FreeBSD as adblocker with unbound and pihole-like dashboard
weekend project - pihole-like dashboard for NLNet Labs unbound caching resolver
lukasz.bromirski.net
Recent content on lukasz.bromirski.net
Latest posts
the internet is my (your) filesystem now
weekend project - a Rust implementation of file storage in travelling packets
about me
my name is Łukasz Bromirski . at IS-Wireless , I oversee product and sales as CPO and CSO. we deliver sovereign, high-performance software for private 5G/6G networks. the stack secures defense customers, but also powers critical communication in civilian world. I have 29 years of experience in “professional” IT. I started as IT engineer, had a 3 year stint as a professional developer…
latency matters
when dealing with disks that power your OS, it’s good to understand that the best way to deal with them is not to deal with them at all - store everything in memory and be done with that. unfortunately, data has to be loaded from somewhere. here comes Intel Optane - with amazingly low latencies. how amazing ? well - in range of 10-20μsec while good SSDs land with 80-120 μsec at best. if…
BGP Blackholing with OpenBGPd and pf
one of the common issues with OpenBGPd ports in FreeBSD is that they don’t have FIB integration, and therefore prefixes received over BGP connections won’t be installed in system routing table. outside of route server and looking glass, that makes OpenBGPd poor choice for “true” BGP router - or client for BGP Blackholing PL edge system. FreeBSD has however great stateful…
CCIE SP bootcamp workbook
long time ago, we decided with Piotr Jablonski to create and run our own CCIE Service Providers bootcamp. since then, Cisco didn’t enter this market through autorised trainings. while Piotr ventured to world of containers (and security), I’m personally still happy to continue to deliver these bootcamps. Service Providers are vibrant market, with interesting mix of technologies (and…
Amazing Stories of the Space Age
a great book for fans of digging into the history of spaceflight and various crazy projects. the moon and space bases when it comes to the ’nazi scum’, they are mainly represented by Wernher von Braun , an SS officer whom the Americans decided to whitewash and portray as a great scientist, in line with their own interests. so, you won’t find stories here about alleged Nazi bases on the…
SMB and Other Remote Filesystems
when working with FreeBSD daily, the ability to mount remote filesystems is super handy. if you’re into NFS, this post isn’t for you — in this post I’m more interested in SMB ( CIFS ) and SSH (yep, really!). to use these protocols, you can either go with dedicated tools or take advantage of the nice abstraction layer provided by FuseFS — including its dedicated kernel module available on FreeBSD.
real internet architecture
a very interesting read to check out, especially if you’re used to books written by networking vendors. this one offers a different perspective on the Internet — a mix of academic insight and practical with real-world examples. it’s a short book, but it does a great job of clearly (and practically) explaining key elements of how the Internet is structured. using a kind of “geological”…
'efekt niszczący' and reset
“in light of the current situation” following polish presidential elections (and the sloppy government reaction to proven anomalies in the voting system), I decided to put aside some non-essential activities and dive back into reading—this time on topics that are a bit more political and social. I can wholeheartedly recommend both of these books. let’s start with Destructive…
BGP Blackholing PL project
what it’s all about? on the internet, not all IPv4 and IPv6 prefixes will be sources or destinations of traffic you’d like to have anything to do with. some of them will be used or controlled by bad actors who may try to compromise your network (you have likely been selected at random; do not flatter yourself) or pursue other evil goals . why would you want to receive that traffic, or…
forced MacOS upgrade
if your usual apple -> system settings -> general -> software update doesn’t want to show that there’s update available, and you absolutely, positively know there is one, you can “push” MacOS to refresh list of available updates. to do so, go to terminal and execute: user@MAC ~ % softwareupdate -l Software Update Tool Finding available software Software Update found the…
AS112 and service.arpa
you may have missed that, but IANA decided to properly delegate service.arpa subdomain, just like they did previously to home.arpa - to avoid DNSSEC breakage. if you’re using BIND to serve your own AS112 instance, it’s enough to add following line: zone 'service.arpa' { type master; file 'm/db.dd-empty'; }; (assuming of course, that the file db.dd-empty is in subdirectory m of…
BGP and Multi-Protocol errors
as you work through various configurations (and - inevitably - troubleshooting), you may end up in situation where because of limited visibility (“hey, it’s customer device!”) you can’t really see what’s wrong on the other side. here’s one example - of (allegedly) “Multi-Protocol BGP being enabled” mp-bgp? ain’t no mp-bgp! my friend asked me…
books
books i wrote CCIE Service Provider v5.0 workbook - coauthored with Piotr Jabłoński ; we’re also running special promotion with our late friend Nicholas Russo that can be found here books i translated (to Polish) Słownik terminów i skrótów sieciowych , Warszawa 2002, wydanie I, 272 strony, ISBN: 83-7279-251-8 Cisco Secure PIX Firewalls , Warszawa 2002, wydanie I, 340 stron, ISBN:…
bootcamps
if you want to get really deep dive into network technologies, take a look below - you may find what you need. if you have further questions or need something special - reach out over e-mail lukasz|at|bromirski.net dedicated bootcamps CCIE Service Providers v5.1 bootcamp in english delivered with Micronics self-study materials are available at github for v5.0 of this bootcamp you can also buy…
IOS XR and routes
those of you working on a daily basis with configuration and reconfiguration of network devices are likely to hit various caveats and surprises. sometimes, we hit problems that take hours to troubleshoot. route? what route? we’re adding new router. it has address of 172.16.0.11 that’s defined on Loopback0. this interface and all other physical interfaces of new router are included in…
Firefox leads!
I’m not using any wonderful scripts on my website, that would measure your “responsiveness” or encourage you to subscribe to newsletters. I only refer to font files and that’s basically it. what I am checking every month is from where, how and on which device you’re browsing my pages using the goaccess package. thanks to this, I am not tempted to profile you in any…
Nexus and ECMP for DNS
if you have read my previous pieces about my home network , you know well my core switch is Nexus 93180YC-EX. you know… home, core switch. anycasted services at any point in time I have a number of DNS (and DHCP) servers available, all reachable via either 192.168.168.168 or 2001:470:xx:a6::168. no matter what is going on, at least one should be able to respond. currently, in the…
FreeBSD on Raspberry Pi 5
if, like me, you would like to use RbPi 5 and FreeBSD at the same time, simply copying the 13.2/14.0 image to the SD card is not enough. in addition to the already known one (where rdiskX contains the ID of your SD card/USB key - beware of accidentally overwriting your system drive or another data drive): $ xz -dc FreeBSD-14.0-RELEASE-arm64-aarch64-RPI.img.xz | sudo dd of=/dev/rdiskX…
presentations
presentations from different events (mind it, most of them are in Polish!) Date Event Presentation — Rozmowa Kontrolowana (cybersecurity podcast) Episode 59 (in Polish) 2024-05-14 PLNOG Bezpieczeństwo sieci w kontekście usług DNS — update projektu AS112 2023-05-16 PLNOG BGP Praktycznie — Route Reflectory, ORR, AddPath, EPE i szybka konwergencja 2022-09-06 PLNOG Jak przechwytywać ruch w Internecie…
projects
below you can see some of the community projects I created/actively maintaining: AS 112 - a worldwide project to sinkhole RFC 1918 DNS traffic locally within countries and regions to avoid slamming DNS root servers; I’m maintaining three AS112 servers in different parts of Poland BGP Blackholing - open BGP route server project, that provides “bogons” feed via dynamic BGP peering…
BGP Blackholing with FlowSpec project
what it’s all about? in the internet, not all IPv4 and IPv6 prefixes will be sources or destinations of traffic you’d like to have anything common with. some of them will be used or controlled by bad actors that can try to compromise your network (you have been likely selected at random, do not flatter yourself) or other evil goals . why would you like to receive that traffic? or send…
IOS XR key authentication
long, long time ago I’ve written a post about how to authenticate with keys via SSH to devices working under the control of IOS XE and ASA/FTD. since the big boys usually work with IOS XR, below is a quick guide on how to import keys to this system in versions 7.0+. OpenSSH and PEM format first step is to convert the format used normally by OpenSSH to PEM. this can be done with ssh-keygen :
MacOS & Bluetooth(d)
I’m not a fan of such ‘solutions’ because they hardly qualify as genuine fixes. however, if you find yourself working in MacOS-heavy environment that’s plagued by radio frequency interference, you’ve probably experienced the erratic behavior of Bluetooth-connected accessories. on my mega-desk, I have numerous devices scattered about, not to mention the abundance of…
logging in VRF
quick note for those spending weekends on labbing - if you want to log info (from Syslog for example), and the management interface is in separate VRF (very good idea), you need to configure VRF in two, or even three (if you count VRF definition itself) different places. if you forget one, it won’t work. so, first of all, create management VRF definition: ! vrf definition MGMNT rd 444:444 !…
casual MacOS TCP tuning
ever since the initial tuning of the FreeBSD TCP/IP stack around version 4.x, I’ve found myself occasionally tinkering with the contents of /etc/sysctl.conf just to fine-tune things, you know over time, numerous changes have been made to the FreeBSD TCP/IP stack, including the introduction of modularity. however, MacOS X, being based on FreeBSD, is more conservative and lacks certain…
installing fresh FreeBSD
as I’m installing FreeBSD boxes and VMs left and right, I typically do some initial setup before doing anything else. while some use cases call for additional ports to be installed (like bird or routinator ), there’s pretty standard “intro”. first, make sure the packages themselves are up to date: sed -i '' s/quarterly/latest/g /etc/pkg/FreeBSD.conf pkg upgrade this will…
multithreaded ZIPping
if you have to pack a lot of things, using sheer power of modern multi-core/multi-threaded CPUs may come handy. unless… the tools you’re using are not enabling that by default, and you suffer running everything on one core/thread. as I spend most of my time recently with FreeBSD and MacOS the tools I typically use are command line. therefore, for every gzip - consider using pigz . and…
archive
a set of old projects, I was taking care of in the past. notice it’s all in Polish. tutorials, howtos, articles (nie)oficjalny Cisco FAQ PL pierwszy z projektów, którego miałem zaszczyt zostać koordynatorem – nieoficjalne Cisco FAQ PL. projekt stanął, miał zamienić się w wiki… i tak na razie stoi - od 10 lat :) korzystając jeszcze z miejsca – chciałbym podziękować wszystkim…
RPKI route server
what it’s all about? as part of efforts to protect BGP routes from “hijacking”, which means unauthorized announcement to redirect traffic, IETF came up with idea of running resource certification for some of BGP attributes. RPKI, which stands for Resource Public Key Infrastructure is a specialized framework that enables doing just that - by cryptologically signing information…
bgp blackholing is back
BGP Blackholing is back - with small steps (‘better done than perfect’). go ahead and visit the current project page with “ quick howto ”. happy blackholing!
nice peak info in BGP summary view
nice addition to recent IOS-XE images is the info in BGP view when the peak number of prefixes was received: rtr-edge#sh bgp ipv4 unicast summary [...] 6807 received paths for inbound soft reconfiguration BGP activity 1126906/107856 prefixes, 1337822/171863 paths, scan interval 60 secs 878960 networks peaked at 15:02:09 Jan 29 2022 CET (22:53:01.065 ago) [...] rtr-edge#sh bgp ipv6 unicast summary…
ctrl-break the new (old) way
one of the very old tricks, that’s even documented is how to simulate ctrl-break on newer PCs to break into ROMMON during router/switch boot. instead of fighting with SecureCRT on MacOS, I just used it recently. basically, you: disconnect terminal from the device turn device off set terminal to 1200 (yes, you read this right), 8N1 and no flow control turn device on press SPACE for 10-15…
backpack
every now and then, I like to cover some technology gadgets here, especially when I’m genuinely delighted with them. for instance, a while back, I wrote about the Bose QC 35 wireless headphones (and how I stubbornly resisted them for so long, despite spending countless days flying - thanks, Gaweł !). as you’re well aware, I frequently delve into topics related to FreeBSD , along with…
two-stage commit config for NX-OS
if you’re not accustomed to reading release notes for your favorite platform (Nexus NX-OS in this case), probably you already overlooked that starting with 10.1(2) there’s 2-stage commit system, known from IOS XR. what does that mean, really? that doing changes over CLI, directly in the parser, you can edit/add/remove whole blocks of configuration before committing them to…
rozmowa KONtrolowana
I was invited by Adam Lange and Adam Haertle to share my story in “ rozmowa KONtrolowana ” podcast (in Polish). I’d like to thank both of them and of course all of participants for invitation, leading it, questions and nice way to spend time in familiar, geeky environment :) now - just view/listen to it your favorite format :)
books...
if you’re not first-time visitor here, likely you know already I’m reading a lot of books . a lot? after years of carefully considering and accumulating books, I finally fulfilled one of my early dreams: to have a wall full of shelves dedicated to storing my book collection (as depicted in the opening picture of this post, although some packages obstruct the view - my apologies for…
working rss
as I get old, seems I’m missing obvious signals. my logs were screaming about it, friends made touchy comments… and nothing. after moving to hugo, despite the fact it has built-in RSS feed support, I somehow missed that completely. fortunately, it’s enough to add template to your page definition and… it works . and that’s about it. that’s all. RSS works now.…
Bellingcat
Eliot Higgins has achieved something remarkable by establishing a highly influential organization right from his own kitchen. this organization is dedicated to combatting the chaos caused by rampant disinformation and falsehoods disseminated by individuals, organizations, companies, and even nations. the book takes us on a compelling journey, tracing Higgins’ path from his humble beginnings…
FLoC and all that mess...
if you, like me, just love corporations that blatantly lie in your eyes about “protecting your privacy”, you’re ready to spend some time to make their lives as hard as possible. one of the new ideas is Google FLoC - Federated Learning of Cohorts . great concept, that apparently was to “increase privacy”, but instead actually decreases it even more. first of all, stop…
ipv6 to the rescue
one notable advantage of possessing expertise in IPv6 is the inherent distinction it maintains from IPv4, as they are entirely separate protocols. take a moment to contemplate this concept. pay close attention to the notion of IPv6 being entirely separate protocol . in case of doubt, read this over again, but slower. alternatively, consider adopting a thoughtful expression or jotting down this…
recert in 2021
my journey with expert-level Cisco certification began already quite far long time ago - 15 years. and with Cisco certification overall - even couple years earlier than that. I was finally able to get hands-on practice with Cisco Continuing Education program. apart from the fact, that trying to pass exams right now remotely during pandemic has abstract requirements I do generally believe it makes…
2034 - a book
the book did a lot of noise, being quoted everywhere even before it was published. as part of the marketing before release, they even did limited publishing in parts in partnership with wired . but… the book is bad. simply as that. if you expected Tom Clancy’s level of technical detail, just because one of the authors is retired US Navy admiral - don’t. you won’t find it.…
Calling Bullsh*t
we are all dealing daily with the eponymous “bullsh*t truth” and unfortunately we are inundated with it. we live in an age where opinions are treated as facts, and anyone who has access to the “mass media” suddenly becomes a great philosopher, thinker and scientist all rolled into one. the beginning of the book gives a brilliant summary of the situation we are in: The world…
freebsd rebuild
one of the most common, but at the same time easiest problems to solve, when you’re working with FreeBSD system installed on too small disk is rebuilding the system. in my specific case, it was very old i386 system initially installed around release 6 on a 20GB HDD. at around release 11 I ran out of tricks to pull and still make it, so had to finally add a disk. fortunately, just before…
connecting switches
after I decided to save you and myself from spying eyes of Google Analytics, I don’t really look at my blog web statistics. just glancing over logs shows you’re reading - and that’s about all if you ask me. I noticed however, that for some mysterious reason (the doc is almost two decades old!), my very old article about connecting the switches together still gets downloaded like…
freebsd and git
FreeBSD just migrated to git, and while handbook is being updated, you can do the migration yourself. first of all, move original src directory (if you’re synchronizing over SVN) away, along with customized kernel config file. for my deployments I do: mv /usr/src /usr/src.old then, let’s install git - it’s not (yet) installed by default: pkg install git last, but not least, you…
load sharing, part one
if you happen to have more than one internet connection and they have different usable bandwidths - which is no longer a rarity today - it becomes interesting element in network design. how would you use these links optimally ? i have to admit, that i was provoked to sit down and write down this series of post by Marcin Ślęczek post on ccie.pl forum. Marcin is CEO of networkers.pl but by heart,…
Raspberry Pi 4 and its cooling
Raspberry Pi 4 that comes originally without any case, or can be bought with original case, can bring you headaches. it’s absolutely great and genius computer (never ask me how many I own… ;) ) in version four has a really very fast CPU - Broadcom BCM2711 . it contains four ARM Cortex A72 cores clocked with up to 1.5GHz and dedicated GPU complex . problems people all around internet…