kevans: does bootstrap flua have modules now? re: reviews.freebsd.org/D56266

ivy: yes, we can force bootstrap flua to get consistent behavior as needed

okay, i'll see if i can get that in for 15.1, but unfortunately that still means you can't build 15.0 on 16, unless perhaps we EN the change...

moderately annoying because des flagged the libucl default change as potentially problematic and i forgot to follow-up

weeks before it landed

let me see if i can get bootstrap flua working for packages, that would mean we can avoid the problem in 15.1 and if it's only 15.0 that's affected, it's not so bad. although not ideal

looking at Makefile.inc1, it looks like I got it all into place except for adjusting the BOOTSTRAPPING checks

though with something like pkgbase using it, it's light enough that it might be better to force bootstrap flua all the time

kevans: we also don't know if the user will be building packages during the bootstrap phase, so i think it's much simpler to always bootstrap it

right

i'd at least say that we should bootstrap any of the modules that work with vendored libs, since their behavior is more flexible in ways that we might not like, though the whole set beyond that isn't huge

kevans: how do i actually use the bootstrap flua? if i just do 'flua generate-ucl.lua', it can't find flua, since it's in usr/libexec

doesn't have generate-ucl.lua a proper shebang?

Cheerio! I've some audio trouble. When playing audio the sound is tinny and low. It is a Realtek ALC285. Dmesg shows two pcm on that card both labeled (Internal Analog). I believe I read a post that the reason is some propriery amp not being used. Trying to bypass the speakers and connecting headphones does not work. sysctl shows a nid for Headphones that is disabled. Adding that nid to devices.hint as

headphones and seq=15 doesn't enable it. Not sure how to continue at this point.

oh, just to make sure. The pin is "dev.hdaa.2.nid33" and I added 'hint.hdac.2.nid33.config="as=1 seq=15 device=Headphones"' to /boot/device.hints. Is it correct with hdaa in sysctl and hdac in device.hints?

Oh, it was supposed to be hdaa in device.hints. The Headphones work now and have good sound. The laptop speakers however don't... yet at least.

nimaje: it has #! /usr/libexec/flua, but that will use the host flua, not the bootstrap flua

ah, then probably use the full path to the bootsrap flua libexec is for executables that just shouldn't be in PATH as they have special purposes

bootstrap usr/libexec is in ${TMPPATH} in Makefile.inc1, but i'm not sure setting PATH="${TMPPATH}" is the right way to do this - oddly i can't find anything else that actually uses bootstrap flua

the problem with hardcoding the path is you then can't run the target without bootstrapping, which we do usually support

I meant like ${TMPPATH}/usr/libexec/flua generate-ucl.lua then

hm, so the hosts flua should be used if you aren't bootstrapping currently?

fwiw, i'm not trying to solve this myself, i'm asking kyle what the actual correct/standard solution is :-)

for testing, PATH="${TMPPATH}" seems to work

kevans: does this look more or less right? people.freebsd.org/~ivy/tmp/bsflua.diff - obviously i'll remove the commented out bits, and also just merge ${_flua} into where it's used instead of having a variable, unless you think there's a good reason not to

ivy: yeah, that LGTM- for `make sysent` I setup this _sysent_PATH so it can use flua from the host if we didn't bootstrap it for some reason, but I think it's fine for this in particular to not do that

in particular, you need to have built world beforehand anyways, so we shouldn't have to worry about the bootstrap version not having been built

thanks. i'll need a different solution for D56087, which i was hoping to land this week, but that can wait :-/

is anybody here familiar with overlay filesystems?

like overlayfs, unionfs and aufs?

is it possible that I create a blank .iso/.img file and make it grow on demand as I populate it?

KNOPPIX is doing that as it seems but I don't know how

/s

oops

ivy: FWIW- I think for bsd.pkg.mk, I'd do something like: FLUA_PATH?= /usr/libexec/flua, invoke generate-ucl.lua with that, then override it in Makefile.inc1 to the TMPPATH version

Is this a user support channel, or if not, is there such a thing on irc?

ivy: IMO we don't have to guarantee that one-off package builds at that granularity has to be completely bug-free, as long as the sanctioned path to a full repository is- we can document caveats for the former along the way

kevans: i was thinking to add /usr/libexec to the end of .PATH, but using an explicit variable is probably neater. and yes, i think it's fine to use the host tools if you do a single-directory make, i think that's how most of src works anyway

you shouldn't really be doing that if the host doesn't match src anyway

*nod*

I don't think either approach is strictly wrong here

(mostly just wanted to throw out an idea in case you didn't have any at the moment and didn't want to shoulder the entire burden, since I can't really commit to a patch at the moment)

My current problem #1 is "error installing partcode on partition nda1p1" which I understand means the system will be unable to boot.

What can I do about it? Is there a way within the installer shell to install a bootloader, if this is what I need?

joepublic: "partcode" sounds like a BIOS thing - if your system supports UEFI, try selecting UEFI instead of BIOS+UEFI in the installer

I don't recall it asking anything about UEFI or BIOS...

it's an option during the disk setup dialogue, iirc

will try. thank you.

it doesn't actually ask explicitly, but there's a bunch of options, one of which is boot code type and the default is BIOS+UEFI

(at least, iirc... it's been a while since i ran the installer)

yeah, the installer defaults to BIOS+UEFI (at least that was the case for 14.3)

I am partitioning manually as an almost completely new-to-freebsd user and undoubtedly I am doing something wrong. Running through it again to see if I can get a working config. Don't see a q. about BIOS or UEFI though.

what partitions did you create?

freebsd-boot x2 (one on each ssd), freebsd-ufs (/), freebsd-ufs (/home), freebsd-swap, freebsd-ufs (/data)

this time through, no error about partcode, but the result still doesn't boot.

does your system support UEFI? in that case, you don't need a freebsd-boot partition, you want an 'efi' type partition (around 256MB) which is formatted as FAT

so you are installing on a BIOS system? for UEFI you need a FAT partition

i would strongly suggest using guided partitioning, which will set this up for you and still lets you change/resize the data partitions

The system supports UEFI, but the partitioner tells me I need a boot partition. Maybe the way I am booting the freebsd iso is the problem, I am booting it with ventoy

I'll make a dedicated usb stick for FreeBSD and try again, with guided partitioning.

My secondary problem is that it is not recognizing my Realtek RTL8125 2.5GbE network adapter

that one lands in 16 i think. you can try net/realtek-rge-kmod

noted; thanks, will do once I get the system installed.

yeah, that

I appreciate the help, and have successfully installed FreeBSD with the partitions looking like I want them to. Thanks.

joepublic, Here is a reference you might find useful: klarasystems.com/articles/the-freebsd-boot-process

I like how all of the different boot configurations are described.

joepublic: if you want to try the new rge(4) driver for your realtek card, you can download this and copy it over on a usb stick: people.freebsd.org/~ivy/tmp/realtek…mod-20260222.1500068~f232ddac47.pkg

install it with 'pkg install <filename>' and follow the instructions it prints to edit loader.conf

i have repeated failure for www/node24 ( that is in poudriere ) - termbin.com/6do4

joepublic, I now see Ventoy in the above. It's probably confusing the installer. The channels for all systems are always full of people having problems using Ventoy installing.

well, it looks like hdr_histogram being broken , not node24 itslef. but node24 made depend on it to replace bundled one.

i only found: linux.die.net/man/3/be32toh

I made a FreeBSD usb stick from an .img file and used that instead of the ventoy, successfully. Thank you all.

And for me I have so many older used hardware with buggy UEFI that if it can boot Legacy BIOS then I always select it as it will reliably boot when UEFI will need a helper such as reEFIng or another workaround for buggy UEFI boot firmware.

so, does it looke hdr_histogram library only looks for OpenBSD betoh32 defines? and not FreeBSD?

The link provided points out that you can't boot in BIOS mode from nvme drives, which appears to have been my ultimate problem

Me wonders what .img image because I always use a .iso image written to a USB flash storage and booted that way... But it is no longer important since you report that you have it working.

For the record it was FreeBSD-15.0-RELEASE-amd64-mini-memstick.img

rwp: hybrid .iso is simultaneously amazing and cursed, it doesn't always work

I am curious as to why not use that instead of FreeBSD-15.0-RELEASE-amd64-disc1.iso ??

I didn't know the ISOs were hybrid, so I used an img file

kevans, It does not always work. It only works 99.44% of the time. But the mini-memstick has similar success failure rates too. Actually seems less reliable.

definitely not 99.4% of the time

depends on your firmware

it works reliably if your firmware doesn't get pissy about the image layout

(I always use 99.44 as a made up number. It's the advertised purity of Ivory soap.)

not all firmware agree with it

ventoy itself was booting in BIOS mode, and in turn booting FreeBSD installer in bios mode, so uefi options were not available to me. The FreeBSD stick itself booted in uefi mode and everything was/is happy.

Being a craphound I run a lot of repurposed used salvaged hardware and out of a dozen UEFI systems I have two that boot UEFI out of the box. The rest all need some type of bug workaround. But ALL of the Legacy BIOS booting systems boot without problem.

The HP workstations such as the Z200 series and Z400 series are the worst at UEFI. They all have problems. The only working UEFI systems are other random ones running Coreboot firmware which seems to work perfectly.

now my RTL8125 is working, but at boot it doesn't get an ip address, I have to run dhclient manually. What do I need to edit?

joepublic: put ifconfig_rge0="DHCP" in /etc/rc.conf

(assuming the interface is rge0)

So if you can manage to use hardware running Coreboot firmware then UEFI will probably work perfectly. If not then my experience has all been bad. rEFInd is a good workaround sometimes.

thanks much

rwp: i think that's probably specific to old systems. new systems pretty much always work fine with UEFI (mostly because they all use EDK-II, which is basically the reference implementation of UEFI)

and by new, i mean like... anything in the last 10 years, at least. your Z400 is pretty old, it shipped with Windows Vista

So joepublic what system hardware are you installing upon? A new system that is known to be UEFI working without problems?

It's a fairly new Aorus motherboard with a Ryzen 5 chip on it.

I never know what version of MS-Windows a system shipped with since I always install over the top of it.

specifically, an "X570 AORUS ELITE WIFI"

i do still use BIOS boot on one of my VMs, because the provider uses SeaBIOS which doesn't do UEFI... i complain to them about this every few months

no problems booting grub/debian via UEFI, wouldn't know about any other problems it has UEFI-ing.

Hello, all. Has anybody managed to bridge the main internet interface with an OpenVPN "tun" network? On my side, adding tun0 to the bride fails with: "BRDGADD tun0: Invalid argument (extended error Unsupported interface type)"

According to OpenVPN docs, I need to "NAT or bridge the TUN/TAP interface to the internet", I can't seem to bridge it...

ant-x: You create a bridge, and then you create tun/tap interfaces that attach to the bridge.

What command are you using to create the bridge?

OpenVPN has already created a tun0 interface that I am trying to bridge. Shall somehow interfer in the creation of tun0 by OpenVPN?

bridge is for bridging data link layer networks, tun is a network layer tunnel

OK. Then I have to learn how people manage to access anything (including the wide internet) via the tun interface.

ant-x: The bridge should be created first (on whatever WAN/LAN/whatever interface). Then tunN would be created within the bridge.

what is your goal? just using the tun interface for some routes? add them via route(8)

My goal is to connect from several devices over OpenVPN to my home PC, and route that traffica via a local SOCKS5 proxy form that server to another server, to bypass internet restrictions.

ek, so I must tell OpenVPN to create its tunN interface within an existing bridge?

so you want to use the openvpn server as your default gateway? you don't need a bridge for that

I can use the OpenVPN server as the default gateway on the client-side. But the problem is, nothing is reachable from inside that VPN. I am reading the docs for the "redirect-gateway def1 bypass-dhcp" setting.

ant-x: OpenVPN should be creating the bridge on the WAN/LAN/whatever interface you choose and then assigning tun devices/interfaces to each successful connection it receives.

So I need tap isntead of tun?

ok, so you have created the default route, but it doesn't work? what have you done to debug where the problem is? does the openvpn server see the packages but just not route them?

I have not understood the logs yet. Will analyse them and report (probably with relevant fragments).

ant-x: Are you following any sort of guide of just going off of OVPN's documentation?

and why did you think you need a bridge in addition to the default route?

ek, both. This guide: <freebsdsoftware.org/blog/openvpn-freebsd-setup.html> .

nimaje, because of the comment in the sample config file, saying that I need to "NAT or bridge the TUN/TAP interface to the internet".

ek, as distinct from the guide, I have no Firewall install so far where NAT could be configured.

ant-x: Well, knowing nothing about your topology or what kind of access you're trying to acquire over OVPN gives us our limitation on how we can assist.

Is this not a gateway/firewall/router you're installing this on?

Can you give us an idea of the topology layout so we know what you're trying to accomplish? Maybe a diagram or something posted to a pastebin?

It is a normal computer (a mini-PC actually) connected to the internet via my router.

bridge only works with tap, if you use tun you have to configure routing and probably NATing

nimaje, then that's my snag: I must NAT my tun interface to the internet, and I need a firewall (!) to do that...

ant-x: Yes. In the guide you linked to, they're using PF for the firewall/NAT. Follow that.

And, obviously, make sure the IP scheme you're using matches your networking needs.

you can also allocate some IP from your network to your openvpn client and configure the routing correctly then you can work without NATing, but that needs careful management of your network

Yeah. I've always tried to avoid that.

nimaje, via iptables?

Yes, I can use a different subnet mask 10.*, because my local network is 192.168.*

I must leave work. Will be back from home.

ant-x: You could also maybe try WireGuard instead of OVPN? A lot of people find that easier. Especially if they're not inviting strangers into their network.

I'm one who switched from OpenVPN to WireGuard

ek: its not only easier, its faster too

I use both. WG is faster. But, I don't like that the client decides what routes they can use/add. I much prefer that to be a server-side option.

I hope everyone is watching the Artemis II live stream (if they can)!?

ek: tbf it's still in the server's control, no? it doesn't have to route arbitrary traffic to/from the peer

kevans: From what I understand, it does. It's the responsibility on the server side to route/block traffic as you see fit.

... which is fine. It's just more work on the server-side.

Just kind of opposite of OVPN's routing. That's all limited by the configuration itself.

ek, at this point my OpenVPN nearly works, so I'd prefer to get to some sensible stage with it, especially because WireGuard is said to be blocked here, and OpenVPN not.

ek, looking forward to watch the actual Moon landing.

ant-x: That's fair. It sounds like things should be working if the client is able to connect to the server. Is it just not routing?

Yes.

Have you set up the routing between 192.168/16 (or whatever) and 10/8 (or whatever)?

The client connects.

No, and I have no idea where and how to do it.

ant-x: It sounds like you're just missing the routing/NAT config. Using the guide you had mentioned, check "Step 4: Enable IP Forwarding and NAT". That should get you to where you need to be.

You may not need some of it, depending on what the requirements/scope may be. But, it should work. A quick look at the guide appears correct to me.

Obviously, adjust the IP's/subnets and network interfaces names to match your setup.

Yes, I will, if I fail to avoid NAT and/or the firewall. Is there no other way to link tun0 with re0 (my main internet interface)?

ek, thanks for reviewding that guide!

OK. With pf and NAT, my OpenVPN connection can reach the internet. Now -- to forward its sever-end over a SOCKS5 proxy.

ant-x: Congrats! Glad you got it working. Sorry about the belated replies. I've been kinda hooked on this Artemis II mission stream.

One of my buddies worked on this project (code-wise) so I'm just enamored that things are going so well.

Good!

I am still on step two, though: no idea how to forward the server-side SOCKS5 proxy to the client side via pf rules.

ant-x: What proxy are you using?

A local (to the server) SOCKS proxy created by ssh -D .

It is on 127.0.0.1:6000

Now, when I connect to that server via OpenVPN, I need that proxy to be available to the client.

I think it should be doable via pf redirections.

My server-side OpenVPN subnet is on interface tun0, 10.8.0.0/24 .

And the SOCKS5 proxy, as I understand, is on interface lo0.

So, I think, I need a bidirectional redierction between 10.8.0.1:6000 and 127.0.0.1:6000 (where 10.8.0.1 is the addess of the server in the OpenVPN subnet).

Better still, I'd like to forward all VPN traffic via that proxy, but I failed to do so with proxychains, and am now trying to the proxy available to the client.

In other words, I am now trying to tunnel the server's SOCKS5 proxy over the OpenVPN connection.

Here what I have done:

pass in on tun0 proto tcp from any to 10.8.0.1 port 6000 rdr-to 127.0.0.1 por t 6000

pass out on tun0 proto tcp from any to 127.0.0.1 port 6000 rdr-to 10.8.0.1 por t 6000

s/por t/port