3 ms·

If you read this site you are probably well above the target audience in terms of skill. By numbers, I'd guess small/mid size business IT personnel dwarf the h

by kev009 8y ago

If you read this site you are probably well above the target audience in terms of skill. By numbers, I'd guess small/mid size business IT personnel dwarf the higher end multi-tier {dev,eng,ops,sre,sec} of tech companies. And these IT folks generally need a push-button appliance experience due to education/skills. Think Microsoft products, and control panels and wizards on Linux like cPanel. If you go walk the floor of a commercial data center, you will see tons of sonicwall, Ubiquiti, etc. Basically these are an open source version of those. Now a subset of these projects might have some serious implementation smells, but I wouldn't really pass judgement on the users of any of those things. Just about any business can benefit from technology, not everything is well suited for services/hosted approaches, and there is clearly a need for simplified IT equipment.

tptacek 8y ago
Sure, I get that, but my point isn't that I would do what pfSense/OPNSense does in a better, more elegant way; it's that I wouldn't do them at all. Isn't that even easier than installing one of these thingies?
- kev009 8y ago
  Say you have a single static IP at a small office and need to set up a network of systems behind a NAT with DHCP, and maybe a few PAT forwarding rules to a server. It would basically take the time to burn a USB stick and boot it, and 30 minutes of following the UI prompts for even low skilled folks. What would you recommend said folks do instead?
  - tptacek 8y ago
    Isn't that a problem almost every wifi router that costs more than $150 already solves? I might just not be understanding your requirements. Also: you just described a problem that requires something like 2% of all the crud OPNSense brags about running.
    - auslander 8y ago
      > every wifi router that costs more than $150 Price does not matter. Botnets are created on consumer grade routers, of any price range. Asus, Netgear and the like. None of them are x86 based, and most run outdated busybox linux on low power SoC chips.
      - user5994461 8y ago
        Botnets are created on internet of things and printers, rarely on routers. A small business trying to setup and administer a Unix server as a router is more likely to go wrong than buying a dedicated appliance.
        auslander 8y ago
        My point is I don't trust consumer grade stuff. > Unix server as a router is more likely to go wrong That is exactly why you install pfSense/OPNsense.
        hultner 8y ago
        I’ve actually trivially rooted my mothers Asus two times when she had network problems and I had to find a way of debugging it remotely. One time I could inject an RCE via some kind of network connection testing tool they had which were supposed to take an uri but happily accepted something like "google.com$(whoami; nc...&)"
        andrewflnr 8y ago
        Uhhhh... https://arstechnica.com/information-technology/2018/06/vpnfilter-malware-infecting-50000-devices-is-worse-than-we-thought/ https://arstechnica.com/information-technology/2018/06/vpnfi...
    - hultner 8y ago
      I’ve been using pfSense for about 5 years. The past 10+ years I’ve been on either 1x1Gbps or 2x1Gbps symmetric up/down links via fiber (no isp boxes), no consumer/semipro router in the $150-400 range have been able to keep up with these links (tried a few at different times) and especially not handling IPSec-tunneling at these speeds. So I use my old Nehalem/supermicron server (8c/24GB ram, multiple intel pro nics). Used to run FreeBSD+pf then NetBSD+npf manually configured but around 2013 my hard drive broke in a move so I just threw pfSense onto an old disk I had laying around as a temporary solution to get up and running quickly, at that point I never had time/got around to actually set up npf again so I just keep running pfSense and still am. This server costed me about $100 since I salvaged most parts from a broken server I bought of some company back in 08, been running really solid and tried to replace it with highend prosumer routers a few times when I were upgrading my Wi-Fi but they never kept up, I’m now using UniFi Ac PRO for Wi-Fi since my last tplink router/ap broke.
  - kev009 8y ago
    The thread is too deep to reply direct, but you appear to be more or less agreeing. There are low powered x86 systems at that price point. pfSense has offered a software upgrade path for over a decade, and takes security advisories seriously, so how many store bought routers can boast anything close to that? pfSense also scales up to 10gbit forwarding performance. I can't really comment on the cruft, AFAIK you don't need to run an IDS and that is all in packages.
- kevin2r 8y ago
  One case where I would use pfsense. Let's say you are a system admin of an small private school, you get an alert email from Comcast saying that copyrighted content was downloaded using torrents. You deploy pfsense and with 30 clicks you have snort configured and set to block torrent connections.

by kev009 8y ago

tptacek 8y ago

Sure, I get that, but my point isn't that I would do what pfSense/OPNSense does in a better, more elegant way; it's that I wouldn't do them at all. Isn't that even easier than installing one of these thingies?

kev009 8y ago
Say you have a single static IP at a small office and need to set up a network of systems behind a NAT with DHCP, and maybe a few PAT forwarding rules to a server. It would basically take the time to burn a USB stick and boot it, and 30 minutes of following the UI prompts for even low skilled folks. What would you recommend said folks do instead?
- tptacek 8y ago
  Isn't that a problem almost every wifi router that costs more than $150 already solves? I might just not be understanding your requirements. Also: you just described a problem that requires something like 2% of all the crud OPNSense brags about running.
  - auslander 8y ago
    > every wifi router that costs more than $150 Price does not matter. Botnets are created on consumer grade routers, of any price range. Asus, Netgear and the like. None of them are x86 based, and most run outdated busybox linux on low power SoC chips.
    - user5994461 8y ago
      Botnets are created on internet of things and printers, rarely on routers. A small business trying to setup and administer a Unix server as a router is more likely to go wrong than buying a dedicated appliance.
      - auslander 8y ago
        My point is I don't trust consumer grade stuff. > Unix server as a router is more likely to go wrong That is exactly why you install pfSense/OPNsense.
      - hultner 8y ago
        I’ve actually trivially rooted my mothers Asus two times when she had network problems and I had to find a way of debugging it remotely. One time I could inject an RCE via some kind of network connection testing tool they had which were supposed to take an uri but happily accepted something like "google.com$(whoami; nc...&)"
      - andrewflnr 8y ago
        Uhhhh... https://arstechnica.com/information-technology/2018/06/vpnfilter-malware-infecting-50000-devices-is-worse-than-we-thought/ https://arstechnica.com/information-technology/2018/06/vpnfi...
  - hultner 8y ago
    I’ve been using pfSense for about 5 years. The past 10+ years I’ve been on either 1x1Gbps or 2x1Gbps symmetric up/down links via fiber (no isp boxes), no consumer/semipro router in the $150-400 range have been able to keep up with these links (tried a few at different times) and especially not handling IPSec-tunneling at these speeds. So I use my old Nehalem/supermicron server (8c/24GB ram, multiple intel pro nics). Used to run FreeBSD+pf then NetBSD+npf manually configured but around 2013 my hard drive broke in a move so I just threw pfSense onto an old disk I had laying around as a temporary solution to get up and running quickly, at that point I never had time/got around to actually set up npf again so I just keep running pfSense and still am. This server costed me about $100 since I salvaged most parts from a broken server I bought of some company back in 08, been running really solid and tried to replace it with highend prosumer routers a few times when I were upgrading my Wi-Fi but they never kept up, I’m now using UniFi Ac PRO for Wi-Fi since my last tplink router/ap broke.
- kev009 8y ago
  The thread is too deep to reply direct, but you appear to be more or less agreeing. There are low powered x86 systems at that price point. pfSense has offered a software upgrade path for over a decade, and takes security advisories seriously, so how many store bought routers can boast anything close to that? pfSense also scales up to 10gbit forwarding performance. I can't really comment on the cruft, AFAIK you don't need to run an IDS and that is all in packages.
kevin2r 8y ago
One case where I would use pfsense. Let's say you are a system admin of an small private school, you get an alert email from Comcast saying that copyrighted content was downloaded using torrents. You deploy pfsense and with 30 clicks you have snort configured and set to block torrent connections.