Netgate and Open Source: Building a Better Network, Together

Open source has always been about more than free code. It's a global community of maintainers, contributors, testers, documentation writers, and users who have shown, over and over, that people working together in the open build better software than any one company can build alone. Netgate® has been fortunate to be part of that community for a long time, and we want to use this post to say thank you and to share how we try to pull our weight.

Standing on Many Shoulders

Every Netgate product is built on work that thousands of people have contributed, often on their own time and often without recognition. Our products simply would not exist without them.

We see contributing back as part of how open source is supposed to work: when you benefit from a shared resource, you help maintain it. So when our engineers find a bug, we send the fix upstream. When we need a feature, we try to build it in a way that is useful to others, not just to us. And when upstream maintainers review our patches, push back, and make them better, we learn from that process too.

The result is software that is more stable and capable for everyone, including our customers, the wider community, and the projects themselves.

Projects We Rely On, Contribute To and Support

Vector Packet Processing (VPP)

VPP is the high-performance packet processing framework at the heart of TNSR®. Originally developed at Cisco® and contributed to the FD.io project, VPP processes packets in batches (vectors) rather than one at a time, which makes very high throughput possible in software.

We're proud to be the third largest contributor to VPP, alongside Cisco and Intel®, and Netgate engineers help maintain several parts of it. Matt Smith maintains the linux-cp and VRRP plugins, and Jon Loeliger maintains VPP's IPv6 longest prefix match code. Being trusted with that stewardship is something we take seriously.

linux-cp is a good example of how this works. It lets Linux act as the control plane for VPP by mirroring VPP's interfaces into Linux, so standard routing daemons and tools can run alongside VPP's fast data plane. Neale Ranns wrote the original code while at Cisco. Matt built on it, spent months hardening it for production use, and sent every change upstream. Since then, others in the community have contributed their own fixes and improvements, and linux-cp is better for it. That's exactly how we hope open source will keep working.

We're grateful to the FD.io maintainers and community who review, test, and improve everything that lands in the project.

FreeBSD

FreeBSD® is the foundation of pfSense® software, and the relationship between pfSense and the FreeBSD project goes back more than eighteen years. Today Netgate is the third largest sponsor of FreeBSD development by commit volume (measured over the last decade), and several FreeBSD committers work with us.

The best example is pf, the packet filter at the heart of pfSense. pf was created by the OpenBSD project, and FreeBSD's version had drifted from its origins over the years. We've sponsored a long-running effort, led by Kristof Provost, to bring the two back into alignment and carry OpenBSD's improvements into FreeBSD. That work has brought OpenBSD-style NAT, NAT64, packet rate matching, and stateful scrubbing to FreeBSD, along with dummynet traffic shaping support and a growing automated test suite. Fixes flow in both directions, and we're grateful to the OpenBSD developers whose work made all of it possible.

Other contributions include if_ovpn, a kernel offload driver for OpenVPN that roughly triples throughput, and the igc(4) driver for Intel's i225 and i226 2.5 Gbps Ethernet interfaces. All of this is available to every FreeBSD user and every project built on FreeBSD, not just pfSense users. We owe a lot to the FreeBSD developers and the FreeBSD Foundation, whose careful stewardship makes a project like pfSense possible in the first place.

DPDK (Data Plane Development Kit)

DPDK is a set of libraries and drivers for fast packet processing that underpins many high-performance networking applications, including TNSR. Running DPDK in demanding production environments teaches us a lot about how it behaves under real load, and we share what we learn with the project.

FRRouting (FRR)

FRR is the open-source routing protocol suite behind dynamic routing in pfSense Plus and TNSR, with support for BGP, OSPF, IS-IS, RIP, and more.

Because we run FRR across two product lines and everything from small business edge deployments to service provider networks, we see a wide range of real-world conditions. That experience goes back to the project as bug reports, fixes, and feature work.

Clixon

Clixon is an open-source framework for network configuration and management that provides NETCONF and RESTCONF support. Netgate has sponsored Clixon since its beginning, and we're proud to have helped a project like this get off the ground. Most of the credit belongs to Clixon's developers and maintainers, whose work has made it a capable, standards-based foundation that anyone can build on. It's a big part of what makes TNSR work well for automation and programmable infrastructure, and our use of it in TNSR continues to drive our contributions back to the project.

strongSwan

strongSwan provides IPsec VPN connectivity in pfSense Plus and TNSR, from small remote-access setups to high-throughput site-to-site tunnels. It handles some of the most security-critical work in our products, and we contribute to help keep it robust, fast, and compatible with the many VPN environments people run.

Linux Kernel

Our work in high-performance networking has also led to contributions to the Linux kernel, which underpins a huge share of the world's computing infrastructure. These contributions go beyond the specific pieces our products depend on, and we're glad to be a small part of that effort.

Why We Do This

People sometimes ask why a commercial company puts real engineering time into upstream work. For us, there are three reasons.

It makes the software better for everyone. Working closely with upstream projects means we understand the code more deeply, build real relationships with maintainers, and end up with a stronger foundation for everyone who relies on it.

It's how we say thank you. The open-source community gave us an extraordinary foundation to build on. Helping maintain it, through code, bug reports, and financial sponsorship, is the least we can do.

Shared infrastructure only stays healthy if people share the work. When the igc(4) driver landed in FreeBSD, every FreeBSD-based project benefited. When a fix lands in VPP, every FD.io user benefits. Open source works because many organizations and individuals make these kinds of contributions, and we want to keep doing our part.

A Long-Term Commitment

No single patch defines our relationship with open source. What matters to us is showing up consistently, year after year: in kernel drivers, routing protocols, VPN implementations, management frameworks, and packet processing.

We know we're one contributor among many, and that the health of these projects depends on everyone who writes code, reviews patches, reports bugs, answers questions, writes documentation, and helps newcomers find their footing. We're grateful to all of them.

Get Involved

Open source is the foundation of our products and our engineering culture, and we plan to keep investing in it for the long haul.

If you use any of these projects, consider getting involved. Filing a good bug report, improving a piece of documentation, or helping someone on a forum all make a real difference. And if you'd like to learn more about Netgate's products and the open-source technologies behind them, visit netgate.com.