Networking and Remote Access on OpenBSD Handbook

Create an Administrator Account with doas and SSH Keys

Mon, 01 Jan 0001 00:00:00 +0000

Synopsis #

Routine administration should use a regular account and doas(1) , not a persistent root login. This guide creates an administrator, installs an SSH public key, validates privilege escalation, and preserves a recovery path until the replacement access method has been tested.

Complete this procedure from the local console or a provider console. Keep the existing root session open throughout the final access tests.

Create the Account #

The installer can create a regular account and place it in the wheel group. If no suitable account exists, run adduser(8) as root:

Configure Secure Remote Access with OpenSSH

Mon, 01 Jan 0001 00:00:00 +0000

Synopsis #

OpenBSD includes OpenSSH in the base system. Its defaults are maintained with the operating system and should not be replaced by copied cipher lists or generic hardening templates. A conservative remote-access setup uses a tested administrator account, public-key authentication, deliberate forwarding policy, Packet Filter exposure, configuration validation, and an independent recovery console.

This guide changes authentication only after a key-based administrator session succeeds. Keep the original session and console access available until a second connection works under the final policy.

Use FIDO Security Keys with OpenSSH

Mon, 01 Jan 0001 00:00:00 +0000

Synopsis #

ssh-keygen(1) can create FIDO authenticator-backed SSH keys. The authenticator retains private key material and normally requires a physical touch for each signature. OpenSSH supports ecdsa-sk and ed25519-sk key types.

A non-resident credential stores a key handle in the local private-key file. Both that file and the authenticator are required. A resident credential stores the key handle on a FIDO2 authenticator and can be recovered to another client, but a stolen authenticator may expose more usable credential material.

Configure Wi-Fi Roaming and Wired Failover

Mon, 01 Jan 0001 00:00:00 +0000

Synopsis #

OpenBSD can maintain an auto-join list of wireless networks and select an available access point automatically. A trunk(4) interface can combine Ethernet and Wi-Fi in failover mode so that Ethernet is preferred whenever it has link.

The wired and wireless connections in this procedure must reach the same Layer 2 network. Do not use a failover trunk when the two interfaces connect to different IP networks, different security zones, or unrelated Internet services.

Troubleshoot PF, NAT, and Routing

Mon, 01 Jan 0001 00:00:00 +0000

Synopsis #

Routing and Packet Filter failures often involve several layers at once. A port forward can fail because the interface has no address, the route is wrong, forwarding is disabled, PF loaded a different rule, an old state remains, the service is not listening, or the test never crossed the external interface.

This guide follows the packet path in order. It begins with read-only inspection and changes one variable at a time. It does not disable PF, flush every state, or replace the ruleset on an exposed remote host.

Route Multiple VLANs with PF

Mon, 01 Jan 0001 00:00:00 +0000

Synopsis #

A virtual LAN (VLAN) separates one Ethernet link into tagged Layer 2 networks. OpenBSD represents each tagged network with a vlan(4) interface. This guide configures two VLANs on one trunk link, enables IPv4 routing, applies an explicit pf.conf(5) policy, and verifies traffic at each layer.

The connected switch must already carry the selected VLAN identifiers as tagged traffic. Management access must not depend on the rules being changed. Keep a console or an established recovery session available until a new administrative session succeeds.

Configure a Road-Warrior WireGuard VPN

Mon, 01 Jan 0001 00:00:00 +0000

Synopsis #

OpenBSD includes the wg(4) WireGuard interface in the base system. This guide configures one OpenBSD gateway and one roaming OpenBSD client with a split tunnel. The client reaches a private LAN through the VPN while ordinary Internet traffic continues to use the client’s existing connection.

WireGuard authenticates peers with public keys. It does not assign addresses, distribute routes, provide user authentication, or create firewall policy. Configure those functions separately.

Route IPv6 Networks without NAT

Mon, 01 Jan 0001 00:00:00 +0000

Synopsis #

Native IPv6 routing assigns a globally routed prefix to each internal network. It does not require network address translation. This guide configures one OpenBSD router with a static upstream, one internal /64, rad(8) router advertisements, and an explicit Packet Filter policy.

The upstream provider must route a prefix to the OpenBSD system. A single on-link address or one SLAAC address does not imply that an additional LAN prefix is available. Confirm the routed-prefix size, next hop, and reverse-routing behavior before making changes.

Test OpenBGPD with Two Providers

Mon, 01 Jan 0001 00:00:00 +0000

Synopsis #

A BGP session can be established while traffic still fails because of forwarding, firewall policy, or a missing return route. This OpenBSD 8.0 lab connects a client to an HTTP server through two simulated providers. It separates route selection, actual packet delivery, export filtering, and recovery into observable steps.

Use five disposable OpenBSD machines with console access. Connect them only to the four isolated Ethernet segments below. Do not attach these segments to a physical network, host gateway, NAT service, or Internet uplink. All addresses and autonomous system numbers are examples for this closed lab.

Unlock an Internal Service with an SSH Key

Mon, 01 Jan 0001 00:00:00 +0000

Synopsis #

Use authpf(8) when a service should become reachable only after its user signs in to the gateway. SSH verifies the user’s key, and authpf loads a PF rule for the connecting IP address. The user keeps that SSH session open while using the service. Logout removes the rule and the associated connection states.

This example grants access to one internal web service using the base OpenBSD tools.

Build a Simple Router and Firewall

Mon, 01 Jan 0001 00:00:00 +0000

Synopsis #

An OpenBSD router and firewall can use two network interfaces: one WAN interface that connects to the Internet service provider and one LAN interface that connects to the local network. The configuration enables IPv4 forwarding, network address translation (NAT), stateful firewalling, IPv4 address assignment with DHCP, and local DNS caching.

A router forwards IP packets between networks. A firewall enforces a policy controlling which packets are permitted. NAT translates addresses on egress to a public address, allowing multiple local hosts to share one public address. OpenBSD uses Packet Filter pf(4) for filtering, NAT, and traffic normalization. See pf(4) .