This project started as a network design project.
The goal was to build a router-centric, explicit-trust network where all accepted routes must be explicitly defined and allowed up front.
Many networks accumulate state through defaults and side effects. Connectivity appears over time, paths are expanded or compromised, and reasoning about the system becomes difficult.
Here, the approach was the opposite.
All communication is defined. If a path exists, it exists because it is written. If it is not written, it is not allowed to exist. This reduces the system to something that can easily be reasoned about.
Building it took some time. Every path had to be explicitly allowed, and there was some lead time before users could reach their FTP servers, or the internet for that matter.
In this system the router was the control point. We had an array of NICs that would separate the different subnets, keeping local switches where needed. We chose OpenBSD as our routing OS, again.
During deployment, the network did not behave as expected.
The issue was not in the policy or topology, but in the interface itself. The Realtek NICs were listed as supported, but turned out to be a new revision. One the driver did not yet know about.
Replacing the NICs was not an option, so we patched in support ourselves. It worked. After 2 days of stress testing, we pushed it upstream.
The patch was fixed up and merged by maintainer Kevin Lo into the OpenBSD network driver if_rge in October 2025.
What started as a network design ended in a driver contribution.