5 ms·

Ars Technica wrote a report on the debacle[1], and I've since stopped using pfsense. I was already on the fence following their move away from open-source with

Ars Technica wrote a report on the debacle[1], and I've since stopped using pfsense. I was already on the fence following their move away from open-source with "pfSense Plus"[2]. [1] https://arstechnica.com/gadgets/2021/03/buffer-overruns-license-violations-and-bad-code-freebsd-13s-close-call/ https://arstechnica.com/gadgets/2021/03/buffer-overruns-lice... [2] https://www.phoronix.com/scan.php?page=news_item&px=Netgate-pfSense-Plus https://www.phoronix.com/scan.php?page=news_item&px=Netgate-...

forcemajeure 5y ago
"you either have a commit bit (enabling you to commit code to FreeBSD's repositories) or you don't. It's hard to find code reviews, and there generally isn't a fixed process ensuring that vitally important code gets reviewed prior to inclusion" Doesn't sound very professional!
screamingninja 5y ago
> I've since stopped using pfsense I find myself in the same boat. What do you use/recommend instead?
- _joel 5y ago
  Perhaps https://opnsense.org/ https://opnsense.org/ ?
- seized 5y ago
  OpnSense has long been the better option. It forked from pfsense years ago and has been better for a long time. Netgate engaged in some shameful behavior after the fork, their mistreatment of Jason isn't their first instance.
  - kayson 5y ago
    The only thing holding me back from opnsense is that there's no pfblockerng...
    - LeoPanthera 5y ago
      I don't use opnsense but a quick google revealed the following, is this not functionally the same? https://www.cjross.net/dns-security-and-adblock-with-opnsense-part-2/ https://www.cjross.net/dns-security-and-adblock-with-opnsens...
    - eddyg 5y ago
      AdGuard Home is in the OPNsense community repo and a very nice alternative: https://www.routerperformance.net/opnsense-repo/ https://www.routerperformance.net/opnsense-repo/
    - seized 5y ago
      Unbound has a block list feature and there are several other options. None are quite to the same level as far as I know, but the rest of OpnSense makes up for it.
    - 0x000000E2 5y ago
      I'm an OpenWrt hawk, they have a plugin for DNS based blocking if you end up going that direction https://github.com/openwrt/packages/tree/master/net/adblock/files https://github.com/openwrt/packages/tree/master/net/adblock/...
  - azinman2 5y ago
    I thought opnsense had various issues too? I can’t remember what, exactly, but perhaps it was around security or performance?
    - seized 5y ago
      None that I have ever heard of. It uses HardenedBSD but they're dropping that soonish.
      - azinman2 5y ago
        Maybe that’s what I’m thinking about. Seems early then to adopt? Aside from community and WireGuard issues, any reason to abandon a working pfsense install?
        kevans91 5y ago
        I personally don't see the need, pfSense is rock-solid for my uses.
- kryptn 5y ago
  Not me personally, but I have a couple friends that have started using VyOS and they seem pretty satisfied. https://vyos.io/ https://vyos.io/
- 0x000000E2 5y ago
  I swear by OpenWrt. It's not just for wifi routers. It's a regular Linux distro you can run on X86 too. My favorite thing about OpenWrt is SQM CAKE, state of the art traffic shaping. A panacea for slow links
- efxhoy 5y ago
  I'm in the same boat. As soon as I find time I'm nuking my pfsense router and installing OpenBSD. I just need it to do NAT, DHCP and always work. I don't need a fancy web-ui, traffic graphs or anything like that, I thought I did when I installed pfsense ~10 years ago but the only time I've logged in for any reason was when it stopped working for some reason (usually the ISP's fault). OpenBSD's history is impeccable and I really don't want to have to think about my router after initial setup other than installing updates once in a while.
- Marsymars 5y ago
  For my home use, I just switched to an Eero device. Not quite the same product categories, but my priority was software security, meaning that there are a very small number of workable options for home use.

forcemajeure 5y ago

"you either have a commit bit (enabling you to commit code to FreeBSD's repositories) or you don't. It's hard to find code reviews, and there generally isn't a fixed process ensuring that vitally important code gets reviewed prior to inclusion" Doesn't sound very professional!

screamingninja 5y ago

> I've since stopped using pfsense I find myself in the same boat. What do you use/recommend instead?

_joel 5y ago
Perhaps https://opnsense.org/ https://opnsense.org/ ?
seized 5y ago
OpnSense has long been the better option. It forked from pfsense years ago and has been better for a long time. Netgate engaged in some shameful behavior after the fork, their mistreatment of Jason isn't their first instance.
- kayson 5y ago
  The only thing holding me back from opnsense is that there's no pfblockerng...
  - LeoPanthera 5y ago
    I don't use opnsense but a quick google revealed the following, is this not functionally the same? https://www.cjross.net/dns-security-and-adblock-with-opnsense-part-2/ https://www.cjross.net/dns-security-and-adblock-with-opnsens...
  - eddyg 5y ago
    AdGuard Home is in the OPNsense community repo and a very nice alternative: https://www.routerperformance.net/opnsense-repo/ https://www.routerperformance.net/opnsense-repo/
  - seized 5y ago
    Unbound has a block list feature and there are several other options. None are quite to the same level as far as I know, but the rest of OpnSense makes up for it.
  - 0x000000E2 5y ago
    I'm an OpenWrt hawk, they have a plugin for DNS based blocking if you end up going that direction https://github.com/openwrt/packages/tree/master/net/adblock/files https://github.com/openwrt/packages/tree/master/net/adblock/...
- azinman2 5y ago
  I thought opnsense had various issues too? I can’t remember what, exactly, but perhaps it was around security or performance?
  - seized 5y ago
    None that I have ever heard of. It uses HardenedBSD but they're dropping that soonish.
    - azinman2 5y ago
      Maybe that’s what I’m thinking about. Seems early then to adopt? Aside from community and WireGuard issues, any reason to abandon a working pfsense install?
      - kevans91 5y ago
        I personally don't see the need, pfSense is rock-solid for my uses.
kryptn 5y ago
Not me personally, but I have a couple friends that have started using VyOS and they seem pretty satisfied. https://vyos.io/ https://vyos.io/
0x000000E2 5y ago
I swear by OpenWrt. It's not just for wifi routers. It's a regular Linux distro you can run on X86 too. My favorite thing about OpenWrt is SQM CAKE, state of the art traffic shaping. A panacea for slow links
efxhoy 5y ago
I'm in the same boat. As soon as I find time I'm nuking my pfsense router and installing OpenBSD. I just need it to do NAT, DHCP and always work. I don't need a fancy web-ui, traffic graphs or anything like that, I thought I did when I installed pfsense ~10 years ago but the only time I've logged in for any reason was when it stopped working for some reason (usually the ISP's fault). OpenBSD's history is impeccable and I really don't want to have to think about my router after initial setup other than installing updates once in a while.
Marsymars 5y ago
For my home use, I just switched to an Eero device. Not quite the same product categories, but my priority was software security, meaning that there are a very small number of workable options for home use.