Re: openbsd or netbsd alpha firewall

I have an alphastation DS10 that I went through a bunch of operating 
systems on recently, so I may be able to give you some advice.  However, 
I'm using mine as a desktop, and I have a decent tolerance for high 
maintenance operating systems, so my needs are not the same as yours.

As you mentioned, NetBSD was rather buggy and, if I remember correctly, 
could not install to the hard disk because of a SCSI driver issue.

OpenBSD worked quite a bit better, displaying no obvious hardware bugs, 
however I was not able to get X11 working, which derailed my plans to use 
it as a desktop.

I finally settled on Gentoo Linux, which is wonderfully stable on my DS10. 
It has X11 working well, and even has the latest version of Firefox 
available.

If you're just using it as a firewall, OpenBSD would be a good choice. 
However, OpenBSD does not use iptables or ipf, rather it uses a much more 
modern firewalling language called pf.  So you'll have to learn pf, but I 
think you'll find it a pleasure to use.

OpenBSD is quite easy to setup, however long term maintenance is not 
trivial.  Since only the current and previous OpenBSD releases are 
supported by the developers, and releases are made every 6 months, you 
will need to conduct an upgrade once a year.  This is not a simple 
process, as you can see in this OpenBSD 4.4 to 4.5 upgrade guide:
http://www.openbsd.org/faq/upgrade45.html

Gentoo is rather high maintenance in its own way.  Unlike the large 
monolithic OpenBSD upgrade process, Gentoo updates each of its packages 
(including core packages like gcc and glibc) incrementally so as long as 
you update your system once every week or two, you won't find alot of 
headaches in the upgrade process.  However, if you forget to update it for 
a couple of months, you can expect to have to spend some time on it. 
Additionally, gentoo has its own way of doing many things (portage for 
package management, eselect for selecting alternatives, etc) that will 
take some time to learn and is not useful to know outside of the Gentoo 
context.

In all honesty, if you're looking for a long term supported operating 
system that you should be able to update without problems, I think you may 
want to reconsider Debian.  I know you mentioned you had a problem with 
it, but I think if you install the latest stable release you'll find that 
you can "apt-get upgrade" every few months with little effort.  Sure, 
every few years you'll want to reinstall the latest stable version, but 
thats nowhere near the need for 6-12 month upgrades of OpenBSD.

If you haven't tried OpenBSD before and you want to explore a new 
operating system, I'd say go with OpenBSD.  It really is a pleasure to 
use, just make sure you read the documentation and your root mail after 
installing.

If you want a set it and forget it OS which requires little maintenance, 
you might want to go with Debian.

Jim


On Sun, 2 Aug 2009, Peter wrote:

> Hi,
>    I have an alpha server DS10 which I intended to use for a
> firewall.  Originally it ran debian linux on it a long time ago but I
> tried to update it recently using the debian package manager and it
> was too far and decided to really screw up the system.  This had
> actually just happened to me on another older computer so I decided I
> was sick of debian.
>
>    I had a netbsd 1.5 cd lying around and I decided to install that.
> This was heinously buggy but I figured I could learn something from
> getting it to work.  I even sent a patch to the netbsd people for some
> of the network code, but they just redid it better.  At any rate I was
> "tracking netbsd current".  Now every time I updated and recompiled,
> it took days and usually failed for something silly.  I think I
> realize now that it was ridiculous of me to expect a cvs repository to
> be compilable all the time.  The last time it did this, it kept
> failing because some manifest list of files was wrong.  And I've had
> numerous problems since 1.5 is an old version and put some cruft on
> the system that other setups don't like.  That's why I was tracking
> current in the first place, to just replace it all.  But so I was
> tired, and I just wanted to get it done, and I went and deleted a
> bunch of "extra" libraries that it was complaining about.  I thought
> these were in an object directory that was later copied to the root,
> but it was a link, and, like I said I was tired, but it borked the
> system.  Things like libpam are missing.
>
>   I feel like I have two choices.  I'm not messing around with netbsd
> current anymore.  So I'm either going to order a netbsd 4 cd or
> whatever, or I'm going to switch to openbsd.  I ran openbsd on another
> computer and it was fine, but the hardware on this one is a little
> stranger.
>
>   Anyway, I'm writing for suggestions on which OS I should go with.
> Like I said its a DS10, I'm using it as a bridging firewall, it has a
> pci usb card and two tulip-type dec chip ethernet cards.  I was using
> ipf to do things, but I've also used ipchains.  I'm buying something
> so if anyone has time, it would be nice to have some assurance that
> one of these OSs is better for what I'm trying to do.  I'm not even
> sure netbsd 4 has bridge-ipf support, so that's an issue for me.
> Thanks for reading all this.
>
>              - Peter