46 Which has nothing to do with anything I said. ---------------------------------------------------------------------- OtherJohnGray · 2022-04-05 09:47 Whoops! Sorry, wrong thread! ---------------------------------------------------------------------- OtherJohnGray · 2022-04-05 09:47 FreeBSD wireguard looks better since september? https://www.freebsd.org/status/report-2021-07-2021-09/wg/ Edit: yeah, for security-critical infrastructure it’s still looking a bit green… ---------------------------------------------------------------------- deafphate · 2022-04-05 16:27 They'd have to provide source code to the distributed GPL code, but not their own product. At work we have many appliances based on Suse or CentOS. I'm no IP to lawyer though. ---------------------------------------------------------------------- deafphate · 2022-04-05 16:54 Exactly, the right tool for the job. I've only used Linux routers at home. It worked well enough that I didn't look elsewhere. ---------------------------------------------------------------------- QGRr2t · 2022-04-05 16:57 Jason (Donenfeld, WireGuard creator) has since re-written the `wireguard-kmod` module for FreeBSD 13. It's available in ports and packages, but still under active development (as is all of WG). It's a heck of a lot better - and safer - than the ****show that preceded it. ---------------------------------------------------------------------- QGRr2t · 2022-04-05 16:59 Not 'totally' inaccurate. Netflix still use FreeBSD for the OpenConnect boxes and serving video. That is to say, the important stuff. ;) They did, however, switch to Ubuntu for some of their workflow. IIRC it's for the front end UI that customers see/use. ---------------------------------------------------------------------- QGRr2t · 2022-04-05 21:26 I never understand why people downvote and run on Reddit. If you disagree, cite your sources - or at least discuss. [Here's a blog](https://ubuntu.com/blog/how-netflix-tunes-ubuntu-on-ec2) from ubuntu.com discussing Netflix's use of Ubuntu on the backend, and all the testing and improvement that came from that. They still run Ubuntu today - it's plastered all over the Ubuntu front page. ---------------------------------------------------------------------- lazy-xo · 2022-06-18 13:42 That’s not fair - you’re leaving out a lot of the politics and human factors in this. Wire guard isn’t part of the network stack anyway.