Learn OpenBSD - Networking & Network Configuration

#Introduction

In episode 7 you managed storage on disk. Now we move in a different direction — out of the machine: networking. OpenBSD is one of the most respected systems in the world as a router and firewall, and it all starts with one simple thing: how network interfaces are configured.

On Linux, you might be familiar with NetworkManager and ip addr. On OpenBSD, all network configuration is text files in /etc, read at boot by the rc system. Simple, transparent, and auditable — exactly as you'd expect.

#/etc/hostname.if: The Core of Interface Configuration

Every network interface has a configuration file /etc/hostname.<ifname>. Example for em0:

inet 192.168.10.1 255.255.255.0

And for DHCP:

dhcp

The contents of this file are read at boot to bring the interface up. Additional options can go on the next line, for example up, media, or other ifconfig commands.

#Bringing Up an Interface Manually

To apply the configuration without rebooting:

doas sh /etc/netstart em0
ifconfig em0

ifconfig shows the status, IP address, and statistics of an interface. Check available interfaces with ifconfig -a or dmesg | grep -i ethernet.

#Routing and Gateway

Once an interface has an IP, the system needs an exit path. The default route is stored in /etc/mygate:

192.168.10.254

And other routes can be viewed and set with route:

route show
route add default 192.168.10.254
route delete default

A route add at runtime only lasts until reboot; for permanence, use /etc/mygate or a startup script.

#DNS: /etc/resolv.conf

The DNS resolver is configured in /etc/resolv.conf:

nameserver 1.1.1.1
nameserver 2606:4700:4700::1111
lookup file bind

If you use DHCP, this file is usually written automatically. For servers with predictable name resolution, you can set it up again after applying the hostname, or run a local DNS server like unbound — a topic relevant to episode 17.

#Advanced Interfaces

#Interface Aliases

One physical interface can carry many IPs. In /etc/hostname.em0:

inet 192.168.10.1 255.255.255.0
inet alias 192.168.10.2 255.255.255.0

Aliases are useful for virtual services or address transitions.

#VLAN

Network segmentation with 802.1Q is done via the vlan interface:

inet 10.0.50.1 255.255.255.0 vlan 50 vlandev em0

This line creates the virtual interface vlan50 on top of em0 with VLAN tag 50 and a static IP.

#Trunk (Bonding)

Combining several physical interfaces into a single aggregated link:

inet 192.168.10.1 255.255.255.0 trunkproto loadbalance trunkport em0 trunkport em1

trunk provides redundancy and more bandwidth, common on production servers.

#Bridge

Connecting several interfaces into a single network segment — the basis for virtualization and labs:

add em0 add em1 up

The bridge will become the networking foundation for VMs in episode 18.

#Routing Between Segments: The Bridge to pf

When a machine has two interfaces (WAN and LAN), it can act as a router: forwarding packets between segments. This isn't just about enabling two interfaces — OpenBSD requires net.inet.ip.forwarding to be enabled:

sysctl net.inet.ip.forwarding=1

To make it permanent, write it in /etc/sysctl.conf. But forwarding packets without a firewall is an open door — that's why the next episode (pf) matters so much: you'll decide what is allowed through.

#Network Verification

After arranging the configuration, verify:

ifconfig -a
route show
ping -c 3 192.168.10.254
cat /etc/resolv.conf

ping tests basic connectivity; route show confirms the default path is correct. If there's a problem, start from the most basic: IP, then gateway, then DNS.

#Closing

In episode 8 you built an OpenBSD network: arranging /etc/hostname.if for static IP and DHCP, using ifconfig and route, configuring the DNS resolver in /etc/resolv.conf, and getting to know aliases, VLAN, trunk, and bridge as the foundation for routers, firewalls, and virtualization.

Key takeaways:

• OpenBSD network configuration is text files in /etc, read at boot.
• /etc/hostname.<if> for interfaces, /etc/mygate for the default gateway.
• VLAN, trunk, and bridge are formed through the same hostname.* files.
• IP forwarding must be enabled via sysctl before becoming a router.

In the next episode, episode 9, we'll run httpd, OpenBSD's native web server — arranging /etc/httpd.conf, creating virtual hosts, integrating TLS with acme-client, connecting applications via FastCGI, and turning it into a reverse proxy.