5 ms·

> What are people doing with these things? home routers ?

tptacek 8y ago
Why do I want my home router to be really good at detecting Windows Server attacks from 2013? Especially since I'd have to park it behind my ISP's prem box, which is the thing that is actually going to get owned up on my home network.
- auslander 8y ago
  Not sure what is your problem, honestly. Custom home router on small form factor machine to replace buggy Netgears. Just put your ISP's box in Bridge mode.
  - tptacek 8y ago
    That didn't address either of my questions/concerns.
    - tw04 8y ago
      For someone claiming to be an expert, you appear to be completely ignorant about the products you're judging. What does "detecting a windows server attack from 2013" have to do with ANYTHING? The primary purpose of the OPNSense and PFSense projects is to be a better home router replacement. Now PFSense has "moved up" if you will into the SMB space, and has further ambitions in the routing space, but the basics still come down to that goal. Suricata and Snort aren't even installed by default, much less required. So why do you keep harping on that functionality? It's irrelevant. These are ROUTERS that can be extended to do IPS if you so choose, but is in no way required.
      - tptacek 8y ago
        Is the page we're commenting on just a really bad description of the project? Because it does not say that OPNSense is simply a ROUTER, and besides "we switched to the fastest PHP framework"† the IPS capabilities are basically the only technical comparison the article makes. OPNSense describes itself as a firewall. A firewall is generally something you deploy along with a router. Does the term "firewall" just mean something else among the community of people repurposing old Dell towers to build complicated home networks? † smdh
        tw04 8y ago
        Blame the industry? Every home router you can by today is a "firewalL" by their definition, because it does NAT and blocks all inbound traffic by default. I think it's silly to debate whether or not that's a fair description, but they're using the terminology their target market is used to hearing. Some vendors have moved towards calling their SPI functionality the "firewall" portion, but that debate is about a decade too late.
        greggman 8y ago
        I want to monitor and/or optionally block outgoing traffic. How do I do that with my airport extreme? which router should I get. One network administrator type friend recommended pfsense on a netgate device. is that bad advice?
        tw04 8y ago
        I don't think so at all (not bad advice that is). I run PFSense and am happy with it. Things like QoS tend to be difficult to get working right, but just straight blocking isn't a big deal. I'm not sure you need to do the netgate device unless you want support, you can use literally any x86-64 box you have lying around. Another good option if you're looking for an "all encompassing" solution would be ubiquiti. If you went that route you'd likely want to dump the airport extreme though and just go all-in on ubiquiti.
        kev009 8y ago
        I'm no fan of php, but you realize the home routers you recommended earlier typically have CGI UIs written in _C_ by people that don't really understand strings and pointers?
        detaro 8y ago
        It's a page to describe what they do differently than PfSense, and that happens to be a) the web frontend and b) the choice of IDS/IPS. There is little reason to describe the "boring" standard stuff that's routing, firewalling, VPN server role that's the core of both projects. Have a look at the comparison table at the bottom for a better idea of the feature sets. > A firewall is generally something you deploy along with a router. Does the term "firewall" just mean something else among the community of people repurposing old Dell towers to build complicated home networks? That's an unfair characterization IMHO. In the commercial market, there are tons of "firewall appliances" that are used as router/firewall combinations: Sophos UTM, Watchguard boxes, Fortigate, ... pfSense and OPNsense play in roughly the same space: a box you plug your WAN interface in that will do (primarily static) routing, firewalling with multiple zones, act as a VPN server. And typically have some amount of security checkboxes a la IDS, WAF, ..., although the commercial ones with the opertunity to sell subscriptions emphasize this more.
      - tedunangst 8y ago
        Why does the linked article prominently feature suricata if it's irrelevant? Also, the word ROUTER doesn't even appear on the linked page.
        detaro 8y ago
        Because it is talking about what they do differently from PfSense, and thus are not covering the basic router/firewall/VPN server functionality both have had forever. The table at the bottom gives a bit better impression of what they are about.
blattimwind 8y ago
If you need a GUI, just use something like Halon's SecurityRouter.
- auslander 8y ago
  Is it free to use? Is it open source?
  - blattimwind 8y ago
    Depends / it's source available AFAIK. Some time ago I looked at this sort of thing (simple management + status GUI for a router), and pfsense & friends are just huge, bloated pieces of mess that I really don't want on critical infra. Securityrouter OTOH came across as one of the very few frontends actually designed for security (see their docs). (Also it doesn't include a the full B/S suite) In the end I didn't choose any GUI and just put a Debian on a box. I don't really know any of the BSDs and it certainly wasn't worth more of my time to fool around with a small piece of infra that's going to be ignored >99.99 % of the time.
    - auslander 8y ago
      > it's source available AFAIK AFAIK it is not.
- SanDiegoSalsa 8y ago
  Halon pivoted away from this market. Last I looked it was a secure email play.
  - blattimwind 8y ago
    Wasn't SR always a side project for them? Still gets releases, though.
tssva 8y ago
PfSense is very popular in the SMB market where there is little to no IT staff or budget but requirements beyond what can be satisfied with a home router. PfSense is also popular as a firewall appliance in cloud deployments. Demand for running pfSense was one of the drivers for Microsoft to add FreeBSD support to Azure.

Why do I want my home router to be really good at detecting Windows Server attacks from 2013? Especially since I'd have to park it behind my ISP's prem box, which is the thing that is actually going to get owned up on my home network.

auslander 8y ago
Not sure what is your problem, honestly. Custom home router on small form factor machine to replace buggy Netgears. Just put your ISP's box in Bridge mode.
- tptacek 8y ago
  That didn't address either of my questions/concerns.
  - tw04 8y ago
    For someone claiming to be an expert, you appear to be completely ignorant about the products you're judging. What does "detecting a windows server attack from 2013" have to do with ANYTHING? The primary purpose of the OPNSense and PFSense projects is to be a better home router replacement. Now PFSense has "moved up" if you will into the SMB space, and has further ambitions in the routing space, but the basics still come down to that goal. Suricata and Snort aren't even installed by default, much less required. So why do you keep harping on that functionality? It's irrelevant. These are ROUTERS that can be extended to do IPS if you so choose, but is in no way required.
    - tptacek 8y ago
      Is the page we're commenting on just a really bad description of the project? Because it does not say that OPNSense is simply a ROUTER, and besides "we switched to the fastest PHP framework"† the IPS capabilities are basically the only technical comparison the article makes. OPNSense describes itself as a firewall. A firewall is generally something you deploy along with a router. Does the term "firewall" just mean something else among the community of people repurposing old Dell towers to build complicated home networks? † smdh
      - tw04 8y ago
        Blame the industry? Every home router you can by today is a "firewalL" by their definition, because it does NAT and blocks all inbound traffic by default. I think it's silly to debate whether or not that's a fair description, but they're using the terminology their target market is used to hearing. Some vendors have moved towards calling their SPI functionality the "firewall" portion, but that debate is about a decade too late.
        greggman 8y ago
        I want to monitor and/or optionally block outgoing traffic. How do I do that with my airport extreme? which router should I get. One network administrator type friend recommended pfsense on a netgate device. is that bad advice?
        tw04 8y ago
        I don't think so at all (not bad advice that is). I run PFSense and am happy with it. Things like QoS tend to be difficult to get working right, but just straight blocking isn't a big deal. I'm not sure you need to do the netgate device unless you want support, you can use literally any x86-64 box you have lying around. Another good option if you're looking for an "all encompassing" solution would be ubiquiti. If you went that route you'd likely want to dump the airport extreme though and just go all-in on ubiquiti.
      - kev009 8y ago
        I'm no fan of php, but you realize the home routers you recommended earlier typically have CGI UIs written in _C_ by people that don't really understand strings and pointers?
      - detaro 8y ago
        It's a page to describe what they do differently than PfSense, and that happens to be a) the web frontend and b) the choice of IDS/IPS. There is little reason to describe the "boring" standard stuff that's routing, firewalling, VPN server role that's the core of both projects. Have a look at the comparison table at the bottom for a better idea of the feature sets. > A firewall is generally something you deploy along with a router. Does the term "firewall" just mean something else among the community of people repurposing old Dell towers to build complicated home networks? That's an unfair characterization IMHO. In the commercial market, there are tons of "firewall appliances" that are used as router/firewall combinations: Sophos UTM, Watchguard boxes, Fortigate, ... pfSense and OPNsense play in roughly the same space: a box you plug your WAN interface in that will do (primarily static) routing, firewalling with multiple zones, act as a VPN server. And typically have some amount of security checkboxes a la IDS, WAF, ..., although the commercial ones with the opertunity to sell subscriptions emphasize this more.
    - tedunangst 8y ago
      Why does the linked article prominently feature suricata if it's irrelevant? Also, the word ROUTER doesn't even appear on the linked page.
      - detaro 8y ago
        Because it is talking about what they do differently from PfSense, and thus are not covering the basic router/firewall/VPN server functionality both have had forever. The table at the bottom gives a bit better impression of what they are about.

blattimwind 8y ago

If you need a GUI, just use something like Halon's SecurityRouter.

auslander 8y ago
Is it free to use? Is it open source?
- blattimwind 8y ago
  Depends / it's source available AFAIK. Some time ago I looked at this sort of thing (simple management + status GUI for a router), and pfsense & friends are just huge, bloated pieces of mess that I really don't want on critical infra. Securityrouter OTOH came across as one of the very few frontends actually designed for security (see their docs). (Also it doesn't include a the full B/S suite) In the end I didn't choose any GUI and just put a Debian on a box. I don't really know any of the BSDs and it certainly wasn't worth more of my time to fool around with a small piece of infra that's going to be ignored >99.99 % of the time.
  - auslander 8y ago
    > it's source available AFAIK AFAIK it is not.
SanDiegoSalsa 8y ago
Halon pivoted away from this market. Last I looked it was a secure email play.
- blattimwind 8y ago
  Wasn't SR always a side project for them? Still gets releases, though.

tssva 8y ago

PfSense is very popular in the SMB market where there is little to no IT staff or budget but requirements beyond what can be satisfied with a home router. PfSense is also popular as a firewall appliance in cloud deployments. Demand for running pfSense was one of the drivers for Microsoft to add FreeBSD support to Azure.