3 ms·

Just a quick shout-out for pfSense as an excellent router OS. I've been playing around with ClearOS, DD-WRT, m0n0wall, Smoothwall, Shorewall, etc. (as well as m

Just a quick shout-out for pfSense as an excellent router OS. I've been playing around with ClearOS, DD-WRT, m0n0wall, Smoothwall, Shorewall, etc. (as well as many of my own home-grown solutions) for years and nothing even comes close to the features and performance offered by pfSense. DD-WRT is close but you're extremely limited in terms of the hardware it will run on (think WRT54G/L units with ancient processors and 16MB RAM). Not to dismiss all those other efforts but pfSense is at least worth a try. The writer of this article seems to disregard it off the bat but it's worth the time investment if you're looking for something secure and stable with features like Snort, VPN, traffic shaping, country blocking, DNSBL... the list goes on and on! Plus, it gave me an excuse to finally get my feet wet with FreeBSD. :-)

jlgaddis 11y ago
pfSense is a good operating system and provides a nice pointy-clicky interface for configuration. I'll give it that. I was a bit turned off by how they yanked the pfsense-tools repository and then put in some restrictions on access to it. (Jim: There's no need to reply and have the same conversation yet again. I'm well aware of what your reasons for doing so were and you are well within your rights to do it; we don't have to agree with it or like it, though.)
- bcook 11y ago
  pfSense-tools is no longer used in pfSense 2.3 (which is in beta). https://blog.pfsense.org/?p=1842 https://blog.pfsense.org/?p=1842
- pyvpx 11y ago
  pfSense is FreeBSD with a clunky web interface that does some "magic" with PHP using XML. now, that characterization won't be as accurate in the future (I'm genuinely curious to see what happens with python, dpdk, and other things they've mentioned/hinted at) but let's be entirely honest here: it's FreeBSD with a web interface and a support company behind it.
  - mwpmaybe 11y ago
    Most router/firewall distributions can be described in such overly-simplistic terms.
mirimir 11y ago
I would have liked to see a comparison between Ubuntu and pfSense on the same hardware. It would have also been useful to subject each of the routers to at least a basic pentest.
rosser 11y ago
I think your info on DD-WRT's hardware support is a bit outdated. When I bought my last router, an Asus AC68, full support was one of my mandatory criteria.
- mwpmaybe 11y ago
  Yes, you're correct, DD-WRT runs on modern consumer AP/router hardware. But the processing power* of that Asus (a quick google tells me 800MHz x 2 cores with 256 MB RAM) pales in comparison to e.g. an Atom C2358 (1.7 GHz x 2 cores) with 4 GB RAM. You can't run DD-WRT on the latter, or at least not last I checked, which is the point I was trying to make (albeit poorly). And when it comes to running things like Snort, VPN, etc., you're going to want that extra memory and processing power. Granted, it's probably overkill for most people, but one might say the same about the Homebrew/Ubuntu solution described in the OP. The whole point of the OP was moving away from MIPS-based consumer AP/router hardware with small memory footprints. * And yes, the Asus has silicon dedicated to networking features, but so does the C2358.
proctor 11y ago
I helped make a list[0] (which is still kept current) of OpenWrt and dd-wrt hardware a while back. You might want to give OpenWrt another chance, it may not be as outdated as it might seem. [0]http://rooftopbazaar.com/routerfirmware/ http://rooftopbazaar.com/routerfirmware/
- mwpmaybe 11y ago
  Can you run OpenWRT/DD-WRT on off-the-shelf x86-64 hardware?
  - proctor 11y ago
    I haven't done so personally, but they have 86-64 builds yes. http://www.instructables.com/id/Openwrt-on-a-pc/ http://www.instructables.com/id/Openwrt-on-a-pc/
    - qb45 11y ago
      I used to run my customized build of OpenWRT on an old, passively-cooled Pentium II box. It ran completely from ramdisk and had all configuration baked into this ramdisk image so that the noisy HDD could be powered down immediately after bootup. This was before the era of cheap small SSDs. The official builds support installation on disk partition just like any other Linux distribution.

jlgaddis 11y ago

pfSense is a good operating system and provides a nice pointy-clicky interface for configuration. I'll give it that. I was a bit turned off by how they yanked the pfsense-tools repository and then put in some restrictions on access to it. (Jim: There's no need to reply and have the same conversation yet again. I'm well aware of what your reasons for doing so were and you are well within your rights to do it; we don't have to agree with it or like it, though.)

bcook 11y ago
pfSense-tools is no longer used in pfSense 2.3 (which is in beta). https://blog.pfsense.org/?p=1842 https://blog.pfsense.org/?p=1842
pyvpx 11y ago
pfSense is FreeBSD with a clunky web interface that does some "magic" with PHP using XML. now, that characterization won't be as accurate in the future (I'm genuinely curious to see what happens with python, dpdk, and other things they've mentioned/hinted at) but let's be entirely honest here: it's FreeBSD with a web interface and a support company behind it.
- mwpmaybe 11y ago
  Most router/firewall distributions can be described in such overly-simplistic terms.

mirimir 11y ago

I would have liked to see a comparison between Ubuntu and pfSense on the same hardware. It would have also been useful to subject each of the routers to at least a basic pentest.

rosser 11y ago

I think your info on DD-WRT's hardware support is a bit outdated. When I bought my last router, an Asus AC68, full support was one of my mandatory criteria.

mwpmaybe 11y ago
Yes, you're correct, DD-WRT runs on modern consumer AP/router hardware. But the processing power* of that Asus (a quick google tells me 800MHz x 2 cores with 256 MB RAM) pales in comparison to e.g. an Atom C2358 (1.7 GHz x 2 cores) with 4 GB RAM. You can't run DD-WRT on the latter, or at least not last I checked, which is the point I was trying to make (albeit poorly). And when it comes to running things like Snort, VPN, etc., you're going to want that extra memory and processing power. Granted, it's probably overkill for most people, but one might say the same about the Homebrew/Ubuntu solution described in the OP. The whole point of the OP was moving away from MIPS-based consumer AP/router hardware with small memory footprints. * And yes, the Asus has silicon dedicated to networking features, but so does the C2358.

proctor 11y ago

I helped make a list[0] (which is still kept current) of OpenWrt and dd-wrt hardware a while back. You might want to give OpenWrt another chance, it may not be as outdated as it might seem. [0]http://rooftopbazaar.com/routerfirmware/ http://rooftopbazaar.com/routerfirmware/

mwpmaybe 11y ago
Can you run OpenWRT/DD-WRT on off-the-shelf x86-64 hardware?
- proctor 11y ago
  I haven't done so personally, but they have 86-64 builds yes. http://www.instructables.com/id/Openwrt-on-a-pc/ http://www.instructables.com/id/Openwrt-on-a-pc/
  - qb45 11y ago
    I used to run my customized build of OpenWRT on an old, passively-cooled Pentium II box. It ran completely from ramdisk and had all configuration baked into this ramdisk image so that the noisy HDD could be powered down immediately after bootup. This was before the era of cheap small SSDs. The official builds support installation on disk partition just like any other Linux distribution.