I’ve been playing around with making VyOS an application aware firewall solution. This was pretty easy to setup using VyOS and nprobe.
Here’s the article:
8 Likes
Very good read! Thanks for pushing the envelope on the filtering side of things. I use my instance of VyOS as a firewall after retiring hardware that previous ran Opnsense, so appreciate this!
1 Like
No problem! One interesting thing with using this on VyOS over OpnSense is the advertised performance difference of Linux vs. FreeBSD. Here is a graphic from the nprobe product page:
Considering my system was barely utilized when maxing out my 1Gbps internet, I believe the Linux performance numbers given. I don’t care to setup OpnSense, so I can’t compare the 2, but I’m very happy with the performance on VyOS.
I was honestly surprised at how easy this was to set up. Almost a direct bolt-on to VyOS and performed very well. It’s to the point that I would suggest to anyone using VyOS as their internet facing device to try it out (will likely require 1.4 or greater). Even if you don’t use it to filter traffic, it can be incredibly useful to see a general list of services you’re device is talking to.
04/May/2024 00:26:02 [nprobe.c:4117] Average traffic: [717.00 pps][All Traffic 5.62 Mb/sec][IP Traffic 5.47 Mb/sec][ratio 0.98]
04/May/2024 00:26:02 [nprobe.c:4125] Current traffic: [125.00 pps][255.88 Kb/sec]
04/May/2024 00:26:02 [nprobe.c:4133] L7 Proto Diff Total
04/May/2024 00:26:02 [nprobe.c:4147] Unknown/0 1.07 MB 7.80 GB
04/May/2024 00:26:02 [nprobe.c:4147] DNS/5 6.40 KB 4.44 MB
04/May/2024 00:26:02 [nprobe.c:4147] HTTP/7 0 B 22.89 KB
04/May/2024 00:26:02 [nprobe.c:4147] NTP/9 76 B 46.31 KB
04/May/2024 00:26:02 [nprobe.c:4147] Outlook/21 16.07 KB 13.72 MB
04/May/2024 00:26:02 [nprobe.c:4147] ntop/26 0 B 745.02 KB
04/May/2024 00:26:02 [nprobe.c:4147] Skype_TeamsCall/38 0 B 74.58 KB
04/May/2024 00:26:02 [nprobe.c:4147] IMAPS/51 0 B 158.33 KB
04/May/2024 00:26:02 [nprobe.c:4147] Discord/58 0 B 26.07 KB
04/May/2024 00:26:02 [nprobe.c:4147] OCSP/63 0 B 57.82 KB
04/May/2024 00:26:02 [nprobe.c:4147] Yahoo/70 75.42 KB 11.97 MB
04/May/2024 00:26:02 [nprobe.c:4147] DisneyPlus/71 0 B 793.49 KB
04/May/2024 00:26:02 [nprobe.c:4147] Steam/74 308 B 2.27 MB
04/May/2024 00:26:02 [nprobe.c:4147] STUN/78 1.99 KB 859.23 KB
04/May/2024 00:26:02 [nprobe.c:4147] IPSec/79 3.15 KB 1.52 MB
04/May/2024 00:26:02 [nprobe.c:4147] ICMP/81 14.11 KB 6.73 MB
04/May/2024 00:26:02 [nprobe.c:4147] RTP/87 14.90 KB 2.34 MB
04/May/2024 00:26:02 [nprobe.c:4147] TLS/91 12.72 KB 168.12 MB
.......many more services omitted for brevity
One thing I didn’t mention in the article is you can also use custom protocol lists, malware lists, and GeoIP data that you create or download.
{ "custom_protocols": "/etc/nprobe/protos.txt" }
{ "category_file": "/etc/nprobe/lists/nfw_malware_list.txt" }
{ "category_file": "/etc/nprobe/lists/nfw_mining_list.txt" }
{ "geoip": { "asn": "/data/dbip-asn-lite-2021-04.mmdb", "city": "/data/dbip-city-lite-2021-04.mmdb" }}
1 Like
This! I saw that when followed the link on your page and was intrigued by that.
Had the APU deployed for years but fiber came and it didn’t have the “oomph” for anything past 1G so that opened the door to trying something new in VyOS.
Have learned a lot since then as a lot of knowledge gets obfuscated behind the GUI.
Regarding the performance difference I think its better to look at x86 and test the very same hardware for both cases.
When going to PC Engines APU and other which isnt x86 based there are plenty of misconfiguration in the kernel complies thats going on and can heavily affect the resulting performance such as pagesizes being used etc. Same with the software being compiled.
Something that gives away that there is something odd going on with their performance numbers is that vanilla Linux who just software routes packets does that at 550Mbps with the PC Engine APU but if you also slap on nprobe that would suddently go at 600Mbps where it should be the other way around.
That is a router doing A should be one speed and the same router doing A+B should be slower.
Looking performance wise Netflix are using FreeBSD servers that dumps 800Gbps of encrypted TLS traffic per server according to: https://papers.freebsd.org/2022/EuroBSDCon/gallatin-The_Other_FreeBSD_Optimizations-Netflix.files/euro2022.pdf
I doubt they would use FreeBSD if the performance difference would be 5x to Linux.