4 ms·

Announcing PfSense Plus

18 points by guiambros 6y ago

na85 6y ago
Reminder that the Netgate folks have been very, very immature and unprofessional towards the OPNsense project, and are consistently crass and rude towards the pfsense community on /r/pfsense. Think twice before giving Netgate your money.
- hyperpl 6y ago
  Agreed. I took action and migrated my firewall from pfsense to OpenBSD and couldn't be happier.
  - na85 6y ago
    Nice. What hardware are you running?
    - hyperpl 6y ago
      Still pcengines apu2d4 since my WAN is still only 400mbps and this is able to route at that speed. If/when I upgrade to gigabit then I'll most likely invest in a protecli. Also, it helps that wireguard is firmly supported in OpenBSD as well.
      - na85 6y ago
        >protecli Oh wow thanks for that, I was unaware of protecli and I'm not super happy with my edgerouterX. Thanks!
  - user3939382 6y ago
    I’ve been using command-line only OpenBSD installs with pf as my default firewall for my clients for years. WebUIs always felt like unnecessary attack surface for a firewall.
    - hyperpl 6y ago
      Not only the attack surface, but it wasn't until I tried migrating everything from pfsense to OpenBSD (firewall, dns, vpn, etc..) and started digging around did I realize how many scripts and processes are involved in managing pfsense's state. I ended up giving up and starting with OpenBSD from scratch and it didn't take me more than a couple of hours to get everything back and operational (wife tested and approved). I'm sure there's a rhyme to their reason for such a setup but I'm extremely content with the relatively few files I manage in vim with my own versioning, upgrade and backup methodology. I do admit that I sometimes miss the odd graph or html report but I'm getting more used to the logs.
icecap12 6y ago
opnsense is where it's at. Alot of pfsense users have been migrating off pfsense lately because of all the Netgate shenanigans.
- nijave 6y ago
  Yup and opnsense has been faithfully making progress building a web API on top of a lot of the functionally making it significantly easier to automate and manage programmaticly Pfsense had some pretty gnarly cobbled together php/html pages last time I used it (probably 6 years ago now)
- slenk 6y ago
  Well, I'm downloading the image right now. Any tips for someone moving from pfSense?
  - croutonwagon 6y ago
    What I did last month. Build a vm and install opnsense. Build a base config. If using vlans or multiple interfaces note the order your create them. Backup config. Install opnsense on your router. Install backup config. Recreate-adding interfaces in order created. And nuts web interface for usb-hids it borked. But it works via ssh. Suricata is a little different. You can get et pro for free with a telemetry agreement. If using vlans only use the physical interface for listening and set the cidr nets in home networks under advanced.
jchw 6y ago
Echoing the other sentiments in this thread, I have also decided against giving NetGate money, due to their persistent BS. Though, it is at least worth noting in case it gets missed, that this announcement appears to be from January.
exabrial 6y ago
Since ubiquiti is currently going the way of the crapper, this is great news
- yjftsjthsd-h 6y ago
  Unfortunately there's room for them both to be bad.
imwillofficial 6y ago
PFsense is unprofessionally run. I’ll never forget their shitty web site they put up making fun of OPNsense.

18 points by guiambros 6y ago

na85 6y ago

Reminder that the Netgate folks have been very, very immature and unprofessional towards the OPNsense project, and are consistently crass and rude towards the pfsense community on /r/pfsense. Think twice before giving Netgate your money.

hyperpl 6y ago
Agreed. I took action and migrated my firewall from pfsense to OpenBSD and couldn't be happier.
- na85 6y ago
  Nice. What hardware are you running?
  - hyperpl 6y ago
    Still pcengines apu2d4 since my WAN is still only 400mbps and this is able to route at that speed. If/when I upgrade to gigabit then I'll most likely invest in a protecli. Also, it helps that wireguard is firmly supported in OpenBSD as well.
    - na85 6y ago
      >protecli Oh wow thanks for that, I was unaware of protecli and I'm not super happy with my edgerouterX. Thanks!
- user3939382 6y ago
  I’ve been using command-line only OpenBSD installs with pf as my default firewall for my clients for years. WebUIs always felt like unnecessary attack surface for a firewall.
  - hyperpl 6y ago
    Not only the attack surface, but it wasn't until I tried migrating everything from pfsense to OpenBSD (firewall, dns, vpn, etc..) and started digging around did I realize how many scripts and processes are involved in managing pfsense's state. I ended up giving up and starting with OpenBSD from scratch and it didn't take me more than a couple of hours to get everything back and operational (wife tested and approved). I'm sure there's a rhyme to their reason for such a setup but I'm extremely content with the relatively few files I manage in vim with my own versioning, upgrade and backup methodology. I do admit that I sometimes miss the odd graph or html report but I'm getting more used to the logs.

icecap12 6y ago

opnsense is where it's at. Alot of pfsense users have been migrating off pfsense lately because of all the Netgate shenanigans.

nijave 6y ago
Yup and opnsense has been faithfully making progress building a web API on top of a lot of the functionally making it significantly easier to automate and manage programmaticly Pfsense had some pretty gnarly cobbled together php/html pages last time I used it (probably 6 years ago now)
slenk 6y ago
Well, I'm downloading the image right now. Any tips for someone moving from pfSense?
- croutonwagon 6y ago
  What I did last month. Build a vm and install opnsense. Build a base config. If using vlans or multiple interfaces note the order your create them. Backup config. Install opnsense on your router. Install backup config. Recreate-adding interfaces in order created. And nuts web interface for usb-hids it borked. But it works via ssh. Suricata is a little different. You can get et pro for free with a telemetry agreement. If using vlans only use the physical interface for listening and set the cidr nets in home networks under advanced.

jchw 6y ago

Echoing the other sentiments in this thread, I have also decided against giving NetGate money, due to their persistent BS. Though, it is at least worth noting in case it gets missed, that this announcement appears to be from January.

exabrial 6y ago

Since ubiquiti is currently going the way of the crapper, this is great news

yjftsjthsd-h 6y ago
Unfortunately there's room for them both to be bad.

imwillofficial 6y ago

PFsense is unprofessionally run. I’ll never forget their shitty web site they put up making fun of OPNsense.