Using OpenBSD as a Secure and Reliable Network Firewall

Learn how routers separate ip subnets and broadcast domains, and use routing tables to route packets via physical interfaces (fiber, ethernet, wireless) or logical interfaces (ssid, vlan, vpn tunnel).

Understand how the dynamic host configuration protocol assigns network addressing information, including network ID, broadcast ID, default gateway, and DNS servers. Learn about DHCP relay for cross-network communication.

Explore IPv4 address classes and subnetting by first octet (A 1–127, B 128–191, C 192–223, D 224–239, E 240–255), covering multicast, broadcast, and reserved addresses like 127.0.0.0/8 and 169.254/8.

Explore subnetting basics, classful boundaries, and IPv4's 32-bit network and host division, then apply RFC 1918 private addresses with NAT on an OpenBSD router.

Explore how nat translates layer three and layer four addresses, including source nat mapping private to public IPs and destination nat with port forwarding, plus its lack of security.

Download OpenBSD from openbsd.org, pick an image architecture (amd64 recommended; i386 discouraged; arm64 caveats), flash to USB with BalenaEtcher or HDD copy, and back up firewall before VM or install.

Explore physical OpenBSD hardware options, including PC Engines APU2 and Dell OptiPlex towers, with PCI Express NICs for better performance; learn to set up in a VM.

Create a firewall virtual machine in VirtualBox, naming it firewall and selecting the ISO image. Set 512 MB RAM and a 4 GB pre-allocated drive, then configure the network interface.

Bridge the virtual machine's second adapter to your wireless card in VirtualBox, and use adapter one with NAT or host-only or internal networks, customizing the virtual machine's IP address.

Use the device manager to add legacy hardware, select Microsoft loopback test net adapter, install it, and finish the configuration in VirtualBox.

Set up network adapters in a virtual box using bridged adapters and a test loopback adapter, configure IP addresses, and explore routing through the vm before installing OpenBSD.

Learn to install OpenBSD as a secure network firewall by configuring interfaces with DHCP, setting root and user accounts, disabling sshd and the X Window System, and verifying the installation.

Install OpenBSD by accepting defaults and setting the time zone. Reboot, log in as root or your user, and begin configuring OpenBSD as a secure network firewall.

Configure OpenBSD network interfaces by assigning lan and wan roles with ifconfig and hostname.m0, then choose dhcp or static wan addresses and verify routes.

Enable ip routing on OpenBSD to turn the system into a layer-3 router, set net.ip.forwarding to one with sysctl and /etc/sysctl.conf, then set up PFF for nat and stateful firewalling.

Configure a stateful pf firewall with nat, define LAN and WAN macros, apply an implicit deny, permit LAN to WAN traffic, and monitor and load the rules.

Configure the dhcp server on the OpenBSD firewall by editing dhcpd.conf with domain name, domain-name-servers, and a subnet. Enable and start the service with rcctl after validating with dhcpd -n.

Discover how to monitor an OpenBSD firewall using Sysstat, vmstat, and Tcpdump, inspect disk usage with df, and manage services with rcctl.

Configure a vlan interface on M0 by creating vlan 20 with 20.1/24 and an 802.1q tag, then reload and verify vlan 20's new connected route in the routing table.

Learn to configure high availability on OpenBSD with carp, creating a carp interface and management IP, sharing an ID, and using advertise skew to fail over to the backup.

Enable high availability on OpenBSD with pfsync to sync firewall states. Configure a dedicated fsync interface with a separate subnet and reload to sync states to the other firewall.

Learn to configure port forwarding on an OpenBSD firewall by creating a macro web server and redirecting WAN traffic on port 80 to the internal web server, with keep state.