Back to post index

Spinning up mica, my new OpenBSD router
Tags: [x86] [openbsd] [router] [firewall]
Published: 20 Oct 2015 08:46

Table of contents:

time for change

smyslov, an old Sun Blade 100 running OpenBSD and acting as my home network’s router / firewall, has been running since November 2013 with no problems except occasional wireless timeouts.

Here’s one of the first times booting OpenBSD on smyslov on November 14, 2012. It would be another year before I used it as a router and firewall full time:

smyslov booting OpenBSD

Unfortunately, it’s noisy, and uses too many watts for a system that is on all the time. As well, recently I moved into a smaller apartment. It was time to upgrade my router.

new hardware

I looked for a system that would meet the following criteria:

So, I was very excited when I found the Jetway JBC320U93W-2930, which satisfies all points:


It seemed like the perfect OpenBSD box (it even has a front serial console!), albeit a bit expensive for a router.

installing OpenBSD 5.7

After the obligatory burn-in, I wrote install57.fs to a USB stick, connected all the appropriate peripherals (monitor, keyboard, etc), and booted from the USB. No problems booting, but the USB keyboard didn’t work.

I saw:

ehci0: timed out waiting for BIOS

My only attempt to fix this was to change Advanced->USB Configuration->EHCI Hand-off to Enabled in the BIOS menu. The ehci time out message did not appear again but

uhub1: device problem, disabling port 1

did. I didn’t try anything else because this box comes with a serial console, and the OpenBSD installer supports reading a custom /etc/ during a netboot:

“Please note that for pxeboot(8) configuration, you can create an /etc/boot.conf on the tftp server. This requires no changes to the bootloader or the kernel.”

So, I put set tty com0 in /var/ftpd/etc/boot.conf, netbooted the box, and saw:

>> OpenBSD/amd64 PXEBOOT 3.23
switching console to com0

on the monitor, and:

>> OpenBSD/amd64 PXEBOOT 3.23

on aronian’s serial console (screen /dev/ttyUSB0 9600). Success!

During setup I also chose:

Change the default console to com0? [yes] yes

in case of other usb related problems - plus, I can sign in using serial later if I lock myself out of the box.

The installation was normal, but the Realtek wireless network adapter that shipped with this system isn’t supported as a hostap. I didn’t pay attention and check for hardware compatibility before purchasing. I bought the Atheros AR9281 wireless network adapter and installed that instead.

post-installation configuration

  1. pf.conf remains mostly the same as smyslov's

  2. configured hostname.eth0, hostname.eth1, and hostname.athn0

  3. still using dnsmasq + unbound for local hostname resolution: I can simply ssh alekhine instead of ssh alekhine.local

  4. I use miniupnpd to so that forwarding Playstation 4 traffic works. I’ve tried configuring relayd with the ports that miniupnpd opens but the PS4 sees that as different. It sets NAT Type 3 when using relayd but NAT Type 2 (less restrictive) if miniupnpd is used.

Configuration is straight-forward with rcctl:

  1. rcctl enable dnsmasq

  2. rcctl enable unbound

  3. rcctl enable miniupnpd

  4. rcctl enable relayd

And again, after scratching my head and trying to figure out why the routing wasn’t working, I realized that I forgot sysctl net.inet.ip.forwarding=1. Adding net.inet.ip.forwarding=1 to /etc/sysctl.conf sets this during system startup.


I’m very happy with this box, and with OpenBSD. It continues to be a solid operating system, and this configuration happily routes 1.7 MB/s without the load average exceeding 0.20. I did see some USB peripheral problems (under OpenBSD, Linux might be fine) so this hardware may not be suitable as a workstation, but it is great as a little router / firewall / server.

I was concerned about the heat build-up in this little form factor but the highest temperature I’ve seen on this box under load is 52 degC and it idles around 45 degC. A little hot compared to other actively cooled CPUs that I own but this should be in the safe range for processor temperature.

decommissioning smyslov

Before finding smyslov a new home, I used an IDE to USB3 bridge to read the data off of the old hard drive:

mount -o ro,ufstype=44bsd /dev/sdb3 /mnt/
rsync -avAX --delete /mnt/ smyslov/sdb3/
umount /mnt/

mount -o ro,ufstype=44bsd /dev/sdb4 /mnt/
rsync -avAX --delete /mnt/ smyslov/sdb4/
umount /mnt/

mount -o ro,ufstype=44bsd /dev/sdb5 /mnt/
rsync -avAX --delete /mnt/ smyslov/sdb5/
umount /mnt/

This discovered some bad blocks - not surprising on a very old 4 GB hard drive but I made sure to warn the new owner about it.