14 ms·

pfSense CE 2.5.2

102 points by sam345 5y ago

zonefuenf 5y ago
This[0] change is interesting for home deployments of IPv6: If your ISP changes advertised prefixes occasionally (which mine does), it was until now not practical to assign/use addresses with fixed host suffixes, e.g. for internal services, because you couldn't write firewall rules using those addresses (part of the address could just change and there's no automatic update of the rules). The change now enables you to write firewall rules that use a placeholder for the ISP-assigned prefix. The rules should update automatically after a prefix change. (What has always worked is using the fc00 or fd00 address spaces for local fixed assignments, but pfSense has had problems with that setup as well in my experience) [0]: https://redmine.pfsense.org/issues/6626 https://redmine.pfsense.org/issues/6626
- globular-toast 5y ago
  That's good, but it's so frustrating that ISPs can't just give out a permanent address range for the lifetime of a subscription. Imagine if your telephone number changed occasionally. It's ridiculous. Some are continuing to charge for a "static IP address" under IPv6 as if they are scarce or cost them anything to implement.
  - zinekeller 5y ago
    I believe it's more of a) some carrier-grade routers basically not supporting static IPv6 unless IPv4 is also static (don't ask why it's like that, some NOCs also deal with buggy CG and CPE firmware in general) b) deliberately done, because in those countries privacy concern in residential connections is paramount.
    - SV_BubbleTime 5y ago
      While the phone number analogy does make sense on the surface, I have to agree, I don’t want my IP to be static for privacy reasons. It’s not a great barrier, but I don’t want the bare minimum skills advertiser, hacker, MPAA consultant, web store, or whoever being able to easily rely on this IP being me. Yes. There are tracking cookies, and fingerprinting, and whatever, but the bar being set this higher is better than lower. The phone analogy makes sense until you realize you’re actively calling everyone all the time, and the callerid shouldn’t be easily readable. It’s not like phones at all really.
      - globular-toast 5y ago
        You'll get a /64 so you'll have more than enough addresses (2^64) to play with if privacy is a concern.
        zinekeller 5y ago
        facepalm In residential connections, every marketer will just figure out that particular AS gives /64 (or /56 or /48) and bundle them up, like how they use IPv4 address to track families.
        Arnavion 5y ago
        Indeed, stuff like IP blacklists, tracking, etc should never consider anything smaller than a /64, because it's trivial for the target to change its IP within that space just with SLAAC.
- AnIdiotOnTheNet 5y ago
  About damn time. Now if only they would fix their completely broken Dynamic DNS update implementation so I wouldn't need to write a cron job to make it work properly...
- throw0101a 5y ago
  > If your ISP changes advertised prefixes occasionally (which mine does), it was until now not practical to assign/use addresses with fixed host suffixes, e.g. for internal services This is actually one of the use cases where 'private addresses' make sense: when you don't have a static assignment but need static addressing. In the IPv4 it's very unlikely that you'll get a static address unless from ARIN/RIPE/etc (or pay US$ 25+/IP on the open market), so we have everyone using 10/8 with NAT. It's quite easy for someone to get a statically assigned IPv6… unless you're a home user. So if you want static address, use the IPv6 equivalent of 10/8, ULA: * https://en.wikipedia.org/wiki/Unique_local_address https://en.wikipedia.org/wiki/Unique_local_address Then you NTPv6: * https://en.wikipedia.org/wiki/IPv6-to-IPv6_Network_Prefix_Translation https://en.wikipedia.org/wiki/IPv6-to-IPv6_Network_Prefix_Tr... * https://datatracker.ietf.org/doc/html/rfc6296 https://datatracker.ietf.org/doc/html/rfc6296 * https://docs.netgate.com/pfsense/en/latest/nat/npt.html https://docs.netgate.com/pfsense/en/latest/nat/npt.html The interface portion of the IPv6 address (right-most 64b) stays the same, and only the prefix (left-most 64b) gets shuffled as they pass through the gateway.
pelasaco 5y ago
if you are here and considering to use pfSense, please take a look on https://opnsense.org/ https://opnsense.org/ and more important https://docs.opnsense.org/history/thefork.html https://docs.opnsense.org/history/thefork.html
- lloydatkinson 5y ago
  I'm really stuck between deciding on which. opnsense claims it's concerned about code quality and separating logic from the UI. Sounds great (and means that pfSense must really suck in terms of code quality and security if they aren't doing that) but then following the link to the PHP framework they use you get: > A full-stack PHP framework delivered as a C-extension! I mean, I've can't even begin to imagine how insecure that awful combination of insecure by default languages is.
  - Nux 5y ago
    Yes, it's no Rust, but so what? You'll be dealing with a locked-down box in most/all situations, stuff won't be accessible to other than the sys admin (unless you misconfigure it).
  - BongoMcCat 5y ago
    I can't really comment on the quality of the code, my reason for going opnsens over pfsense is mainly because the company that owns pfsense seem to be real asshats. But, looking at: https://docs.opnsense.org/development/architecture.html https://docs.opnsense.org/development/architecture.html It seems that it's mostly just the frontend that's php, or am I missing something?
    - lloydatkinson 5y ago
      Yes, I certainly feel much better now I read that thank you. I think I'll probably use opn then.
  - Ardren 5y ago
    >> A full-stack PHP framework delivered as a C-extension! > I mean, I've can't even begin to imagine how insecure that awful combination of insecure by default languages is. What is inherently insecure about PHP? Or Phalcon? Do they have vulnerabilities that other C programs don't have?
imwillofficial 5y ago
My obligatory “PFsense is a terrible childishly run project that took out a domain in their competition’s name and made a derogatory website about them before being shouted down” comment. Ref: https://opnsense.org/opnsense-com/ https://opnsense.org/opnsense-com/ From the link: “ Some of you may have come across OPNsense.com a domain that until September 21, 2017 was home to a controversial website with content targeted to harm our open source project. On the fore mentioned date we filed a complaint with WIPO, the World Intellectual Property Organization to try and stop this website from being operated. Until our legal action we were unable to determine the owner of the domains as it was registered using Domains By Proxy, LLC, however we believed the site was created by a pfSense enthusiast who had gone a step too far. Much to our surprise we received an email on September 26, 2017 stating that the owner of this domain was in fact Jamie Thompson, Rubicon Communications dba Netgate also known for the competing pfSense project.”
- deviledeggs 5y ago
  This should be at top. I miss pfsense, but they been the trailer trash of routers for a while now
gogopuppygogo 5y ago
Ever since cmb sold to netgate the Pfsense project has been run by people who I suspect are working hard to find a way to stop releasing open source versions. FYI, my observations as an outsider are the project went through three phases of owners: BSD Perimeter is owner and starts open source fork creating open source releases = CMB and Scott as founders. Electric Sheep Fencing ownership is a result of CMB taking more of the day to day while Scott bows out and Netgate starts funding things / sinking hooks in. Open source continues to be important and CMB is in charge for the most part. Netgate ownership completes obtaining full ownership / gets their hooks into every bit of the project. We see annoying screen about licensing and they start nonsense with OPNSense to flex their tiny muscles. FYI netgate hardware isn’t bad and you get stellar support for what is currently an open source product but they have worked hard to fracture the hard won trust CMB had been building up in the community.
- pelasaco 5y ago
  I remember when pFsense removed the pfsense-tools.git from github because people were creating forks from pfSense.. looks like somebody got the open source thing totally wrong: https://marc.info/?l=pfsense-dev&m=139336551027270 https://marc.info/?l=pfsense-dev&m=139336551027270 https://forum.netgate.com/topic/66157/pfsense-tools-missing-from-repository https://forum.netgate.com/topic/66157/pfsense-tools-missing-...
  - oneplane 5y ago
    Definitely. Their aim has always been to figure out ways to squeeze the software for money. It partially makes sense as they built the company and expenses first and now have to monetise that. Yet nobody asked for it. With pfSense "plus" they published that they will only work on that paid product and mostly ignore the open source stuff, only do the essential requirements. It's essentially just a marketing gateway into their closed products. At that point you might as well buy any other mature closed product... there are many and from a closed source commercial product perspective they are all better than wat netgate produces, including commercial VyOS without a gui.
- apple4ever 5y ago
Jonnax 5y ago
I remember pfsense from them trying to merge bug ridden code into FreeBSD for Wireguard support. The creater of Wireguard said it was bad with buffer overruns and they got angry for being called out. https://arstechnica.com/gadgets/2021/03/buffer-overruns-license-violations-and-bad-code-freebsd-13s-close-call/ https://arstechnica.com/gadgets/2021/03/buffer-overruns-lice... The software seems to be the default open source firewall / router network admins go to, but it seems like a ticking time bomb to me. They also seem to be pivoting to a closed source firewall / router project so this will result in less work going in.
- btgeekboy 5y ago
  Luckily, OPNsense is practically a drop-in replacement.
  - IgorPartola 5y ago
    Can confirm. I recently set it up and ran into an issue with my ISP’s DHCP implementation. There was a pull request for PfSense from like 4 years ago that helped with the issue but remained open. The OPNSense developer I talked to merged a modified fix within a very short time and is even helping others test their broken PfSense systems.
  - user3939382 5y ago
    You could also go with my solution for this use case, which is to use pf on OpenBSD. Firewalls don’t necessarily need a web interface.
    - bityard 5y ago
      Pfsense and opnsense do far more than just packet filtering
    - yabones 5y ago
      I've wanted to go that way for some time, the real problem is that it's basically impossible to hand that off to another net/sysadmin. Imagine walking onto a new job, and they hand you a yubikey and say "here's your keys, the old guy whiteboxed everything with Debian and BSD. Have fun!" Unfortunately, the only time CLI wins out in networking is when there's a cert to dangle in front of people. As much as I want to do things the "right" way, part of that equation is handing projects off to other people to maintain...
aborsy 5y ago
Wireguard’s founder, Jason Donenfeld, reviewed Wireguard implementation in Pfsense/FreeBSD. The review was very negative, with numerous pointers to critical (sometimes childish) security flaws. Why would someone use a router operating system with such strongly negative review from a respected security specialist? A minimal Linux installation is an option, if your firewall is simple.
- erk__ 5y ago
  The implementation got pulled from FreeBSD and a new implementation have been made by contributors including Donenfeld, though it will likely not end up in mainline FreeBSD before the next release.
- hunta2097 5y ago
  Shout out for Shorewall, i've been using it as my primary firewall-helper for nearly 20 years with 0 upgrade hassle. It's a perfect-balance of power and simplicity. It doesn't have a web interface but is just a nice way configure Linux' built-in networking features. It doesn't consume any extra resources and will run anywhere Linux does.
- IntelMiner 5y ago
  I've been quietly nibbling away at making my own "router distro" since PFsense's wireguard fiasco I never much liked PFsense as a project. It feels very convoluted, and the hardware they sell (I was an early adopter of the then-new SG1000 appliance) is laughably exaggerated in its capabilities But the Wireguard event is where they went from "incompetent" to "malicious" in my eyes I ordered a Rasberry Pi 4 compute module and this accompanying ethernet breakout kit after seeing a review from Jeff Geerling (Raspberry Pi accessory mad scientist) and am currently waiting for it to arrive https://www.dfrobot.com/product-2242.html https://www.dfrobot.com/product-2242.html I know I could just use something like OpenWRT, indeed I do have a lot of respect for the OpenWRT project. But I feel that the distro is more geared toward, well, routers. Devices with maybe 32 megs of flash storage and a slow MIPS CPU. Not a moderately powerful ARM machine with 8 gigs of RAM and gigabytes of SD or eMMC storage
  - 5y ago
hestefisk 5y ago
I really miss m0n0wall (https://en.m.wikipedia.org/wiki/M0n0wall https://en.m.wikipedia.org/wiki/M0n0wall). A really minimalist firewall distribution based on FreeBSD. I used to deploy it to my clients’ as an easy to use firewall and router on Soekris Engineering embedded x86 systems. Very compact and efficient.
- mig39 5y ago
  Wasn't pfsense originally a fork of m0n0wall?
  - hestefisk 5y ago
    True but it branched out to focus on bigger rigs than small footprint devices.
sandGorgon 5y ago
Are there any linux alternatives ? Especially something that uses BPF/XDP ? It seems that all the big ones - Google, Facebook, Cloudflare...all use BPF on Linux for everything. https://blog.cloudflare.com/cloudflare-architecture-and-how-bpf-eats-the-world/ https://blog.cloudflare.com/cloudflare-architecture-and-how-...
- koselig 5y ago
  I've been using IPFire on my home network with a PCEngines APU hardware and works great with my gig speed internet. https://www.ipfire.org/ https://www.ipfire.org/
- loganmarchione 5y ago
  Try VyOS. It's based on Vyatta, which is also what Ubiquiti's EdgeOS is based on. It's all CLI-only, but it's pretty powerful. https://vyos.io/ https://vyos.io/
jsight 5y ago
I wish they'd build a version for the Raspberry Pi. It makes a great router.
Arnavion 5y ago
People here are linking to pfSense's past misbehavior wrt OPNsense. I used to use pfSense knowing about that but not caring. But what motivated me to switch to OPNsense was much more basic: - https://www.netgate.com/blog/announcing-pfsense-plus https://www.netgate.com/blog/announcing-pfsense-plus - https://www.netgate.com/blog/pfsense-plus-pfsense-ce-dev-insights-direction https://www.netgate.com/blog/pfsense-plus-pfsense-ce-dev-ins... If you're using pfSense CE you're using an EOL product, so you should move to OPNsense just for that reason alone. Those two posts try to convince you that CE is still relevant and will still get releases, but read carefully and you realize any changes to CE will either be by third parties or those that were part of the base FreeBSD system and thus were upstreamed to FreeBSD anyway. All the actual development work will be for Plus, and the design of Plus is sufficiently divergent (UI backend rewritten from PHP to golang apparently) that you can't backport the work to CE either. Plus will be free for home use (and hopefully remain so), but won't be open source. Not that CE is all that open source either, but at least you can read and modify the PHP scripts in your installation. Another reason people stayed off OPNsense was that it was based on HardenedBSD instead of FreeBSD, however that changed a few months ago so that should no longer be a concern.
- thebiss 5y ago
  Where does it say CE is going EOL? Long says updates will continue after 2.6, albeit slowly. Just like today. > There will be CE releases after 2.6, but unlike Plus, they’ll be done when they’re ready, not on a regular cadence.
  - Arnavion 5y ago
    The answer is already in the comment you responded to.
EricE 5y ago
After what netgate pulled with Wireguard and their continuing abrasiveness towards the community I'm moving everything to Opnsense. I get that netgate has challenges earning enough money to stay alive - but they sure are picking ham fisted ways to do it :p
Helmut10001 5y ago
Long term pfSense user here (4+ years). I have followed the discussion for pfSense issues in recent months, and overall agree. However, I think the situation is a little bit more nuanced towards the context pfsense is used: If you have open WAN ports, for hosting services, I would avoid pfSense as it is now. If you have a fully closed WAN, with several mechanisms added to block local access (VLANs etc.), then the difference between OPNSense/pfSense is really not that obvious. Even if you have a OpenVPN Server on a single port, lets say UDP, it is possible to add HMAC, 2-Factor-Auth etc. in pfSense, too. So the security risks atm still seem rather low in this use context. pfSense currently just has a bit better support for packages. pfblockerng-devel, radius server for 2FA, Telegraf etc. Those are not available in OPNsense yet. Using pfblockerng-devel GeoIP lists, I can add an extra layer of security, allowing only certain countries to even reach my OpenVPN port. There is no guarantee that OPNSense is any better, other than the mentality aspect. It is a critical project and I am hoping to make the hop as soon as possible. At the moment, given my use case, I still feel that there is some time.

102 points by sam345 5y ago

This[0] change is interesting for home deployments of IPv6: If your ISP changes advertised prefixes occasionally (which mine does), it was until now not practical to assign/use addresses with fixed host suffixes, e.g. for internal services, because you couldn't write firewall rules using those addresses (part of the address could just change and there's no automatic update of the rules). The change now enables you to write firewall rules that use a placeholder for the ISP-assigned prefix. The rules should update automatically after a prefix change. (What has always worked is using the fc00 or fd00 address spaces for local fixed assignments, but pfSense has had problems with that setup as well in my experience) [0]: https://redmine.pfsense.org/issues/6626 https://redmine.pfsense.org/issues/6626

globular-toast 5y ago
That's good, but it's so frustrating that ISPs can't just give out a permanent address range for the lifetime of a subscription. Imagine if your telephone number changed occasionally. It's ridiculous. Some are continuing to charge for a "static IP address" under IPv6 as if they are scarce or cost them anything to implement.
- zinekeller 5y ago
  I believe it's more of a) some carrier-grade routers basically not supporting static IPv6 unless IPv4 is also static (don't ask why it's like that, some NOCs also deal with buggy CG and CPE firmware in general) b) deliberately done, because in those countries privacy concern in residential connections is paramount.
  - SV_BubbleTime 5y ago
    While the phone number analogy does make sense on the surface, I have to agree, I don’t want my IP to be static for privacy reasons. It’s not a great barrier, but I don’t want the bare minimum skills advertiser, hacker, MPAA consultant, web store, or whoever being able to easily rely on this IP being me. Yes. There are tracking cookies, and fingerprinting, and whatever, but the bar being set this higher is better than lower. The phone analogy makes sense until you realize you’re actively calling everyone all the time, and the callerid shouldn’t be easily readable. It’s not like phones at all really.
    - globular-toast 5y ago
      You'll get a /64 so you'll have more than enough addresses (2^64) to play with if privacy is a concern.
      - zinekeller 5y ago
        facepalm In residential connections, every marketer will just figure out that particular AS gives /64 (or /56 or /48) and bundle them up, like how they use IPv4 address to track families.
        Arnavion 5y ago
        Indeed, stuff like IP blacklists, tracking, etc should never consider anything smaller than a /64, because it's trivial for the target to change its IP within that space just with SLAAC.
AnIdiotOnTheNet 5y ago
About damn time. Now if only they would fix their completely broken Dynamic DNS update implementation so I wouldn't need to write a cron job to make it work properly...
throw0101a 5y ago
> If your ISP changes advertised prefixes occasionally (which mine does), it was until now not practical to assign/use addresses with fixed host suffixes, e.g. for internal services This is actually one of the use cases where 'private addresses' make sense: when you don't have a static assignment but need static addressing. In the IPv4 it's very unlikely that you'll get a static address unless from ARIN/RIPE/etc (or pay US$ 25+/IP on the open market), so we have everyone using 10/8 with NAT. It's quite easy for someone to get a statically assigned IPv6… unless you're a home user. So if you want static address, use the IPv6 equivalent of 10/8, ULA: * https://en.wikipedia.org/wiki/Unique_local_address https://en.wikipedia.org/wiki/Unique_local_address Then you NTPv6: * https://en.wikipedia.org/wiki/IPv6-to-IPv6_Network_Prefix_Translation https://en.wikipedia.org/wiki/IPv6-to-IPv6_Network_Prefix_Tr... * https://datatracker.ietf.org/doc/html/rfc6296 https://datatracker.ietf.org/doc/html/rfc6296 * https://docs.netgate.com/pfsense/en/latest/nat/npt.html https://docs.netgate.com/pfsense/en/latest/nat/npt.html The interface portion of the IPv6 address (right-most 64b) stays the same, and only the prefix (left-most 64b) gets shuffled as they pass through the gateway.

pelasaco 5y ago

if you are here and considering to use pfSense, please take a look on https://opnsense.org/ https://opnsense.org/ and more important https://docs.opnsense.org/history/thefork.html https://docs.opnsense.org/history/thefork.html

lloydatkinson 5y ago
I'm really stuck between deciding on which. opnsense claims it's concerned about code quality and separating logic from the UI. Sounds great (and means that pfSense must really suck in terms of code quality and security if they aren't doing that) but then following the link to the PHP framework they use you get: > A full-stack PHP framework delivered as a C-extension! I mean, I've can't even begin to imagine how insecure that awful combination of insecure by default languages is.
- Nux 5y ago
  Yes, it's no Rust, but so what? You'll be dealing with a locked-down box in most/all situations, stuff won't be accessible to other than the sys admin (unless you misconfigure it).
- BongoMcCat 5y ago
  I can't really comment on the quality of the code, my reason for going opnsens over pfsense is mainly because the company that owns pfsense seem to be real asshats. But, looking at: https://docs.opnsense.org/development/architecture.html https://docs.opnsense.org/development/architecture.html It seems that it's mostly just the frontend that's php, or am I missing something?
  - lloydatkinson 5y ago
    Yes, I certainly feel much better now I read that thank you. I think I'll probably use opn then.
- Ardren 5y ago
  >> A full-stack PHP framework delivered as a C-extension! > I mean, I've can't even begin to imagine how insecure that awful combination of insecure by default languages is. What is inherently insecure about PHP? Or Phalcon? Do they have vulnerabilities that other C programs don't have?

imwillofficial 5y ago

My obligatory “PFsense is a terrible childishly run project that took out a domain in their competition’s name and made a derogatory website about them before being shouted down” comment. Ref: https://opnsense.org/opnsense-com/ https://opnsense.org/opnsense-com/ From the link: “ Some of you may have come across OPNsense.com a domain that until September 21, 2017 was home to a controversial website with content targeted to harm our open source project. On the fore mentioned date we filed a complaint with WIPO, the World Intellectual Property Organization to try and stop this website from being operated. Until our legal action we were unable to determine the owner of the domains as it was registered using Domains By Proxy, LLC, however we believed the site was created by a pfSense enthusiast who had gone a step too far. Much to our surprise we received an email on September 26, 2017 stating that the owner of this domain was in fact Jamie Thompson, Rubicon Communications dba Netgate also known for the competing pfSense project.”

deviledeggs 5y ago
This should be at top. I miss pfsense, but they been the trailer trash of routers for a while now

gogopuppygogo 5y ago

Ever since cmb sold to netgate the Pfsense project has been run by people who I suspect are working hard to find a way to stop releasing open source versions. FYI, my observations as an outsider are the project went through three phases of owners: BSD Perimeter is owner and starts open source fork creating open source releases = CMB and Scott as founders. Electric Sheep Fencing ownership is a result of CMB taking more of the day to day while Scott bows out and Netgate starts funding things / sinking hooks in. Open source continues to be important and CMB is in charge for the most part. Netgate ownership completes obtaining full ownership / gets their hooks into every bit of the project. We see annoying screen about licensing and they start nonsense with OPNSense to flex their tiny muscles. FYI netgate hardware isn’t bad and you get stellar support for what is currently an open source product but they have worked hard to fracture the hard won trust CMB had been building up in the community.

pelasaco 5y ago
I remember when pFsense removed the pfsense-tools.git from github because people were creating forks from pfSense.. looks like somebody got the open source thing totally wrong: https://marc.info/?l=pfsense-dev&m=139336551027270 https://marc.info/?l=pfsense-dev&m=139336551027270 https://forum.netgate.com/topic/66157/pfsense-tools-missing-from-repository https://forum.netgate.com/topic/66157/pfsense-tools-missing-...
- oneplane 5y ago
  Definitely. Their aim has always been to figure out ways to squeeze the software for money. It partially makes sense as they built the company and expenses first and now have to monetise that. Yet nobody asked for it. With pfSense "plus" they published that they will only work on that paid product and mostly ignore the open source stuff, only do the essential requirements. It's essentially just a marketing gateway into their closed products. At that point you might as well buy any other mature closed product... there are many and from a closed source commercial product perspective they are all better than wat netgate produces, including commercial VyOS without a gui.
apple4ever 5y ago

Jonnax 5y ago

I remember pfsense from them trying to merge bug ridden code into FreeBSD for Wireguard support. The creater of Wireguard said it was bad with buffer overruns and they got angry for being called out. https://arstechnica.com/gadgets/2021/03/buffer-overruns-license-violations-and-bad-code-freebsd-13s-close-call/ https://arstechnica.com/gadgets/2021/03/buffer-overruns-lice... The software seems to be the default open source firewall / router network admins go to, but it seems like a ticking time bomb to me. They also seem to be pivoting to a closed source firewall / router project so this will result in less work going in.

btgeekboy 5y ago
Luckily, OPNsense is practically a drop-in replacement.
- IgorPartola 5y ago
  Can confirm. I recently set it up and ran into an issue with my ISP’s DHCP implementation. There was a pull request for PfSense from like 4 years ago that helped with the issue but remained open. The OPNSense developer I talked to merged a modified fix within a very short time and is even helping others test their broken PfSense systems.
- user3939382 5y ago
  You could also go with my solution for this use case, which is to use pf on OpenBSD. Firewalls don’t necessarily need a web interface.
  - bityard 5y ago
    Pfsense and opnsense do far more than just packet filtering
  - yabones 5y ago
    I've wanted to go that way for some time, the real problem is that it's basically impossible to hand that off to another net/sysadmin. Imagine walking onto a new job, and they hand you a yubikey and say "here's your keys, the old guy whiteboxed everything with Debian and BSD. Have fun!" Unfortunately, the only time CLI wins out in networking is when there's a cert to dangle in front of people. As much as I want to do things the "right" way, part of that equation is handing projects off to other people to maintain...

aborsy 5y ago

Wireguard’s founder, Jason Donenfeld, reviewed Wireguard implementation in Pfsense/FreeBSD. The review was very negative, with numerous pointers to critical (sometimes childish) security flaws. Why would someone use a router operating system with such strongly negative review from a respected security specialist? A minimal Linux installation is an option, if your firewall is simple.

erk__ 5y ago
The implementation got pulled from FreeBSD and a new implementation have been made by contributors including Donenfeld, though it will likely not end up in mainline FreeBSD before the next release.
hunta2097 5y ago
Shout out for Shorewall, i've been using it as my primary firewall-helper for nearly 20 years with 0 upgrade hassle. It's a perfect-balance of power and simplicity. It doesn't have a web interface but is just a nice way configure Linux' built-in networking features. It doesn't consume any extra resources and will run anywhere Linux does.
IntelMiner 5y ago
I've been quietly nibbling away at making my own "router distro" since PFsense's wireguard fiasco I never much liked PFsense as a project. It feels very convoluted, and the hardware they sell (I was an early adopter of the then-new SG1000 appliance) is laughably exaggerated in its capabilities But the Wireguard event is where they went from "incompetent" to "malicious" in my eyes I ordered a Rasberry Pi 4 compute module and this accompanying ethernet breakout kit after seeing a review from Jeff Geerling (Raspberry Pi accessory mad scientist) and am currently waiting for it to arrive https://www.dfrobot.com/product-2242.html https://www.dfrobot.com/product-2242.html I know I could just use something like OpenWRT, indeed I do have a lot of respect for the OpenWRT project. But I feel that the distro is more geared toward, well, routers. Devices with maybe 32 megs of flash storage and a slow MIPS CPU. Not a moderately powerful ARM machine with 8 gigs of RAM and gigabytes of SD or eMMC storage
- 5y ago

hestefisk 5y ago

I really miss m0n0wall (https://en.m.wikipedia.org/wiki/M0n0wall https://en.m.wikipedia.org/wiki/M0n0wall). A really minimalist firewall distribution based on FreeBSD. I used to deploy it to my clients’ as an easy to use firewall and router on Soekris Engineering embedded x86 systems. Very compact and efficient.

mig39 5y ago
Wasn't pfsense originally a fork of m0n0wall?
- hestefisk 5y ago
  True but it branched out to focus on bigger rigs than small footprint devices.

sandGorgon 5y ago

Are there any linux alternatives ? Especially something that uses BPF/XDP ? It seems that all the big ones - Google, Facebook, Cloudflare...all use BPF on Linux for everything. https://blog.cloudflare.com/cloudflare-architecture-and-how-bpf-eats-the-world/ https://blog.cloudflare.com/cloudflare-architecture-and-how-...

koselig 5y ago
I've been using IPFire on my home network with a PCEngines APU hardware and works great with my gig speed internet. https://www.ipfire.org/ https://www.ipfire.org/
loganmarchione 5y ago
Try VyOS. It's based on Vyatta, which is also what Ubiquiti's EdgeOS is based on. It's all CLI-only, but it's pretty powerful. https://vyos.io/ https://vyos.io/

jsight 5y ago

I wish they'd build a version for the Raspberry Pi. It makes a great router.

Arnavion 5y ago

People here are linking to pfSense's past misbehavior wrt OPNsense. I used to use pfSense knowing about that but not caring. But what motivated me to switch to OPNsense was much more basic: - https://www.netgate.com/blog/announcing-pfsense-plus https://www.netgate.com/blog/announcing-pfsense-plus - https://www.netgate.com/blog/pfsense-plus-pfsense-ce-dev-insights-direction https://www.netgate.com/blog/pfsense-plus-pfsense-ce-dev-ins... If you're using pfSense CE you're using an EOL product, so you should move to OPNsense just for that reason alone. Those two posts try to convince you that CE is still relevant and will still get releases, but read carefully and you realize any changes to CE will either be by third parties or those that were part of the base FreeBSD system and thus were upstreamed to FreeBSD anyway. All the actual development work will be for Plus, and the design of Plus is sufficiently divergent (UI backend rewritten from PHP to golang apparently) that you can't backport the work to CE either. Plus will be free for home use (and hopefully remain so), but won't be open source. Not that CE is all that open source either, but at least you can read and modify the PHP scripts in your installation. Another reason people stayed off OPNsense was that it was based on HardenedBSD instead of FreeBSD, however that changed a few months ago so that should no longer be a concern.

thebiss 5y ago
Where does it say CE is going EOL? Long says updates will continue after 2.6, albeit slowly. Just like today. > There will be CE releases after 2.6, but unlike Plus, they’ll be done when they’re ready, not on a regular cadence.
- Arnavion 5y ago
  The answer is already in the comment you responded to.

EricE 5y ago

After what netgate pulled with Wireguard and their continuing abrasiveness towards the community I'm moving everything to Opnsense. I get that netgate has challenges earning enough money to stay alive - but they sure are picking ham fisted ways to do it :p

Helmut10001 5y ago

Long term pfSense user here (4+ years). I have followed the discussion for pfSense issues in recent months, and overall agree. However, I think the situation is a little bit more nuanced towards the context pfsense is used: If you have open WAN ports, for hosting services, I would avoid pfSense as it is now. If you have a fully closed WAN, with several mechanisms added to block local access (VLANs etc.), then the difference between OPNSense/pfSense is really not that obvious. Even if you have a OpenVPN Server on a single port, lets say UDP, it is possible to add HMAC, 2-Factor-Auth etc. in pfSense, too. So the security risks atm still seem rather low in this use context. pfSense currently just has a bit better support for packages. pfblockerng-devel, radius server for 2FA, Telegraf etc. Those are not available in OPNsense yet. Using pfblockerng-devel GeoIP lists, I can add an extra layer of security, allowing only certain countries to even reach my OpenVPN port. There is no guarantee that OPNSense is any better, other than the mentality aspect. It is a critical project and I am hoping to make the hop as soon as possible. At the moment, given my use case, I still feel that there is some time.