#freebsd Articles

FreeBSD 15 ships mdo(1) and the mac_do(4) policy module in the base system. It replaces sudo and doas for most of my hosts, needs no ports, and configures with a single sysctl. This article walks through enabling it, the rule syntax, a few real examples, and a short detour into the security sysctls I run on every box.

A practical tour of FreeBSD’s built-in tools for watching CPU, memory, disk I/O, and network activity, finding the process or jail that is eating your server, and applying per-jail accounting and limits with kern.racct and rctl.

Building a DN42 node from scratch - registering AS4242422539 and fdce:73f7:a2dc::/48 in the registry, configuring a MikroTik border router with three WireGuard peerings and BGP filters, running a FreeBSD bastille jail as authoritative DNS for chofstede.dn42, and reaching the rest of the hobbyist mesh in two hops.

Part 4 of the AS201379 journey: adding a fourth FreeBSD edge router at iFog with FogIXP peering, establishing direct BGP sessions with Hetzner, bringing the home network into the AS via an iBGP-speaking MikroTik, and a little traffic engineering to steer Deutsche Telekom traffic over Vultr.

cdist is refreshingly minimal - the target only needs POSIX sh, and the control machine speaks ssh. But cdist expects one ssh endpoint per host, and FreeBSD jails are not normally their own ssh targets. Two small Python wrappers plug cdist into jexec on the host, so configuration state flows into every jail without running a single daemon, agent, or Python interpreter inside the jail itself.

Podman runs on FreeBSD too - but without systemd, the workflow is different. This follow-up to my Linux Podman deep dive covers how to run both native FreeBSD and Linux OCI containers on FreeBSD, how container lifecycle management works without Quadlets, and how Podman complements Jails rather than replacing them.

Backups are the thing everyone knows they should do and nobody does well enough. Here’s my multi-stage strategy for keeping about a dozen servers safe: ZFS snapshots with sanoid, off-site replication with syncoid to rsync.net, Proxmox Backup Server with an S3 backend for VMs, and a creative Podman trick for backing up RHEL hosts that don’t have proxmox-backup-client. Plus a dead man’s switch, because the only thing worse than no backups is backups that silently stopped working three months ago.

Watch someone backspace 40 characters instead of pressing CTRL+W, and you’ll understand why this list exists. A collection of shell tricks-grouped by what works everywhere and what’s Bash/Zsh-specific-that save keystrokes and time.

How to run a FreeBSD server with two completely independent internet uplinks - a physical provider and a BGP tunnel - using dual-FIB routing tables, PF’s rtable and reply-to directives, and a single bridge that carries NAT’d, routed, and pure public jail traffic simultaneously.

Connecting AS201379 to LocIX Düsseldorf via a dedicated edge router - adding direct exchange point peering to the existing multi-homed BGP setup, completing a three-router FreeBSD infrastructure with transit, native peering, and IXP connectivity.