Learn FreeBSD - FreeBSD as a Router, Firewall & Network Appliance

#Introduction

In the previous episode 18, you did performance tuning. Now we bring everything together into real-world scenarios: running FreeBSD as a router, firewall, and network device — one of FreeBSD's most established use cases.

From home routers to enterprise-class appliances, FreeBSD is the foundation of many famous network products. This episode covers those roles, including OPNsense and NAS, then turns to application services: running the Nginx, MySQL, PostgreSQL, and Redis web stack for production.

#FreeBSD as a Router and Firewall

#Assembling a Network Appliance

You already assembled the router basics in episode 11. Now we refine it with best practices: separate WAN and LAN interfaces, active forwarding, NAT, and DHCP:

sysrc ifconfig_em0="inet 203.0.113.1/24"
sysrc ifconfig_em1="inet 192.168.1.1/24"
sysrc gateway_enable="YES"
sysrc pf_enable="YES"
sysrc dhcpd_enable="YES"

#Hardening the Ruleset

The pf ruleset for a network appliance should be minimal and strict — only open the ports you need:

ext_if = "em0"
lan_if = "em1"
table <admin> { 192.168.1.0/24 }
 
set skip on lo0
scrub in all
nat on $ext_if from $lan_if:network to any -> ($ext_if)
block all
pass in on $lan_if from <admin> to any keep state
pass in on $ext_if proto tcp to port 22 from <admin> keep state
pass out all keep state

#OPNsense: A FreeBSD-Based Firewall Distro

OPNsense is a firewall distribution built on FreeBSD — real proof of FreeBSD's capability as an appliance. With a web UI for firewall, VPN, IDS/IPS, and monitoring, OPNsense hides the complexity behind a friendly interface.

For those who love the CLI, running FreeBSD directly as a router is the pure choice. For those who want team management and a UI, OPNsense is a mature, finished product.

#FreeBSD as a NAS with ZFS

ZFS makes FreeBSD a leading choice for network attached storage (NAS):

zpool create nas mirror /dev/ada1 /dev/ada2
zfs create nas/share
zfs set compression=lz4 nas/share
zfs set sharenfs="on" nas/share

File sharing services on FreeBSD can use NFS (as above), Samba for Windows interoperability, or a finished product like TrueNAS, which is based on FreeBSD.

#Running a Web Stack on FreeBSD

#Nginx as the Web Server

Nginx is a popular web server on FreeBSD:

pkg install nginx
sysrc nginx_enable="YES"
service nginx start
service nginx status

Server block configuration goes in /usr/local/etc/nginx/nginx.conf or separate files in conf.d. For TLS, point it at the certificates you created in episode 14.

#Databases: MySQL, PostgreSQL, and Redis

FreeBSD runs production-class databases well:

pkg install mysql84-server
pkg install postgresql16-server
pkg install redis

Enable each one:

sysrc mysql_enable="YES"
service mysql-server start
sysrc postgresql_enable="YES"
service postgresql start
sysrc redis_enable="YES"
service redis start

#Assembling a Complete Stack

A common production pattern: Nginx in front as a reverse proxy and static file server, the application behind it, and the database in the last layer. Put the whole service set on a ZFS dataset for snapshots:

zfs create tank/data/www
zfs create tank/data/db

#Production Web Server Deployment

A few practices that keep a web server healthy:

• Restrict database access to the application only, not the public.
• Use the Nginx reverse proxy for TLS termination.
• Enable log rotation (episode 20).
• Snapshot datasets before application upgrades.

bectl create sebelum-deploy
pkg upgrade
service nginx reload
service mysql-server restart

#Basic Monitoring

Network appliances and web servers need constant monitoring — not just when there's a problem:

service -e
pfctl -s info
systat -ifstat 1
tail -f /var/log/messages

#Closing

In this episode 19, you applied FreeBSD as a network device: a router and firewall with a strict ruleset, an introduction to OPNsense and TrueNAS as FreeBSD-based products, and running the Nginx, MySQL, PostgreSQL, and Redis web stack for reliable production.

Key takeaways:

• A FreeBSD router = forwarding + pf NAT + DHCP with separate WAN/LAN interfaces.
• OPNsense is a FreeBSD firewall distro; TrueNAS is a FreeBSD-based NAS.
• ZFS makes a FreeBSD NAS robust: checksums, snapshots, and replication.
• Nginx + databases + Redis run stably on FreeBSD with the rc system.
• Always snapshot and create a boot environment before big deployments.

In the next episode, episode 20, we'll cover high availability & monitoring — failover with CARP, load balancing, and monitoring with netdata, Prometheus, and node_exporter, plus log rotation with newsyslog.