Verdict: OpenBSD

You looked at the internet and correctly concluded it is out to get you. OpenBSD agrees, and has spent thirty-five years acting on it: aggressive code auditing, exploit mitigations invented here and copied everywhere by everyone else, and a default install with famously few remote holes. Two remote holes in a decade is considered a crisis.

What you get

• pf, the firewall other firewalls wish they were. Not just a tool, an entire philosophy about how firewalls should work. If you need a router or firewall, this is why you are here.
• Sane, secure defaults. The installer asks few questions because the answer is already decided. No question marks. No escape hatches for bad ideas. You get what is correct.
• Man pages so good they are the documentation. Not a reference, not a summary. The complete, correct, authoritative answer. Read pf(4). That is your entire firewall tutorial.
• OpenSSH. The remote access tool everyone uses. OpenBSD wrote it. You already run their code on your machine right now.
• Code auditing. Security theater doesn’t work here. The code is read, examined, and questioned before it gets in.

What will hurt

• Performance is not the priority. Security is. Cryptography is slow and expensive and correct. Your benchmarks will notice, and that is the point.
• Hardware support is deliberately conservative. No Bluetooth. Proprietary wireless drivers? No. Check the supported list first, not after. If your card isn’t there, it won’t work.
• The community answers questions precisely and briefly. No hand-holding. No forums. Read the man page before asking, because the answer will be the man page, verbatim.
• Wifi support lags. If Wifi works, it works well. If it doesn’t work on your hardware, that’s because OpenBSD decided not to add proprietary support for it.

Getting help

• OpenBSD FAQ - the only documentation you need, written by the developers themselves.
• OpenBSD Mailing Lists - misc@ for general questions, but read the FAQ first.
• Man pages. Your solution is in man 8 pf or man 5 rc.conf. Go read it.
• IRC: irc.libera.chat, #openbsd channel.

First steps

• Read faq4.html before installing. Yes, really.
• Check the hardware support list for your exact machine type first.
• Use the standard OpenBSD installer. All the options are correct by default.
• Enable PF during install. You want the firewall. That is the whole point.
• Don’t deviate from the installer’s suggestions. OpenBSD developers chose every answer for you. They are smarter than you.

Where to start

Download from openbsd.org, check that your hardware is supported, read the FAQ in order, and install. The entire process is suspiciously quick. That is on purpose.

← FreeBSDNetBSD →

See all verdicts:

LinuxFreeBSDOpenBSDNetBSDDragonFly BSDT2SDE LinuxJailStation 47ChaosBSD