9 ms·
As someone with extensive experience and nuance in the FreeBSD community, I will just say that OPNsense and closely affiliated HardenedBSD are basically uninten
by kev009 8y ago
As someone with extensive experience and nuance in the FreeBSD community, I will just say that OPNsense and closely affiliated HardenedBSD are basically unintentionally hilarious clown projects. They created some bad blood with particular people but the HBSD side tends to just give me a good belly laugh every handful of months, usually around the larger conference season. Folks from OPN and HBSD appear to have rudimentary grasp of C while making grandiose security claims. This is probably my favorite feature comparison of all time https://hardenedbsd.org/content/easy-feature-comparison https://hardenedbsd.org/content/easy-feature-comparison. It appears to be largely cult of personality ensnaring users that don't really know any better.
YMMV but for people wanting a firewall you'd be much better off with pfSense, stock OpenBSD, or stock FreeBSD. To get involved in OS work or BSDs you're much better off with Free/Open/Net/TrueOS. Those are communities filled with competent people to support the code and that you can learn from.
- auslander 8y ago"It is a fork of pfSense, which in turn was forked from m0n0wall, which was built on FreeBSD. It was launched in January 2015. When m0n0wall closed down in February 2015 its creator, Manuel Kaspar, referred its developer community to OPNsense" [0] I just heard of OPNsense today. Also, there [0] is a thing about pfSense hoarding OPNsense's domain ... [0] https://en.wikipedia.org/wiki/OPNsense https://en.wikipedia.org/wiki/OPNsense
- auslander 8y ago> be much better off with pfSense, stock OpenBSD, or stock FreeBSD There is a reason why people install pfSense and not stock BSD, its called GUI :) And pfSense was playing with licences before, some think it's getting ready to do it again.
- gonzo 8y ago> And pfSense was playing with licences before, some think it's getting ready to do it again. FUD much? 'some' might think, but I know, and we're not.
- auslander 8y agoReddit folks are worried, for example: https://www.reddit.com/r/PFSENSE/comments/7398pa/absolutely_no_commercial_distribution_is_allowed/ https://www.reddit.com/r/PFSENSE/comments/7398pa/absolutely_... Btw, OPNsense is using BSD 2-Clause "Simplified" license. The "permissive", non-copyleft one, same as FreeBSD uses, not psSense's Apache 2.0.
- sgt 8y agoAgreed - I will not change from pfSense to OPNsense. Just because you sprinkle Bootstrap on top of pfSense and even remove some functionality does not make it better. My primary concern with OPNsense is however the community behind it, and their tendency to engage in deceptive behavior. Oh, and note the passive aggressiveness here: https://docs.opnsense.org/fork/thefork.html#so-why-did-we-fork https://docs.opnsense.org/fork/thefork.html#so-why-did-we-fo...
- auslander 8y agoTwo forks fighting :)
- auslander 8y agoIt somehow reminds me OpenBSD. People complained about their developers being rude, but hey, they cleaned a lot of junk and are more secure now that FreeBSD.
- blattimwind 8y agoOpenBSD is not a FreeBSD fork.
- oneplane 8y agoPerhaps, but the pfSense community has gotten toxic over the past few years, mostly due to the commercial side and the very aggressive stance towards any perceived loss of income. Projects like pfSense, OpnSense and other GUI-on-top-of-OS systems are only sensible for more end-user applications and community driven approaches. I switched from pfSense to OpnSense not because of any real diffrence between the two, but because of the backing community, which is more for the users than it is for me personally; most people using this stuff are in the home of SMB markets and are much more serviced by a Web UI and a community than some commercial entity. Once you go commercial or deep technical, none of the projects make sense as you are almost always better of going current with a configuration management based system (like plain pf on a BSD in combination with something like SaltStack, Ansible, or Chef) or go classic with one of the larger vendors like Cisco and Juniper. pfSense is shooting itself in the foot by being (petty) d.cks, OpnSense is shooting itself in the foot by (and this is hearsay afaik) technical deficiencies in the primary backing team. On top of that, prosumer vendors are now getting the hang of it and are releasing affordable, supported, yet not too-expensive hardware for most of the setups you'd see those BSD-based WebUIs in. (i.e. UBNT) I'm predicting that pfSense will try very hard to go full-on commercial, perhaps using the open core model like GitLab does, but probably failing at the commercial side because the advantages (that that goes for OpnSense too) vs. a prosumer/entry-level device from an existing brand are getting smaller and smaller. Most of the advertised stuff (again, goes for both) that you'd get for using open source software isn't really that much of an advantage anyway, most users never report bugs, write patches, inspect the OS, or check checksums. For OpnSense, they are probably going to try to not make a split product, but instead try the vendor network model where you make money by selling support and perhaps pre-configured hardware for people that are stuck between prosumer and home gear needs. What I personally would like (and I'm still using a mix of pfSense and OpnSense for all GUI-needing systems) is an API-first system, with either no GUI at all, or an optional GUI. Maybe in the direction of VyOS (https://vyos.io/ https://vyos.io/), which is linux based, and currently API-only. This would perhaps have to compete with OpenWRT, but at that point we're getting pretty far away from the capabilities of BSD. A lot of the setups where there was no budget, or the firewall/router had to be virtual are currently only running pfSense/OPNSense because of a lack of better alternatives, the paid systems are not 'better' by any means, and their past USP was always with the hardware (which at some point became obsolete as well as packet processing in software became fast enough). For now, I'd suggest anyone who needs a software router/firewall/gateway with a GUI and reasonable OS to first check OPNSense, as for most uses a healthy community is important. For everyone else, it's probably not really an issue in the case of cloud networking as they all have API-driven (and a GUI to drive the API) firewalling which covers almost all SMB use cases. So far I've only seen three cases where the box-with-a-firewal-and-GUI approach still matters: home, smb, on-prem with no investment in skill. As soon as you have the skill and infrastructure to go without a GUI, none of the sense/ wrt and prosumer systems matter, and as soon as you go beyond the 'need to buy stuff because we don't know or want to do it' stage you get in MSP/Cloud territory. Editing (mostly for my own update regarding what's out there) for some extra projects: There seems to be a number of 'other' projects in various states of integration, support and maintenance; 1. https://bsdrp.net https://bsdrp.net which looks like a much more 'embedded' CLI router, has configuration abstraction 2. https://securityrouter.org https://securityrouter.org which uses open everything except the nice backend which does paid upgrades for features 3. Floodlight Controller has a REST API for configuration, which does mostly firewalling and switching, not really a gateway or something like that, lives mostly in the SDN realm, mostly found on Linux systems instead of BSD, but it's a model that comes closer and closer to the model you get on providers like AWS. CloudFirewall is an (older) example of letting one device do the packet and frame forwarding, but some other service do the rules and control of one or more of those devices (be it hardware or software devices).
- nAwYz 8y agoFolks from OPN and HBSD appear to have rudimentary grasp of C while making grandiose security claims. This is probably my favorite feature comparison of all time https://hardenedbsd.org/content/easy-feature-comparison https://hardenedbsd.org/content/easy-feature-comparison. It appears to be largely cult of personality ensnaring users that don't really know any better Could you explain whats bad about that comparison? Or point to an example of their "rudimentary grasp of C" ?
- kev009 8y agoThe comparison is cherry picked cargo cult. ASLR and a lot of these mitigations were obsolete when HBSD implemented them https://www.endgame.com/blog/technical-blog/rop-dying-and-your-exploit-mitigations-are-life-support https://www.endgame.com/blog/technical-blog/rop-dying-and-yo.... Their ASLR try was rejected by FreeBSD.org. Some of the bullets are completely asinine like xxx hardening, what does that even mean? The lead developer recently gave a conference talk where as far as I can tell he showed that you can root a box as.. root https://www.youtube.com/watch?v=bT_k06Xg-BE https://www.youtube.com/watch?v=bT_k06Xg-BE. Can anyone point to a paper showing where HBSD successfully prevented an attack over FreeBSD? So they generate a lot of noise. Instead of learning from the larger communities that are filled with extremely talented security people like Colin "cperciva" Percival, Robert Watson, Theo de Raadt, Maxime Villard, etc Shawn seems hellbent on being an exemplar of Dunning-Kruger effect. Unfortunately he is towing others along for the ride.