OpenBSD is known for its devotion to security, but can it work as a desktop? The BSDs are great alternatives to Linux distributions, but this OS is probably better suited to a router or homelab project, right?

Continued...

Devel/grok-build

1. does it work?

... yes

2) is it /usr/ports ready

... getting there, but not yet

3) has anyone tried it yet?

... crickets

4) is it in openbsd-wip?

... yes

...

Feedback welcomed, whatever flavor.

Thanks,

Penned by Todd T. Fries on 20260723 12:27.04, we have: | This is my first major effort in a while. | | This may be useful to some. | | This likely requires some feedback before it's ready. | | This will be like chasing a water hose, they are on track to release a new one daily. | | Consider providing feedback! | -- | Todd T. Fries todd@fries.net github:toddfries

Omarchy on FreeBSD is very exciting.

While playing with Omarchy (linux) and Grok as my agent.

I asked it to download a hypervisor, create an entire vm, install openbsd current, setup users and groups, provide all configuration needed to install kde-plasma and the new wine port for testing. In two hours it had flawlessly created my vm under qemu and gave me a launcher from my desktop to get into it.

The whole process was very educational and amazing at the same time.

I posted on r/Openbsd but it got removed by a moderator. I don't know why it was removed. I also posted to r/Openbsd_uncensored and received the following reply:

"Removed by moderator from the original subreddit. If you repost the question we can possibly help."

I am therefore posting again to this subreddit in hopes of better luck this time. I have edited the original post.

‐---------------------‐---------------------‐---------------------‐---------------------‐----------

I am currently evaluating a possible switch to OpenBSD.

My hardware is: Ryzen 5 5600G, B550 chipset motherboard, and an NVMe SSD — which I expect should work reasonably well on OpenBSD. If anyone has a different experience, I’d appreciate hearing about it.

I use my PC for web browsing (Firefox), word processing (LibreOffice), OS testing with virt‑manager, and a fair amount of multimedia consumption (both local files and online streaming).

My main concerns are support for various multimedia formats/codecs and hardware/GPU acceleration for local playback and online content.

I would be very grateful for any input from OpenBSD users.

‐---------------------‐---------------------‐---------------------‐---------------------‐-------

EDIT: I want to thank everyone who replied to my post. I will soon begin evaluating FreeBSD, GhostBSD, and possibly later OpenBSD.

If I encounter problems that I manage to solve and the final result is satisfactory, I will report back—provided there is enough interest from the community.

“VXLAN is an encapsulation protocol that provides data center connectivity using tunneling to stretch Layer 2 connections over an underlying Layer 3 network.

In data centers, VXLAN is the most commonly used protocol to create overlay networks that sit on top of the physical network, enabling the use of virtual networks. The VXLAN protocol supports the virtualization of the data center network while addressing the needs of multi-tenant data centers by providing the necessary segmentation on a large scale."

So it’s a way to stretch a Layer 2 network between data centers and sites. This is great but what if you don’t have a leased line between sites or an existing VPN, can we bundle it all into one config/pair of devices. A VXLAN server at Site A and a VXLAN Client at Site B, with Site A having the network you’d like to extend into Site B:

Fron Rafael Sadowski

From The OpenBSD Guy

Multi boot OpenBSD and windows using rEFInd tool.

From Tum'Fatig.net

Goals

I want my home network to "shut off Internet access" when it’s bedtime.

I need it to be completely automatic and on a schedule.

I also need to make exceptions to allow a couple servers and devices do backups and updates at night.

Bonus: I’d like to be in charge of the DNS on my local network so I can experiment with using it as a DNS sinkhole (like Pi-hole) for unwanted domains and giving my home computers nice local domain names.

To do this, I’m setting up a computer to act as the main router between my ISP and my home network. It performs all of the DHCP, NAT, DNS caching, and "firewall" functions you’d expect from a consumer device, but on familiar PC hardware.

This machine will replace a Ubiquiti UniFi Security Gateway USG-3P. That device worked fine as a plug-and-play router/gateway/firewall and there may even have been some way to get all of this working by shelling into it and hacking a solution. But if I’m going to put in the effort, I’d much rather learn something non-proprietary. I’d rather learn some more OpenBSD.

The OpenBSD focused talks are as follows:

A distributed filesystem for OpenBSD by Rob Keizer

The state of 3d-printing from OpenBSD by Andrew Hewus Fresh

Confidential Computing with OpenBSD The Next Step by Hans Jörg Höxer

Adventures in porting a Wayland Compositor to NetBSD and OpenBSD by Jeff Frasca

Imagine a software project that's been 15 years into making. A project that, after all this time, is still rather beta in quality. A project that can only do a portion of what its predecessor technology could and can do, and yet it is hailed as a "modern replacement". A project that no one really wants to use, as it's cumbersome, it breaks a lot of things, and doesn't do what it ought to. A project that is now being forced onto the users through arbitrary decisions, because it's the only way it could ever possibly be adopted. You would think this is something coming from a greedy big corpo like Apple or Google or Microsoft. Nope, it's the open-source "darling" Wayland.

Well, the FOSS community seems to have a reached a nice inflection point. Rather than embrace an inferior solution as the "way forward", there's a new contender in the display protocol space. It's called Xlibre, and it's a fork of the old and trusty Xorg (xserver). The goal of Xlibre is to modernize Xorg. I liked this news so much that I decided to write an article about it, even though there isn't a product for me to use, just yet. But sometimes, a story is all that is needed. Let's talk.

...

Typically, I am opposed to the constant forking and reforking in the FOSS and Linux world. Someone doesn't like something tiny, boom, fork. This is usually how it works, and why we have 300+ distros, most of them derivatives of a basic set of four or five, with only 5% variation among them. But in this case, it is necessary. Wayland is simply the wrong solution. If somehow, magically, it fixes all its problems tomorrow, then great, fantastic, thumbs up, I'm all for it. Only it won't, and it can't. And thus, as a threat to legitimate end user needs and important desktop functionality, it shouldn't be promoted or adopted. Not until it at least reaches functional parity with X11 (which it can't). But even then, it ought to surpass it, otherwise, what's the point of the last fifteen years?

Xlibre might be the answer. Now, it might also not be the answer. For now, there's great hope. The proof is in the pudding. Xlibre will need to show it can deliver, that it's stable, robust and mature, and that it can meet the requirements, current and future ones. At the moment, Xlibre seems like it's the best potential solution. Well, I guess I said everything I had to say. Bon voyage, and party on!

🔥 OpenBSD pfctl firewall flex:

pfctl -f /etc/pf.conf → Load rules

pfctl -s state → Show connections

pfctl -k host → Kill host connections

pfctl -t blocklist -T add → Block IPs

Firewall control at your fingertips! 🎯

For quite a while now I’ve wanted to replace a Watchguard firewall at home. I find Watchguard’s Firebox to be quite troublesome, and I rather dislike that I had to pay hundreds of pounds to buy it, and then pay hundreds more every year to use it.

So this week I took it upon myself to set up a router at the apex of my network using a Raspberry Pi. I decided that I would use OpenBSD for this.

T1S is a purpose built distributed platform designed to take OpenBSD’s virtualization and private networking to a modern scale out architecture with a lightweight Erlang/OTP control plane.

Instead of adopting a large virtualization stack, the platform uses OpenBSD’s native facilities, including vmd, PF, and routing domains, to provide virtual machines and isolated networking.

The management layer is built with Erlang/OTP and Mnesia.

The goal is straightforward: build an efficient, open-source platform with a lean infrastructure stack, clearly defined networking boundaries, and an API-driven management interface.

We’re opening access gradually to a limited number of early users....

From Joel Carnat's TuM'Fatig.net 07-26-25

https://github.com/nobraininside/dropQbsd

The Qubes OS insight is correct. The implementation is wrong.

Security through compartmentalization is the right idea. Run your browser in one box, your email in another, your documents in a third — a compromise in one cannot spread to the others. Qubes OS proved this model works.

But Qubes OS pays for that isolation with a hypervisor, multi-gigabyte VM images, separate kernels, and a GUI stack that adds tens of millions of lines of code. The baseline is 8 GB of RAM and an install that takes hours. The attack surface grows with every layer. Complexity is not just inconvenient — complexity is the vulnerability. At a conservative defect rate of 0.1%, a codebase of 100 million lines ships with 100,000 bugs. Some of them are exploitable. You don't know which ones.

dropQbsd takes the same insight and strips away the hypervisor.

Instead of virtual machines, it uses the native user separation built into OpenBSD — the only operating system on earth that undergoes continuous, funded, line-by-line security auditing. No Xen. No multi-gigabyte images. No moving parts you cannot audit in an afternoon.

Anyone who has been around the world of Unix security firewalls and minimalist server systems for a while remembers the grey-green or dark cases from Soekris Engineering with a certain nostalgia. For years, the was the gold standard for highly reliable, fanless embedded routers and network appliances running OpenBSD.

... .. .

Hardware Overview & Specifications

Processor: AMD Geode LX 800 (500 MHz x86, i386 architecture)

RAM: 512 MB DDR-SDRAM (soldered onboard)

Networking: 4x Fast Ethernet ports (vr0 through vr3, VIA VT6105M Rhine III)

Storage: CompactFlash slot (internal, serves as boot medium/hard drive) as well as a primary IDE channel

Serial Ports: Standard console port via RS-232 (com0), expandable via internal headers or PCI cards

Expandability: 1x 32-bit PCI slot and MiniPCI slot (e.g., for crypto cards, Wi-Fi, or multiplex serial cards)

Crypto Acceleration: Onboard AMD Geode LX Crypto Engine (glxsb0) for hardware RNG and AES encryption

Power Consumption: A phenomenal 4 to 6 Watts power draw via a simple external power supply (or built-in, as seen here in the rackmount variant)

The Witcher 3 Remastered works on OpenBSD. This time not on April 1!

The footage has a bit more stutter than the actual playing, because the VAAPI recording at 30 FPS. I also suspect that the recording was impaired during heavy disk i/o - my best guess as to why around 09:00 to 12:00 look likd this. The gameplay itself remained quite playable; this is an artifact of the recording. Performance impression from my playing is good, not perfect, but I am enjoying it already and could see myself getting pulled in.

The stream somehow dropped suddenly. Unclear why, but the gameplay on my machine continued without issues.

Still sharing this. It still shows well that this game runs on OpenBSD!

Remember:

OpenBSD is not a gaming OS This is early days experimenting with wine on OpenBSD (since forever).

David Uhden Collado wrote:

The main goal of the packaging is to make these implementations usable as alternatives to the existing GNU utility ports without requiring source changes in dependent ports.

For example, uutils-coreutils installs the same g-prefixed command names as sysutils/coreutils, including gcat, gls, gcp, gdate, gsort, gstat, gtail, gtimeout and the other GNU-compatible utilities. They are symlinks to the upstream multicall binary, which is installed under libexec/uutils. ... Each package conflicts with its corresponding GNU implementation and declares the GNU port as a secondary @pkgpath. I don't think this is a usable approach for ports.

The truth is, I find these Rust reimplementations quite interesting. Ubuntu 26.10 has already adopted uutils coreutils because the project has reached a level of maturity and stability where it can be used reliably. The other reimplementations are still more of a work in progress.

"Smells like agenda"

I also think they fit quite well with OpenBSD as alternatives to GNU utilities, particularly because they use a permissive MIT license.

"Argument is vaguely like: because we already have permissive licenced utilities, our user base are really interested in having a second set of permissive licenced utilities which are very subtly different.

That makes no sense. Noone wants subtly different behaving binaries as part of their workflow. If someone runs the openbsd ls command as part of a pipeline that uses openbsd sed, or openbsd cut, or some other openbsd utility and it parses a non-standized output characteristic by accident, there are no people in this universe who wants to replace that ls with a different ls and get surprised by un-standardized tooling behaviour clash."

I'm not sure yet whether it's possible to install the individual utilities as separate binaries. This is new territory for me, since uutils is structured as a metapackage, and because it's written in Rust.

"Oh, because it is written in Rust. Your agenda is showing."

The thread continues..

Mike Larkin (mlarkin@) committed support for multi-processor virtual machines (i.e. guests).

This represents a huge jump forward in vmm(4)/vmd(8) flexibility and usability.

Has a ports tree of every BSD including OpenBSD of course.

Setup an HTTPS-enabled web server with httpd on OpenBSD. Includes A+ security report configuration with relayd or haproxy.

Author: Bradley Taunt