FreeBSD

Named

Manually updating a Dynamic controlled zone

"If you have to edit the zone files of dynamic zones manually while the DNS server is running, you'll have to freeze the zones with # rndc freeze <myzone> before editing and unfreeze them with # rndc thaw <myzone> after editing. This is because named(8) has internal state information and external journal files attached to dynamic zones that have to be kept in sync with the zone files".

Rsync

To delete files in the target if they disappeared from the source, then add the --delete option to your command. For example:

rsync -avh source/ dest/ --delete
NB: -avh is for --archive --verbose --human-readable.

Migration of folders to a new server

One shot

rsync -av /var/db/ports/ root@newice3:/var/db/ports/
rsync -av /etc/ root@newice3:/etc/oldice3/
rsync -av /usr/local/etc/ root@newice3:/usr/local/etc/oldice3/
rsync -av /etc/ssh/ssh_config /etc/ssh/sshd_config newice3:/etc/ssh/
rsync -av /etc/banner /etc/motd.template /etc/pki/ newice3:/etc/
rsync -av /etc/pki/ newice3:/etc/pki/
rsync -av /usr/local/lib/sasl2/smtpd.conf root@newice3:/usr/local/lib/sasl2/
rsync -av /var/ftp/ newice3:/var/ftp/

1 full + diff at the migration time

rsync -av --exclude={'rc.d','oldice3','newice3','namedb','openvpn','pkg.conf','portsnap.conf'} /usr/local/etc/ root@newice3:/usr/local/etc/ --delete --dry-run
rsync -av /etc/pf.blocked.ip.conf root@newice3:/etc/ --dry-run
rsync -av /etc/pf.blocked.webspam.conf root@newice3:/etc/ --dry-run
rsync -av /etc/pf.blocked.webspam_awstats.conf root@newice3:/etc/ --dry-run
rsync -av /root/ root@newice3:/root/ --delete --dry-run
rsync -av /home/ root@newice3:/home/ --delete --dry-run
rsync -av /var/www/ root@newice3:/var/www/ --delete --dry-run
rsync -av /usr/local/www/ root@newice3:/usr/local/www/ --delete --dry-run
rsync -av /var/log/ root@newice3:/var/log/oldice3/ --delete --dry-run
rsync -av /var/awstats/ root@newice3:/var/awstats/ --delete --dry-run
rsync -av /var/log/www/ root@newice3:/var/log/www/ --delete --dry-run
rsync -av /var/db/fail2ban/ root@newice3:/var/db/fail2ban/ --delete --dry-run
rsync -av /var/db/mysql/ root@newice3:/var/db/mysql/ --delete --dry-run (to do when mysql server is off)

Nginx

Maxmind

Country based filtering can be performed in nginx thanks to the free Maxmind databases.

A cron job shall be used to update these databases on a daily basis

ZFS snapshots

FreeBSD creates a snapshot at each update (freebsd-update fetch && freebsd-update install). These snapshots are not needed anymore should your system restarts & runs correctly. Moreover they take loads of space on your hardrive.

Procedure to delete

List & check

root@icecube BSD:~ # bectl list
BE                                Active Mountpoint Space Created
14.3-RELEASE-p6_2025-12-19_121434 -      -          927M  2025-12-19 12:14
default                           NR     /          814G  2023-12-01 23:34

Check that the active Boot Envionment is the default (NR set on default).

root@icecube BSD:~ # zfs list -t snapshot
NAME                                       USED  AVAIL  REFER  MOUNTPOINT
zroot/ROOT/default@2025-12-19-12:14:34-0   927M      -   812G  -

Delete

root@icecube BSD:~ # bectl destroy 14.3-RELEASE-p6_2025-12-19_121434

Results

root@icecube BSD:~ # bectl list
BE      Active Mountpoint Space Created
default NR     /          813G  2023-12-01 23:34
root@icecube BSD:~ # zfs list -t snapshot
no datasets available

Reboot or no reboot after a minor system upgrade ?

After a system upgrade performed thanks to :

root@icecube BSD:~ # freebsd-update fetch
root@icecube BSD:~ # freebsd-update install

If the output of these two commands differs, then reboot your system:

root@icecube BSD:~ # freebsd-version -k
14.3-RELEASE-p7
root@icecube BSD:~ # uname -r
14.3-RELEASE-p7

PF

After a reboot of FreeBSD, PF may fail to start due to tables being too big (i.e. > 100k entries).
This is explained here with a quick & dirty non-permanent fix :
https://forums.freebsd.org/threads/table-loading-in-pf-issues.86101/#post-577832

1. First load the PF Options only (specific to big tables handling):

pfctl -Of /etc/pf.conf

1. Then restart PF the usual way

root@icecube BSD:~ # service pf restart
Disabling pf.
Enabling pf/etc/pf.conf:98: cannot define table firehol4: Cannot allocate memory
pfctl: Syntax error in config file: pf rules not loaded
/etc/rc.d/pf: WARNING: Unable to load /etc/pf.conf.
.
root@icecube BSD:~ # sed -n '98p' /etc/pf.conf
table <firehol4> persist file "/etc/pf_table_firehol4"
root@icecube BSD:~ # wc -l /etc/pf_table_firehol4
   99856 /etc/pf_table_firehol4
root@icecube BSD:~ # pfctl -Of /etc/pf.conf
root@icecube BSD:~ # service pf restart
Disabling pf.
Enabling pf.
root@icecube BSD:~ # 

Note that GENERIC FreeBSD kernel have a hardlimit set to 200.000 entries. So if you need more than that, then a custom kernel will have to be compiled and used. This happened to me on 20260920, but instead of recompiling the kernel I deleted one source of data in the table (i.e. duggytuxy). This source accounted for 91997 entries:

root@icecube BSD:~/scripts # wc -l /tmp/duggytuxy
   91997 /tmp/duggytuxy

root@icecube BSD:~/scripts # wc -l /etc/pf_table_*
    1245 /etc/pf_table_be
    6801 /etc/pf_table_befr
   11232 /etc/pf_table_befrmaes
      20 /etc/pf_table_blockedips.conf
    8592 /etc/pf_table_cn
   38098 /etc/pf_table_firehol4
   84849 /etc/pf_table_noirtotal
    3264 /etc/pf_table_tor
   18763 /etc/pf_table_webspam.conf
  172864 total

So I'm losing interesting blocked IP's but I have no choice at the moment as I don't want to use a custom kernel. I tried to aggregate the IP's vs ranges but I wouldn't fall below 200K entries in total ...