Welcome to Larvitz Blog! I’m Christian, a Senior Consultant by day and FreeBSD enthusiast by night, with over 20 years in enterprise IT. Here I write about FreeBSD jails, PF firewalling, self-hosting, Linux system administration, and anything that’s cleanly engineered. Most articles are hands-on guides born from running my own infrastructure, from dual-stack networking and Ansible automation to hosting a Mastodon instance on FreeBSD.

Have a question or want to discuss something? Find me on the Fediverse at @Larvitz@burningboard.net. I’m always happy to chat!

#pf Articles

Thu 30 July 2026
Networking

Running Your Own AS: An IXP over VXLAN, IPv4 on the Overlay, and a Config Spring Clean

Part 5 of the AS201379 journey: joining EVIX, an internet exchange that hands out VXLAN tunnels instead of switch ports, carrying a routed IPv4 /29 across the IPv6 overlay with PF policy routing, the dual-FIB routing that makes a VPS work as both a normal host and a routed AS site, moving the downstream MikroTik onto WireGuard, and a long-overdue cleanup of four routers’ worth of accumulated configuration.

Sun 05 July 2026
FreeBSD

A Caching FreeBSD Mirror for DN42: nginx proxy_store, pf, and a Dual-Homed VM

Patching FreeBSD machines inside the DN42 overlay network without giving them clearnet access - a dual-homed VM that lazily caches pkg.freebsd.org, update.freebsd.org, and release tarballs from ftp.freebsd.org with nginx proxy_store, follows CDN redirects server-side, and serves everything over IPv6 into the mesh. Now also available as a public DN42 service at bsdmirror.chofstede.dn42.

Thu 16 April 2026
Networking

Running Your Own AS: Direct Hetzner Peering, a Fourth Edge, and Bringing the Home LAN into the Fabric

Part 4 of the AS201379 journey: adding a fourth FreeBSD edge router at iFog with FogIXP peering, establishing direct BGP sessions with Hetzner, bringing the home network into the AS via an iBGP-speaking MikroTik, and a little traffic engineering to steer Deutsche Telekom traffic over Vultr.

Mon 23 March 2026
FreeBSD

Dual-FIB Policy Routing on FreeBSD: Two Upstreams, One Server, Zero Confusion

How to run a FreeBSD server with two completely independent internet uplinks - a physical provider and a BGP tunnel - using dual-FIB routing tables, PF’s rtable and reply-to directives, and a single bridge that carries NAT’d, routed, and pure public jail traffic simultaneously.

Sat 21 March 2026
Networking

Running Your Own AS: Joining an IXP with a Third Edge Router

Connecting AS201379 to LocIX Düsseldorf via a dedicated edge router - adding direct exchange point peering to the existing multi-homed BGP setup, completing a three-router FreeBSD infrastructure with transit, native peering, and IXP connectivity.

Mon 02 March 2026
FreeBSD

FreeBSD Foundationals: Jails - From Chroot on Steroids to Full Virtual Networks

The first in a series on FreeBSD fundamentals. This one covers Jails from the ground up: why they exist, how classic Jails differ from VNET Jails, what epair interfaces actually are, how bridges tie it all together, and what devfs rules do for your isolation story. Practical configurations included.

Thu 26 February 2026
Networking

Running Your Own AS: Going Multi-Homed with iBGP and three Transits

Expanding a single BGP router into a two-PoP distributed network: adding a Vultr edge router with native BGP peering, three upstream GRE providers and iBGP to tie it together - plus the stateless PF rules that make transit routing actually work.

Sun 08 February 2026
Networking

Running Your Own AS: BGP on FreeBSD with FRR, GRE Tunnels, and Policy Routing

How I obtained my own AS number and IPv6 prefix, set up a FreeBSD BGP router with FRR, and built a tunnel overlay to bring globally routable addresses to servers that already have provider-assigned IPv6 - using dual-FIB policy routing to make both coexist.

Fri 06 February 2026
FreeBSD

PF Firewall on FreeBSD: A Practical Guide

A comprehensive guide to configuring PF on FreeBSD, covering core concepts, practical configurations for jails and dual-stack networking, and advanced techniques including brute-force protection and bastion host setups with authpf.

Tue 13 January 2026
FreeBSD

GeoIP-Aware Firewalling with PF on FreeBSD

Using MaxMind’s GeoLite2 database with FreeBSD’s PF firewall to restrict client-facing services to specific countries, reducing brute-force attempts and log noise while keeping essential services globally accessible.