subnetspider

https://mastodon.bsd.cafe/@subnetspider

My main interests are IPv6, FreeBSD, ZFS and jails.

I also enjoy playing around with automation, networking, virtualization, lots of hardware, free software, and trying to learn more about IT security.

I fix computer networks for a living, each one more borked than the last.

Blog: https://www.subnetspider.com/
DM (Signal): subnetspider.01
Location: 🇪🇺

Public Key

npub14ln3qcf05p0dla6wpwpvyq8z4g85pg5jgjezjljrea8ujyk73s7sleav3d

NIP-05 Address

[email protected]

Profile Code

nprofile1qqs2lecsvyh6qhkl7a8qhqkzqr325r6q52fyfv3f0epu7n7fzt0gc0gpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dstuc6sn

Publishing to

relay.mostr.pub

nos.lol

relay.damus.io

Author Public Key

npub14ln3qcf05p0dla6wpwpvyq8z4g85pg5jgjezjljrea8ujyk73s7sleav3d

Show more details

Last Notes

2026-10-16 14:42:41 GMT

Hey #NetBSD users,
can you share with a n00b how you keep your hosts patched and up to date?
I am used to use freebsd-update/pkgbase and have tried syspatch on OpenBSD once, but here I am completely clueless. 🫠

2026-10-15 13:19:29 GMT

- reply

I tried my home made bolognese with tagliatelle once, and now I can't go back to spaghetti. 😋

2026-10-13 17:58:18 GMT

- reply

👀 now I want Tiramisu, and I make you responsible

2026-10-12 13:28:22 GMT

- reply

I bet the LMM agent upgraded and rebooted FreeBSD without updating the boot code, something which is documented in both the FreeBSD upgrading instructions and in the FreeBSD handbook.

2026-10-10 20:33:55 GMT

I have just noticed that with FreeBSD Jails updated to 15.1-RELEASE, they can't load new firewall rules via "pfctl -f /etc/pf.conf" anymore, if the jail's securelevel is set to 2 or higher. On FreeBSD 15.0 and before this worked.
Is there something I can do to restore this behaviour or do I have to set all my VNET jails to securelevel 1 to allow pfctl to make changes again?
I understand that this is a feature, not a bug, but it still kinda surprised me.
---
Edit
According to the security(7) man page, kern.securelevel should only block changes to pf and ipfw rulesets at level 3, but my jails only run at level 2???

2026-10-10 18:44:59 GMT

After a couple weeks of procrastinating, I finally migrated my NetBox instance from the Ubuntu 22.04 Proxmox LXC old to the new #FreeBSD 15.1 Jail.
The old NetBox instance was still on v4.1.7, because I would have needed to upgraded Postgres 14 to a later version.
Fortunately, the only thing I had to do was to dump the old netbox database and restore it into the Postgres 18 DB inside the jail, and copy all the images from .../media/devicetype-images over.
The Jails runs v4.6.10 and simply running "manage.py migrate" once after restoring the data was all it took.
Now I can finally shut down my Proxmox VE server, as all services have been migrated to my FreeBSD NAS / home server. 😁
https://media.bsd.cafe/bsdmmedia01/media_attachments/files/117/418/065/692/367/994/original/f050698a59d730c5.png
https://media.bsd.cafe/bsdmmedia01/media_attachments/files/117/418/088/437/364/600/original/1e9090897e43c8db.png

2026-10-05 07:46:17 GMT

- reply

I want to be able to run a Tor Guard or Exit relay, which is not allowed on BoxyBSD. ;)

2026-10-05 07:20:03 GMT

Hey there #NetBSD people,
I am thinking about installing NetBSD on a Linux-only VPS provider, which I have done a lot already with FreeBSD, thanks to the mfsBSD project, which lets you install FreeBSD from a RAM disk.
Does something like that also exist for NetBSD as well? I would love it if I could just attach a custom ISO, but a lot of cheap VPS providers only give you a list of 5-6 Linux distros instead.

2026-09-29 18:51:17 GMT

I've just ran `pkg upgrade` on my home server and now it runs FreeBSD 15.1-RELEASE-p4. I don't know if -p4 was released today, or if I only got the patches because I noticed I had "enabled: no" set on the FreeBSD-base pkg repo. Does someone know the answer?

2026-09-26 15:34:37 GMT

- reply

"IT" notes as in "Italian Tiramisu" notes?

2026-09-23 12:55:16 GMT

- reply

Which part of OpenZFS exactly is LLM generated or LLM assisted? I can't find any sources online ... 🤔

2026-09-17 17:08:41 GMT

I always find it funny when someone on the Internet says "ZFS is memory hungry" or "ZFS needs at least 8 GB of ECC RAM to run". Nonsense.
To prove it, I installed #FreeBSD 15.1 (64 bit!) on a 23 year old PC, with ZFS and only 1 GB of RAM, running multiple jails without issue. 😎
It has been a bit tricky to get FreeBSD 15.1 to boot off a modern SATA drive, but I found some old PCI SATA controller I bought way back in the Windows 7 days which is still supported.
The single core AMD Athlon 64 3000+ is a bit slow, but pkgbase really helps with speeding up installing patches. It's still fast enough to reach 604 Mbit/s in iperf3 (and 490 Mbit/s in client mode).
If I wanted to, I could even turn this ancient machine into a NAS, which really proves that old PCs aren't trash, but modern software is.
https://media.bsd.cafe/bsdmmedia01/media_attachments/files/117/287/402/095/022/717/original/11d4afe1d8167d8a.png

2026-09-15 09:07:33 GMT

Fun fact: FreeBSD's ifconfig can display information about installed SFP modules, like their temperature, voltage, and tx/rx power. Example: ifconfig -v ix0
https://media.bsd.cafe/bsdmmedia01/media_attachments/files/117/274/255/230/196/237/original/04d852dbea76420b.png
https://media.bsd.cafe/bsdmmedia01/media_attachments/files/117/274/259/151/178/212/original/1bfdcbff3ece1a43.png

2026-09-15 00:25:58 GMT

- reply

I am 100% sure that even earlier versions of iOS support IPv6 (e.g. SLAAC, NAT64, 464XLAT/CLAT ...). What isn't working exactly?

2026-09-14 13:44:58 GMT

Today I migrated my last Proxmox VE VM to my FreeBSD NAS and migrated it to Bhyve. After a quick zfs send | receive of the Zvols I only had to modify the config file vm-bhyve had created and that was it. 😁
Since the Windows Server 2022 VM was already installed as UEFI, I didn't even had to convert the Install from BIOS to UEFI.
Thank you @npub1ef5…gcpc for your blog post (https://it-notes.dragas.net/2024/11/15/migrating-windows-vms-from-bios-kvm-to-uefi-bhyve/), this helped me a lot. :)
https://media.bsd.cafe/bsdmmedia01/media_attachments/files/117/269/687/913/655/637/original/6b19f8633fe3afce.png

2026-08-27 14:43:49 GMT

- reply

I think I'm going to copy most of what you did and apply it to my own FreeBSD server. I already do the same with Samba and NFS, which both run inside VNET jails, so the host stays tidy. :)

2026-08-23 11:33:15 GMT

- reply

Here is how the netgraph setup looks like:
https://media.bsd.cafe/bsdmmedia01/media_attachments/files/117/144/601/327/850/319/original/eed221c78ad4a53b.png

2026-08-23 11:28:35 GMT

And another #FreeBSD host installed successfully. 😁 After I retired the Proxmox VE host at my parent's house, all services ran on the FreeBSD NAS, but now the secondary DNS jails run on their own thin client once more.
VNET with bridging didn't work, so I used Netgraph instead.
The realtek re0 driver received all of the ethernet frames addressed to the VNET jails, but the bridge0 interface (I tried the new VLAN aware bridging) didn't receive them from their parent interface.
Luckily, I can just create VLAN interfaces on re0 and use Netgraph together with Bastille to create netgrap bridges and netgraph eiface interfaces, which do not require driver support, as they directly hook into the network card's send/receive buffer.
https://media.bsd.cafe/bsdmmedia01/media_attachments/files/117/144/551/257/604/785/original/713c712b0dc17618.png

2026-08-17 21:26:12 GMT

I have no Idea why, but my Nextcloud jail wants to download 5 GB of new packages when updating php84-pecl-imagick:
doas pkg install php84-pecl-imagick
Number of packages to be installed: 173
The process will require 5 GiB more space.
196 MiB to be downloaded.
Does someone know why this is happening? I don't remember this thing having this many dependencies (wayland, llvm, 10 versions of gcc, Nvigia drivers ...).

2026-08-07 16:22:32 GMT

- reply

I suppose boot times will be rather quick?

2026-08-01 08:03:53 GMT

The cable Internet at my parent's house died and in order for IPv6 to work with the 4G internet connection, I've just created a NAT66 source NAT rule on my parent's #OPNsense
This feels very wrong, but since the 4G connection only gets a /64 prefix, I can't do NPTv6, so this is all I can do. But at least it works. 🫣
IPv4 is only NATed by the Cable and 4G routers, and WAN failover is taken care of by Gateway Groups.
https://media.bsd.cafe/bsdmmedia01/media_attachments/files/117/019/171/913/596/412/original/cf156f5fa6a57f26.png
https://media.bsd.cafe/bsdmmedia01/media_attachments/files/117/019/202/161/876/071/original/95c3e8ee93c00c73.png

2026-06-11 11:40:19 GMT

- reply

Did your apartment pass the rat inspection?

2026-06-11 07:02:14 GMT

- reply

Is it just me, or is your blog now loading even faster? Feels almost instant on my 4 year old Smartphone.

2026-05-13 16:14:31 GMT

- reply

True, but IPv6 isn't RFC1918 😉

2026-05-13 15:07:41 GMT

- reply

It works, unless your router is behind a CG-NAT and you want to connect to it via VPN 😁

2026-05-02 11:52:48 GMT

- reply

Looks good, I have only 4 hops (including my OPNsense firewall) in my traceroute. 😁
https://media.bsd.cafe/bsdmmedia01/media_attachments/files/116/504/834/528/477/572/original/548fdc1269146347.png

2026-05-02 11:42:10 GMT

Thanks to a lot of help from @npub1fj6…aq90 I now have access to the DN42 network. :D
https://media.bsd.cafe/bsdmmedia01/media_attachments/files/116/504/792/976/037/307/original/26c56e0141b67fdf.png

2026-04-22 16:16:06 GMT

- reply

CHR on Bhyve, nice. :)
What does the network of the RouterOS VM look like (e.g. bridge + tap / netgraph / ...)?

2026-04-17 07:55:43 GMT

- reply

Pretty sad when all their networks support IPv6 but their hardware doesn't. Consumers apparently don't need IPv6...

2026-04-15 16:54:56 GMT

Yesterday I decided to move my test env at work from VMware ESXi 8.0 to Bhyve, so I exported all VMs, Installed FreeBSD 15.0 on a 2x SSD ZFS mirror, and set up the network (bridge / VLAN) today.
Now I just need to converte the vmdk files and import them, let's see if it works.
The host is an old Dell T330, and since it uses the PERC H330, I had to modify the FreeBSD installer again, so it uses the newer mrsas driver. It's Intel Xeon E3-1230 v6 and 32 GiB of RAM are still fast enough for light virtualization tasks, so no reason to toss it. 😁

2026-03-11 18:15:11 GMT

- reply

The realization that 2012 is already 14 years ago ... some pets don't even live that long. 😅

2026-03-02 21:49:34 GMT

- reply

VNET Jails really are one of FreeBSD's greatest features. 😁
And while I do not have need for, you could also give a jail of of your FreeBSD hosts physical interfaces, skipping epair and bridge interfaces entirely. 😎
Netgraph VNET Jails are also pretty neat, though I find working with ng_* interfaces a bit too complicated, so I usually stick with epair.

2026-02-26 19:03:30 GMT

- reply

Considering that I pay my ISP around €50 a month just for a static /56 IPv6 prefix, this is very tempting. 😵‍💫

2026-02-15 13:24:50 GMT

- reply

NAT64? NAT46!

2025-11-24 23:54:14 GMT

Does anyone know when the #Tor package for #FreeBSD will be upgraded from 0.4.8.20 to 0.4.8.21?
It's been almost a week since 0.4.8.21 was released due to a critical security fix, but nothing's happening... :(

2025-11-04 21:52:43 GMT

Huh ... just enabled DNS64 and DHCP option 108 on my OPNsense to see if my phones would enable their CLAT, guessing that I would need to do more work, but it just works™️.
The iPhone reports 192.0.0.3 as it's IPv4 and 192.0.0.1 as gateway, and the Android doesn't show any IPv4 (but 255.0.0.0 as next hop in traceroute?).
Either way, that's another two IPv6-only devices, I'm actually making progress. 😁
#IPv6 #NAT64

2025-11-02 09:57:50 GMT

I'm currently thinking about the best way to convert my home network to IPv6-only / IPv6-mostly (for devices without CLAT), but the biggest obstacle is my Sophos XG Firewall.
- No IPv6 DNS via router advertisement
- No NAT64 support (only via an explicit proxy).
- No DNS64 support
I'm now asking myself whether I should run OPNsense in parallel with the Sophos FW or simply remove the Sophos FW and revert to OPNsense... 😒

2025-07-13 19:54:27 GMT

So today I tried powerd++ on my physical #FreeBSD hosts as an alternative to the native powerd after reating @npub1wft…s0mg 's blog post about FreeBSD Power Management (https://vermaden.wordpress.com/2018/11/28/the-power-to-serve-freebsd-power-management/).
The first thing I noticed is that with powerd++, the CPUs stay clocked very low at 800 MHz almost all of the time, while with powerd, the clock speeds keep spiking every couple of seconds, and then coming down again.
I don't have a way to measure how large this change is over days, weeks or months, but I'd guess it should save me a couple of % of power.
As the hosts CPUs usually sit at just 1-2% load 99.9% of the time, performance shouldn't be impacted in a meaningful way. :) Considering how a dozen jails are running on them, they're still way overbuilt.
https://media.bsd.cafe/bsdmmedia01/media_attachments/files/114/847/656/779/161/281/original/1ac41bd99ad0daee.png
https://media.bsd.cafe/bsdmmedia01/media_attachments/files/114/847/660/628/106/913/original/b896009bf778de0d.png

2025-07-11 06:08:13 GMT

- reply

PF on modern CPUs barely has any trouble filtering packets at gigabit speeds, more cores do help with routing though - which also depends on your network card, it's drivers, and it's queues. I would recommend Intel i226 NICs when getting a mini-PC, don't touch the i225 NICs though (they suck at stability). Some good-ish 2.5G Realtek NICs also exist, but I never tried them.

2025-07-11 05:26:20 GMT

- reply

Even a Intel N150 should be more than enough for routing/firewalling 1 gigabit of WAN to LAN traffic. I used to run a pf-based firewall on an AMD GX-222GC (2x 2.2 GHz x86 SoC from 2014) and got up to 770 Mbit/s even with that. 😎

2025-06-28 20:58:12 GMT

- reply

Do you boot FreeBSD with the BIOS or UEFI firmware on the T480?

2025-06-03 20:10:27 GMT

- reply

And now there's a Debian 12 VM running on bhyve with the nvme disk driver.
To be honest, vm-bhyve seems to be all I need to run my virtual machines. Maybe I'll just replace my Proxmox VE host and use bhyve instead...
https://media.bsd.cafe/bsdmmedia01/media_attachments/files/114/621/224/106/046/206/original/91acc4f6c1947d0a.png

2025-06-03 19:26:19 GMT

- reply

Can really recommend this video, that all I needed: https://www.youtube.com/watch?v=E47Pd0P58Co
https://media.bsd.cafe/bsdmmedia01/media_attachments/files/114/621/069/374/027/732/original/7839e4815ad7dc58.png

2025-06-03 19:25:12 GMT

I've just set up vm-bhyve on a vanilla FreeBSD 14.2 server and created my first VM, it was actually a lot easier than I thought. :D
https://media.bsd.cafe/bsdmmedia01/media_attachments/files/114/621/020/146/079/392/original/20a122de30af7b59.png

2025-02-17 08:04:26 GMT

- reply

https://www.nasa.gov/image-article/jupiters-south-pole/ He you go :)

2025-02-17 07:37:26 GMT

- reply

It is, it's just from Jupiters South Pole afaik, instead of the equator.

2024-09-30 21:31:04 GMT

Just put the #bsdcafe #boxybsd stickers I got from @gyptazy at FrOSCon on my laptop, still more space to fill. 😄
https://media.bsd.cafe/bsdmmedia01/media_attachments/files/113/228/624/278/153/949/original/77cb3125e3aebc80.jpg