Puffy Today I worked on my new network installation: I decided to build a router connected to 3 networks (ext, adm and dmz).

Since I "only" have a 512/128 Kb DSL connection, I like to do some QoS (prio on upload). The best way I found to do this was to use altq under OpenBSD. I used it for a while.

So, I re-installed OpenBSD 3.5 on a another machine (small Pentium 120) and put my old pf.conf from the old machine. Then I did a ssh another-server-far-on-the-net and... the connection got stuck at SSH2_MSG_KEX_DH_GEX_INIT sent... And you know what ? One of my friend had the same problem since two days with his gateway running OpenBSD 3.5...

Finally, I discovered that using pass out all keep state instead of pass out all in packet filter now blocks some SSH connections. It worked under OpenBSD 3.4, 3.3, for me and surely before.

Altq and pf definitively rock, but I will be HAPPY when NetBSD or FreeBSD people will have fully pf/altq integrated in their stable branches.

OpenBSD is definitively a f****ed buggy OS.