mirror of
https://github.com/opnsense/docs.git
synced 2026-06-09 00:22:06 -04:00
change os references
This commit is contained in:
Ad Schellevis
parent
9ee69df3d2
commit
3f5aeebdfb
19 changed files with 32 additions and 97 deletions
|
|
@ -5,8 +5,8 @@ Development Manual
|
|||
.. image:: /development/images/ideas_join_the_development.jpg
|
||||
|
||||
The OPNsense® project invites developers to start developing with OPNsense:
|
||||
"For your own purpose or even better to join us in creating the best HardenedBSD
|
||||
based open source firewall available!" The development workflow & build process
|
||||
"For your own purpose or even better to join us in creating the best open source firewall available!"
|
||||
The development workflow & build process
|
||||
have been redesigned to make it more straightforward and easy for developers to
|
||||
build OPNsense.
|
||||
|
||||
|
|
|
|||
|
|
@ -111,11 +111,11 @@ socket.
|
|||
Core system
|
||||
-----------
|
||||
|
||||
The core of OPNsense is powered by an almost standard HardenedBSD ® system
|
||||
The core of OPNsense is powered by an almost standard FreeBSD ® system
|
||||
extended with packages using the pkg system. GIT is used for version
|
||||
control and the repositories are split into 4 parts:
|
||||
|
||||
- src : the base (HardenedBSD ®) system
|
||||
- src : the base (FreeBSD ®) system
|
||||
- ports : the ports collection containing third party software
|
||||
- core : the OPNsense gui and system configuration parts
|
||||
- tools : easy tools to build OPNsense
|
||||
|
|
|
|||
|
|
@ -62,7 +62,7 @@ The different field types in our model system are aimed to help the developer sa
|
|||
-----------------
|
||||
Ideal Development
|
||||
-----------------
|
||||
Our ideal OPNsense system looks like a standard HardenedBSD system using our
|
||||
Our ideal OPNsense system looks like a standard FreeBSD system using our
|
||||
pluggable user interface for management, which supports both real users as "machine"
|
||||
users (REST).
|
||||
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@
|
|||
Remote debugging the kernel
|
||||
==============================
|
||||
|
||||
FreeBSD/HardenedBSD supports remote debugging using a serial interface.
|
||||
FreeBSD supports remote debugging using a serial interface.
|
||||
Since most virtual solutions support serial interfaces it can be quite convenient to deploy a kernel and start a debug session
|
||||
on another machine.
|
||||
|
||||
|
|
|
|||
|
|
@ -46,7 +46,7 @@ from pfSense to the new framework to avoid a big-bang approach.
|
|||
Community
|
||||
---------
|
||||
A thriving community can only exist when people are willing to share. We want to
|
||||
make it easier for people to join and help to build the community. With pfSense,
|
||||
make it easier for people to join and help to build the community. With pfSense,
|
||||
this has been rather difficult, as the tools to build it are difficult to use and
|
||||
often do not work in the first few attempts. And since 2014 they are not
|
||||
freely available any more, you need to apply for access with ESF. We believe a
|
||||
|
|
@ -83,9 +83,9 @@ Much work had already been done before the `first official release <https://opns
|
|||
* The build-tools had been completely rewritten from the ground up
|
||||
with clear and easy to read build scripts that are portable and small,
|
||||
|
||||
* OPNsense is now a package that can be installed on top of our custom HardenedBSD
|
||||
* OPNsense is now a package that can be installed on top of our custom FreeBSD
|
||||
build (you can literally do pkg remove opnsense and you are left with an almost
|
||||
standard HardenedBSD base system),
|
||||
standard FreeBSD base system),
|
||||
|
||||
* The firmware upgrade process is now done with pkgng,
|
||||
|
||||
|
|
|
|||
|
|
@ -8,7 +8,7 @@
|
|||
Welcome to OPNsense's documentation!
|
||||
====================================
|
||||
`OPNsense® <https://opnsense.org>`__ is an open source,
|
||||
easy-to-use and easy-to-build HardenedBSD based firewall and routing platform.
|
||||
easy-to-use and easy-to-build FreeBSD based firewall and routing platform.
|
||||
|
||||
**OPNsense** includes most of the features available in expensive commercial
|
||||
firewalls, and more in many cases. It brings the rich feature set of commercial
|
||||
|
|
|
|||
|
|
@ -13,7 +13,7 @@ how to :doc:`contribute`.
|
|||
Welcome to OPNsense's documentation!
|
||||
------------------------------------
|
||||
`OPNsense® <https://opnsense.org>`__ is an open source,
|
||||
easy-to-use and easy-to-build HardenedBSD based firewall and routing platform.
|
||||
easy-to-use and easy-to-build FreeBSD based firewall and routing platform.
|
||||
|
||||
**OPNsense** includes most of the features available in expensive commercial
|
||||
firewalls, and more in many cases. It brings the rich feature set of commercial
|
||||
|
|
@ -93,7 +93,7 @@ Feature set
|
|||
|
||||
The feature set of OPNsense includes high-end features such as forward caching
|
||||
proxy, traffic shaping, intrusion detection and easy OpenVPN client setup.
|
||||
The latest release is based on a recent HardenedBSD for long-term support and uses a
|
||||
The latest release is based on a recent FreeBSD for long-term support and uses a
|
||||
newly developed MVC-framework based on Phalcon. OPNsense’s focus on security
|
||||
brings unique features such as the option to use LibreSSL instead of OpenSSL
|
||||
(selectable in the GUI).
|
||||
|
|
|
|||
|
|
@ -52,8 +52,8 @@ LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
|
|||
NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
|
||||
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
|
||||
OPNsense is based on `HardenedBSD <https://hardenedbsd.org/>`__
|
||||
Copyright © The HardenedBSD Project. All rights reserved.
|
||||
OPNsense is based on `FreeBSD <https://www.freebsd.org>`__
|
||||
Copyright © The FreeBSD Project. All rights reserved.
|
||||
|
||||
OPNsense is a fork of `pfSense® <https://www.pfsense.org>`__
|
||||
(Copyright © 2004-2014 Electric Sheep Fencing, LLC. All rights
|
||||
|
|
|
|||
|
|
@ -158,7 +158,7 @@ Network interface cards
|
|||
.. rubric:: Supported hardware
|
||||
:name: supported-hardware
|
||||
|
||||
The HardenedBSD 11.2-RELEASE is the base of OPNsense. All HardenedBSD drivers
|
||||
FreeBSD is the base of OPNsense. All FreeBSD drivers
|
||||
are included in the OPNsense kernel, and the hardware compatibility is
|
||||
the same.
|
||||
|
||||
|
|
@ -168,8 +168,8 @@ the same.
|
|||
|
||||
For further help and support, see
|
||||
|
||||
- `FreeBSD 11.2-RELEASE Hardware Compatibility
|
||||
List <https://www.freebsd.org/releases/11.2R/hardware.html>`__
|
||||
- `FreeBSD 13.0-RELEASE Hardware Compatibility
|
||||
List <https://www.freebsd.org/releases/13.0R/hardware/>`__
|
||||
- `OPNsense Forum <https://forum.opnsense.org/>`__
|
||||
|
||||
.. rubric:: List of references
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ Supported devices
|
|||
-----------------
|
||||
|
||||
In general, OPNsense should support all cellular modems that are supported by the
|
||||
respective HardenedBSD kernel. However, not all devices behave the same way, you might
|
||||
respective FreeBSD kernel. However, not all devices behave the same way, you might
|
||||
have to tweak your card with specific AT commands, for example in the init string.
|
||||
|
||||
The screenshots in this guide are for a Huawei ME909u-521 miniPCIe cellular modem.
|
||||
|
|
@ -47,7 +47,7 @@ First, we need to figure out what device is accepting AT commands on your modem.
|
|||
the Huawei modem used in this example the device is ``/dev/cuaU0.0``, other modems
|
||||
might provide the AT interface on another device.
|
||||
|
||||
On HardenedBSD, ``/dev/cuauN`` devices are call-out ports that are used for modems instead
|
||||
On FreeBSD, ``/dev/cuauN`` devices are call-out ports that are used for modems instead
|
||||
of terminals, see section `26.2.1 <https://www.freebsd.org/doc/handbook/serial.html>`_ in the FreeBSD manual.
|
||||
|
||||
The best way to locate the correct port is to send AT commands to it. This can be
|
||||
|
|
|
|||
|
|
@ -37,8 +37,8 @@ The device name can differ per system and per serial device. Examples of names a
|
|||
|
||||
* /dev/ttyS0 (serial port, Linux)
|
||||
* /dev/ttyUSB0 (usb-to-serial, Linux)
|
||||
* /dev/cuau0 (serial port, FreeBSD or HardenedBSD)
|
||||
* /dev/cuaU0 (usb-to-serial, FreeBSD or HardenedBSD)
|
||||
* /dev/cuau0 (serial port, FreeBSD)
|
||||
* /dev/cuaU0 (usb-to-serial, FreeBSD)
|
||||
* /dev/tty.usbmodem1112421 (usb-to-serial, macOS)
|
||||
* COM1, COM2, ... (Windows)
|
||||
|
||||
|
|
|
|||
|
|
@ -102,7 +102,7 @@ to get the public key from include:
|
|||
* https://forum.opnsense.org/index.php?board=11.0
|
||||
* https://opnsense.org/blog/
|
||||
* https://github.com/opnsense/changelog/tree/master/community
|
||||
* https://pkg.opnsense.org (/<HardenedBSD version & architecture>/<release version>/sets/changelog.txz) (lands signed and verified in the GUI of the running software)
|
||||
* https://pkg.opnsense.org (/<FreeBSD version & architecture>/<release version>/sets/changelog.txz) (lands signed and verified in the GUI of the running software)
|
||||
|
||||
Note that only release announcements with images (typically all major
|
||||
releases) contain the public key. I.e. 18.7 would have a copy of the public
|
||||
|
|
@ -240,11 +240,11 @@ If you need to know more about using the serial interface,
|
|||
consult the :doc:`serial access how-to<how-tos/serial_access>`.
|
||||
|
||||
Write the image to a USB flash drive (>=1 GB) or an IDE hard disk,
|
||||
either with dd under FreeBSD, HardenedBSD or under Windows with physdiskwrite
|
||||
either with dd under FreeBSD or under Windows with physdiskwrite
|
||||
|
||||
Before writing an (iso) image you need to unpack it first (use bunzip2).
|
||||
|
||||
**FreeBSD, HardenedBSD**
|
||||
**FreeBSD**
|
||||
::
|
||||
|
||||
dd if=OPNsense-##.#.##-[Type]-[Architecture].img of=/dev/daX bs=16k
|
||||
|
|
|
|||
|
|
@ -59,7 +59,7 @@ For IPv4:
|
|||
=============================== ===============================================================================================================================================================================================================
|
||||
**Static IPv4 configuration**
|
||||
IPv4 address
|
||||
IPv4 Upstream Gateway When an Upstream Gateway is set, packets entering the interface will also sent out on the same interface when replied. In addition outbound nat will be set up automatically when mode is set to *Automatic* or *Hybrid*.
|
||||
IPv4 Upstream Gateway When an Upstream Gateway is set, packets entering the interface will also sent out on the same interface when replied. In addition outbound nat will be set up automatically when mode is set to *Automatic* or *Hybrid*.
|
||||
**DHCP client configuration**
|
||||
Configuration Mode
|
||||
Alias IPv4 address Used as a fixed alias IPv4 address by the DHCP client.
|
||||
|
|
@ -144,7 +144,7 @@ interface. Both USB and (mini)PCIe cards are supported.
|
|||
.............................
|
||||
Supported Devices
|
||||
.............................
|
||||
While all devices supported by HardenedBSD will likely function under OPNsense their
|
||||
While all devices supported by FreeBSD will likely function under OPNsense their
|
||||
configuration depends on a AT command string that can differ from device to device.
|
||||
To make thing easier some of these strings are part of a easy selectable profile.
|
||||
|
||||
|
|
|
|||
|
|
@ -15,7 +15,7 @@ different options to utilize IPv6. Currently these scenarios are known to work:
|
|||
.. Warning::
|
||||
|
||||
NAT64, IPv4 <-> IPv6 Network address translations, is currently not supported
|
||||
by HardenedBSD.
|
||||
by FreeBSD.
|
||||
|
||||
-----------
|
||||
Configuring
|
||||
|
|
|
|||
|
|
@ -5,7 +5,7 @@ Netflow Export & Analyses
|
|||
.. image:: images/netflow_analyzer_insight.png
|
||||
:width: 100%
|
||||
|
||||
Netflow is a monitoring feature, invented by Cisco, it is implemented in the HardenedBSD
|
||||
Netflow is a monitoring feature, invented by Cisco, it is implemented in the FreeBSD
|
||||
kernel with ng_netflow (Netgraph). Since Netgraph is a kernel implementation it
|
||||
is very fast with little overhead compared to softflowd or pfflowd.
|
||||
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ install them when not installed by default.
|
|||
The operating system
|
||||
....................................
|
||||
|
||||
The basic ( `HardenedBSD <https://hardenedbsd.org/>`__) system contains a kernel and a base package, which provide the
|
||||
The basic ( `FreeBSD <https://www.freebsd.org/>`__) system contains a kernel and a base package, which provide the
|
||||
bare essentials for the system to be able to boot and do its work.
|
||||
|
||||
Both components are updated using :code:`opnsense-update`, which is explained in more detail
|
||||
|
|
@ -66,7 +66,7 @@ If, for example you would like to install the gnu `nano <https://www.nano-editor
|
|||
|
||||
.. Warning::
|
||||
|
||||
Adding (FreeBSD, HardenedBSD, ..) repositories in :code:`/usr/local/etc/pkg/repos/` manually is not supported and usually lead to unexpected
|
||||
Adding (FreeBSD, ..) repositories in :code:`/usr/local/etc/pkg/repos/` manually is not supported and usually lead to unexpected
|
||||
issues. Before reporting any type of issue with such setups, we kindly ask you to revert to a standard setup first.
|
||||
|
||||
The ports tree
|
||||
|
|
|
|||
|
|
@ -23,8 +23,8 @@ maintained by a large community.
|
|||
-----------------------
|
||||
Relations with OPNsense
|
||||
-----------------------
|
||||
OPNsense is built on top of HardenedBSD which is a fork of FreeBSD. The aim of the OPNsense team is to stay as
|
||||
close to the original HardenedBSD source as possible. OPNsense can be installed on
|
||||
OPNsense is built on top of FreeBSD. The aim of the OPNsense team is to stay as
|
||||
close to the original source as possible. OPNsense can be installed on
|
||||
a standard FreeBSD installation, this way a hosted system can be converted
|
||||
easily to run OPNsense. A bootstrap script is available to make the installation
|
||||
process a joyful experience.
|
||||
|
|
|
|||
|
|
@ -1,65 +0,0 @@
|
|||
===========
|
||||
HardenedBSD
|
||||
===========
|
||||
|
||||
.. image:: ./images/Logo-label-hardenedbsd.png
|
||||
|
||||
------------
|
||||
Introduction
|
||||
------------
|
||||
|
||||
HardenedBSD is a fork of FreeBSD, founded in 2014, that implements
|
||||
exploit mitigations and security hardening technologies. The primary
|
||||
goal of HardenedBSD is to perform a clean-room re-implementation of
|
||||
the grsecurity patchset for Linux to HardenedBSD.
|
||||
|
||||
-----------------
|
||||
Why Fork FreeBSD?
|
||||
-----------------
|
||||
|
||||
Work on HardenedBSD began in 2013 when Oliver Pinter and Shawn Webb
|
||||
started working on an implementation of Address Space Layout
|
||||
Randomization (ASLR), based on PaX's publicly-available documentation,
|
||||
for FreeBSD. At that time, HardenedBSD was meant to be a staging area
|
||||
for experimental development on the ASLR patch. Over time, as the
|
||||
process of upstreaming ASLR to FreeBSD became more difficult,
|
||||
HardenedBSD naturally became a fork.
|
||||
|
||||
|
||||
HardenedBSD completed its ASLR implementation in 2015 with the
|
||||
strongest form of ASLR in any of the BSDs. Since then, HardenedBSD has
|
||||
moved on to implementing other exploit mitigations and hardening
|
||||
technologies. OPNsense, an open source firewall based on FreeBSD,
|
||||
incorporated HardenedBSD's ASLR implementation in 2016.
|
||||
|
||||
|
||||
HardenedBSD exists today as a fork of FreeBSD that closely follows
|
||||
FreeBSD's source code. HardenedBSD syncs with FreeBSD every six hours.
|
||||
|
||||
|
||||
-------------------
|
||||
HardenedBSD's Goals
|
||||
-------------------
|
||||
|
||||
HardenedBSD aims to provide the BSD community with a clean-room
|
||||
reimplementation of the publicly-documented portions of the grsecurity
|
||||
patchset for Linux.
|
||||
|
||||
|
||||
-------------------
|
||||
Who is HardenedBSD?
|
||||
-------------------
|
||||
|
||||
HardenedBSD's core team consists of Oliver Pinter and Shawn Webb.
|
||||
Contributions have been made by many individuals around the globe.
|
||||
|
||||
|
||||
-------------------------
|
||||
Cooperation with OPNsense
|
||||
-------------------------
|
||||
|
||||
In May 2015, HardenedBSD announced collaboration with OPNSense. A
|
||||
HardenedBSD-flavored version of OPNsense was published early on as a
|
||||
proof-of-concept work. As the proof-of-concept proved stable, robust,
|
||||
and scalable, OPNsense migrated to HardenedBSD with the support of
|
||||
HardenedBSD's core team.
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 18 KiB |
Loading…
Reference in a new issue