Post #350798

2026-02-21 12:44 UTC

Spent way too long getting HTTP/3 working on FreeBSD with nginx, so I wrote it all up. The highlights: stock OpenSSL silently breaks QUIC at the HTTP/3 framing layer (the TLS handshake succeeds, so openssl s_client lies to you). eBPF worker routing doesn't exist on FreeBSD. And if nginx is in a jail with IPv4 NAT, a pass rule for UDP 443 is useless without a matching rdr. New post: https://blog.hofstede.it/http3-on-freebsd-getting-quic-working-with-nginx-in-a-bastille-jail/ #FreeBSD #nginx #HTTP3 #QUIC #Networking

Replies (4)

@vermaden@mastodon.bsd.cafe 2026-02-21 20:20

@Larvitz Another great article that goes straight to latest Valuable News issue - thank You for writing it :) Now ... I would probably add least needed and least technical comment here - but that also hit me in the past ... the 'special' ASCII character ... misalign like 9 in 10 times. Using 'regular' chars like '|' or '+' instead always aligns these ASCII diagrams well. Regards, vermaden

Open ##1234153
@jamesog@mastodon.social 2026-02-22 09:33

@Larvitz Great write up! One question: do you also have HTTP/2 enabled? The config you listed at the end looks like it would have the client start on 1.1. Just curious because I seem to recall Nginx having multiple ways of doing h2.

Open ##1234155
@jan@social.eden.one 2026-02-22 16:13

@Larvitz Thanks for the documentation! I also switched my website to HTTP/3 recently, but I did not have any issues with the stock OpenSSL.

Open ##1234163
@FiLiS@mastodon.social 2026-03-09 11:14

@Larvitz thank you so much for your post. Do you run this in a jail? I ran into an issue where nginx would return this error: `sendmsg() failed (22: Invalid argument) while handling initial packet ...`. Looks like it is fixed by using the v4/v6 IPs with the listen directive, since FreeBSD too picky about the originating IP address.

Open ##1234164