36 ms·

pfSense: Open source network firewall distribution

309 points by lobo_tuerto 10y ago

kiallmacinnes 10y ago
It's been a few years since I used pfSense (maybe 7 or 8 years?) - when did they become so "commerical"? (I'm not saying thats a bad thing, I really have no opinion on that, I'm just curious!)
- tonmoy 10y ago
  Looking at the wayback machine it seems that the new "commercial" website was released somewhere between March 29, 2015 and April 7, 2015
- Fuxy 10y ago
  They target the market that can get them the money i guess I don't really have a problem with that since they make the best firewall/router software i ever used. My home router is basically this https://linitx.com/product/linitx-apu-2c-3nicusbrtc-pfsense-embed-firewall-kit-silver/14131 https://linitx.com/product/linitx-apu-2c-3nicusbrtc-pfsense-... with a ubiquity wifi AP and it works beautifully and it's rock stable.
- oneplane 10y ago
  It's been a few years like that, most likely a combination between someone getting fired and starting a fork (OPNSense) which risks fragmentation (and maybe a bit more competition), and the company behind pfSense needing a bit more return on their investment. In the long run, it doesn't matter all that much, pfSense is still 'free' as in beer, and you can still get to the sources, and forking is still possible. Only protection of the name 'pfSense' as a brand has gotten somewhat more intense. On top of that, they are powered by their hardware sales and service subscriptions, of which the former is probably a more important source of income. It seems they either 'are' netgate, or are a subsidiary, and also partner with ADI engineering. Some hardware seems almost purpose built for pfSense, like that tiny uFW micro firewall, or the modified Turbot board (Intel) with two Gigabit Ethernet NIC's. There also seems to be a uBMC in the works, a somewhat 'universal' BMC with IPMI etc. running BSD as well, most likely pfSense-based. I suppose those would be commercially interesting but not that much consumer-oriented but more the bigger ODM's and OEM's since it requires a bit more integration. So those hardware things are a lot more 'commercial' than the software project ever was. I suppose that naturally overflows into pfSense itself. Currently, pfSense seems to have been 'branded' as a 'community edition'. There doesn't seem to be a 'commercial edition' anywhere yet, but I can imagine a model similar to GitLab where you have a common core and a paid version with enterprise extras. It also seems to be showing the serial number or platform UUID in the web interface, I guess that's somehow going to be tied into the non-community version of pfSense to use with an activation system for the 'more-than-community' version. I do believe that there is already at least a special version for VMWare on their 'market' or whatever it's called, and a possibly modified version that runs on the pfSense or netgate branded hardware since it needs special software support to function due to it not being simply a 'standard x86 PC'. The uFW is ARM, so a working ARM version of pfSense is out there too! Notice: a lot of this is just observation and speculation on my part, but it might help you dig for clues on the interwibble.
- feld 10y ago
  There are over 500,000 pfSense installations in the wild. The creation of a company around pfSense has allowed them to offer real support and hire developers to improve everything from the UI to massive improvements to network stack/firewall and even IPSEC performance. These changes get pushed upstream to FreeBSD, everyone wins.
  - deleted 10y ago
    [deleted]
  - kiallmacinnes 10y ago
    Nice, glad to see changes getting pushed upstream! It's was interesting to hit the site for the first time in many years and see how much had changed and how the project has grown! I wonder what other projects I used to use have grown this much :)
  - pyvpx 10y ago
    what developers have they hired? besides Neville as a consultant for FreeBSD netstack performance improvements.
    - gonzo 10y ago
      There are two FreeBSD committers on staff (one second, the other ports), the author of the O'Reiley book on git, the guy who rewrote the GUI, and three others. Several have really deep telecommunications equipment / router vendor experience. Plus gnn, whom, as you say is a consultant. If we're going to include him, we should include Patrick Kennedy, who has done work on libuinet for us.
dstroot 10y ago
Happy user here. I have used this exclusively for the past eight years. It's gotten better as it's got more commercial – better UI, more polished plugins, better features, etc.
amadeuspzs 10y ago
Having used pfsense for a good few years, we recently switched to Meraki. Global infrastructure and Meraki APs just made it easier to go with their ecosystem, despite the licensing costs.
- ausjke 10y ago
  meraki started with wifi-mesh and nowadays it is shifting towards wired network and security mostly.
- ShakataGaNai 10y ago
  Ironic. I just did the reverse. Moved from years of Meraki to pfSense (or Palo Alto Networks at another company). The Meraki WAP's are mostly great, their switches are fine, but their "gateway" devices are terrible. The performance is horrible and their internal tests have proven as much. If you need more than 150mbps consistently, Meraki is going to bite you in the ass.
amadeuspzs 10y ago
Having used pfsense for a good few years, we recently switched to Meraki. Global infrastructure and Meraki APs just made it easier to go with their ecosystem, despite the licensing costs.
sschueller 10y ago
PfSense is awesome! It runs very well for very little money on your own hardware [1]. You can do so many things easily. For example force all local chromecasts via a VPN for netflix. [1] https://pcengines.ch/apu2.htm https://pcengines.ch/apu2.htm
- sashk 10y ago
  Agree. I've been running pfSense on HP thin client (T5740[1] with expansion module + gigabit dual port ethernet NIC) and was pretty happy. Cost to me was about $60 for fully working firewall/router. [1]: http://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c01926335 http://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_...
nailer 10y ago
Is this 'pf' like the BSD firewall? Anyone more familiar with the space want to provide some detail? Edit: yeah it is: > The pfSense project is a free network firewall distribution, based on the FreeBSD operating system with a custom kernel and including third party free software packages for additional functionality. From https://pfsense.org/getting-started/ https://pfsense.org/getting-started/ see also https://doc.pfsense.org/index.php/Installing_pfSense https://doc.pfsense.org/index.php/Installing_pfSense
- hueving 10y ago
  Yep, basically a really nice web interface and management system for configuring a pf-driven firewall. You can click your way to high availability with sub 5-second failovers (even including NAT state synchronization) in a morning starting from no pfsense or bsd knowledge.
lima 10y ago
Last time I checked, pfSense was good at firewalling but bad at everything else security-wise. - Web panel allows root code execution on the device (every XSS is full RCE!) - Everything runs as root - No ASLR or other hardening flags because FreeBSD - Lots of XSS and CSRF opportunities (probably got better with the new UI) - Did not replace SSL certificate after Heartbleed (on packages.pfsense.org!) - No package signing, either (not sure if this is still true with pkgng) - Did not even have SSL on packages.pfsense.org until one or two years ago I'm also missing the fq_codel queueing discipline on my home network (prevents bufferbloat). I still use it since it's awesome, but I hope their security posture has improved since. Most of the commercial vendors are even worse, but still.
- bcook 10y ago
  fq_codel is on it's way (though, it's implemented in dummynet/"limiters" rather than ALTQ): http://caia.swin.edu.au/freebsd/aqm/ http://caia.swin.edu.au/freebsd/aqm/ pfSense already has codel, which can be used with FAIRQ.
  - nalllar 10y ago
    > pfSense already has codel, which can be used with FAIRQ. That's not nearly as good as fq_codel, which is not the same as using fairq + codel.
- Algent 10y ago
  I also had some very bad experience with pfense performances in a virtual environment. Under Proxmox any kind of network load have an abnormal impact on cpu load, often almost freezing the host. On esx it's a bit better but at the cost of low throughput. From what I've read it's an issue with offload/checksum with FreeBSD. After lots of digging on the subject I gave up and switched to VyOS for my proxmox cluster. It doesn't have a nice web panel but the load of the host is now barely noticeable.
  - ComputerGuru 10y ago
    Yeah, you have to disable tcp hardware packet segmentation offloading.
wslh 10y ago
I don't have such experience. I tried to configure IPSec and IKEv2 in pfSense following the instructions and it never worked with a Windows client. There are a lot of questions related to this on the forums without a concrete/canonical answer. I like pfSense but I chose it to easily configure usually complex networking stuff, not a DHCP or DNS. We are trying now to configure IKEv2 on an Ubiquiti device using UniFi with a load balancer and doesn't seem to be trivial.
- jlgaddis 10y ago
  IPSec across multiple vendors is always a PITA.
  - kogepathic 10y ago
    Yeah, but that's mostly because IPSec supports so damn many authentication methods, cipher settings, etc. I've had to integrate with several telcos via IPSec (mobile money processing), and it's always fun to try and figure out what they're saying when all they can do is describe the [incredibly generic] settings in the Cisco ASA WebUI. Then you finally figure out the ipsec.conf settings to make it work, and they come back to you a month later asking for a copy of your file to give to another company who's trying to integrate. Sure, how much are you going to pay us? Oh, nothing? Well, I remember how much help you gave us when we were banging our head on the wall trying to figure it out. So, hire competent people and figure it out yourself!
- curtipus 10y ago
  When did you try the IPSec/IKEv2 in pfsense? Prior to, I think, 2.4 you had to go into the registry and do some hack to get around certificate limitations. It's no longer necessary and setup was a breeze for me (and the registry hack worked for me as well). I loosely followed: https://doc.pfsense.org/index.php/IKEv2_with_EAP-MSCHAPv2 https://doc.pfsense.org/index.php/IKEv2_with_EAP-MSCHAPv2
  - gonzo 10y ago
    > Prior to, I think, 2.4 2.3 (which got Strongswan), but yeah. 2.4 isn't released yet.
notaplumber 10y ago
If you want a pf firewall, you should probably get it from OpenBSD.. they created pf. https://www.openbsd.org/faq/pf/index.html https://www.openbsd.org/faq/pf/index.html
kek918 10y ago
We use pfSense at a client of mine and it's great. I didn't have any prior experience with it but I only spent a couple of nights setting everything up. We use it to manage firewall rules and as DHCP server for 2 VLANs. We've used it for about a year now. Had several power outages. The pfSense box is still running like a champ, no problems whatsoever. Turns out my client actually wanted an email spamfilter though, but our mail is hosted in another country so I had a little trouble explaining why our internal pfSense couldn't help us there. Oh well.
F00Fbug 10y ago
I can't say enough good things about pfSense. I'm running three of 'em and would gladly trash my Checkpoint firewalls to use pfSense, if our parent company didn't mandate them. I've run it on everything from tiny, Atom-based machines to kitted-out HP DL385s, and even on ESXi virtual machines. It works great in all scenarios.
sandGorgon 10y ago
I always had this question - can something like pfsense be built on linux with comparable performance or is there something inherent to the whole stack that makes this effective? I have always wondered if building pfsense on a modern linux kernel + selinux + BPF with something like nginx/lua scripting (for addon packages) would make more sense. http://www.brendangregg.com/blog/2016-10-27/dtrace-for-linux-2016.html http://www.brendangregg.com/blog/2016-10-27/dtrace-for-linux...
- edcastro 10y ago
  https://vyos.io/ https://vyos.io/ might be what you're looking for.
  - Dangeranger 10y ago
    So is VyOS the successor to Vyatta? It looks like maybe this project forked after the purchase by Brocade. As a side not Vyatta is the base OS in many of the Ubiquiti Networks routers. It's quite nice for small office/ home office.
    - ddeck 10y ago
      That's correct. Brocade closed sourced the main product in 2012 and left the community edition to die. It was forked in 2013 (renamed VyOS) and is under active development as a free open source project.
    - slau 10y ago
      I would say it's nice enough for more than just "small" stuff. Depending on your definition of "small", I guess. I'm running a VyOS machine (old desktop with a couple of NICs) which handles the traffic for our Copenhagen office. That's ~15 CI boxes, and 30 people. This is on a 100/100 connection. For Ubiquiti, I'm a fan. I helped our co-working space setup a network on another floor, and we used an EdgeRouter Lite to handle the 200/200 connection. The ERL handles it without breaking a sweat. That's for 60 people on a daily basis. For another building, I just finished setting up an ERPro (the 8-port rack-mounted version). It's again on a 200/200 connection, and for roughly 150 people on average, with a maximum around 300-500. At home, I have an ERPoE, which handles my home lab just perfectly. I'm only on a 100/100 uplink at the moment, but will be upgraded to 1000/500 soon, and I know the ERPoE will handle that just fine as well (thank you hardware offloading ;)). 5 VLANs with full firewalling and routing between them, native IPv6 with prefix delegation, mDNS proxying between VLANs, OpenVPN handled by the router. I could do a lot of this with OpenWRT on an Archer C7, but the ERPoE is simply miles ahead. The UI is nice for newcomers, and the CLI is amazing. I fell in love with the CLI on VyOS, and am very happy to see the same in the UBNT products. For $100, they are amazing devices. VyOS is my go-to choice when I need to have a virtual router.
vxxzy 10y ago
I use pfSense as a vitual machine to firewall/NAT off my vitual environment. It works great. I am running it on KVM/QEMU and handing off the PCI device to the pfSense VM. Great for managing my environment through VPN. I've also used this in a retail chain in DC/MD/VA. Each location used pfSense for site-site VPN (OpenVPN). We also used the asterisk package to handle VoIP. Overall, pfSense is a robust UTM.
jstewartmobile 10y ago
I liked pfSense until it got too beefy for my ALIX board. That forced me to move to OpenBSD, and boy am I glad I did. Once you grok the syntax, it is so much easier to directly update settings in pf.conf than the pfSense web GUI--especially traffic shaping rules. That, and OpenBSD has great documentation, decent IPv6 support, and almost everything you need already baked-in. Here's a basic set of config files for a home setup: https://github.com/BourgeoisBear/OpenBSDFirewall https://github.com/BourgeoisBear/OpenBSDFirewall If you need IPv6 or anything fancy, PM me.
- SSLy 10y ago
  ugh, i wish we could use that syntax on the linux side of the computing world
  - jstewartmobile 10y ago
    Ha! I wish I could find the jwz article where he shared his tale of woe with iptables before jumping to pf.
  - mhurron 10y ago
    Syntax differences between pf and ipchains/iptables are why I chose OpenBSD on my firewall so many years ago.
  - lima 10y ago
    nftables (the iptables successor) is really close to the pf syntax. It's awesome.
  - tasn 10y ago
    I recently switched to nftables on Linux and the syntax is great, you should give it a go. I wrote a blog post demonstrating my server configuration. Shameless plug: https://stosb.com/blog/explaining-my-configs-nftables/ https://stosb.com/blog/explaining-my-configs-nftables/
    - dhess 10y ago
notaplumber 10y ago
Netgate/pfSense has been notoriously anti-community, with their own co-founder attacking other projects, including a recent fork called OPNSense. They've also been very hostile towards the OpenBSD developers, and project. Despite the fact they've effectively built a business on OpenBSD innovations, like pf and CARP, even incorporating the name 'pf' into their trademark having not contributed a bit of code.. n̶o̶r̶ ̶a̶ ̶d̶i̶m̶e̶ (but perhaps some hw). But feel free to keep using it.. no need to take my word for it. https://www.openbsd.org/donations.html https://www.openbsd.org/donations.html http://www.openbsdfoundation.org/contributors.html http://www.openbsdfoundation.org/contributors.html
- stsp 10y ago
  I won't defend their demeaning public behaviour towards OpenBSD. I find it revolting. But they did make one donation to this OpenBSD developer. They sent me 3 rcc-ve boards which I am still using for development: http://cvsweb.openbsd.org/cgi-bin/cvsweb/www/want.html#rev1.945 http://cvsweb.openbsd.org/cgi-bin/cvsweb/www/want.html#rev1.... They took much more than they have given (which the source code licence allows them to do, even if it's morally wrong). Claiming they never gave anything at all is incorrect.
  - notaplumber 10y ago
    I've edited my post, will remove it if you think it does more harm to highlight their actions than good.
    - stsp 10y ago
      Please don't remove your post. Pointing out these issues is very important, and making one donation should not indemnify people who behave in this way.
  - ianai 10y ago
    Not necessarily a question for just you, but what have they done, exactly?
  - 10y ago
kylegordon 10y ago
Been using pfsense for a while now, and with CARP and system redundancy, firewalling, and twin ipsec tunnels to AWS, it's been great and hugely reliable.
mrmondo 10y ago
I've been using PFSense both at various workplaces and at home for many years now, it's seriously fantastic. Feature rich, rock solid and good 3rd party packages.
rdslw 10y ago
Guys, they started in 2004. Its 2017 today. hackersNEWS ?
- jug5 10y ago
  I don't understand these posts. There's no new version of pfSense there's no announcements, nothing has happened to warrant the post. WTF?
dcow 10y ago
Usually when people mention they run pfSense it means, "I heard pfSense is good for security so I use it". If I get that impression in an interview, GG. IMO it's an easy litmus test for netsec/secops roles. If you can't write a pf rule, there are probably bigger issues. OpenBSD is the way to go. I also think the pfSense CEO has a massively inflated ego and pays little homage to the roots of his software. Does pf really need a GUI? edit: clarity.
- chrisper 10y ago
  Are you saying that people who use pfSense don't know what they are doing?
  - dcow 10y ago
    Not quite. But I am saying I've always found better candidates.
- gonzo 10y ago
  > I also think the pfSense CEO has a massively inflated ego and pays little homage to the roots of his software. The Netgate CEO is a woman. (I am not the CEO.)
  - dcow 10y ago
    That only happened late 2015. I'm talking about some reddit comments by whomever was in control of pfSense.
    - gonzo 10y ago
      That was me making those comments. The person who has been CEO since September 2012 is a woman.
jenkstom 10y ago
We've had a lot of success with pfSense. BGP works, IPSEC works, most things work quite well with no headaches. My previous employer used a Watchguard firewall and to be honest pfSense was a much better experience all around. Except for cloud VOIP. Neither 8x8 nor Shoretel worked worth a darn through this firewall. We even paid for the gold support and opened more than one support case with no luck. It appeared to be a RTSP issue, SIP didn't have any trouble. And it was intermittent. Most of the time it would work, occasionally it would not. Eventually we replaced pfSense with a Cisco router for our phones and it worked fine.
storrgie 10y ago
Does there exist an analog to this for switching (particularly an organization that sells hardware)?
stevefeinstein 10y ago
I used pfSense for a long time and ultimately the conclusion was it was a 75% solution. It made those 75% things pretty easy to set up and configure. But once you needed something from the 25% you had to dig into the BSD configuration and now had to deal with how that interoperated with the pfSense stuff. Better to just bite the bullet and configure BSD (or linux for some things it does even better) from scratch and get exactly what you want and need.
deleted 10y ago
[deleted]
throw2016 10y ago
Unless your needs are extreme in which case you will have networking experts making choices the linux networking subsystem is actually quite good both in terms of tooling and performance. I experimented with Vyatta which was based on Debian - open source fork now used by Ubiquity networks in their devices, and pfsense a couple of years ago and I found plain linux on its own delivers better performance. The recent series of Ars articles on building your own router confirm this with some benchmarks [1] [1] https://arstechnica.com/gadgets/2016/01/numbers-dont-lie-its-time-to-build-your-own-router/ https://arstechnica.com/gadgets/2016/01/numbers-dont-lie-its...
widea 10y ago
Yet I use Smallwall, the successor of M0n0wall on an old Soekris 5501-70. It is just a firewall, no bells and whistles and therefor very stable.
hobarrera 10y ago
You know what's open source and works great as a firewall (also based on pf)? OpenBSD. No, seriously. Don't bother picking a third-party repackage of pf, when you can actually get the a secure OS built by people who actually put security above everything else. If you care about security, there's no reason to go elsewhere.
deleted 10y ago
[deleted]
MPSimmons 10y ago
Do they have an API yet? Because I hated using it without an API.
- bpineau 10y ago
  Same here. No API means no automation, no Chef/Puppet/Ansible/Salt or other kind of scripts. Everything in the head of the person who clicked through the web interface. Are there automation friendly alternatives?
- gonzo 10y ago
  I also dislike it not having an API, but we have a strategy now.
xer 10y ago
I reviewed pfSense around nov 2016, it failed on many basic security best-practices, and was rejected for our purpose.
- gonzo 10y ago
  Yet in the same timeframe US Army Cyber Command selected it to stand in front of their infrastructure.
  - xer 10y ago
    Lol
- gonzo 10y ago
  Yet in the same timeframe US Army Cyber Command selected it to stand in front of their infrastructure.
Bombthecat 10y ago
I want something like that in docker :)
pelasaco 10y ago
I still prefer https://opnsense.org/ https://opnsense.org/
hpcjoe 10y ago
A fan of pfSense, I've used/deployed it a number of times to customers, and for some previous employer bits. Current version doesn't have an API, but is fine for what I do with it. I did see people hating on it here, and while I cannot/will not speak to their specific issues, I look at it as a much better tool than the integrated hardware units you can buy online for ~$100USD, with also integrated back-doors, courtesy of the development effort. I know perfectly well that I could build what I need using IPtables ... but have you used IPtables? I'm a CLI guy, and heck ... I want a GUI for IP tables ... I've not yet played with the nftables, and frankly, I am looking for a generally simpler model of putting some of these things together. pfSense does a pretty good job of this. One note on the php on the stack ... yeah, this is a concern for me as well. So I don't generally expose the admin access to the interwebs. And I lock that aspect down pretty hard (only specific addresses are allowed to even connect to the admin port). This isn't perfect, but its far better than setting up a web port, and suddenly presenting the pfSense gui out (yeah, this sorta happens by default if you don't move the gui to a different port, and do some other config). This all said, it is pretty good for what it does, and a few of my previous customers have bought the support for it directly from the team.

309 points by lobo_tuerto 10y ago

It's been a few years since I used pfSense (maybe 7 or 8 years?) - when did they become so "commerical"? (I'm not saying thats a bad thing, I really have no opinion on that, I'm just curious!)

tonmoy 10y ago
Looking at the wayback machine it seems that the new "commercial" website was released somewhere between March 29, 2015 and April 7, 2015
Fuxy 10y ago
They target the market that can get them the money i guess I don't really have a problem with that since they make the best firewall/router software i ever used. My home router is basically this https://linitx.com/product/linitx-apu-2c-3nicusbrtc-pfsense-embed-firewall-kit-silver/14131 https://linitx.com/product/linitx-apu-2c-3nicusbrtc-pfsense-... with a ubiquity wifi AP and it works beautifully and it's rock stable.
oneplane 10y ago
It's been a few years like that, most likely a combination between someone getting fired and starting a fork (OPNSense) which risks fragmentation (and maybe a bit more competition), and the company behind pfSense needing a bit more return on their investment. In the long run, it doesn't matter all that much, pfSense is still 'free' as in beer, and you can still get to the sources, and forking is still possible. Only protection of the name 'pfSense' as a brand has gotten somewhat more intense. On top of that, they are powered by their hardware sales and service subscriptions, of which the former is probably a more important source of income. It seems they either 'are' netgate, or are a subsidiary, and also partner with ADI engineering. Some hardware seems almost purpose built for pfSense, like that tiny uFW micro firewall, or the modified Turbot board (Intel) with two Gigabit Ethernet NIC's. There also seems to be a uBMC in the works, a somewhat 'universal' BMC with IPMI etc. running BSD as well, most likely pfSense-based. I suppose those would be commercially interesting but not that much consumer-oriented but more the bigger ODM's and OEM's since it requires a bit more integration. So those hardware things are a lot more 'commercial' than the software project ever was. I suppose that naturally overflows into pfSense itself. Currently, pfSense seems to have been 'branded' as a 'community edition'. There doesn't seem to be a 'commercial edition' anywhere yet, but I can imagine a model similar to GitLab where you have a common core and a paid version with enterprise extras. It also seems to be showing the serial number or platform UUID in the web interface, I guess that's somehow going to be tied into the non-community version of pfSense to use with an activation system for the 'more-than-community' version. I do believe that there is already at least a special version for VMWare on their 'market' or whatever it's called, and a possibly modified version that runs on the pfSense or netgate branded hardware since it needs special software support to function due to it not being simply a 'standard x86 PC'. The uFW is ARM, so a working ARM version of pfSense is out there too! Notice: a lot of this is just observation and speculation on my part, but it might help you dig for clues on the interwibble.
feld 10y ago
There are over 500,000 pfSense installations in the wild. The creation of a company around pfSense has allowed them to offer real support and hire developers to improve everything from the UI to massive improvements to network stack/firewall and even IPSEC performance. These changes get pushed upstream to FreeBSD, everyone wins.
- deleted 10y ago
  [deleted]
- kiallmacinnes 10y ago
  Nice, glad to see changes getting pushed upstream! It's was interesting to hit the site for the first time in many years and see how much had changed and how the project has grown! I wonder what other projects I used to use have grown this much :)
- pyvpx 10y ago
  what developers have they hired? besides Neville as a consultant for FreeBSD netstack performance improvements.
  - gonzo 10y ago
    There are two FreeBSD committers on staff (one second, the other ports), the author of the O'Reiley book on git, the guy who rewrote the GUI, and three others. Several have really deep telecommunications equipment / router vendor experience. Plus gnn, whom, as you say is a consultant. If we're going to include him, we should include Patrick Kennedy, who has done work on libuinet for us.

dstroot 10y ago

Happy user here. I have used this exclusively for the past eight years. It's gotten better as it's got more commercial – better UI, more polished plugins, better features, etc.

amadeuspzs 10y ago

Having used pfsense for a good few years, we recently switched to Meraki. Global infrastructure and Meraki APs just made it easier to go with their ecosystem, despite the licensing costs.

ausjke 10y ago
meraki started with wifi-mesh and nowadays it is shifting towards wired network and security mostly.
ShakataGaNai 10y ago
Ironic. I just did the reverse. Moved from years of Meraki to pfSense (or Palo Alto Networks at another company). The Meraki WAP's are mostly great, their switches are fine, but their "gateway" devices are terrible. The performance is horrible and their internal tests have proven as much. If you need more than 150mbps consistently, Meraki is going to bite you in the ass.

amadeuspzs 10y ago

Having used pfsense for a good few years, we recently switched to Meraki. Global infrastructure and Meraki APs just made it easier to go with their ecosystem, despite the licensing costs.

sschueller 10y ago

PfSense is awesome! It runs very well for very little money on your own hardware [1]. You can do so many things easily. For example force all local chromecasts via a VPN for netflix. [1] https://pcengines.ch/apu2.htm https://pcengines.ch/apu2.htm

sashk 10y ago
Agree. I've been running pfSense on HP thin client (T5740[1] with expansion module + gigabit dual port ethernet NIC) and was pretty happy. Cost to me was about $60 for fully working firewall/router. [1]: http://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c01926335 http://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_...

nailer 10y ago

Is this 'pf' like the BSD firewall? Anyone more familiar with the space want to provide some detail? Edit: yeah it is: > The pfSense project is a free network firewall distribution, based on the FreeBSD operating system with a custom kernel and including third party free software packages for additional functionality. From https://pfsense.org/getting-started/ https://pfsense.org/getting-started/ see also https://doc.pfsense.org/index.php/Installing_pfSense https://doc.pfsense.org/index.php/Installing_pfSense

hueving 10y ago
Yep, basically a really nice web interface and management system for configuring a pf-driven firewall. You can click your way to high availability with sub 5-second failovers (even including NAT state synchronization) in a morning starting from no pfsense or bsd knowledge.

lima 10y ago

Last time I checked, pfSense was good at firewalling but bad at everything else security-wise. - Web panel allows root code execution on the device (every XSS is full RCE!) - Everything runs as root - No ASLR or other hardening flags because FreeBSD - Lots of XSS and CSRF opportunities (probably got better with the new UI) - Did not replace SSL certificate after Heartbleed (on packages.pfsense.org!) - No package signing, either (not sure if this is still true with pkgng) - Did not even have SSL on packages.pfsense.org until one or two years ago I'm also missing the fq_codel queueing discipline on my home network (prevents bufferbloat). I still use it since it's awesome, but I hope their security posture has improved since. Most of the commercial vendors are even worse, but still.

bcook 10y ago
fq_codel is on it's way (though, it's implemented in dummynet/"limiters" rather than ALTQ): http://caia.swin.edu.au/freebsd/aqm/ http://caia.swin.edu.au/freebsd/aqm/ pfSense already has codel, which can be used with FAIRQ.
- nalllar 10y ago
  > pfSense already has codel, which can be used with FAIRQ. That's not nearly as good as fq_codel, which is not the same as using fairq + codel.
Algent 10y ago
I also had some very bad experience with pfense performances in a virtual environment. Under Proxmox any kind of network load have an abnormal impact on cpu load, often almost freezing the host. On esx it's a bit better but at the cost of low throughput. From what I've read it's an issue with offload/checksum with FreeBSD. After lots of digging on the subject I gave up and switched to VyOS for my proxmox cluster. It doesn't have a nice web panel but the load of the host is now barely noticeable.
- ComputerGuru 10y ago
  Yeah, you have to disable tcp hardware packet segmentation offloading.

wslh 10y ago

I don't have such experience. I tried to configure IPSec and IKEv2 in pfSense following the instructions and it never worked with a Windows client. There are a lot of questions related to this on the forums without a concrete/canonical answer. I like pfSense but I chose it to easily configure usually complex networking stuff, not a DHCP or DNS. We are trying now to configure IKEv2 on an Ubiquiti device using UniFi with a load balancer and doesn't seem to be trivial.

jlgaddis 10y ago
IPSec across multiple vendors is always a PITA.
- kogepathic 10y ago
  Yeah, but that's mostly because IPSec supports so damn many authentication methods, cipher settings, etc. I've had to integrate with several telcos via IPSec (mobile money processing), and it's always fun to try and figure out what they're saying when all they can do is describe the [incredibly generic] settings in the Cisco ASA WebUI. Then you finally figure out the ipsec.conf settings to make it work, and they come back to you a month later asking for a copy of your file to give to another company who's trying to integrate. Sure, how much are you going to pay us? Oh, nothing? Well, I remember how much help you gave us when we were banging our head on the wall trying to figure it out. So, hire competent people and figure it out yourself!
curtipus 10y ago
When did you try the IPSec/IKEv2 in pfsense? Prior to, I think, 2.4 you had to go into the registry and do some hack to get around certificate limitations. It's no longer necessary and setup was a breeze for me (and the registry hack worked for me as well). I loosely followed: https://doc.pfsense.org/index.php/IKEv2_with_EAP-MSCHAPv2 https://doc.pfsense.org/index.php/IKEv2_with_EAP-MSCHAPv2
- gonzo 10y ago
  > Prior to, I think, 2.4 2.3 (which got Strongswan), but yeah. 2.4 isn't released yet.

notaplumber 10y ago

If you want a pf firewall, you should probably get it from OpenBSD.. they created pf. https://www.openbsd.org/faq/pf/index.html https://www.openbsd.org/faq/pf/index.html

kek918 10y ago

We use pfSense at a client of mine and it's great. I didn't have any prior experience with it but I only spent a couple of nights setting everything up. We use it to manage firewall rules and as DHCP server for 2 VLANs. We've used it for about a year now. Had several power outages. The pfSense box is still running like a champ, no problems whatsoever. Turns out my client actually wanted an email spamfilter though, but our mail is hosted in another country so I had a little trouble explaining why our internal pfSense couldn't help us there. Oh well.

F00Fbug 10y ago

I can't say enough good things about pfSense. I'm running three of 'em and would gladly trash my Checkpoint firewalls to use pfSense, if our parent company didn't mandate them. I've run it on everything from tiny, Atom-based machines to kitted-out HP DL385s, and even on ESXi virtual machines. It works great in all scenarios.

sandGorgon 10y ago

I always had this question - can something like pfsense be built on linux with comparable performance or is there something inherent to the whole stack that makes this effective? I have always wondered if building pfsense on a modern linux kernel + selinux + BPF with something like nginx/lua scripting (for addon packages) would make more sense. http://www.brendangregg.com/blog/2016-10-27/dtrace-for-linux-2016.html http://www.brendangregg.com/blog/2016-10-27/dtrace-for-linux...

edcastro 10y ago
https://vyos.io/ https://vyos.io/ might be what you're looking for.
- Dangeranger 10y ago
  So is VyOS the successor to Vyatta? It looks like maybe this project forked after the purchase by Brocade. As a side not Vyatta is the base OS in many of the Ubiquiti Networks routers. It's quite nice for small office/ home office.
  - ddeck 10y ago
    That's correct. Brocade closed sourced the main product in 2012 and left the community edition to die. It was forked in 2013 (renamed VyOS) and is under active development as a free open source project.
  - slau 10y ago
    I would say it's nice enough for more than just "small" stuff. Depending on your definition of "small", I guess. I'm running a VyOS machine (old desktop with a couple of NICs) which handles the traffic for our Copenhagen office. That's ~15 CI boxes, and 30 people. This is on a 100/100 connection. For Ubiquiti, I'm a fan. I helped our co-working space setup a network on another floor, and we used an EdgeRouter Lite to handle the 200/200 connection. The ERL handles it without breaking a sweat. That's for 60 people on a daily basis. For another building, I just finished setting up an ERPro (the 8-port rack-mounted version). It's again on a 200/200 connection, and for roughly 150 people on average, with a maximum around 300-500. At home, I have an ERPoE, which handles my home lab just perfectly. I'm only on a 100/100 uplink at the moment, but will be upgraded to 1000/500 soon, and I know the ERPoE will handle that just fine as well (thank you hardware offloading ;)). 5 VLANs with full firewalling and routing between them, native IPv6 with prefix delegation, mDNS proxying between VLANs, OpenVPN handled by the router. I could do a lot of this with OpenWRT on an Archer C7, but the ERPoE is simply miles ahead. The UI is nice for newcomers, and the CLI is amazing. I fell in love with the CLI on VyOS, and am very happy to see the same in the UBNT products. For $100, they are amazing devices. VyOS is my go-to choice when I need to have a virtual router.

vxxzy 10y ago

I use pfSense as a vitual machine to firewall/NAT off my vitual environment. It works great. I am running it on KVM/QEMU and handing off the PCI device to the pfSense VM. Great for managing my environment through VPN. I've also used this in a retail chain in DC/MD/VA. Each location used pfSense for site-site VPN (OpenVPN). We also used the asterisk package to handle VoIP. Overall, pfSense is a robust UTM.

jstewartmobile 10y ago

I liked pfSense until it got too beefy for my ALIX board. That forced me to move to OpenBSD, and boy am I glad I did. Once you grok the syntax, it is so much easier to directly update settings in pf.conf than the pfSense web GUI--especially traffic shaping rules. That, and OpenBSD has great documentation, decent IPv6 support, and almost everything you need already baked-in. Here's a basic set of config files for a home setup: https://github.com/BourgeoisBear/OpenBSDFirewall https://github.com/BourgeoisBear/OpenBSDFirewall If you need IPv6 or anything fancy, PM me.

SSLy 10y ago
ugh, i wish we could use that syntax on the linux side of the computing world
- jstewartmobile 10y ago
  Ha! I wish I could find the jwz article where he shared his tale of woe with iptables before jumping to pf.
- mhurron 10y ago
  Syntax differences between pf and ipchains/iptables are why I chose OpenBSD on my firewall so many years ago.
- lima 10y ago
  nftables (the iptables successor) is really close to the pf syntax. It's awesome.
- tasn 10y ago
  I recently switched to nftables on Linux and the syntax is great, you should give it a go. I wrote a blog post demonstrating my server configuration. Shameless plug: https://stosb.com/blog/explaining-my-configs-nftables/ https://stosb.com/blog/explaining-my-configs-nftables/
  - dhess 10y ago

notaplumber 10y ago

Netgate/pfSense has been notoriously anti-community, with their own co-founder attacking other projects, including a recent fork called OPNSense. They've also been very hostile towards the OpenBSD developers, and project. Despite the fact they've effectively built a business on OpenBSD innovations, like pf and CARP, even incorporating the name 'pf' into their trademark having not contributed a bit of code.. n̶o̶r̶ ̶a̶ ̶d̶i̶m̶e̶ (but perhaps some hw). But feel free to keep using it.. no need to take my word for it. https://www.openbsd.org/donations.html https://www.openbsd.org/donations.html http://www.openbsdfoundation.org/contributors.html http://www.openbsdfoundation.org/contributors.html

stsp 10y ago
I won't defend their demeaning public behaviour towards OpenBSD. I find it revolting. But they did make one donation to this OpenBSD developer. They sent me 3 rcc-ve boards which I am still using for development: http://cvsweb.openbsd.org/cgi-bin/cvsweb/www/want.html#rev1.945 http://cvsweb.openbsd.org/cgi-bin/cvsweb/www/want.html#rev1.... They took much more than they have given (which the source code licence allows them to do, even if it's morally wrong). Claiming they never gave anything at all is incorrect.
- notaplumber 10y ago
  I've edited my post, will remove it if you think it does more harm to highlight their actions than good.
  - stsp 10y ago
    Please don't remove your post. Pointing out these issues is very important, and making one donation should not indemnify people who behave in this way.
- ianai 10y ago
  Not necessarily a question for just you, but what have they done, exactly?
- 10y ago

kylegordon 10y ago

Been using pfsense for a while now, and with CARP and system redundancy, firewalling, and twin ipsec tunnels to AWS, it's been great and hugely reliable.

mrmondo 10y ago

I've been using PFSense both at various workplaces and at home for many years now, it's seriously fantastic. Feature rich, rock solid and good 3rd party packages.

rdslw 10y ago

Guys, they started in 2004. Its 2017 today. hackersNEWS ?

jug5 10y ago
I don't understand these posts. There's no new version of pfSense there's no announcements, nothing has happened to warrant the post. WTF?

dcow 10y ago

Usually when people mention they run pfSense it means, "I heard pfSense is good for security so I use it". If I get that impression in an interview, GG. IMO it's an easy litmus test for netsec/secops roles. If you can't write a pf rule, there are probably bigger issues. OpenBSD is the way to go. I also think the pfSense CEO has a massively inflated ego and pays little homage to the roots of his software. Does pf really need a GUI? edit: clarity.

chrisper 10y ago
Are you saying that people who use pfSense don't know what they are doing?
- dcow 10y ago
  Not quite. But I am saying I've always found better candidates.
gonzo 10y ago
> I also think the pfSense CEO has a massively inflated ego and pays little homage to the roots of his software. The Netgate CEO is a woman. (I am not the CEO.)
- dcow 10y ago
  That only happened late 2015. I'm talking about some reddit comments by whomever was in control of pfSense.
  - gonzo 10y ago
    That was me making those comments. The person who has been CEO since September 2012 is a woman.

jenkstom 10y ago

We've had a lot of success with pfSense. BGP works, IPSEC works, most things work quite well with no headaches. My previous employer used a Watchguard firewall and to be honest pfSense was a much better experience all around. Except for cloud VOIP. Neither 8x8 nor Shoretel worked worth a darn through this firewall. We even paid for the gold support and opened more than one support case with no luck. It appeared to be a RTSP issue, SIP didn't have any trouble. And it was intermittent. Most of the time it would work, occasionally it would not. Eventually we replaced pfSense with a Cisco router for our phones and it worked fine.

storrgie 10y ago

Does there exist an analog to this for switching (particularly an organization that sells hardware)?

stevefeinstein 10y ago

I used pfSense for a long time and ultimately the conclusion was it was a 75% solution. It made those 75% things pretty easy to set up and configure. But once you needed something from the 25% you had to dig into the BSD configuration and now had to deal with how that interoperated with the pfSense stuff. Better to just bite the bullet and configure BSD (or linux for some things it does even better) from scratch and get exactly what you want and need.

deleted 10y ago

[deleted]

throw2016 10y ago

Unless your needs are extreme in which case you will have networking experts making choices the linux networking subsystem is actually quite good both in terms of tooling and performance. I experimented with Vyatta which was based on Debian - open source fork now used by Ubiquity networks in their devices, and pfsense a couple of years ago and I found plain linux on its own delivers better performance. The recent series of Ars articles on building your own router confirm this with some benchmarks [1] [1] https://arstechnica.com/gadgets/2016/01/numbers-dont-lie-its-time-to-build-your-own-router/ https://arstechnica.com/gadgets/2016/01/numbers-dont-lie-its...

widea 10y ago

Yet I use Smallwall, the successor of M0n0wall on an old Soekris 5501-70. It is just a firewall, no bells and whistles and therefor very stable.

hobarrera 10y ago

You know what's open source and works great as a firewall (also based on pf)? OpenBSD. No, seriously. Don't bother picking a third-party repackage of pf, when you can actually get the a secure OS built by people who actually put security above everything else. If you care about security, there's no reason to go elsewhere.

deleted 10y ago

[deleted]

MPSimmons 10y ago

Do they have an API yet? Because I hated using it without an API.

bpineau 10y ago
Same here. No API means no automation, no Chef/Puppet/Ansible/Salt or other kind of scripts. Everything in the head of the person who clicked through the web interface. Are there automation friendly alternatives?
gonzo 10y ago
I also dislike it not having an API, but we have a strategy now.

xer 10y ago

I reviewed pfSense around nov 2016, it failed on many basic security best-practices, and was rejected for our purpose.

gonzo 10y ago
Yet in the same timeframe US Army Cyber Command selected it to stand in front of their infrastructure.
- xer 10y ago
  Lol
gonzo 10y ago
Yet in the same timeframe US Army Cyber Command selected it to stand in front of their infrastructure.

Bombthecat 10y ago

I want something like that in docker :)

pelasaco 10y ago

I still prefer https://opnsense.org/ https://opnsense.org/

hpcjoe 10y ago

A fan of pfSense, I've used/deployed it a number of times to customers, and for some previous employer bits. Current version doesn't have an API, but is fine for what I do with it. I did see people hating on it here, and while I cannot/will not speak to their specific issues, I look at it as a much better tool than the integrated hardware units you can buy online for ~$100USD, with also integrated back-doors, courtesy of the development effort. I know perfectly well that I could build what I need using IPtables ... but have you used IPtables? I'm a CLI guy, and heck ... I want a GUI for IP tables ... I've not yet played with the nftables, and frankly, I am looking for a generally simpler model of putting some of these things together. pfSense does a pretty good job of this. One note on the php on the stack ... yeah, this is a concern for me as well. So I don't generally expose the admin access to the interwebs. And I lock that aspect down pretty hard (only specific addresses are allowed to even connect to the admin port). This isn't perfect, but its far better than setting up a web port, and suddenly presenting the pfSense gui out (yeah, this sorta happens by default if you don't move the gui to a different port, and do some other config). This all said, it is pretty good for what it does, and a few of my previous customers have bought the support for it directly from the team.