37 ms·

PfSense vs OPNsense: technical comparison

45 points by auslander 8y ago

tptacek 8y ago
I have been doing security work for a very long time, since before the projects underpinning pfSense were a thing (I don't mean Snort, which I predate, but pf itself; I was working in network security when we were all being thrilled by Darren Reed's work on ipfilter). I say this not to brag (it would be a terrible brag, like playing up my Turbo C++ bona fides) but as context for a question: What are people doing with these things? When is it making sense for people to be deploying what appears for all the world to be the Kali Linux of Defensive Network Security? I'd be confused to hear about a client deploying Suricata at all --- but Suricata on a dedicated firewall box with a PHP interface? What problem is this solving? Among the top 10 questions startups ask us when we talk to them about what we do is, "we got this self-assessment questionnaire from a big client and it asks what our IPS is, what IPS should we use?" And we laugh and say "these SAQs were written in the 1990s and lovingly handed down from generation to generation of network security engineers and nobody actually expects you to install an IPS because doing that in a 2018 production environment would be silly, just tell them you only expose ports 80 and 443". And that answer always works. How are people finding a different answer? I'm genuinely asking.
- auslander 8y ago
  > What are people doing with these things? home routers ?
  - tptacek 8y ago
    Why do I want my home router to be really good at detecting Windows Server attacks from 2013? Especially since I'd have to park it behind my ISP's prem box, which is the thing that is actually going to get owned up on my home network.
    - auslander 8y ago
      Not sure what is your problem, honestly. Custom home router on small form factor machine to replace buggy Netgears. Just put your ISP's box in Bridge mode.
      - tptacek 8y ago
        That didn't address either of my questions/concerns.
        tw04 8y ago
        For someone claiming to be an expert, you appear to be completely ignorant about the products you're judging. What does "detecting a windows server attack from 2013" have to do with ANYTHING? The primary purpose of the OPNSense and PFSense projects is to be a better home router replacement. Now PFSense has "moved up" if you will into the SMB space, and has further ambitions in the routing space, but the basics still come down to that goal. Suricata and Snort aren't even installed by default, much less required. So why do you keep harping on that functionality? It's irrelevant. These are ROUTERS that can be extended to do IPS if you so choose, but is in no way required.
        tptacek 8y ago
        Is the page we're commenting on just a really bad description of the project? Because it does not say that OPNSense is simply a ROUTER, and besides "we switched to the fastest PHP framework"† the IPS capabilities are basically the only technical comparison the article makes. OPNSense describes itself as a firewall. A firewall is generally something you deploy along with a router. Does the term "firewall" just mean something else among the community of people repurposing old Dell towers to build complicated home networks? † smdh
        tw04 8y ago
        Blame the industry? Every home router you can by today is a "firewalL" by their definition, because it does NAT and blocks all inbound traffic by default. I think it's silly to debate whether or not that's a fair description, but they're using the terminology their target market is used to hearing. Some vendors have moved towards calling their SPI functionality the "firewall" portion, but that debate is about a decade too late.
  - blattimwind 8y ago
    If you need a GUI, just use something like Halon's SecurityRouter.
    - auslander 8y ago
      Is it free to use? Is it open source?
      - blattimwind 8y ago
        Depends / it's source available AFAIK. Some time ago I looked at this sort of thing (simple management + status GUI for a router), and pfsense & friends are just huge, bloated pieces of mess that I really don't want on critical infra. Securityrouter OTOH came across as one of the very few frontends actually designed for security (see their docs). (Also it doesn't include a the full B/S suite) In the end I didn't choose any GUI and just put a Debian on a box. I don't really know any of the BSDs and it certainly wasn't worth more of my time to fool around with a small piece of infra that's going to be ignored >99.99 % of the time.
        auslander 8y ago
        > it's source available AFAIK AFAIK it is not.
    - SanDiegoSalsa 8y ago
      Halon pivoted away from this market. Last I looked it was a secure email play.
      - blattimwind 8y ago
        Wasn't SR always a side project for them? Still gets releases, though.
  - tssva 8y ago
    PfSense is very popular in the SMB market where there is little to no IT staff or budget but requirements beyond what can be satisfied with a home router. PfSense is also popular as a firewall appliance in cloud deployments. Demand for running pfSense was one of the drivers for Microsoft to add FreeBSD support to Azure.
- kev009 8y ago
  If you read this site you are probably well above the target audience in terms of skill. By numbers, I'd guess small/mid size business IT personnel dwarf the higher end multi-tier {dev,eng,ops,sre,sec} of tech companies. And these IT folks generally need a push-button appliance experience due to education/skills. Think Microsoft products, and control panels and wizards on Linux like cPanel. If you go walk the floor of a commercial data center, you will see tons of sonicwall, Ubiquiti, etc. Basically these are an open source version of those. Now a subset of these projects might have some serious implementation smells, but I wouldn't really pass judgement on the users of any of those things. Just about any business can benefit from technology, not everything is well suited for services/hosted approaches, and there is clearly a need for simplified IT equipment.
  - tptacek 8y ago
    Sure, I get that, but my point isn't that I would do what pfSense/OPNSense does in a better, more elegant way; it's that I wouldn't do them at all. Isn't that even easier than installing one of these thingies?
    - kev009 8y ago
      Say you have a single static IP at a small office and need to set up a network of systems behind a NAT with DHCP, and maybe a few PAT forwarding rules to a server. It would basically take the time to burn a USB stick and boot it, and 30 minutes of following the UI prompts for even low skilled folks. What would you recommend said folks do instead?
      - tptacek 8y ago
        Isn't that a problem almost every wifi router that costs more than $150 already solves? I might just not be understanding your requirements. Also: you just described a problem that requires something like 2% of all the crud OPNSense brags about running.
        auslander 8y ago
- nmjohn 8y ago
  I use pfSense. I do not use the IPS features mostly because of the reasons you present. However pfSense is also a very capable router, which is why I use it. Are there other ways to solve this problem? Of course, most problems in tech have a large number of solutions, each with their own trade offs. If I were to set my network up again, I would probably go with an edgerouter pro or similar - but since I already had a low power server I could repurpose as the router, it was $0 vs $400.
  - tptacek 8y ago
    That makes sense. If that's why most people use these things --- to repurpose old hardware in their basement rather than ordering a new router --- then pfSense makes some sense to me.
    - antongribok 8y ago
      Doesn't have to be just re-purposing old hardware for it to make sense IMHO. I started using pfSense on old hardware to get rid of Verizon's router, however I plan to replace it with a brand new box that will likely be $250-500. I have gigabit FiOS coming into the ONT outside, and from there I get an Ethernet port that comes straight to the pfSense box. No Verizon router present at all. Besides pfSense, what other open source options do I have to run a firewall that can handle gigabit ethernet with VPN? DD-WRT? Tomato? Sure, I can setup a Debian box with iptables in my sleep, but pfSense is much nicer.
      - dev_dull 8y ago
        I’m in a similar boat (ATT fiber) and really curious as well. I’ve considers pfsense with dual gigabit nic but honestly I’d rather have a dedicated box that can handle the routing and firewall features.
      - yumr 8y ago
        OpenWRT is standard for routers, you can even run it on x86 just fine, and unlike PFSense it won't shit a brick and sit in a broken state at console just because a secondary ethernet interface disappears. PFSense really is targeted at the prosumer market. If your happy to haul a screen out on every upgrade or minor hardware change, PFSense is fine. Otherwise, going Openwrt is a solid choice as you can actually debug it remotely.
- deleted 8y ago
  [deleted]
- thijsvandien 8y ago
  I've used pfSense several times to have a (semi-)pro grade router/firewall at an entry level price. For me it strikes a nice balance between power and ease of configuration. Even though personally I don't care too much about most advanced features, I like how there are no arbitrary limitations, and it's good to know that the underlying technology is solid and inspectable/tweakable if needed. And yes, I do buy new hardware for it without hesitation; the PC Engines APU is very well-suited. This way $200 can get you a better solution than $600–$800 off-the-shelf.
- mikevm 8y ago
  Can you please comment why installing IPS in a production environment in 2018 is silly? (genuinly want to know) Also, when or where would you recommend installing an IPS product? As part of a corporate firewall?
  - tptacek 8y ago
    I would more or less never recommend installing an IPS. In the past dozen or so years I've spent lots of time (months at a time) working on the networks of F500s that have fleets of IPS systems, alongside their security teams, and I have never once seen an IPS do anything but generate alerts that get bucketed in a SEM and forgotten about.
    - 616c 8y ago
      I completely agree but think this shows a failing of "blue team" culture and education. I now started work in a massive project with half a dozen companies sharing massive AWS VPCs. They have limited security team oversight and coordination. Wouldn't it be nice of they had sufficient levels of access to Snort Suricata data and could learn what normal operations looks like and educate themselves to look for poorly documented systems that are not hooked up to SIEM or even the APM correctly or are failing to talk to different EC2 instances correctly and help? Inventory and ops is sexy and not security but why countless times I see younger SOC kids know absolutely nothing about what their environment looks like. That data would not help them even if they are allowed out if the kiddie sandbox and only allowed to read baked queries and alerts. The reason this stuff is useless is bc I have never met someone with sufficient experience to act on it for any context, bc people think the tools magically bring educated talented people.
- mindslight 8y ago
  > Suricata on a dedicated firewall box with a PHP interface? What problem is this solving? The same as every other feature bullet - checking off a box so the product doesn't get "out-checked". Only this time it involves tinkerers, who might set the thing up because it sounds cool, before really asking why. Presumably the package was already in some repo, and it tickled someone's fancy to do the little bit of integration work. But that doesn't mean these types of packages are driving the adoption of pfSense. That said, I don't really need MRTG graphs but if I can get them by clicking a few boxes, I just might. As other people have said, the main driver is (NAT) routers. Soon in need of a faster router, I'm personally considering trying out the pfSense route rather than straightforward (for me) Debian+iptables. Both for a bit of kernel diversity, and sometimes it's nice to just click away. > Especially since I'd have to park it behind my ISP's prem box, which is the thing that is actually going to get owned up on my home network. Your ISP's equipment is not part of your home network - you're better off viewing its ethernet port as the service demarc. In fact, given the straightforward business interest in say enumerating the devices on your home network, I'd characterize it as a persistent attacker. Protocol wise, there's little drawback to just lumping it with the ISP's overtly-hostile DPI gear. About the only trust I'm willing to grant that thing is that it's unable to draw untoward amounts of power say mining crypto coins, and if it's already fed by fibre that it won't create its own electrical surges.
- mgamache 8y ago
  PFSense does provide a free GUI interface to OpenPVN. That's useful in many small business applications. Also, don't discount that you can't buy one at BestBuy, that lends (for non-technical peeps) a veneer of credibility.
- antoncohen 8y ago
  I once tried out pfSense, about 8 years ago. I was looking for a VPN solution for a small startup. I had used pf on OpenBSD, and really liked it as a firewall, so having "pf" in the name made pfSense sound good to me. My hope was that pfSense would provide an easy out of the box VPN setup, without me having to configure a RADUIS server to talk to LDAP, and have easy user provisioning. What I found was a mess of PHP and poor quality plugins. The init scripts were written in PHP, and the plugins modified the init scripts. So plugins could, and did, break the init process, preventing the firewall rules from loading. I don't think people are using pfSense in production environments, I see this class of solution being used by IT at small companies. Think about big corporate networks, where you might have a device from Palo Alto Networks, or a Cisco ASA for a remote access VPN. Then imagine you are at a 20 person company, a decade ago before SaaS really took off, and you think you need a VPN, but can't afford something from a big company, and don't want to glue together a bunch of open source tools. I think that is when people reach for pfSense. I don't think it makes much sense these days. Small companies can use much dumber (and better) gateway devices. With SaaS and things like Google IAP and Cloudflare Access there is little need for VPNs. As for IPS, I have trouble imagining IPS being needed or even working at a small company. Big companies can have sophisticated detection systems and teams to deal with them. Hopefully big companies were never using pfSense.
  - dijit 8y ago
    >What I found was a mess of PHP and poor quality plugins. The init scripts were written in PHP, and the plugins modified the init scripts. So plugins could, and did, break the init process, preventing the firewall rules from loading. Really, really, not my experience and I've been using it for 7~ years. >I don't think people are using pfSense in production environments I was running 1% of all internet traffic through dual pair of pfSense firewalls running on some HP 2U servers during Christmas 2011.. (interface was slow as shit with that load though to be honest). I wouldn't discount it's power. Mostly when you buy something like a Juniper SRX it's similar underneath. It's not like there are common ASICs for firewalls.
  - apple4ever 8y ago
    You need to use pfSense now. Its come a long way since you did. People are using pfSense in production too. (though I have my quibbles with NetGate, who owns pfSense).
- noja 8y ago
  > What are people doing with these things? With Suricata, or with pfSense? Suricata is used when you want to block internal clients that do something suspicious (like join a botnet), or to notice something unwanted (like using a banned application, such as dropbox).
- zouhair 8y ago
  Here[0] is a series of videos showing what a small IT company does with pfsense. [0]: https://www.youtube.com/user/TheTecknowledge/search?query=pfsense https://www.youtube.com/user/TheTecknowledge/search?query=pf...
- xenophonf 8y ago
  Maybe we're doing it wrong, but we use IPS for the same reasons that we use signature-based antivirus---as a backstop. Ideally, they wouldn't do anything, but we live and work in a less-than-ideal world with imperfect information security policies (and configurations), mobile users and visitors and students, and IT staff who aren't all infosec pros like you. And in that less-than-ideal world, both intrusion prevention systems and antivirus software mitigate enough risk to make their procurement, deployment, management, monitoring, and maintenance worth my while.
- xen2xen1 8y ago
  Huge number of answers, but I'll give mine. At work I would use a Ubiquity or untangle or Mikrotik or something, but for home use yeah, for less than the cost of one of those that will do gigabit you can get an old server (small), put PfSense on it, and have something far more flexible than an Asus or Netgear. For instance:. Try setting port 80 only coming IN from certain IP with one of those? Not even sure you can do that on a Ubiquity. Try to find something that can do that AND do UPNP so you kid can play Black Ops 3...
- apple4ever 8y ago
  > but Suricata on a dedicated firewall box with a PHP interface? What problem is this solving? Ease of use with out overpaying for the same feature seat. I'm surprised you think there isn't a problem its solving, to be honest.
kev009 8y ago
As someone with extensive experience and nuance in the FreeBSD community, I will just say that OPNsense and closely affiliated HardenedBSD are basically unintentionally hilarious clown projects. They created some bad blood with particular people but the HBSD side tends to just give me a good belly laugh every handful of months, usually around the larger conference season. Folks from OPN and HBSD appear to have rudimentary grasp of C while making grandiose security claims. This is probably my favorite feature comparison of all time https://hardenedbsd.org/content/easy-feature-comparison https://hardenedbsd.org/content/easy-feature-comparison. It appears to be largely cult of personality ensnaring users that don't really know any better. YMMV but for people wanting a firewall you'd be much better off with pfSense, stock OpenBSD, or stock FreeBSD. To get involved in OS work or BSDs you're much better off with Free/Open/Net/TrueOS. Those are communities filled with competent people to support the code and that you can learn from.
- auslander 8y ago
  "It is a fork of pfSense, which in turn was forked from m0n0wall, which was built on FreeBSD. It was launched in January 2015. When m0n0wall closed down in February 2015 its creator, Manuel Kaspar, referred its developer community to OPNsense" [0] I just heard of OPNsense today. Also, there [0] is a thing about pfSense hoarding OPNsense's domain ... [0] https://en.wikipedia.org/wiki/OPNsense https://en.wikipedia.org/wiki/OPNsense
- auslander 8y ago
  > be much better off with pfSense, stock OpenBSD, or stock FreeBSD There is a reason why people install pfSense and not stock BSD, its called GUI :) And pfSense was playing with licences before, some think it's getting ready to do it again.
  - gonzo 8y ago
    > And pfSense was playing with licences before, some think it's getting ready to do it again. FUD much? 'some' might think, but I know, and we're not.
myrandomcomment 8y ago
I had a hard time reading this. The flow and phrasing is quite bad. Read 1/2 way and quit.
- auslander 8y ago
  Yeah, my bad. Try this https://opnsense.org/about/about-opnsense/ https://opnsense.org/about/about-opnsense/
madjam002 8y ago
I am currently running pfSense, but am currently handrolling a firewall with Ansible and nftables. I highly recommend it over something like pfSense or OPNSense, I found the GUI in pfSense wasn't flexible enough.
solotronics 8y ago
reading about the recent developments putting FPGA in front of a NIC it seems to me that would be a really neat way to build a firewall
- user5994461 8y ago
  Firewall and routing have been done with FPGA for many many years. Have a look at enterprise and carrier grade hardware.
asn1parse 8y ago
I replaced all my bad phrasing with a pointer back to the commenter who referenced pfsense and others a clown projects. so true. bye
Corrado 8y ago
I'm running OPNSense for a small private school and it seems to be working fine. I looked at pfSense but between the licensing changes, petty infighting, and "not so pretty" GUI I chose not to use it. One of the things that OPNSense has over pfSense is the ease-of-use factor. This firewall/router will be used in a school, by non-technical people, it needs to be pretty and easy to make simple changes to. Things like blacklisting/whitelisting a site, and adding a static IP for a printer, are activities that are commonly done by a teacher or administrator. If it's hard to do then I get a call and that's no good for me. :)
robbyt 8y ago
I did some performance testing comparing pfsense and opnsense on idential hardware, and out-of-the-box configuration. On my Atom 1.6ghz dual Intel nic router I was able to get near line-speed gigabit NAT from pfsense, while opnsense maxed out around 825mbps. I spent only a couple of hours with the test, and quickly decided switching off pfsense wasn't worth it for me.
auslander 8y ago
Summary, kind of. I replaced my Sophos UTM with OPNsense. So far so good. - Sophos phones home too much, is not open source. OPNsense in comparison to pfSense: - using better BSD, with ASLR (the only check I did so far) - licensed under BSD 2-Clause, vs Apache 2.0 - nicer GUI :) - not running PHP as a root user Looks like OPNsense is true hacker's stuff, check this out for DNS over TLS: https://forum.opnsense.org/index.php?topic=8748.msg38928#msg38928 https://forum.opnsense.org/index.php?topic=8748.msg38928#msg...
auslander 8y ago
What I learned from this submission: - people who start with their credentials, 'I'm experienced ..' - are making least sense. - people who use the word 'FUD' are actually trying to shut down sensitive for them topic.
apple4ever 8y ago
My biggest issue with pfSense is the company that runs it: Netgate. Its putting it mildly to say they are jerks. I was banned from their forum for saying I wouldn't pay for Gold if they were going to sunset a range of CPUs when their explanation of why was less than clear. I then apologized for offending them, and they said its a life ban so too bad. Just read their forum or the reddit. Look for Ivor comments specifically.

45 points by auslander 8y ago

I have been doing security work for a very long time, since before the projects underpinning pfSense were a thing (I don't mean Snort, which I predate, but pf itself; I was working in network security when we were all being thrilled by Darren Reed's work on ipfilter). I say this not to brag (it would be a terrible brag, like playing up my Turbo C++ bona fides) but as context for a question: What are people doing with these things? When is it making sense for people to be deploying what appears for all the world to be the Kali Linux of Defensive Network Security? I'd be confused to hear about a client deploying Suricata at all --- but Suricata on a dedicated firewall box with a PHP interface? What problem is this solving? Among the top 10 questions startups ask us when we talk to them about what we do is, "we got this self-assessment questionnaire from a big client and it asks what our IPS is, what IPS should we use?" And we laugh and say "these SAQs were written in the 1990s and lovingly handed down from generation to generation of network security engineers and nobody actually expects you to install an IPS because doing that in a 2018 production environment would be silly, just tell them you only expose ports 80 and 443". And that answer always works. How are people finding a different answer? I'm genuinely asking.

auslander 8y ago
> What are people doing with these things? home routers ?
- tptacek 8y ago
  Why do I want my home router to be really good at detecting Windows Server attacks from 2013? Especially since I'd have to park it behind my ISP's prem box, which is the thing that is actually going to get owned up on my home network.
  - auslander 8y ago
    Not sure what is your problem, honestly. Custom home router on small form factor machine to replace buggy Netgears. Just put your ISP's box in Bridge mode.
    - tptacek 8y ago
      That didn't address either of my questions/concerns.
      - tw04 8y ago
        For someone claiming to be an expert, you appear to be completely ignorant about the products you're judging. What does "detecting a windows server attack from 2013" have to do with ANYTHING? The primary purpose of the OPNSense and PFSense projects is to be a better home router replacement. Now PFSense has "moved up" if you will into the SMB space, and has further ambitions in the routing space, but the basics still come down to that goal. Suricata and Snort aren't even installed by default, much less required. So why do you keep harping on that functionality? It's irrelevant. These are ROUTERS that can be extended to do IPS if you so choose, but is in no way required.
        tptacek 8y ago
        Is the page we're commenting on just a really bad description of the project? Because it does not say that OPNSense is simply a ROUTER, and besides "we switched to the fastest PHP framework"† the IPS capabilities are basically the only technical comparison the article makes. OPNSense describes itself as a firewall. A firewall is generally something you deploy along with a router. Does the term "firewall" just mean something else among the community of people repurposing old Dell towers to build complicated home networks? † smdh
        tw04 8y ago
        Blame the industry? Every home router you can by today is a "firewalL" by their definition, because it does NAT and blocks all inbound traffic by default. I think it's silly to debate whether or not that's a fair description, but they're using the terminology their target market is used to hearing. Some vendors have moved towards calling their SPI functionality the "firewall" portion, but that debate is about a decade too late.
- blattimwind 8y ago
  If you need a GUI, just use something like Halon's SecurityRouter.
  - auslander 8y ago
    Is it free to use? Is it open source?
    - blattimwind 8y ago
      Depends / it's source available AFAIK. Some time ago I looked at this sort of thing (simple management + status GUI for a router), and pfsense & friends are just huge, bloated pieces of mess that I really don't want on critical infra. Securityrouter OTOH came across as one of the very few frontends actually designed for security (see their docs). (Also it doesn't include a the full B/S suite) In the end I didn't choose any GUI and just put a Debian on a box. I don't really know any of the BSDs and it certainly wasn't worth more of my time to fool around with a small piece of infra that's going to be ignored >99.99 % of the time.
      - auslander 8y ago
        > it's source available AFAIK AFAIK it is not.
  - SanDiegoSalsa 8y ago
    Halon pivoted away from this market. Last I looked it was a secure email play.
    - blattimwind 8y ago
      Wasn't SR always a side project for them? Still gets releases, though.
- tssva 8y ago
  PfSense is very popular in the SMB market where there is little to no IT staff or budget but requirements beyond what can be satisfied with a home router. PfSense is also popular as a firewall appliance in cloud deployments. Demand for running pfSense was one of the drivers for Microsoft to add FreeBSD support to Azure.
kev009 8y ago
If you read this site you are probably well above the target audience in terms of skill. By numbers, I'd guess small/mid size business IT personnel dwarf the higher end multi-tier {dev,eng,ops,sre,sec} of tech companies. And these IT folks generally need a push-button appliance experience due to education/skills. Think Microsoft products, and control panels and wizards on Linux like cPanel. If you go walk the floor of a commercial data center, you will see tons of sonicwall, Ubiquiti, etc. Basically these are an open source version of those. Now a subset of these projects might have some serious implementation smells, but I wouldn't really pass judgement on the users of any of those things. Just about any business can benefit from technology, not everything is well suited for services/hosted approaches, and there is clearly a need for simplified IT equipment.
- tptacek 8y ago
  Sure, I get that, but my point isn't that I would do what pfSense/OPNSense does in a better, more elegant way; it's that I wouldn't do them at all. Isn't that even easier than installing one of these thingies?
  - kev009 8y ago
    Say you have a single static IP at a small office and need to set up a network of systems behind a NAT with DHCP, and maybe a few PAT forwarding rules to a server. It would basically take the time to burn a USB stick and boot it, and 30 minutes of following the UI prompts for even low skilled folks. What would you recommend said folks do instead?
    - tptacek 8y ago
      Isn't that a problem almost every wifi router that costs more than $150 already solves? I might just not be understanding your requirements. Also: you just described a problem that requires something like 2% of all the crud OPNSense brags about running.
      - auslander 8y ago
nmjohn 8y ago
I use pfSense. I do not use the IPS features mostly because of the reasons you present. However pfSense is also a very capable router, which is why I use it. Are there other ways to solve this problem? Of course, most problems in tech have a large number of solutions, each with their own trade offs. If I were to set my network up again, I would probably go with an edgerouter pro or similar - but since I already had a low power server I could repurpose as the router, it was $0 vs $400.
- tptacek 8y ago
  That makes sense. If that's why most people use these things --- to repurpose old hardware in their basement rather than ordering a new router --- then pfSense makes some sense to me.
  - antongribok 8y ago
    Doesn't have to be just re-purposing old hardware for it to make sense IMHO. I started using pfSense on old hardware to get rid of Verizon's router, however I plan to replace it with a brand new box that will likely be $250-500. I have gigabit FiOS coming into the ONT outside, and from there I get an Ethernet port that comes straight to the pfSense box. No Verizon router present at all. Besides pfSense, what other open source options do I have to run a firewall that can handle gigabit ethernet with VPN? DD-WRT? Tomato? Sure, I can setup a Debian box with iptables in my sleep, but pfSense is much nicer.
    - dev_dull 8y ago
      I’m in a similar boat (ATT fiber) and really curious as well. I’ve considers pfsense with dual gigabit nic but honestly I’d rather have a dedicated box that can handle the routing and firewall features.
    - yumr 8y ago
      OpenWRT is standard for routers, you can even run it on x86 just fine, and unlike PFSense it won't shit a brick and sit in a broken state at console just because a secondary ethernet interface disappears. PFSense really is targeted at the prosumer market. If your happy to haul a screen out on every upgrade or minor hardware change, PFSense is fine. Otherwise, going Openwrt is a solid choice as you can actually debug it remotely.
deleted 8y ago
[deleted]
thijsvandien 8y ago
I've used pfSense several times to have a (semi-)pro grade router/firewall at an entry level price. For me it strikes a nice balance between power and ease of configuration. Even though personally I don't care too much about most advanced features, I like how there are no arbitrary limitations, and it's good to know that the underlying technology is solid and inspectable/tweakable if needed. And yes, I do buy new hardware for it without hesitation; the PC Engines APU is very well-suited. This way $200 can get you a better solution than $600–$800 off-the-shelf.
mikevm 8y ago
Can you please comment why installing IPS in a production environment in 2018 is silly? (genuinly want to know) Also, when or where would you recommend installing an IPS product? As part of a corporate firewall?
- tptacek 8y ago
  I would more or less never recommend installing an IPS. In the past dozen or so years I've spent lots of time (months at a time) working on the networks of F500s that have fleets of IPS systems, alongside their security teams, and I have never once seen an IPS do anything but generate alerts that get bucketed in a SEM and forgotten about.
  - 616c 8y ago
    I completely agree but think this shows a failing of "blue team" culture and education. I now started work in a massive project with half a dozen companies sharing massive AWS VPCs. They have limited security team oversight and coordination. Wouldn't it be nice of they had sufficient levels of access to Snort Suricata data and could learn what normal operations looks like and educate themselves to look for poorly documented systems that are not hooked up to SIEM or even the APM correctly or are failing to talk to different EC2 instances correctly and help? Inventory and ops is sexy and not security but why countless times I see younger SOC kids know absolutely nothing about what their environment looks like. That data would not help them even if they are allowed out if the kiddie sandbox and only allowed to read baked queries and alerts. The reason this stuff is useless is bc I have never met someone with sufficient experience to act on it for any context, bc people think the tools magically bring educated talented people.
mindslight 8y ago
> Suricata on a dedicated firewall box with a PHP interface? What problem is this solving? The same as every other feature bullet - checking off a box so the product doesn't get "out-checked". Only this time it involves tinkerers, who might set the thing up because it sounds cool, before really asking why. Presumably the package was already in some repo, and it tickled someone's fancy to do the little bit of integration work. But that doesn't mean these types of packages are driving the adoption of pfSense. That said, I don't really need MRTG graphs but if I can get them by clicking a few boxes, I just might. As other people have said, the main driver is (NAT) routers. Soon in need of a faster router, I'm personally considering trying out the pfSense route rather than straightforward (for me) Debian+iptables. Both for a bit of kernel diversity, and sometimes it's nice to just click away. > Especially since I'd have to park it behind my ISP's prem box, which is the thing that is actually going to get owned up on my home network. Your ISP's equipment is not part of your home network - you're better off viewing its ethernet port as the service demarc. In fact, given the straightforward business interest in say enumerating the devices on your home network, I'd characterize it as a persistent attacker. Protocol wise, there's little drawback to just lumping it with the ISP's overtly-hostile DPI gear. About the only trust I'm willing to grant that thing is that it's unable to draw untoward amounts of power say mining crypto coins, and if it's already fed by fibre that it won't create its own electrical surges.
mgamache 8y ago
PFSense does provide a free GUI interface to OpenPVN. That's useful in many small business applications. Also, don't discount that you can't buy one at BestBuy, that lends (for non-technical peeps) a veneer of credibility.
antoncohen 8y ago
I once tried out pfSense, about 8 years ago. I was looking for a VPN solution for a small startup. I had used pf on OpenBSD, and really liked it as a firewall, so having "pf" in the name made pfSense sound good to me. My hope was that pfSense would provide an easy out of the box VPN setup, without me having to configure a RADUIS server to talk to LDAP, and have easy user provisioning. What I found was a mess of PHP and poor quality plugins. The init scripts were written in PHP, and the plugins modified the init scripts. So plugins could, and did, break the init process, preventing the firewall rules from loading. I don't think people are using pfSense in production environments, I see this class of solution being used by IT at small companies. Think about big corporate networks, where you might have a device from Palo Alto Networks, or a Cisco ASA for a remote access VPN. Then imagine you are at a 20 person company, a decade ago before SaaS really took off, and you think you need a VPN, but can't afford something from a big company, and don't want to glue together a bunch of open source tools. I think that is when people reach for pfSense. I don't think it makes much sense these days. Small companies can use much dumber (and better) gateway devices. With SaaS and things like Google IAP and Cloudflare Access there is little need for VPNs. As for IPS, I have trouble imagining IPS being needed or even working at a small company. Big companies can have sophisticated detection systems and teams to deal with them. Hopefully big companies were never using pfSense.
- dijit 8y ago
  >What I found was a mess of PHP and poor quality plugins. The init scripts were written in PHP, and the plugins modified the init scripts. So plugins could, and did, break the init process, preventing the firewall rules from loading. Really, really, not my experience and I've been using it for 7~ years. >I don't think people are using pfSense in production environments I was running 1% of all internet traffic through dual pair of pfSense firewalls running on some HP 2U servers during Christmas 2011.. (interface was slow as shit with that load though to be honest). I wouldn't discount it's power. Mostly when you buy something like a Juniper SRX it's similar underneath. It's not like there are common ASICs for firewalls.
- apple4ever 8y ago
  You need to use pfSense now. Its come a long way since you did. People are using pfSense in production too. (though I have my quibbles with NetGate, who owns pfSense).
noja 8y ago
> What are people doing with these things? With Suricata, or with pfSense? Suricata is used when you want to block internal clients that do something suspicious (like join a botnet), or to notice something unwanted (like using a banned application, such as dropbox).
zouhair 8y ago
Here[0] is a series of videos showing what a small IT company does with pfsense. [0]: https://www.youtube.com/user/TheTecknowledge/search?query=pfsense https://www.youtube.com/user/TheTecknowledge/search?query=pf...
xenophonf 8y ago
Maybe we're doing it wrong, but we use IPS for the same reasons that we use signature-based antivirus---as a backstop. Ideally, they wouldn't do anything, but we live and work in a less-than-ideal world with imperfect information security policies (and configurations), mobile users and visitors and students, and IT staff who aren't all infosec pros like you. And in that less-than-ideal world, both intrusion prevention systems and antivirus software mitigate enough risk to make their procurement, deployment, management, monitoring, and maintenance worth my while.
xen2xen1 8y ago
Huge number of answers, but I'll give mine. At work I would use a Ubiquity or untangle or Mikrotik or something, but for home use yeah, for less than the cost of one of those that will do gigabit you can get an old server (small), put PfSense on it, and have something far more flexible than an Asus or Netgear. For instance:. Try setting port 80 only coming IN from certain IP with one of those? Not even sure you can do that on a Ubiquity. Try to find something that can do that AND do UPNP so you kid can play Black Ops 3...
apple4ever 8y ago
> but Suricata on a dedicated firewall box with a PHP interface? What problem is this solving? Ease of use with out overpaying for the same feature seat. I'm surprised you think there isn't a problem its solving, to be honest.

kev009 8y ago

As someone with extensive experience and nuance in the FreeBSD community, I will just say that OPNsense and closely affiliated HardenedBSD are basically unintentionally hilarious clown projects. They created some bad blood with particular people but the HBSD side tends to just give me a good belly laugh every handful of months, usually around the larger conference season. Folks from OPN and HBSD appear to have rudimentary grasp of C while making grandiose security claims. This is probably my favorite feature comparison of all time https://hardenedbsd.org/content/easy-feature-comparison https://hardenedbsd.org/content/easy-feature-comparison. It appears to be largely cult of personality ensnaring users that don't really know any better. YMMV but for people wanting a firewall you'd be much better off with pfSense, stock OpenBSD, or stock FreeBSD. To get involved in OS work or BSDs you're much better off with Free/Open/Net/TrueOS. Those are communities filled with competent people to support the code and that you can learn from.

auslander 8y ago
"It is a fork of pfSense, which in turn was forked from m0n0wall, which was built on FreeBSD. It was launched in January 2015. When m0n0wall closed down in February 2015 its creator, Manuel Kaspar, referred its developer community to OPNsense" [0] I just heard of OPNsense today. Also, there [0] is a thing about pfSense hoarding OPNsense's domain ... [0] https://en.wikipedia.org/wiki/OPNsense https://en.wikipedia.org/wiki/OPNsense
auslander 8y ago
> be much better off with pfSense, stock OpenBSD, or stock FreeBSD There is a reason why people install pfSense and not stock BSD, its called GUI :) And pfSense was playing with licences before, some think it's getting ready to do it again.
- gonzo 8y ago
  > And pfSense was playing with licences before, some think it's getting ready to do it again. FUD much? 'some' might think, but I know, and we're not.

myrandomcomment 8y ago

I had a hard time reading this. The flow and phrasing is quite bad. Read 1/2 way and quit.

auslander 8y ago
Yeah, my bad. Try this https://opnsense.org/about/about-opnsense/ https://opnsense.org/about/about-opnsense/

madjam002 8y ago

I am currently running pfSense, but am currently handrolling a firewall with Ansible and nftables. I highly recommend it over something like pfSense or OPNSense, I found the GUI in pfSense wasn't flexible enough.

solotronics 8y ago

reading about the recent developments putting FPGA in front of a NIC it seems to me that would be a really neat way to build a firewall

user5994461 8y ago
Firewall and routing have been done with FPGA for many many years. Have a look at enterprise and carrier grade hardware.

asn1parse 8y ago

I replaced all my bad phrasing with a pointer back to the commenter who referenced pfsense and others a clown projects. so true. bye

Corrado 8y ago

I'm running OPNSense for a small private school and it seems to be working fine. I looked at pfSense but between the licensing changes, petty infighting, and "not so pretty" GUI I chose not to use it. One of the things that OPNSense has over pfSense is the ease-of-use factor. This firewall/router will be used in a school, by non-technical people, it needs to be pretty and easy to make simple changes to. Things like blacklisting/whitelisting a site, and adding a static IP for a printer, are activities that are commonly done by a teacher or administrator. If it's hard to do then I get a call and that's no good for me. :)

robbyt 8y ago

I did some performance testing comparing pfsense and opnsense on idential hardware, and out-of-the-box configuration. On my Atom 1.6ghz dual Intel nic router I was able to get near line-speed gigabit NAT from pfsense, while opnsense maxed out around 825mbps. I spent only a couple of hours with the test, and quickly decided switching off pfsense wasn't worth it for me.

auslander 8y ago

Summary, kind of. I replaced my Sophos UTM with OPNsense. So far so good. - Sophos phones home too much, is not open source. OPNsense in comparison to pfSense: - using better BSD, with ASLR (the only check I did so far) - licensed under BSD 2-Clause, vs Apache 2.0 - nicer GUI :) - not running PHP as a root user Looks like OPNsense is true hacker's stuff, check this out for DNS over TLS: https://forum.opnsense.org/index.php?topic=8748.msg38928#msg38928 https://forum.opnsense.org/index.php?topic=8748.msg38928#msg...

auslander 8y ago

What I learned from this submission: - people who start with their credentials, 'I'm experienced ..' - are making least sense. - people who use the word 'FUD' are actually trying to shut down sensitive for them topic.

apple4ever 8y ago

My biggest issue with pfSense is the company that runs it: Netgate. Its putting it mildly to say they are jerks. I was banned from their forum for saying I wouldn't pay for Gold if they were going to sunset a range of CPUs when their explanation of why was less than clear. I then apologized for offending them, and they said its a life ban so too bad. Just read their forum or the reddit. Look for Ivor comments specifically.