5 ms·

Say you have a single static IP at a small office and need to set up a network of systems behind a NAT with DHCP, and maybe a few PAT forwarding rules to a serv

by kev009 8y ago

Say you have a single static IP at a small office and need to set up a network of systems behind a NAT with DHCP, and maybe a few PAT forwarding rules to a server. It would basically take the time to burn a USB stick and boot it, and 30 minutes of following the UI prompts for even low skilled folks. What would you recommend said folks do instead?

tptacek 8y ago
Isn't that a problem almost every wifi router that costs more than $150 already solves? I might just not be understanding your requirements. Also: you just described a problem that requires something like 2% of all the crud OPNSense brags about running.
- auslander 8y ago
  > every wifi router that costs more than $150 Price does not matter. Botnets are created on consumer grade routers, of any price range. Asus, Netgear and the like. None of them are x86 based, and most run outdated busybox linux on low power SoC chips.
  - user5994461 8y ago
    Botnets are created on internet of things and printers, rarely on routers. A small business trying to setup and administer a Unix server as a router is more likely to go wrong than buying a dedicated appliance.
    - auslander 8y ago
      My point is I don't trust consumer grade stuff. > Unix server as a router is more likely to go wrong That is exactly why you install pfSense/OPNsense.
    - hultner 8y ago
      I’ve actually trivially rooted my mothers Asus two times when she had network problems and I had to find a way of debugging it remotely. One time I could inject an RCE via some kind of network connection testing tool they had which were supposed to take an uri but happily accepted something like "google.com$(whoami; nc...&)"
    - andrewflnr 8y ago
      Uhhhh... https://arstechnica.com/information-technology/2018/06/vpnfilter-malware-infecting-50000-devices-is-worse-than-we-thought/ https://arstechnica.com/information-technology/2018/06/vpnfi...
- hultner 8y ago
  I’ve been using pfSense for about 5 years. The past 10+ years I’ve been on either 1x1Gbps or 2x1Gbps symmetric up/down links via fiber (no isp boxes), no consumer/semipro router in the $150-400 range have been able to keep up with these links (tried a few at different times) and especially not handling IPSec-tunneling at these speeds. So I use my old Nehalem/supermicron server (8c/24GB ram, multiple intel pro nics). Used to run FreeBSD+pf then NetBSD+npf manually configured but around 2013 my hard drive broke in a move so I just threw pfSense onto an old disk I had laying around as a temporary solution to get up and running quickly, at that point I never had time/got around to actually set up npf again so I just keep running pfSense and still am. This server costed me about $100 since I salvaged most parts from a broken server I bought of some company back in 08, been running really solid and tried to replace it with highend prosumer routers a few times when I were upgrading my Wi-Fi but they never kept up, I’m now using UniFi Ac PRO for Wi-Fi since my last tplink router/ap broke.
- nl 8y ago
  I don't know why people use it either. I looked pretty seriously at using it when I was considering building a outgoing firewall product, when people could share blocklists for IoT devices and things like SmartTVs. It's pretty well suited for building things like that on top of. Maybe people are building things like site blockers for schools on top of it? Maybe it's just a hobbyist/prosumer play?
  - apple4ever 8y ago
    > I don't know why people use it either. I'm shocked this is a common statement on this. Because its great. Its a fast firewall and router. Its perfect for not overpaying for something like a Cisco ASA.
    - nl 8y ago
      But in what circumstances? How big is your business? If you are running a SME office, then there are plenty of decent firewall appliances which are much cheaper than Cisco ASA, and have much lower support overhead than Sense. If people are doing it for fun or as a hobby great. But given that you can get perfectly good appliances at $500/$1000/$2000 pricepoints, where is th price tradeoff where is makes sense to use Sense?
kev009 8y ago
The thread is too deep to reply direct, but you appear to be more or less agreeing. There are low powered x86 systems at that price point. pfSense has offered a software upgrade path for over a decade, and takes security advisories seriously, so how many store bought routers can boast anything close to that? pfSense also scales up to 10gbit forwarding performance. I can't really comment on the cruft, AFAIK you don't need to run an IDS and that is all in packages.

by kev009 8y ago

tptacek 8y ago

Isn't that a problem almost every wifi router that costs more than $150 already solves? I might just not be understanding your requirements. Also: you just described a problem that requires something like 2% of all the crud OPNSense brags about running.

auslander 8y ago
> every wifi router that costs more than $150 Price does not matter. Botnets are created on consumer grade routers, of any price range. Asus, Netgear and the like. None of them are x86 based, and most run outdated busybox linux on low power SoC chips.
- user5994461 8y ago
  Botnets are created on internet of things and printers, rarely on routers. A small business trying to setup and administer a Unix server as a router is more likely to go wrong than buying a dedicated appliance.
  - auslander 8y ago
    My point is I don't trust consumer grade stuff. > Unix server as a router is more likely to go wrong That is exactly why you install pfSense/OPNsense.
  - hultner 8y ago
    I’ve actually trivially rooted my mothers Asus two times when she had network problems and I had to find a way of debugging it remotely. One time I could inject an RCE via some kind of network connection testing tool they had which were supposed to take an uri but happily accepted something like "google.com$(whoami; nc...&)"
  - andrewflnr 8y ago
    Uhhhh... https://arstechnica.com/information-technology/2018/06/vpnfilter-malware-infecting-50000-devices-is-worse-than-we-thought/ https://arstechnica.com/information-technology/2018/06/vpnfi...
hultner 8y ago
I’ve been using pfSense for about 5 years. The past 10+ years I’ve been on either 1x1Gbps or 2x1Gbps symmetric up/down links via fiber (no isp boxes), no consumer/semipro router in the $150-400 range have been able to keep up with these links (tried a few at different times) and especially not handling IPSec-tunneling at these speeds. So I use my old Nehalem/supermicron server (8c/24GB ram, multiple intel pro nics). Used to run FreeBSD+pf then NetBSD+npf manually configured but around 2013 my hard drive broke in a move so I just threw pfSense onto an old disk I had laying around as a temporary solution to get up and running quickly, at that point I never had time/got around to actually set up npf again so I just keep running pfSense and still am. This server costed me about $100 since I salvaged most parts from a broken server I bought of some company back in 08, been running really solid and tried to replace it with highend prosumer routers a few times when I were upgrading my Wi-Fi but they never kept up, I’m now using UniFi Ac PRO for Wi-Fi since my last tplink router/ap broke.
nl 8y ago
I don't know why people use it either. I looked pretty seriously at using it when I was considering building a outgoing firewall product, when people could share blocklists for IoT devices and things like SmartTVs. It's pretty well suited for building things like that on top of. Maybe people are building things like site blockers for schools on top of it? Maybe it's just a hobbyist/prosumer play?
- apple4ever 8y ago
  > I don't know why people use it either. I'm shocked this is a common statement on this. Because its great. Its a fast firewall and router. Its perfect for not overpaying for something like a Cisco ASA.
  - nl 8y ago
    But in what circumstances? How big is your business? If you are running a SME office, then there are plenty of decent firewall appliances which are much cheaper than Cisco ASA, and have much lower support overhead than Sense. If people are doing it for fun or as a hobby great. But given that you can get perfectly good appliances at $500/$1000/$2000 pricepoints, where is th price tradeoff where is makes sense to use Sense?

kev009 8y ago

The thread is too deep to reply direct, but you appear to be more or less agreeing. There are low powered x86 systems at that price point. pfSense has offered a software upgrade path for over a decade, and takes security advisories seriously, so how many store bought routers can boast anything close to that? pfSense also scales up to 10gbit forwarding performance. I can't really comment on the cruft, AFAIK you don't need to run an IDS and that is all in packages.