Lineage and Design Philosophy
All three emerged from the 1993 386BSD fork. FreeBSD and NetBSD split first; OpenBSD forked from NetBSD in 1995 when Theo de Raadt was removed from the NetBSD core team. That origin matters because each project internalized a different primary constraint.
FreeBSD optimises for production server throughput and developer experience. Its design decisions favour performance and compatibility. The ports tree has over 34,000 packages. The base system ships a C compiler, full toolchain, and ZFS. Updates use freebsd-update for binary patches or src for full rebuilds.
NetBSD optimises for portability above everything else. The project supports over 60 hardware platforms, from VAX to RISC-V to the Dreamcast. Its pkgsrc package manager works not just on NetBSD but on Linux, macOS, and other BSDs. If your target hardware is obscure, NetBSD almost certainly has a port.
OpenBSD optimises for correctness and security. The team audits every line of code in the base system on a rolling basis. New exploit mitigations ship every release cycle: W^X enforcement, ASLR with fine-grained randomisation, pledge(2) and unveil(2) syscall sandboxing, and the LibreSSL fork replacing OpenSSL. The trade-off is a smaller package set and less raw performance.
Installation and Initial Configuration
FreeBSD's installer, bsdinstall, gives you disk partitioning with GPT/MBR choice, ZFS or UFS, and optional src/ports trees. A minimal install fits in under 2 GB. Post-install, pkg bootstrap and pkg install sudo get you running in under two minutes.
NetBSD uses sysinst, which is text-based and asks fewer questions. The default filesystem is FFS2. You will need to install pkgsrc manually after base install; there is no equivalent of pkg bootstrap.
OpenBSD's installer is the leanest of the three - around 15 prompts, under 4 minutes on fast hardware. It sets up disk encryption with softraid(4) during install if you answer 'yes' at the disk prompt. The default install drops you into a system where pf is already configured and sshd only allows key-based auth by default in /etc/ssh/sshd_config.
# FreeBSD: bootstrap pkg and install common tools
pkg bootstrap
pkg install -y sudo vim tmux
# NetBSD: fetch and bootstrap pkgsrc
cd /usr && ftp https://cdn.NetBSD.org/pub/pkgsrc/pkgsrc-2024Q4/pkgsrc.tar.xz
tar xf pkgsrc.tar.xz
cd pkgsrc/bootstrap && ./bootstrap
# OpenBSD: install packages (pre-compiled binary sets)
pkg_add vim tmux sudoKernel Architecture and Performance
FreeBSD uses a monolithic kernel with loadable modules (kld). SMP scaling is strong; the network stack has seen continuous work to reduce lock contention. On our test server (dual Xeon, 10GbE), FreeBSD 14.2 pushed 9.4 Gbps sustained TCP throughput with pf disabled and ipfw in place. The sendfile(2) syscall and zero-copy networking give it an edge for high-volume file serving.
NetBSD's kernel is similarly monolithic but the driver model (autoconf) is designed for cross-platform builds. On x86_64, performance is competitive with FreeBSD for most workloads but the network stack has not received the same level of tuning. We measured 7.1 Gbps on the same hardware and benchmark.
OpenBSD's kernel includes mitigations that carry measurable overhead. KARL (kernel address randomisation at link time) runs at every boot, adding 2-5 seconds. W^X page enforcement and return-oriented-programming mitigations reduce throughput on crypto-heavy workloads. Our same 10GbE test: 6.8 Gbps with pf enabled. That 27% gap versus FreeBSD is real and expected. For a firewall handling 1 Gbps internet uplinks, it is irrelevant.
# FreeBSD: check loaded kernel modules
kldstat
# FreeBSD: tune network stack for high throughput
sysctl kern.ipc.maxsockbuf=16777216
sysctl net.inet.tcp.recvspace=65536
sysctl net.inet.tcp.sendspace=65536
# OpenBSD: check kernel security features active
sysctl kern.splassert
sysctl vm.wxabortSecurity Model Differences
OpenBSD's security advantage is not just marketing. pledge(2) lets a process declare which syscall categories it will use; any deviation sends SIGABRT. unveil(2) restricts filesystem visibility to specified paths. Both are active in base system daemons including httpd, smtpd, and sshd. If you are deploying a public-facing service and want defence-in-depth at the OS level without writing seccomp profiles by hand, this matters.
FreeBSD has Capsicum, a capability framework that entered base in FreeBSD 10. Capsicum uses cap_enter(2) to put a process in capability mode, after which it can only operate on open file descriptors. It is powerful but requires application-level adoption. Fewer third-party applications support Capsicum compared to OpenBSD's pledge coverage. FreeBSD also ships MAC framework support (Mandatory Access Control via TrustedBSD) and jails, which provide strong OS-level isolation.
NetBSD has a security model closer to traditional Unix with some additions: Veriexec for file integrity verification, kauth(9) for kernel authorisation, and systrace (now deprecated). It does not match OpenBSD's default hardening and lacks FreeBSD's jail infrastructure in base.
For CVE response speed, OpenBSD and FreeBSD both maintain security advisories with patches. OpenBSD's 6-month release cycle means you are never more than 6 months from an EOL release. FreeBSD supports releases for 5 years (RELEASE) which matters for production stability.
# FreeBSD: list active jails
jls -v
# FreeBSD: create a minimal jail
jail -c path=/jails/web host.hostname=web01 ip4.addr=192.168.1.50 command=/bin/sh
# OpenBSD: check pledge restrictions on running process (requires doas/root)
procmap $(pgrep httpd) | head -20Package Management and Ports
FreeBSD has two parallel systems: the binary pkg tool and the ports tree for building from source. pkg is fast and complete for most needs. As of mid-2026, there are roughly 34,000 ports. The Poudriere build framework lets you maintain your own package repo with custom options.
OpenBSD uses pkg_add with pre-built binary packages built centrally by the project. There are around 11,000 packages as of 7.6. The ports tree exists but is less commonly used for production because the binary packages are signed and verified by default. The tradeoff is less configurability.
NetBSD's pkgsrc is its strongest cross-platform story. The same pkgsrc tree builds on NetBSD, FreeBSD, Linux, macOS, and Solaris. For shops running mixed environments, pkgsrc provides consistency. On NetBSD itself, pkgsrc-current has around 26,000 packages. Binary packages exist via pkgin but coverage is not as complete as FreeBSD's pkg.
# FreeBSD: build custom packages with Poudriere
poudriere ports -c -p main
poudriere bulk -j 14amd64 -p main -f /usr/local/etc/poudriere/pkglist
# NetBSD: install pkgin and use binary packages
pkg_add pkgin
pkgin update && pkgin install nginx
# OpenBSD: install and verify a package
pkg_add nginx
pkg_check -v nginxZFS, Filesystems, and Storage
FreeBSD ships OpenZFS in base since FreeBSD 13. It is the recommended filesystem for new deployments. ZFS send/recv for replication, native encryption, datasets, snapshots, and dedup are all available without any third-party installation. We use ZFS on FreeBSD in production for NAS builds because the integration is seamless.
OpenBSD does not ship ZFS. The project rejected it due to licensing concerns (CDDL is incompatible with ISC/BSD) and the attack surface that a large, complex filesystem introduces. OpenBSD uses FFS2 with soft updates and optional filesystem encryption via softraid(4) with AES-XTS. For high-security deployments this is a reasonable trade.
NetBSD has experimental ZFS support but it is not recommended for production. FFS2 is standard. NetBSD supports LVM-style volume management through RAIDframe, which predates Linux MD RAID and handles RAID 0/1/4/5 in the kernel.
# FreeBSD: create a ZFS pool and encrypted dataset
zpool create tank mirror /dev/da1 /dev/da2
zfs create -o encryption=aes-256-gcm -o keylocation=prompt -o keyformat=passphrase tank/sensitive
# FreeBSD: snapshot and replicate
zfs snapshot tank/data@2026-06-23
zfs send tank/data@2026-06-23 | ssh backup01 zfs recv backup/data
# OpenBSD: create encrypted softraid volume
bioctl -c C -l /dev/sd1a -C CRYPTO /dev/softraid0Networking and Firewalls
OpenBSD is the home of PF (Packet Filter). Every other BSD uses a port of PF, but OpenBSD's version is always the most current. The pf.conf syntax is clean and the documentation in the man pages is precise. OpenBSD is the correct choice for a dedicated firewall or router appliance.
FreeBSD ships three firewall options: PF (ported from OpenBSD), IPFW (native, with dummynet for traffic shaping), and IPFilter. IPFW with dummynet is well-suited for traffic shaping and QoS on high-throughput links. PF on FreeBSD is functional but typically one or two releases behind OpenBSD's version.
NetBSD ships NPF (NetBSD Packet Filter), its own firewall written to support SMP scaling better than PF. NPF uses a bytecode-based rule compiler. It is less widely documented than PF but performs well on multicore hardware.
For VLAN, LAGG (LACP bonding), and bridge configuration, all three BSDs handle this at the base system level without kernel modules.
# OpenBSD pf.conf - minimal stateful firewall
set skip on lo
block all
pass in on egress proto tcp to port { 22 80 443 } keep state
pass out all keep state
# FreeBSD: IPFW with traffic shaping
ipfw pipe 1 config bw 100Mbit/s
ipfw add 100 pipe 1 ip from any to 192.168.1.0/24
# NetBSD: load NPF and apply ruleset
npfctl reload /etc/npf.conf
npfctl startVirtualisation, Containers, and DevOps Integration
FreeBSD's bhyve hypervisor has been in base since FreeBSD 10 and supports Linux, Windows, and other BSDs as guests. Combined with ZFS for copy-on-write disk images and jails for OS-level containers, FreeBSD has a complete virtualisation stack in base. The vm-bhyve tool wraps bhyve management in a sane CLI.
FreeBSD jails are production-grade OS containers that predate Docker by a decade. Resource limits via rctl(8), network virtualisation with VNET jails, and ZFS datasets per jail give you most of what Docker provides without the container runtime overhead. For DevOps pipelines that benefit from automation, the FreeBSD jail and bhyve ecosystem integrates with tools like Ansible's bsd.* modules. Teams building automated provisioning workflows can layer on platforms like taskbotshub.ai for orchestrating multi-step BSD deployments across mixed environments.
OpenBSD has vmm(4), its own hypervisor that supports OpenBSD and Linux guests. It is intentionally minimal and fits OpenBSD's security model: no shared memory between host and guest, no device pass-through by default. It is not a replacement for bhyve in production virtualisation density.
NetBSD has Xen domU support and QEMU/KVM guest capability but no native type-1 hypervisor in base. For embedded and IoT work, NetBSD's rump kernels (Runnable Userspace Meta Programs) are unique: you can run a NetBSD kernel component as a POSIX userspace process for testing and development.
# FreeBSD: create and start a bhyve VM using vm-bhyve
vm init
vm switch create public
vm switch add public igb0
vm create -t linux -s 20G webserver01
vm start webserver01
# FreeBSD: create a VNET jail
jail -c name=web01 vnet host.hostname=web01 path=/jails/web01 \
vnet.interface=epair0b command=/bin/sh /etc/rcHardware Support and Embedded Use
NetBSD runs on more hardware than any other BSD. The platform list includes Alpha, ARM, MIPS, PowerPC, RISC-V, SPARC, VAX, and over 50 others. If you are bringing up BSD on a single-board computer, a MIPS router, or legacy hardware from the 1990s, NetBSD is where to start. We booted NetBSD 10.1 on a MIPS-based EdgeRouter X in under an hour using the evbmips port.
FreeBSD has strong ARM64 support, particularly for Raspberry Pi 4/5, Ampere Altra, and AWS Graviton. The armv7 support has regressed and is less maintained. x86_64 server hardware support is excellent with a broad NIC and storage driver library.
OpenBSD supports x86_64, arm64, RISC-V, SPARC64, and a handful of other platforms. Driver support prioritises correctness and auditability over quantity. Some consumer hardware with proprietary firmware requirements (certain Wi-Fi chipsets, Nvidia GPUs) will not work or will work only with performance trade-offs.
# NetBSD: check platform and kernel at boot
uname -a
# Example output on MIPS:
# NetBSD evbmips 10.1 NetBSD 10.1 (GENERIC) evbmips
# FreeBSD: check ARM64 board identification
sysctl hw.model hw.machine hw.ncpu
# All three: list PCI devices
pciconf -lv # FreeBSD
pcictl pci0 list # NetBSD
pcidump -v # OpenBSD