Setting up a FreeBSD / TrueOS home router with IPFW
(Updated 1/13/2015 with in-kernel NAT example!)
Over the Christmas holidays I had some spare time and was ready to take the plunge and retire an old Asus router. It had begun getting rather slow, due to the increasing number of devices connected to our network, and of course I wanted peace of mind using a FreeBSD system I could be sure was up to date with security fixes. I used PC-BSD’s server release, TrueOS 10.1, because I wanted to use ZFS with boot-environments to ensure upgrading and replacing disks would be risk-free down the road. The following details how I setup TrueOS on the new box.
Many users have asked us about the recent OpenSSL Heartbleed bug. This only applies to users of PC-BSD 10.0, users of 9.x and earlier will not be effected.
A patch has gone out this morning to correct the issue, which includes the following FreeBSD security advisories:
By running the graphical “System Updater” you can apply the bug fixes, or via “freebsd-update” at the command-prompt. After applying this fix, please reboot and the systems version should now show 10.0-RELEASE–p9
Kris gets to sit down with a blogger at Texas Linux Fest and discuss a bit about PC-BSD.
I wanted to take this time to give you a status update on PC-BSD / TrueOS, and the direction going forward. As many of you know, we’ve been doing builds of 9.1-RELEASE and 9-STABLE as a “Rolling-Release”. Our new plan is to issue system and package updates on the following schedule:
– Update PKGNG repo on or about the 1st and 15th of the month.
– Update the PKGNG repo on or about the 5th and 20th of the month
– Issue a new “freebsd-update” patch on the 1st, which includes the latest –STABLE version
In addition to the rolling release, we also have some other cool new projects in the works. The first among these is our work to make ZFS the cornerstone of the PC-BSD/TrueOS experience. This will bring features such as ZFS “Boot-Environments”, including the ability to boot directly from them at the boot-loader. If you’ve not run boot-environments before, you will wonder how you survived without them. To accomplish this, we are going to be moving to the GRUB boot-loader, which now has ZFS support. The pbi-manager and Warden already have extensive ZFS support, and we will be enhancing our other utilities, such as “Life-Preserver” with ZFS features as well.
In addition to re-focusing on solely on ZFS as our default file-system, we have had to take a look at the feasibility of continuing with the i386 builds. As many of you know, ZFS is a 21st century operating system and doesn’t play nicely with the legacy i386 kernel / versions of FreeBSD. In addition over the past couple years, more and more of time-consuming issues we’ve encountered have been only on i386, partly due to the fact that most FreeBSD devs have already moved on to 64bit and also due to the quickly shrinking number of users / systems that still run i386. In order to make PC-BSD / TrueOS, secure, stable and timely, we’ve decided to drop the i386 builds going forward, and instead focus on a single 64bit architecture. This means the next editions of rolling-release and 9.2 onward will be 64bit only. If you are already on 64bit, then you won’t need to worry about anything. However if you are running i386 on your box you will need to consider moving it to the 64bit versions in the near future. If your hardware is less than 10 years old then most likely you will be able to do this without any difficulty.
For those helping us test the rolling-release now, I hope to have a new ISO + package set available in the next week or so, which includes the new GRUB boot-loader for Boot-Environments. I will post back details on how to manually setup / test this feature in the near future. Once these new features have stabilized a bit further, we will begin to issue general updates for users of the old 9.1-RELEASE from January to upgrade to 9.1 Rolling Release.
A number of PC-BSD 32bit users have reported problems booting their
systems after applying the latest FreeBSD update patches. We have found the problem and will have a bugfix issued shortly. Once this bugfix is issued, you may then continue re-applying FreeBSD updates. If this has affected your system, you can fix it manually following the directions below.
NOTE: At this time it *only* seems to be hitting users of 9.1-Release on 32bit / i386.
Fixing the problem
If your system has run into this issue, and can no longer boot, you can fix it with the following steps:
1. Boot your 9.1-Release DVD / USB media to the installation screen
2. Right-click on the desktop to open “xterm”
3. Mount your PC-BSD partition:
# mount /dev/ada0s1a /mnt
(Replace “ada0s1” with the disk name / partition number)
4. Copy the original /boot/loader file
# cp /mnt/boot/loader.old /mnt/boot/loader
5. Unmount and reboot
# umount /mnt
# shutdown –r now
A fix named “Boot-loader — beastie” fix has been issued and is being updated to the mirrors as of April 9. Once the update is installed, it is safe to do the freebsd-update.
Since it takes time to sync to all of the mirrors, be sure that it downloads and installs before running freebsd-update.
One of the most requested features in the upcoming PC-BSD 9 series, is the ability to easily install to BootCamp partition, allowing dual-booting with OSX. We are pleased to announce that the initial support for this will be available soon in the 9.0-RC1 release.We are looking forward to feedback from Mac users to ensure this works smoothly for everybody in 9.0-Final.
For details on BootCamp installation, please take a look at the wiki page below.
Special thanks to Marcel Moolenaar for the GPT / gpart improvements which enabled this functionality!