Switched to NethSecurity (on arm64)

mark_nl · September 22, 2025, 6:36pm

Hello (Again),

Happy to be an user of a Nethsever/Nethesis product again!

Switched from Opnsense to NethSecurity as a router and after kicking the tires on a PC Engines apu4 (amd X64_86) running it on aarch64 nanopi rs4 now.
To get it running on arm there where some head-scratches and glitches on the way:

It took me a while to figure out the needed contend for the target file. In the end it turned out to be very similar to a (linux)kernel config, which can be made by running make menuconfig in the builder-container and find the differences in .config (diff)
With the refactoring of the builder the dependencies for building uboot are omitted (zlib1g-dev, python3-setuptools, swig, python3-pyelftools, python3-dev)
It tuns out because my build did not create an config for dpi the UI could not display any “object” such as DNS-records or IP reservations. Because of the missing config for dpi the UI choked here with UciExcNotFound for all objects.

github.com/NethServer/python3-nethsec

src/nethsec/objects/init.py

3f5c021f3


      
              - a list of firewall sections where domain set is used
          """
          matches = []
          for section in uci.get_all("firewall"):
              if uci.get('firewall', section, 'ns_src', default=None) == database_id or uci.get('firewall', section, 'ns_dst', default=None) == database_id:
                  matches.append(f'firewall/{section}')
          for section in uci.get_all("mwan3"):
              if uci.get('mwan3', section, 'ns_src', default=None) == database_id or uci.get('mwan3', section, 'ns_dst', default=None) == database_id:
                  matches.append(f'mwan3/{section}')
          for section in uci.get_all("dpi"):
              if uci.get('dpi', section, 'source', default=None) == database_id:
                  matches.append(f'dpi/{section}')
          for section in uci.get_all("objects"):
              try:
                  ips = uci.get_all('objects', section, 'ipaddr')
                  if database_id in ips:
                      matches.append(f'objects/{section}')
              except:
                  continue
          return len(matches) > 0, matches

Here the proof (with kudus for those who got the system displaying right!):

Networking is not my strong point so I need some guidance and tips to test this: for example how to test the max trough put speed? What else to test?

Tbaile · September 23, 2025, 9:08am

Nice job!
Could you kindly provide the .manifest file that the build produced? So that the missing packages can be addressed even when building on another architecture. This will help dramatically!

The missing dpi config file, could be due to a custom builds missing the netifyd plugins. This is intended due to a commercial agreement with Nethesis that allows us to re-distribute such components. A simple touch of /etc/config/dpi is all will take.

I am pretty sure that info in real-time monitor is broken (no data), but everything else should work just fine!

Speedtest is available through CLI: Speedtest — NethSecurity documentation
This will roughly give you what are the speeds that the system can handle.

This will however change based of what traffic analysis you choose to enable, for instance if you enable IPS, you’ll see in top that CPU usage will go up due to the system analyzing all the flows that are currently passing through.

mark_nl · September 23, 2025, 4:27pm

Which one? There are several .manifest files..
Here all the results of the build.

here the used target file:

github.com/markVnl/nethsecurity

config/targets/nanopi-r4s.conf

nanopi-r4s

CONFIG_TARGET_rockchip=y
CONFIG_TARGET_rockchip_armv8=y
CONFIG_TARGET_rockchip_armv8_DEVICE_friendlyarm_nanopi-r4s=y
CONFIG_TARGET_BOARD="rockchip"
CONFIG_TARGET_SUBTARGET="armv8"
CONFIG_TARGET_PROFILE="DEVICE_friendlyarm_nanopi-r4s"
CONFIG_TARGET_ARCH_PACKAGES="aarch64_generic"

Note: I cross compiled on x86_64 the hole thing; compiling on aarch64 failed..

mark_nl · September 23, 2025, 6:13pm

Do not understand what you referring to with info in real-time monitor ..

nevertheless looking for it I found “netdata”.. and I’m impressed!

Copied the dpi config from an x64_86 instance after which the UI worked as expected.
Going to test your suggestion this weekned

Tbaile · September 25, 2025, 7:18am

Inside our UI, you’ll find the real-time monitor page: Monitoring — NethSecurity documentation

This is data that comes from the software that we re-distribute, the same that is missing from the local compilations. Netdata will still work, but it cannot be setup with data retention sadly…

It sure will! But no functionality will be applied, for instance the DPI filtering for the applications won’t work even if configured.

mark_nl · October 3, 2025, 4:50pm

I can confirm a simple touch is all it takes.

thanx, this works fine to test if my ISP delivers what is in my subscription because I have a modest (read cheap) subscription of 100 Mbps it does not push the nanopi R6S** to the limits.
Speediest results are aprox. 135 Mbit/s down and 270 Mbit/s up at a cpu load around 25%**.

**Note I could not resist to buy yet an other arm device… I have 2 lan’s so need 3 nic’s and noticed an USB NIC (which worked after installing the kernel-mod) shuffled the NIC names eth0 and eth1. Besides that this device has 3 PCIe NIC’s, 2 PCIe 3.0 (2 lane) Realtek’s 8125BG and one PCIe 2.1 8211F. Would not call them “enterprice grade”, still decent NIC’s.

So still looking for a local test setup without using the actual internet (ISP) connection.

mark_nl · October 4, 2025, 7:48am

iperf3 seems to be the go-to command line tool, so going to to set up something.
first premature results from lan1 to lan2 are hopeful
(On the right htop running on the Nethsecurity device)

Tbaile · October 6, 2025, 7:28am

You can see that both netifyd and snort are keeping tracks of the traffic, this will likely hinders the max speed you can have on the device when using such testing utils (unless you want to analyze real-world scenarios, in that case it’s fine)

oneitonitram · October 6, 2025, 7:59am

so nethsecurity supports both arm and x86?

Tbaile · October 6, 2025, 8:20am

You can compile the whole system for it, but we cannot give an official support yet.

At the moment if you compile nethsecurity by yourself, Deep Package Inspection monitoring and filtering won’t work since it’s something that we compile ourselves from a private repo.

Planning to tackle this issue in the next releases, we need to update netifyd to v5 and some things might change