17 ms·

In-kernel WireGuard is on its way to FreeBSD and the pfSense router

379 points by xoa 6y ago

freedom42 6y ago
PSA: pfSense is closed-source [1]. It was discussed last month here on HN [2]. OPNsense is the equivalent FOSS alternative [3]. [1] https://github.com/rapi3/pfsense-is-closed-source https://github.com/rapi3/pfsense-is-closed-source [2] https://news.ycombinator.com/item?id=25894420 https://news.ycombinator.com/item?id=25894420 [3] https://en.wikipedia.org/wiki/OPNsense https://en.wikipedia.org/wiki/OPNsense
- mig39 6y ago
  I don't think this is completely accurate, nor is it recent. Their "community edition" is open source and free: https://www.pfsense.org/download/ https://www.pfsense.org/download/ Also, they have https://github.com/pfsense/ https://github.com/pfsense/
  - freedom42 6y ago
    Then idk what this comment [1] means. Maybe someone could clarify? [1] https://news.ycombinator.com/item?id=25915295 https://news.ycombinator.com/item?id=25915295
  - k_roy 6y ago
    Except it's not. The source that is provided doesn't actually build pfSense as shipped. Plus there are binaries that no source is provided for that "you don't need to worry about"
  - tw04 6y ago
    Community Edition will diverge from Pfsense+ with the 2.6 release. They have also made no commitments there will be any releases after that - "it's up to the community". They will, however, gatekeep what features the community is allowed to add. Community Edition is more or less a dead man walking at this point, they just refuse to come right out and say that. Someone asked if they'd allow one of the REST API projects to be put into upstream and they gave some ridiculous answer about how they'd review any commit but alluded to the fact they won't actually accept it. Because what would they do if the maintainer left? Their suggestion was to fork it. Which, ironically, is exactly what OPNsense did and then Jim Thompson acted like a misbehaving 6 year old and created a website trying to bash them and didn't even have the spine to own up to it until there was a court order. https://opnsense.org/opnsense-com/ https://opnsense.org/opnsense-com/ I'm not sure why ANYONE would waste any effort on adding anything to pfsense at this point when they won't actually commit to accepting features upstream that competes with PFsense+.
    - k_roy 6y ago
      I've been on the wrong end of the Netgate brigade/shills/apologists before due to a few blog entries, and it's not fun. I'm just glad others are seeing the darker side of them.
    - WarOnPrivacy 6y ago
      In my case, I don't readily find hostility toward a group that has busted tail to provide me tremendous value while I have contributed very little in return. My interactions over the years have been - perhaps not exclusively positive but overwhelmingly so. History says one day pfSense will no longer fill my needs. Okay. I'll raise an imaginary glass move on with gratitude.
      - frankharv 6y ago
        Well instead of pfSense no longer fulfilling your needs than maybe its time to beam up to the mothership. FreeBSD can do everything pfSense does without a web interface.
        kbenson 6y ago
        pfSense provided a real easy of use, at least back in the day. Given that the whole config synced over to a backup/HA failover system and updates to one could easily be confirmed synced to the other, there was a real ease of use in using pfSense (at least I thought so about a decade ago when I was using it). Spend enough time configuring HA firewalls and you start wishing you had something to take care of alerting about config differences and syncing changes automatically, and that's one of the things pfSense offered that was good. This wasn't a case of us not knowing how to configure stuff in the OS, we moved from configuring OpenBSD firewalls with pf+pfsync, ipsec+sasync and carp to pfSense because it just made it easier to deploy and configure, given we had about ten or more of these we maintained for customers. Even recently at a new job we were talking about upgrading or replacing some HA FreeBSD firewall pairs, and I was suggesting pfSense because it's simple to use, and just BSD underneath. Given what I've learned in this thread about the state of the project and company behind them now, I don't think I would recommend it anymore, but I still think a similar project with similar features has something to offer over vanilla BSD.
- jaytaylor 6y ago
  The dramas [0] between PFSense, OPNsense, and IPFire [1] always seems to come up. I ended up going with PFSense and it works fine. It's open enough that you can always dive in to figure out what's going on. Perhaps philosophically suboptimal, but for all practical purposes it's worked great for my home! [0] https://www.reddit.com/r/homelab/comments/dg2wme/opnsense_vs_pfsense_2019_edition/f38q3ii/ https://www.reddit.com/r/homelab/comments/dg2wme/opnsense_vs... [1] https://www.ipfire.org/ https://www.ipfire.org/
  - justaj 6y ago
    Oh god I hate this so much about Reddit: > Why fuck netgate? > [deleted] > Exactly this. Well said. As a sidenote, can anyone recommend me a service which lets me see the contents of now deleted Reddit comments?
    - croutonwagon 6y ago
      Pushshift is the service. There’s a bunch of sites using their api. Like removeddit.com and ceddit.com where you can just edit the url and it will query pushshift
      - justaj 6y ago
        Thanks, it looks like Ceddit no longer works though.
- WarOnPrivacy 6y ago
  The shade I occasionally see thrown toward pfSense is curious to me. This isn't push-back at the parent comment but me expressing a bit of confusion. I've used pfSense since 2009 or so. I was skeptical when Netgate entered the picture but since I've had no reason to complain. It's been a continuous and usually smooth timeline of serving me well. A relevant sidebar is that I've been part of different, stellar volunteer efforts - started by a core team that was trying to improve or fix something worthwhile. It is inevitable that core teams members will eventually run low on time/energy and changes must follow. Those changes can be anything and usually are.
  - anfogoat 6y ago
    > The shade I occasionally see thrown toward pfSense is curious to me. Every last bit of it is deserved. They made a promise to keep pfSense open source and they broke it as soon as they could. I see them hiding behind it's the newly announced pfSense Plus that is closed source, not pfSense CE and it's pure weaseling. I still use pfSense but I feel bad for ever being excited about it and contributing to their popularity.
    - WarOnPrivacy 6y ago
      However, you are directing your disdain (about pfSense) toward us. To what end? What is it you want to achieve?
      - anfogoat 6y ago
        > However, you are directing your disdain (about pfSense) toward us. I don't think I am; who's us in that sentence? > To what end? What is it you want to achieve? I'm scratching an itch. If Netgate can screw the community that helped pfSense gain popularity then surely it is perfectly acceptable for a member of that community to express a little disdain.
        WarOnPrivacy 6y ago
        > who's us in that sentence? Everyone in this thread. > it is perfectly acceptable for a member of that community to express a little disdain. Okay. I never inferred otherwise. If venting is the total of your goal here are you okay we blow that off or is there something else you're hoping for? To be clear, I've no animosity toward your posts. My 'hidden' agenda is this: Because hostility takes a toll on the recipients (us), I'm curious if what you're getting in return is worth it. No judgment. We all do this.
- whalesalad 6y ago
  Woah, I have been using pfsense for quite a while but never knew it was closed source until now.
  - croutonwagon 6y ago
    It’s a fairly recent turn of events. First it was difficult to compile on 2.4 because three left out closed source dependencies that their build scripts relied on. With 2.6 they are basically diverging entirely. Albeit they are still trying to argue they are foss. The issue I have is if I’m going with an edge security appliance that has code that can’t be easily audited by security pros better than me, I’ll go with Pali Alto or Cisco who has entire branches and teams dedicated to security like Talos/snort. They are less succeptible to security errors and have a customer base that straight affects national security. So even Alphabet agencies will report exploits and 0days to them. With their wire guard shenanigans it’s clear they are a small team and closing off the code base means I’m now relying on people that act this way to criticisms for security. I don’t really care about internet drama and it’s a reason I’ve stayed with pfsense to now. But pragmatically their choices mean I have to change. Which is okay too. https://www.netgate.com/blog/painful-lessons-learned-in-security-and-community.html https://www.netgate.com/blog/painful-lessons-learned-in-secu... https://old.reddit.com/r/networking/comments/m6zjie/wireguard_netgate_pfsense_drama/ https://old.reddit.com/r/networking/comments/m6zjie/wireguar...
- hda111 6y ago
  I hope this will make a lot people contribute to OPNsense because I really prefer their GUI and over pfsense.
andrius4669 6y ago
Link to relevant announcement email: https://lists.zx2c4.com/pipermail/wireguard/2021-March/006494.html https://lists.zx2c4.com/pipermail/wireguard/2021-March/00649... There's also Jason's reply to apparently not-nice feedback of someone from NetGate: https://lists.zx2c4.com/pipermail/wireguard/2021-March/006499.html https://lists.zx2c4.com/pipermail/wireguard/2021-March/00649...
- Jonnax 6y ago
  Wow. Netgate come off as incredibly unprofessional. According to the article linked and the info here in that email you linked this is my conclusion: * Netgate tried to ship flawed code that has multiple security issues. * Jason Donenfeld, one of the lead Wireguard developers, went out of his way to work on rewriting it to be better in time for the 13.0 release of FreeBSD * This Netgate employee is angry that they weren't able to ship their bad code and starts throwing accusations of a smear campaign. Am I understanding what happened correctly? Because it really makes this Firewall/Router look really bad.
  - kbenson 6y ago
    That was my impression too, then I went back a couple prior messages, and looked at the earlier announcement. Wihle Netgate looks to have overreacted (at least from the info we have), I can understand why they would be upset. This was in the original announcement: The first step was assessing the current state of the code the previous developer had dumped into the tree. It was not pretty. I imagined strange Internet voices jeering, “this is what gives C a bad name!” There were random sleeps added to “fix” race conditions, validation functions that just returned true, catastrophic cryptographic vulnerabilities, whole parts of the protocol unimplemented, kernel panics, security bypasses, overflows, random printf statements deep in crypto code, the most spectacular buffer overflows, and the whole litany of awful things that go wrong when people aren’t careful when they write C. Or, more simply, it seems typical of what happens when code ships that wasn’t meant to. It was essentially an incomplete half-baked implementation – nothing close to something anybody would want on a production machine. Matt had to talk me out of just insisting they pull the code entirely, and rework it more slowly and carefully for the next release cycle. I can understand being upset if that's how you're portrayed publicly.
lambda_obrien 6y ago
I'll have to take a look at freebsd, does anyone have a good reference to the differences in a bsd versus Linux?
- tachion 6y ago
  https://docs.freebsd.org/en/articles/explaining-bsd/comparing-bsd-and-linux.html https://docs.freebsd.org/en/articles/explaining-bsd/comparin...
- annoyingnoob 6y ago
  If it helps, OSX is based on BSD. I've had great success with pfSense. I found great tuning advice here: https://calomel.org https://calomel.org Edit: Not sure why I'm getting down votes for trying to provide info. I didn't down vote anything in this thread.
  - WarOnPrivacy 6y ago
    I can't find any logic in downvoting a declaration like this (and the parent Q). It really seems like lashing out at good-faith.
    - Datagenerator 6y ago
      BSD adheres the POLA principle and is serving many PB of data in production at work. Rock solid and no sudden changes. The manual pages are to me of higher quality when compared to Linux. POLA Principle Of Least Astonishment
      - WarOnPrivacy 6y ago
        I can't argue with any of that.
  - sgt 6y ago
    OSX changed its name 5 years ago to macOS. For what it's worth, I've also had great success with pfSense. Ran it for years at our company. Recently we've migrated to Mikrotik, but to be honest I fail to see any major advantage. It's perhaps easier to train people in learning to use Mikrotik.
WarOnPrivacy 6y ago
I've been waiting for pfSense+Wireguard for a while. OpenVPN has been very good to me but I'm psyched to trade up.
- closeparen 6y ago
  pfSense has the only friendly admin GUI for OpenVPN that I know of, besides the proprietary Access Server. Will they do the same for Wireguard?
  - sschueller 6y ago
    Wireguard is already in the latest version (2.5). UI is ok but you need to understand how wireguard works what the fields mean.
- BuildTheRobots 6y ago
  The opnsense fork has supported wireguard for a while, and has far less restrictive licensing. I highly recommend having a look.
  - WarOnPrivacy 6y ago
    Only if BBCan177 jumps ship. He's my hero.
    - Arnavion 6y ago
      Assuming you're referring to pfblockerng, you can have DNS blocking and IP blocking in OPNsense without the need for any plugins.
  - LeSaucy 6y ago
    OPNsense is criminally underrated. My main routers for my office are virtualized OPNsense VM's in high availability with CARP, DHCP, DNS, VPN endpoints, inter-vlan routing, gateway policies, outbound nat... I could go on. It all works extremely well I can't fathom why people still choose pfSense with all of the community shenanigans and closed source versions. My only gripe with it over 3 years has been the documentation on their API's for programatically updating firewall rules/aliases could use some more examples, or just mention "use browser's network requests developer mode to see what calls you need to make".
sandGorgon 6y ago
is there any linux equivalent of pfsense+freebsd ?
- fullstop 6y ago
  Untangle NG Firewall, perhaps. [1] 1. https://wiki.untangle.com/index.php/NG_Firewall_Installation https://wiki.untangle.com/index.php/NG_Firewall_Installation
  - sandGorgon 6y ago
    what about vyos ? https://vyos.io/products/#vyos-router https://vyos.io/products/#vyos-router
    - fullstop 6y ago
      I'm not sure why that didn't immediately come to mind. Ubiquiti products used to use vyos, but now they are their own fork.
- bubblethink 6y ago
  openwrt works well enough for routing, qos, adblock, vpn, etc.
  - josteink 6y ago
    So what does people typically use pfSense/OPNsense for which OpenWRT can’t do, or is a bad fit for? Asking as a curious OpenWRT devotee.
    - dtx1 6y ago
      I'd say anything remotely security relevant.
      - wtallis 6y ago
        Is that based in any way on the relative capabilities and security track records of OpenWRT and pfSense, or is a highly security-conscious userbase merely what's left for pfSense after eliminating anyone who wants good WiFi support and the ability to run on cheap commodity consumer appliances with tight memory and storage limits?
sschueller 6y ago
Im confused, pfsense 2.5 is out and has wireguard support. Is that version full holes I should be aware off?
- jandrese 6y ago
  It's a userland implementation. This is for the in-kernel implementation. It should be faster. Also, there are some comments that the userland version is rather hacky and probably should be transitioned away from once you can.
  - JStanton617 6y ago
    OPNSense (the pfSense fork) is using the userland version. pfSense 2.5 is using this kernel code - https://docs.netgate.com/pfsense/en/latest/releases/2-5-0.html https://docs.netgate.com/pfsense/en/latest/releases/2-5-0.ht... "pfSense® Plus software version 21.02 and pfSense Community Edition (CE) software version 2.5.0 include a major OS version upgrade, a kernel WireGuard implementation..."
  - pimeys 6y ago
    The userland version is also from the original author of WireGuard and not that bad actually. I'm currently running it in an OPNsense box to serve our internet needs. I have a connection that without VPN can push through about 400-800 Mbps, and when I put the VPN on for all traffic, I can still push 400-800 Mbps through my connection. The in-kernel version can do the same with less CPU usage, and can probably drive multi-gigabit connections without any trouble.
- JStanton617 6y ago
  Yes. The code you're running is described as having "random sleeps added to “fix” race conditions, validation functions that just returned true, catastrophic cryptographic vulnerabilities, whole parts of the protocol unimplemented, kernel panics, security bypasses, overflows, random printf statements deep in crypto code, the most spectacular buffer overflows" This is a kernel RCE just waiting to happen.
kevans91 6y ago
Note that there's additional follow-up available here: https://lists.freebsd.org/pipermail/freebsd-hackers/2021-March/057082.html https://lists.freebsd.org/pipermail/freebsd-hackers/2021-Mar...
- darkwater 6y ago
  Came here to post that, looks like they are pulling out the recent effort EDIT: removed the "and revert to the original freebsd (broken?) implementation"
  - cperciva 6y ago
    WireGuard is gone from the kernel in 13.0-RELEASE. Given the choice between "buggy" and "less than a week old", we're going with the third option of "you can ship a kernel module via the ports tree".
    - zx2c4 6y ago
      Which is really the absolute best outcome: https://lists.freebsd.org/pipermail/freebsd-hackers/2021-March/057083.html https://lists.freebsd.org/pipermail/freebsd-hackers/2021-Mar... https://lists.freebsd.org/pipermail/freebsd-hackers/2021-March/057084.html https://lists.freebsd.org/pipermail/freebsd-hackers/2021-Mar...
  - beatrobot 6y ago
    They are removing both implementations(the new and the broken one) in order to put more work and review on the new one, and release it properly at a later time.
- ksec 6y ago
  Absolutely the best outcome. BSDs has always been ( to me at least ) about getting things right, take time to get it baked before committing. The old, out of fashion style of getting things done properly and not shipping for the sake of it. Which is both a good thing and a bad thing in the modern world. But it is a trade off. I also hope FreeBSD sort of look into why it was committed in the first place. Hopefully this also set the tone for Scott and Netgate. Even having mild scepticism of the one sided bash to them on HN had me downvoted into oblivion.
aborsy 6y ago
If true, this calls into question the security of the rest of pfsense as well (not just the WG piece).
deleted 6y ago
[deleted]
SigmundA 6y ago
Scott Long from Netgate's response: https://www.netgate.com/blog/painful-lessons-learned-in-security-and-community.html https://www.netgate.com/blog/painful-lessons-learned-in-secu... "Unfortunately, the public discussion has also veered into vague claims and slanderous attacks. This is where the lack of transparency, the lack of respect, and the inflation of ego is damaging and unproductive. We had hoped for a better collaboration than this, and it makes me doubt the motives of the attackers. And yes, I make deliberate use of the word “attacker” here, because that’s what this is, an attack on Netgate and on the FreeBSD and pfSense communities. Beware of anyone who says that they have all the answers. I also worry about the integrity of those who make vague statements and blanket, over-the-top accusations."
- tptacek 6y ago
  I think this... pretty much speaks for itself. Wow.
- intellirogue 6y ago
  Wow. I'm a complete outsider to this, not using FreeBSD or pfSense or Wireguard - but this blog post makes Netgate seem incredibly unprofessional. Especially to anyone who actually read the mailing list exchanges.
  - tptacek 6y ago
    It is not great. I think this is all pretty much over now, right? FreeBSD is pulling back from a kernel WireGuard I think everyone agrees wasn't ready for prime time in mainline FreeBSD, and everyone's working getting it ready for a future release. I don't really understand what pfSense had to gain from a post like this, but, it's their blog.
- _joel 6y ago
  I've never used Netgate's products but reading that certainly doesn't enamour me to use them in the future.
Black101 6y ago
that shows you what I know, I thought that it was already part of the kernel...
- anderiv 6y ago
  It is indeed part of the Linux kernel. This discussion is about FreeBSD, though.

379 points by xoa 6y ago

PSA: pfSense is closed-source [1]. It was discussed last month here on HN [2]. OPNsense is the equivalent FOSS alternative [3]. [1] https://github.com/rapi3/pfsense-is-closed-source https://github.com/rapi3/pfsense-is-closed-source [2] https://news.ycombinator.com/item?id=25894420 https://news.ycombinator.com/item?id=25894420 [3] https://en.wikipedia.org/wiki/OPNsense https://en.wikipedia.org/wiki/OPNsense

mig39 6y ago
I don't think this is completely accurate, nor is it recent. Their "community edition" is open source and free: https://www.pfsense.org/download/ https://www.pfsense.org/download/ Also, they have https://github.com/pfsense/ https://github.com/pfsense/
- freedom42 6y ago
  Then idk what this comment [1] means. Maybe someone could clarify? [1] https://news.ycombinator.com/item?id=25915295 https://news.ycombinator.com/item?id=25915295
- k_roy 6y ago
  Except it's not. The source that is provided doesn't actually build pfSense as shipped. Plus there are binaries that no source is provided for that "you don't need to worry about"
- tw04 6y ago
  Community Edition will diverge from Pfsense+ with the 2.6 release. They have also made no commitments there will be any releases after that - "it's up to the community". They will, however, gatekeep what features the community is allowed to add. Community Edition is more or less a dead man walking at this point, they just refuse to come right out and say that. Someone asked if they'd allow one of the REST API projects to be put into upstream and they gave some ridiculous answer about how they'd review any commit but alluded to the fact they won't actually accept it. Because what would they do if the maintainer left? Their suggestion was to fork it. Which, ironically, is exactly what OPNsense did and then Jim Thompson acted like a misbehaving 6 year old and created a website trying to bash them and didn't even have the spine to own up to it until there was a court order. https://opnsense.org/opnsense-com/ https://opnsense.org/opnsense-com/ I'm not sure why ANYONE would waste any effort on adding anything to pfsense at this point when they won't actually commit to accepting features upstream that competes with PFsense+.
  - k_roy 6y ago
    I've been on the wrong end of the Netgate brigade/shills/apologists before due to a few blog entries, and it's not fun. I'm just glad others are seeing the darker side of them.
  - WarOnPrivacy 6y ago
    In my case, I don't readily find hostility toward a group that has busted tail to provide me tremendous value while I have contributed very little in return. My interactions over the years have been - perhaps not exclusively positive but overwhelmingly so. History says one day pfSense will no longer fill my needs. Okay. I'll raise an imaginary glass move on with gratitude.
    - frankharv 6y ago
      Well instead of pfSense no longer fulfilling your needs than maybe its time to beam up to the mothership. FreeBSD can do everything pfSense does without a web interface.
      - kbenson 6y ago
        pfSense provided a real easy of use, at least back in the day. Given that the whole config synced over to a backup/HA failover system and updates to one could easily be confirmed synced to the other, there was a real ease of use in using pfSense (at least I thought so about a decade ago when I was using it). Spend enough time configuring HA firewalls and you start wishing you had something to take care of alerting about config differences and syncing changes automatically, and that's one of the things pfSense offered that was good. This wasn't a case of us not knowing how to configure stuff in the OS, we moved from configuring OpenBSD firewalls with pf+pfsync, ipsec+sasync and carp to pfSense because it just made it easier to deploy and configure, given we had about ten or more of these we maintained for customers. Even recently at a new job we were talking about upgrading or replacing some HA FreeBSD firewall pairs, and I was suggesting pfSense because it's simple to use, and just BSD underneath. Given what I've learned in this thread about the state of the project and company behind them now, I don't think I would recommend it anymore, but I still think a similar project with similar features has something to offer over vanilla BSD.
jaytaylor 6y ago
The dramas [0] between PFSense, OPNsense, and IPFire [1] always seems to come up. I ended up going with PFSense and it works fine. It's open enough that you can always dive in to figure out what's going on. Perhaps philosophically suboptimal, but for all practical purposes it's worked great for my home! [0] https://www.reddit.com/r/homelab/comments/dg2wme/opnsense_vs_pfsense_2019_edition/f38q3ii/ https://www.reddit.com/r/homelab/comments/dg2wme/opnsense_vs... [1] https://www.ipfire.org/ https://www.ipfire.org/
- justaj 6y ago
  Oh god I hate this so much about Reddit: > Why fuck netgate? > [deleted] > Exactly this. Well said. As a sidenote, can anyone recommend me a service which lets me see the contents of now deleted Reddit comments?
  - croutonwagon 6y ago
    Pushshift is the service. There’s a bunch of sites using their api. Like removeddit.com and ceddit.com where you can just edit the url and it will query pushshift
    - justaj 6y ago
      Thanks, it looks like Ceddit no longer works though.
WarOnPrivacy 6y ago
The shade I occasionally see thrown toward pfSense is curious to me. This isn't push-back at the parent comment but me expressing a bit of confusion. I've used pfSense since 2009 or so. I was skeptical when Netgate entered the picture but since I've had no reason to complain. It's been a continuous and usually smooth timeline of serving me well. A relevant sidebar is that I've been part of different, stellar volunteer efforts - started by a core team that was trying to improve or fix something worthwhile. It is inevitable that core teams members will eventually run low on time/energy and changes must follow. Those changes can be anything and usually are.
- anfogoat 6y ago
  > The shade I occasionally see thrown toward pfSense is curious to me. Every last bit of it is deserved. They made a promise to keep pfSense open source and they broke it as soon as they could. I see them hiding behind it's the newly announced pfSense Plus that is closed source, not pfSense CE and it's pure weaseling. I still use pfSense but I feel bad for ever being excited about it and contributing to their popularity.
  - WarOnPrivacy 6y ago
    However, you are directing your disdain (about pfSense) toward us. To what end? What is it you want to achieve?
    - anfogoat 6y ago
      > However, you are directing your disdain (about pfSense) toward us. I don't think I am; who's us in that sentence? > To what end? What is it you want to achieve? I'm scratching an itch. If Netgate can screw the community that helped pfSense gain popularity then surely it is perfectly acceptable for a member of that community to express a little disdain.
      - WarOnPrivacy 6y ago
        > who's us in that sentence? Everyone in this thread. > it is perfectly acceptable for a member of that community to express a little disdain. Okay. I never inferred otherwise. If venting is the total of your goal here are you okay we blow that off or is there something else you're hoping for? To be clear, I've no animosity toward your posts. My 'hidden' agenda is this: Because hostility takes a toll on the recipients (us), I'm curious if what you're getting in return is worth it. No judgment. We all do this.
whalesalad 6y ago
Woah, I have been using pfsense for quite a while but never knew it was closed source until now.
- croutonwagon 6y ago
  It’s a fairly recent turn of events. First it was difficult to compile on 2.4 because three left out closed source dependencies that their build scripts relied on. With 2.6 they are basically diverging entirely. Albeit they are still trying to argue they are foss. The issue I have is if I’m going with an edge security appliance that has code that can’t be easily audited by security pros better than me, I’ll go with Pali Alto or Cisco who has entire branches and teams dedicated to security like Talos/snort. They are less succeptible to security errors and have a customer base that straight affects national security. So even Alphabet agencies will report exploits and 0days to them. With their wire guard shenanigans it’s clear they are a small team and closing off the code base means I’m now relying on people that act this way to criticisms for security. I don’t really care about internet drama and it’s a reason I’ve stayed with pfsense to now. But pragmatically their choices mean I have to change. Which is okay too. https://www.netgate.com/blog/painful-lessons-learned-in-security-and-community.html https://www.netgate.com/blog/painful-lessons-learned-in-secu... https://old.reddit.com/r/networking/comments/m6zjie/wireguard_netgate_pfsense_drama/ https://old.reddit.com/r/networking/comments/m6zjie/wireguar...
hda111 6y ago
I hope this will make a lot people contribute to OPNsense because I really prefer their GUI and over pfsense.

andrius4669 6y ago

Link to relevant announcement email: https://lists.zx2c4.com/pipermail/wireguard/2021-March/006494.html https://lists.zx2c4.com/pipermail/wireguard/2021-March/00649... There's also Jason's reply to apparently not-nice feedback of someone from NetGate: https://lists.zx2c4.com/pipermail/wireguard/2021-March/006499.html https://lists.zx2c4.com/pipermail/wireguard/2021-March/00649...

Jonnax 6y ago
Wow. Netgate come off as incredibly unprofessional. According to the article linked and the info here in that email you linked this is my conclusion: * Netgate tried to ship flawed code that has multiple security issues. * Jason Donenfeld, one of the lead Wireguard developers, went out of his way to work on rewriting it to be better in time for the 13.0 release of FreeBSD * This Netgate employee is angry that they weren't able to ship their bad code and starts throwing accusations of a smear campaign. Am I understanding what happened correctly? Because it really makes this Firewall/Router look really bad.
- kbenson 6y ago
  That was my impression too, then I went back a couple prior messages, and looked at the earlier announcement. Wihle Netgate looks to have overreacted (at least from the info we have), I can understand why they would be upset. This was in the original announcement: The first step was assessing the current state of the code the previous developer had dumped into the tree. It was not pretty. I imagined strange Internet voices jeering, “this is what gives C a bad name!” There were random sleeps added to “fix” race conditions, validation functions that just returned true, catastrophic cryptographic vulnerabilities, whole parts of the protocol unimplemented, kernel panics, security bypasses, overflows, random printf statements deep in crypto code, the most spectacular buffer overflows, and the whole litany of awful things that go wrong when people aren’t careful when they write C. Or, more simply, it seems typical of what happens when code ships that wasn’t meant to. It was essentially an incomplete half-baked implementation – nothing close to something anybody would want on a production machine. Matt had to talk me out of just insisting they pull the code entirely, and rework it more slowly and carefully for the next release cycle. I can understand being upset if that's how you're portrayed publicly.

lambda_obrien 6y ago

I'll have to take a look at freebsd, does anyone have a good reference to the differences in a bsd versus Linux?

tachion 6y ago
https://docs.freebsd.org/en/articles/explaining-bsd/comparing-bsd-and-linux.html https://docs.freebsd.org/en/articles/explaining-bsd/comparin...
annoyingnoob 6y ago
If it helps, OSX is based on BSD. I've had great success with pfSense. I found great tuning advice here: https://calomel.org https://calomel.org Edit: Not sure why I'm getting down votes for trying to provide info. I didn't down vote anything in this thread.
- WarOnPrivacy 6y ago
  I can't find any logic in downvoting a declaration like this (and the parent Q). It really seems like lashing out at good-faith.
  - Datagenerator 6y ago
    BSD adheres the POLA principle and is serving many PB of data in production at work. Rock solid and no sudden changes. The manual pages are to me of higher quality when compared to Linux. POLA Principle Of Least Astonishment
    - WarOnPrivacy 6y ago
      I can't argue with any of that.
- sgt 6y ago
  OSX changed its name 5 years ago to macOS. For what it's worth, I've also had great success with pfSense. Ran it for years at our company. Recently we've migrated to Mikrotik, but to be honest I fail to see any major advantage. It's perhaps easier to train people in learning to use Mikrotik.

WarOnPrivacy 6y ago

I've been waiting for pfSense+Wireguard for a while. OpenVPN has been very good to me but I'm psyched to trade up.

closeparen 6y ago
pfSense has the only friendly admin GUI for OpenVPN that I know of, besides the proprietary Access Server. Will they do the same for Wireguard?
- sschueller 6y ago
  Wireguard is already in the latest version (2.5). UI is ok but you need to understand how wireguard works what the fields mean.
BuildTheRobots 6y ago
The opnsense fork has supported wireguard for a while, and has far less restrictive licensing. I highly recommend having a look.
- WarOnPrivacy 6y ago
  Only if BBCan177 jumps ship. He's my hero.
  - Arnavion 6y ago
    Assuming you're referring to pfblockerng, you can have DNS blocking and IP blocking in OPNsense without the need for any plugins.
- LeSaucy 6y ago
  OPNsense is criminally underrated. My main routers for my office are virtualized OPNsense VM's in high availability with CARP, DHCP, DNS, VPN endpoints, inter-vlan routing, gateway policies, outbound nat... I could go on. It all works extremely well I can't fathom why people still choose pfSense with all of the community shenanigans and closed source versions. My only gripe with it over 3 years has been the documentation on their API's for programatically updating firewall rules/aliases could use some more examples, or just mention "use browser's network requests developer mode to see what calls you need to make".

sandGorgon 6y ago

is there any linux equivalent of pfsense+freebsd ?

fullstop 6y ago
Untangle NG Firewall, perhaps. [1] 1. https://wiki.untangle.com/index.php/NG_Firewall_Installation https://wiki.untangle.com/index.php/NG_Firewall_Installation
- sandGorgon 6y ago
  what about vyos ? https://vyos.io/products/#vyos-router https://vyos.io/products/#vyos-router
  - fullstop 6y ago
    I'm not sure why that didn't immediately come to mind. Ubiquiti products used to use vyos, but now they are their own fork.
bubblethink 6y ago
openwrt works well enough for routing, qos, adblock, vpn, etc.
- josteink 6y ago
  So what does people typically use pfSense/OPNsense for which OpenWRT can’t do, or is a bad fit for? Asking as a curious OpenWRT devotee.
  - dtx1 6y ago
    I'd say anything remotely security relevant.
    - wtallis 6y ago
      Is that based in any way on the relative capabilities and security track records of OpenWRT and pfSense, or is a highly security-conscious userbase merely what's left for pfSense after eliminating anyone who wants good WiFi support and the ability to run on cheap commodity consumer appliances with tight memory and storage limits?

sschueller 6y ago

Im confused, pfsense 2.5 is out and has wireguard support. Is that version full holes I should be aware off?

jandrese 6y ago
It's a userland implementation. This is for the in-kernel implementation. It should be faster. Also, there are some comments that the userland version is rather hacky and probably should be transitioned away from once you can.
- JStanton617 6y ago
  OPNSense (the pfSense fork) is using the userland version. pfSense 2.5 is using this kernel code - https://docs.netgate.com/pfsense/en/latest/releases/2-5-0.html https://docs.netgate.com/pfsense/en/latest/releases/2-5-0.ht... "pfSense® Plus software version 21.02 and pfSense Community Edition (CE) software version 2.5.0 include a major OS version upgrade, a kernel WireGuard implementation..."
- pimeys 6y ago
  The userland version is also from the original author of WireGuard and not that bad actually. I'm currently running it in an OPNsense box to serve our internet needs. I have a connection that without VPN can push through about 400-800 Mbps, and when I put the VPN on for all traffic, I can still push 400-800 Mbps through my connection. The in-kernel version can do the same with less CPU usage, and can probably drive multi-gigabit connections without any trouble.
JStanton617 6y ago
Yes. The code you're running is described as having "random sleeps added to “fix” race conditions, validation functions that just returned true, catastrophic cryptographic vulnerabilities, whole parts of the protocol unimplemented, kernel panics, security bypasses, overflows, random printf statements deep in crypto code, the most spectacular buffer overflows" This is a kernel RCE just waiting to happen.

kevans91 6y ago

Note that there's additional follow-up available here: https://lists.freebsd.org/pipermail/freebsd-hackers/2021-March/057082.html https://lists.freebsd.org/pipermail/freebsd-hackers/2021-Mar...

darkwater 6y ago
Came here to post that, looks like they are pulling out the recent effort EDIT: removed the "and revert to the original freebsd (broken?) implementation"
- cperciva 6y ago
  WireGuard is gone from the kernel in 13.0-RELEASE. Given the choice between "buggy" and "less than a week old", we're going with the third option of "you can ship a kernel module via the ports tree".
  - zx2c4 6y ago
    Which is really the absolute best outcome: https://lists.freebsd.org/pipermail/freebsd-hackers/2021-March/057083.html https://lists.freebsd.org/pipermail/freebsd-hackers/2021-Mar... https://lists.freebsd.org/pipermail/freebsd-hackers/2021-March/057084.html https://lists.freebsd.org/pipermail/freebsd-hackers/2021-Mar...
- beatrobot 6y ago
  They are removing both implementations(the new and the broken one) in order to put more work and review on the new one, and release it properly at a later time.
ksec 6y ago
Absolutely the best outcome. BSDs has always been ( to me at least ) about getting things right, take time to get it baked before committing. The old, out of fashion style of getting things done properly and not shipping for the sake of it. Which is both a good thing and a bad thing in the modern world. But it is a trade off. I also hope FreeBSD sort of look into why it was committed in the first place. Hopefully this also set the tone for Scott and Netgate. Even having mild scepticism of the one sided bash to them on HN had me downvoted into oblivion.

aborsy 6y ago

If true, this calls into question the security of the rest of pfsense as well (not just the WG piece).

deleted 6y ago

[deleted]

SigmundA 6y ago

Scott Long from Netgate's response: https://www.netgate.com/blog/painful-lessons-learned-in-security-and-community.html https://www.netgate.com/blog/painful-lessons-learned-in-secu... "Unfortunately, the public discussion has also veered into vague claims and slanderous attacks. This is where the lack of transparency, the lack of respect, and the inflation of ego is damaging and unproductive. We had hoped for a better collaboration than this, and it makes me doubt the motives of the attackers. And yes, I make deliberate use of the word “attacker” here, because that’s what this is, an attack on Netgate and on the FreeBSD and pfSense communities. Beware of anyone who says that they have all the answers. I also worry about the integrity of those who make vague statements and blanket, over-the-top accusations."

tptacek 6y ago
I think this... pretty much speaks for itself. Wow.
intellirogue 6y ago
Wow. I'm a complete outsider to this, not using FreeBSD or pfSense or Wireguard - but this blog post makes Netgate seem incredibly unprofessional. Especially to anyone who actually read the mailing list exchanges.
- tptacek 6y ago
  It is not great. I think this is all pretty much over now, right? FreeBSD is pulling back from a kernel WireGuard I think everyone agrees wasn't ready for prime time in mainline FreeBSD, and everyone's working getting it ready for a future release. I don't really understand what pfSense had to gain from a post like this, but, it's their blog.
_joel 6y ago
I've never used Netgate's products but reading that certainly doesn't enamour me to use them in the future.

Black101 6y ago

that shows you what I know, I thought that it was already part of the kernel...

anderiv 6y ago
It is indeed part of the Linux kernel. This discussion is about FreeBSD, though.