11 ms·

PfSense – WireGuard Returns as Experimental Package

55 points by vermaden 5y ago

ianlevesque 5y ago
It's odd that they mention working with Christian McDonald and not Jason A. Donenfeld or Matt Dunwoodie. The module they reference appears to be https://www.freshports.org/net/wireguard-kmod/ https://www.freshports.org/net/wireguard-kmod/ which itself came from the work the latter two did here https://git.zx2c4.com/wireguard-freebsd/log/ https://git.zx2c4.com/wireguard-freebsd/log/ And indeed just three days ago the work was announced on the wireguard list https://lists.zx2c4.com/pipermail/wireguard/2021-May/006711.html https://lists.zx2c4.com/pipermail/wireguard/2021-May/006711....
- SigmundA 5y ago
  Probably because Scott Long considers Jason Donenfield an "attacker" of PfSense, FreeBSD and Netgate: https://www.netgate.com/blog/painful-lessons-learned-in-security-and-community.html https://www.netgate.com/blog/painful-lessons-learned-in-secu...
  - frickinLasers 5y ago
    Ars Technica wrote a report on the debacle[1], and I've since stopped using pfsense. I was already on the fence following their move away from open-source with "pfSense Plus"[2]. [1] https://arstechnica.com/gadgets/2021/03/buffer-overruns-license-violations-and-bad-code-freebsd-13s-close-call/ https://arstechnica.com/gadgets/2021/03/buffer-overruns-lice... [2] https://www.phoronix.com/scan.php?page=news_item&px=Netgate-pfSense-Plus https://www.phoronix.com/scan.php?page=news_item&px=Netgate-...
    - forcemajeure 5y ago
      "you either have a commit bit (enabling you to commit code to FreeBSD's repositories) or you don't. It's hard to find code reviews, and there generally isn't a fixed process ensuring that vitally important code gets reviewed prior to inclusion" Doesn't sound very professional!
    - screamingninja 5y ago
      > I've since stopped using pfsense I find myself in the same boat. What do you use/recommend instead?
      - _joel 5y ago
        Perhaps https://opnsense.org/ https://opnsense.org/ ?
      - seized 5y ago
        OpnSense has long been the better option. It forked from pfsense years ago and has been better for a long time. Netgate engaged in some shameful behavior after the fork, their mistreatment of Jason isn't their first instance.
        kayson 5y ago
        The only thing holding me back from opnsense is that there's no pfblockerng...
        LeoPanthera 5y ago
        I don't use opnsense but a quick google revealed the following, is this not functionally the same? https://www.cjross.net/dns-security-and-adblock-with-opnsense-part-2/ https://www.cjross.net/dns-security-and-adblock-with-opnsens...
        eddyg 5y ago
        AdGuard Home is in the OPNsense community repo and a very nice alternative: https://www.routerperformance.net/opnsense-repo/ https://www.routerperformance.net/opnsense-repo/
        seized 5y ago
        Unbound has a block list feature and there are several other options. None are quite to the same level as far as I know, but the rest of OpnSense makes up for it.
        0x000000E2 5y ago
comboy 5y ago
Works fine on opnsense. But I'm pretty sure I've seen wireguard settings on pfsense a few months ago (non-commercial version)? So what is new here? Btw, I'm wondering what HN folks think but I'm leaning to basically go full wireguard. I don't see why I wouldn't want it basically everywhere. It simplifies network management, makes things more explicit. There don't see to be any performance issues (running production database through it right now), and when running it at home it can even make my Internet seem faster when tunneling through it (probably because of some suboptimal TCP settings somewhere along the way, which seems common).
- gtirloni 5y ago
  kernel vs user-space implemention.
  - comboy 5y ago
    Oh, and why would you want to have it as part of the kernel?
    - SigmundA 5y ago
      Performance: https://www.netgate.com/blog/wireguard-in-pfsense-2-5-performance.html https://www.netgate.com/blog/wireguard-in-pfsense-2-5-perfor...
      - carlhjerpe 5y ago
        DPDK is fast in userspace by taking ownership of devices (I believe) so that there's no context switching anyways.
        SigmundA 5y ago
        My understanding is DPDK has much smaller set a supported nic's since it doesn't use the kernel drivers for the card along with all the other things that the kernel provides. Wireguard in kernel gives great performance while just working if your kernel is already working on the hardware. Wireguard is so small it is considered easy to audit so is a prime candidate for kernel implementation. DPDK is listed as an "Exotic" todo for Wireguard: https://www.wireguard.com/todo/ https://www.wireguard.com/todo/

55 points by vermaden 5y ago

It's odd that they mention working with Christian McDonald and not Jason A. Donenfeld or Matt Dunwoodie. The module they reference appears to be https://www.freshports.org/net/wireguard-kmod/ https://www.freshports.org/net/wireguard-kmod/ which itself came from the work the latter two did here https://git.zx2c4.com/wireguard-freebsd/log/ https://git.zx2c4.com/wireguard-freebsd/log/ And indeed just three days ago the work was announced on the wireguard list https://lists.zx2c4.com/pipermail/wireguard/2021-May/006711.html https://lists.zx2c4.com/pipermail/wireguard/2021-May/006711....

SigmundA 5y ago
Probably because Scott Long considers Jason Donenfield an "attacker" of PfSense, FreeBSD and Netgate: https://www.netgate.com/blog/painful-lessons-learned-in-security-and-community.html https://www.netgate.com/blog/painful-lessons-learned-in-secu...
- frickinLasers 5y ago
  Ars Technica wrote a report on the debacle[1], and I've since stopped using pfsense. I was already on the fence following their move away from open-source with "pfSense Plus"[2]. [1] https://arstechnica.com/gadgets/2021/03/buffer-overruns-license-violations-and-bad-code-freebsd-13s-close-call/ https://arstechnica.com/gadgets/2021/03/buffer-overruns-lice... [2] https://www.phoronix.com/scan.php?page=news_item&px=Netgate-pfSense-Plus https://www.phoronix.com/scan.php?page=news_item&px=Netgate-...
  - forcemajeure 5y ago
    "you either have a commit bit (enabling you to commit code to FreeBSD's repositories) or you don't. It's hard to find code reviews, and there generally isn't a fixed process ensuring that vitally important code gets reviewed prior to inclusion" Doesn't sound very professional!
  - screamingninja 5y ago
    > I've since stopped using pfsense I find myself in the same boat. What do you use/recommend instead?
    - _joel 5y ago
      Perhaps https://opnsense.org/ https://opnsense.org/ ?
    - seized 5y ago
      OpnSense has long been the better option. It forked from pfsense years ago and has been better for a long time. Netgate engaged in some shameful behavior after the fork, their mistreatment of Jason isn't their first instance.
      - kayson 5y ago
        The only thing holding me back from opnsense is that there's no pfblockerng...
        LeoPanthera 5y ago
        I don't use opnsense but a quick google revealed the following, is this not functionally the same? https://www.cjross.net/dns-security-and-adblock-with-opnsense-part-2/ https://www.cjross.net/dns-security-and-adblock-with-opnsens...
        eddyg 5y ago
        AdGuard Home is in the OPNsense community repo and a very nice alternative: https://www.routerperformance.net/opnsense-repo/ https://www.routerperformance.net/opnsense-repo/
        seized 5y ago
        Unbound has a block list feature and there are several other options. None are quite to the same level as far as I know, but the rest of OpnSense makes up for it.
        0x000000E2 5y ago

comboy 5y ago

Works fine on opnsense. But I'm pretty sure I've seen wireguard settings on pfsense a few months ago (non-commercial version)? So what is new here? Btw, I'm wondering what HN folks think but I'm leaning to basically go full wireguard. I don't see why I wouldn't want it basically everywhere. It simplifies network management, makes things more explicit. There don't see to be any performance issues (running production database through it right now), and when running it at home it can even make my Internet seem faster when tunneling through it (probably because of some suboptimal TCP settings somewhere along the way, which seems common).

gtirloni 5y ago
kernel vs user-space implemention.
- comboy 5y ago
  Oh, and why would you want to have it as part of the kernel?
  - SigmundA 5y ago
    Performance: https://www.netgate.com/blog/wireguard-in-pfsense-2-5-performance.html https://www.netgate.com/blog/wireguard-in-pfsense-2-5-perfor...
    - carlhjerpe 5y ago
      DPDK is fast in userspace by taking ownership of devices (I believe) so that there's no context switching anyways.
      - SigmundA 5y ago
        My understanding is DPDK has much smaller set a supported nic's since it doesn't use the kernel drivers for the card along with all the other things that the kernel provides. Wireguard in kernel gives great performance while just working if your kernel is already working on the hardware. Wireguard is so small it is considered easy to audit so is a prime candidate for kernel implementation. DPDK is listed as an "Exotic" todo for Wireguard: https://www.wireguard.com/todo/ https://www.wireguard.com/todo/