6 ms·
This is why http://Pfsense.com http://Pfsense.com should get even more coverage on here than it does. Chris and his team do an incredible job of creating secur
by godzillabrennus 11y ago
This is why http://Pfsense.com http://Pfsense.com should get even more coverage on here than it does. Chris and his team do an incredible job of creating secure open firewall software.
- mulander 11y agoWho does the great job again? https://www.reddit.com/r/BSD/comments/391nyj/pfsense_considered_harmful_to_the_community/ https://www.reddit.com/r/BSD/comments/391nyj/pfsense_conside...
- bashtoni 11y agoAlso OpenWRT: https://openwrt.org/ https://openwrt.org/
- xcasex 11y agonot as long as everything runs privileged as the superuser. running all services as root by default is bad juju.
- wtallis 11y agoThat's certainly true of servers, but it's way less important for the limited set of services a router typically provides. Aside from the services that really need root because they're changing system settings, you've pretty much got just dnsmasq and hostapd out of the box. Isolating them is nice if you've got the storage space for that extra complexity, but it's not like OpenWRT is a massive attack surface with gaping holes.
- jlgaddis 11y agoI'll certainly agree that they do a pretty good job of bundling it all up and slapping a web interface on top of it... but the operating system and firewall (pf) and 95% of the software that comes with it? That's an incredible job done (mostly) by many other people.
- gonzo 11y agoWhile what you say is in some sense true, we also make fairly large contributions back to FreeBSD as well. Case-in-point: AES-GCM, including AES-NI support, and support for same for IPsec. There are other, more minor contributions, such as the new 'tryforward' code (replaces what was 'fast-forward', but doesn't break IPsec). r290383 Or r290028, where we eliminated the performance impact of IPsec (which is now on by default in -CURRENT). I could go on to detail around 30 recent changes to FreeBSD, but I think the point is made. In any case, it's a bit more than "bundling it all up and slapping a web interface on top of it", as you assert, but you're not the only person who thinks this way. Your point that we leverage others work is correct.
- killerpopiller 11y agothank you guys for you work, our pfsense is a bastion since 10 years
- gonzo 11y agoyou are welcome. thanks for your support.
- zxv 11y agoKudos for the AES-GCM and AES-NI work, and for your contributions back to FreeBSD. Best wishes for your 2.3 release and the new bootstrap based webGui!
- gonzo 11y agoThank you!
- deleted 11y ago[deleted]
- vex 11y agoTheir software is good, but their hardware? Awful. PFsense doesn't know how to do reliable hardware at all.
- gonzo 11y agoDo you have specific points here?
- alsetmusic 11y agoI own the SG-4860 and it's been solid for about eight months. It's the first hardware I've purchased from them and I have no regrets. https://www.pfsense.org/products/product-family.html https://www.pfsense.org/products/product-family.html
- gonzo 11y agoThanks. It's what I run at home.
- snuxoll 11y agoDo you have any experience with the lower end SG-2220? I'm looking at replacing the Aspire Revo AR1600 I've hacked into a firewall at my aunt's shop running Sophos UTM with something that doesn't require a USB NIC, it looks like a pretty good value at the price.
- dgacmu 11y agoI'm surprised at this - I run four pfSense boxen; my two homebrew ones on repurposed old machines have both died on me at least once, and the two running on purchased pfSense hardware are still up & running. Anecdote != data and all that, but I'd buy their hardware again if I didn't have a large stack of machines I can reuse for "free." (ahem. free does not count my time or that of my students, but sometimes it's fun to admin things a little.)
- d3c4f 11y agoCheck out https://opnsense.org/ https://opnsense.org/ It's a more modern fork of PFSense with a better community behind it.
- sjwright 11y agoAre you a sockpuppet? Routers are not a toy to be dicked around with by amateurs and called "modern". Opnsense is a bad fork which focuses on dubious UI tweaks at the expense of testing and validation. As far as I can tell its raison d'être is marketing and spite. http://m0n0.ch/wall/list/showmsg.php?id=376/07 http://m0n0.ch/wall/list/showmsg.php?id=376/07 https://www.google.com/search?q=pfsense+vs+opnsense https://www.google.com/search?q=pfsense+vs+opnsense
- dang 11y ago> Are you a sockpuppet? Accusations of astroturfing, sockpuppetry, and shillage are not allowed in HN arguments unless you have evidence. Someone disagreeing with your view doesn't count as evidence. So please don't do this here. If you want to understand our thinking on this, I've posted about it many times, e.g. https://news.ycombinator.com/item?id=9277068 https://news.ycombinator.com/item?id=9277068 and the links back from there.
- sjwright 11y agoThanks for the robo-call quality advice.
- realkitkat 11y agoAnd what guarantees we have that when they ( or any number of other OSS vendors ) include OpenSSH into their product, it isn't some boopytrapped variant? Oh wait, it's open source, so we can go and find out? Anyone?
- gonzo 11y agohttps://github.com/pfsense/pfsense https://github.com/pfsense/pfsense Have at it.
- antoncohen 11y agopfSense might be fine for home or small business use, but I wouldn't recommend it for datacenter or medium/large enterprise use. It is primarily GUI-driven, which won't cut it for automation, version control, or some auditing. AFAIK it is still based on m0n0wall. The init scripts are written in PHP. There is (or was when I used it years ago) one big PHP script with a bunch of includes. If any part of the PHP script fails the rest may fail. This led to a bunch of problems with packages. For example I installed the RADIUS package through the web UI, decided I didn't want it, removed the package through the web UI. Removing the RADIUS package removed something the large PHP init script was trying to include, which led to the script exiting immediately with an error. The PHP script was also reasonable for loading the firewall rules, but it exited before loading the rules. Which resulted in a booted internet gateway with _no firewall_ (allow any). This aspect of pfSense may have changed, so I'm not trying to hate on it, just trying to point out that it may have shortcomings for some use cases. I've managed straight pf on OpenBSD for gateways/firewalls. pf is very nice to work with, much nicer than iptables/tc for internet gateways. But that also won't scale to large enterprises or datacenters . The amount of data is too much for OpenBSD and generic hardware, at least as for as I've seen. At one employer the largest Palo Alto Networks firewalls couldn't handle our office network traffic, they had to be replaced by firewalls from another vendor. So it really isn't fair to compare FortiGate firewalls, some models of which can do 300+ Gbps, with 40/100 GbE ports, to a little box running pfSense.
- gonzo 11y ago> I wouldn't recommend it for datacenter or medium/large enterprise use. Fortunately (for us), the large consulting firms disagree with your assessment.
- st3fan 11y ago> So it really isn't fair to compare FortiGate firewalls, some models of which can do 300+ Gbps, with 40/100 GbE ports You forgot: and an ssh backdoor
- ryanlol 11y agoWhy? pfsense code quality isn't very good either, and if that's not where it defeats fortinet... then where?
- bcook 11y agoThe BSD tcp/ip stack is well respected. Maybe the most respected? What is your definition of "quality code"? (Without going in to a huge rant.)
- ryanlol 11y agoI was talking about code specific to the pfsense project, their PHP code looks like it was written in the 90s and has several greppable bugs.
- gonzo 11y agoa) I hope you're looking at 2.3. I agree than the PHP in previous versions was abhorrent. Going forward, the plan is to eliminate the PHP. b) if you're serious about greppable bugs, please open bug reports (redmine.pfsense.org) or, failing that, email me with a description. (jim-at-pfsense-dot-org)