7 ms·

if you are here and considering to use pfSense, please take a look on https://opnsense.org/ https://opnsense.org/ and more important https://docs.opnsense.org/h

if you are here and considering to use pfSense, please take a look on https://opnsense.org/ https://opnsense.org/ and more important https://docs.opnsense.org/history/thefork.html https://docs.opnsense.org/history/thefork.html

lloydatkinson 5y ago
I'm really stuck between deciding on which. opnsense claims it's concerned about code quality and separating logic from the UI. Sounds great (and means that pfSense must really suck in terms of code quality and security if they aren't doing that) but then following the link to the PHP framework they use you get: > A full-stack PHP framework delivered as a C-extension! I mean, I've can't even begin to imagine how insecure that awful combination of insecure by default languages is.
- Nux 5y ago
  Yes, it's no Rust, but so what? You'll be dealing with a locked-down box in most/all situations, stuff won't be accessible to other than the sys admin (unless you misconfigure it).
- BongoMcCat 5y ago
  I can't really comment on the quality of the code, my reason for going opnsens over pfsense is mainly because the company that owns pfsense seem to be real asshats. But, looking at: https://docs.opnsense.org/development/architecture.html https://docs.opnsense.org/development/architecture.html It seems that it's mostly just the frontend that's php, or am I missing something?
  - lloydatkinson 5y ago
    Yes, I certainly feel much better now I read that thank you. I think I'll probably use opn then.
- Ardren 5y ago
  >> A full-stack PHP framework delivered as a C-extension! > I mean, I've can't even begin to imagine how insecure that awful combination of insecure by default languages is. What is inherently insecure about PHP? Or Phalcon? Do they have vulnerabilities that other C programs don't have?
  - beermonster 5y ago
    PHP itself used to have a poor security track record. Not sure what the situation is these days? I guess this[1] is one place to start. C programs are often exposed to classes of vulnerability owing to weaker safety guarantees see[2] [1] https://wiki.php.net/cve https://wiki.php.net/cve [2] https://msrc-blog.microsoft.com/2019/07/22/why-rust-for-safe-systems-programming/ https://msrc-blog.microsoft.com/2019/07/22/why-rust-for-safe...
    - topspin 5y ago
      Vulnerabilities in PHP appear regularly. A mass of them for PHP 7.x appeared in my inbox yesterday: https://ubuntu.com/security/notices/USN-5006-1 https://ubuntu.com/security/notices/USN-5006-1
  - lloydatkinson 5y ago
    I should think a quick google of "C string vulnerability" will answer your question.
    - lloydatkinson 5y ago
      Ah yes, the C users got triggered.
- oneplane 5y ago
  OPNSense replaced a lot of the old PHP that was in pfSense after it forked. So if PHP is a concern for you, you could argue that's OPNSense's PHP is better than pfSense's PHP. OPNSense also splits front-end into the MVC and control layer, as well as the back-end between the control layer and the configuration daemon which is written in python. All of the actual packet processing and daemons are C or C++, essentially the standard packages you'd find in FreeBSD. Whether PHP or C is more secure depends on who wrote it.
  - 293984j29384 5y ago
    I'm not a PHP programmer so I can't assess the quality of the code myself but do we know objectively that OPNSense's PHP is better than pfSense? That seems like a big assumption that just because it's been rewritten it's more secure or "better"
    - oneplane 5y ago
      I do because I've worked with the code. It's not 100% beter or something like that, but the Phalcon framework does impose quality requirements to work with it effectively. It also has immutable facilities loaded as an extension (for speed benefit but also means you can't actually mess with the framework at runtime). While I haven't really done any hardcode PHP work after PHP5 came out, there are plenty of ways to do it wrong, and a few ways to do it right. One thing is separation of concerns and encapsulation to the point where a fault in PHP can only mess up the PHP part and not the external system PHP calls into to ask for configuration changes. Currently, a lot of the old pfSense code has been removed and replaced with code in the MVC framework, but it's a lot of work, and the team behind open-source OPNSense isn't huge. It will take time to cover it all.
- c0nsumer 5y ago
  If it helps, about a year ago I was replacing a UniFi setup at home and I was trying to decide with pfSense or OPNsense. After poking at both in VMs for about a week I settled on OPNsese. My main reasons were that it did everything I wanted pfSense to do, something about the UI felt a bit smoother to me, and it didn't have the smarmy/wonky feeling that pfSense does (aggressive company behavior, closed-ish stuff, and then post-switch the Wireguard stuff happened). I'm running this on a Protectli FW4B and have been quite happy. It's still doing exactly what I wanted, updates have been good, a bug I reported got fixed quickly, and it's... just working. Also, by going to open hardware (and not the Netgate stuff I was originally thinking of) I can switch to another platform (eg: Untangle, OpenBSD) if desired. But, for the forseeable future, OPNsense seems to be working just fine. <shrug>
  - unethical_ban 5y ago
    What moved you off of Unifi? Did you move off entirely, or just for the gateway?
    - c0nsumer 5y ago
      I moved entirely. It was mostly the GW that I didn't like. The primary bug was when they changed the maximum SSID length from 32 (standard) to 31 and I could no longer edit my network. I also had a very frustrating ARP bug where ARP broadcasts wouldn't work across mesh'd APs (https://www.reddit.com/r/UNIFI/comments/ghs4bg/arp_for_client_on_meshed_ap_not_working_help/ https://www.reddit.com/r/UNIFI/comments/ghs4bg/arp_for_clien...). Then there was just some various other quirkyness/weirdness, and I happened to get out just before the big security breach was disclosed. I ended up going to a Ruckus R610 AP that I got via eBay running the Unleashed OS, and it's outstanding. Coverage is so good I no longer need my old AP + extra mesh'd one. For switching I'm just using an old TP-Link that I had laying around. UniFi seemed really neat at first, but then it just felt... overwraught. I don't need single-pane-of-glass monitoring of a ton of stuff for my home network. I don't want to run a management software server just for my home network. I do want something robust, but I don't want to worry about it, and I want to be able to piecemeal upgrade it. A small PC running OPNsense + a solid AP + just whatever for switching does exactly that. (I'm not a homelab-type person... If I want that I use VMs, or my employer's hardware. I want my home network to be a solid, reliable utility that requires little maintenance. I don't want to be tweaking my home network after my day job.)
- mikey_p 5y ago
  PHP is already written in C and can be quite secure when following best practices (as with any language), so I'm not sure why an additional PHP extension written in C would be a red flag? Note that Phalcon is a PHP extension (not a C extension) that provides new functionality available in the PHP runtime. This is roughly equivalent to a Ruby gem with a C extension, like Nokogiri.
- McGlockenshire 5y ago
  > I've can't even begin to imagine how insecure that awful combination of insecure by default languages is. Phalcon was at one point moderately well-regarded, though it's fallen out of favor for a wide variety of reasons, mostly the PHP development style moving on. I say this because as near as I can tell, Phalcon has had an entire single CVE in its entire decade plus of active development. Casual anti-PHP bigotry isn't just uninformed, its harmful.
beermonster 5y ago
Is it easy to migrate pfSense instances to OPNSense? How does security patching compare?
- tw04 5y ago
  Opnsense has been far more consistent with their upgrade releases. Migration is really a complete reinstall and rebuild of your rules. I took a backup of my physical pfsense box and restored it to a VM then reinstalled opnsense on the physical hardware. With the pf box running in a vm I could just reference it while creating new rules. I think someone made a script to load a pfsense backup onto an opnsense instance but I really think you’re better off with a clean slate.
  - vocatus_gate 5y ago
    I did the same thing, pulled up my pfSense config in a VM side-by-side with the fresh OPNSense install and manually ported everything over. Kind of a pain, sure, but I felt better knowing it was a fresh build and everything was where it should be.
huy-nguyen 5y ago
I considered both and ended up just using pf on OpenBSD. Very simple config on top of a rock solid OS.
- technofiend 5y ago
  OpenBSD is also my go to. The only caveat I'll throw out is when I upgraded to gigabit internet I discovered OpenBSD on the protectli FW4B couldn't keep up. In fact in iperf benchmarks it pushed ~300 Mb/s to FreeBSD's 600 Mb/s. Considering all the work done on Linux's network stack I plan to try it next to see if I can squeeze any more out of the hardware. Just means anyone who wants to try OpenBSD should spec something a little more powerful than that appliance.
  - flatiron 5y ago
    Makes sense. Open bsd focuses on code quality and security not performance. I bet a lot of DMA tricks are poo poo’d by openbsd
  - pak9rabid 5y ago
    Linux + nftables isn't a bad combination. Certainly an improvement over the old iptables userspace.
  - Lammy 5y ago
    I don’t know if it would fix your problem, but pf on FreeBSD is SMP-enabled unlike OpenBSD’s. You have to deal with using the “old” pf.conf syntax though.
AnIdiotOnTheNet 5y ago
I've been looking to replace the ancient, used, power hungry, overbuilt 2U rack server I'm currently using for PfSsense with something lighter (ditto my Proxmox server, incidentally). Last I used OPNsense it had issues with the NICs in whatever it was I put it on that caused it to frequently drop connections. Is there any recommended hardware for OPNsense?
- hestefisk 5y ago
  I have used a low power Qotom Intel-based mini pc with 4 NICs running Opnsense since version 18.x. I bought it off Amazon for 300 USD and it runs like a charm. It currently serves my 1Gbps fibre connection with significant amount of simultaneous workloads without a sweat. Only downside is in the older models the Qotom bios will not get past POST if no screen is plugged in, so you will need either a screen when you reboot or a stump VGA cable with a resistor built in. Apart from this, I can highly recommend it.
  - radiowave 5y ago
    Seconded. These are my default choice for pfsense (and probably opnsense in the future). Only issue I've had is that if it's a J1900 Celeron CPU, ensure you have the machine set to boot via UEFI before installing. (IIRC there's an open issue for FreeBSD installations failing to legacy boot on J1900 boards.)
    - hestefisk 5y ago
      Good point. My current firewall is an older Celeron cpu and with 20+ devices hammering the 1Gbps fibre,I can hardly make it sweat.
- tw04 5y ago
  Stay away from Realtek and I’m sure you’ll be fine. Intel would be my first pick followed by Chelsio (for 10gb). Broadcom will be serviceable. In all cases I’d double check the individual chipset by doing a quick search on the forums whether you decide to go pf or opn.

lloydatkinson 5y ago

I'm really stuck between deciding on which. opnsense claims it's concerned about code quality and separating logic from the UI. Sounds great (and means that pfSense must really suck in terms of code quality and security if they aren't doing that) but then following the link to the PHP framework they use you get: > A full-stack PHP framework delivered as a C-extension! I mean, I've can't even begin to imagine how insecure that awful combination of insecure by default languages is.

Nux 5y ago
Yes, it's no Rust, but so what? You'll be dealing with a locked-down box in most/all situations, stuff won't be accessible to other than the sys admin (unless you misconfigure it).
BongoMcCat 5y ago
I can't really comment on the quality of the code, my reason for going opnsens over pfsense is mainly because the company that owns pfsense seem to be real asshats. But, looking at: https://docs.opnsense.org/development/architecture.html https://docs.opnsense.org/development/architecture.html It seems that it's mostly just the frontend that's php, or am I missing something?
- lloydatkinson 5y ago
  Yes, I certainly feel much better now I read that thank you. I think I'll probably use opn then.
Ardren 5y ago
>> A full-stack PHP framework delivered as a C-extension! > I mean, I've can't even begin to imagine how insecure that awful combination of insecure by default languages is. What is inherently insecure about PHP? Or Phalcon? Do they have vulnerabilities that other C programs don't have?
- beermonster 5y ago
  PHP itself used to have a poor security track record. Not sure what the situation is these days? I guess this[1] is one place to start. C programs are often exposed to classes of vulnerability owing to weaker safety guarantees see[2] [1] https://wiki.php.net/cve https://wiki.php.net/cve [2] https://msrc-blog.microsoft.com/2019/07/22/why-rust-for-safe-systems-programming/ https://msrc-blog.microsoft.com/2019/07/22/why-rust-for-safe...
  - topspin 5y ago
    Vulnerabilities in PHP appear regularly. A mass of them for PHP 7.x appeared in my inbox yesterday: https://ubuntu.com/security/notices/USN-5006-1 https://ubuntu.com/security/notices/USN-5006-1
- lloydatkinson 5y ago
  I should think a quick google of "C string vulnerability" will answer your question.
  - lloydatkinson 5y ago
    Ah yes, the C users got triggered.
oneplane 5y ago
OPNSense replaced a lot of the old PHP that was in pfSense after it forked. So if PHP is a concern for you, you could argue that's OPNSense's PHP is better than pfSense's PHP. OPNSense also splits front-end into the MVC and control layer, as well as the back-end between the control layer and the configuration daemon which is written in python. All of the actual packet processing and daemons are C or C++, essentially the standard packages you'd find in FreeBSD. Whether PHP or C is more secure depends on who wrote it.
- 293984j29384 5y ago
  I'm not a PHP programmer so I can't assess the quality of the code myself but do we know objectively that OPNSense's PHP is better than pfSense? That seems like a big assumption that just because it's been rewritten it's more secure or "better"
  - oneplane 5y ago
    I do because I've worked with the code. It's not 100% beter or something like that, but the Phalcon framework does impose quality requirements to work with it effectively. It also has immutable facilities loaded as an extension (for speed benefit but also means you can't actually mess with the framework at runtime). While I haven't really done any hardcode PHP work after PHP5 came out, there are plenty of ways to do it wrong, and a few ways to do it right. One thing is separation of concerns and encapsulation to the point where a fault in PHP can only mess up the PHP part and not the external system PHP calls into to ask for configuration changes. Currently, a lot of the old pfSense code has been removed and replaced with code in the MVC framework, but it's a lot of work, and the team behind open-source OPNSense isn't huge. It will take time to cover it all.
c0nsumer 5y ago
If it helps, about a year ago I was replacing a UniFi setup at home and I was trying to decide with pfSense or OPNsense. After poking at both in VMs for about a week I settled on OPNsese. My main reasons were that it did everything I wanted pfSense to do, something about the UI felt a bit smoother to me, and it didn't have the smarmy/wonky feeling that pfSense does (aggressive company behavior, closed-ish stuff, and then post-switch the Wireguard stuff happened). I'm running this on a Protectli FW4B and have been quite happy. It's still doing exactly what I wanted, updates have been good, a bug I reported got fixed quickly, and it's... just working. Also, by going to open hardware (and not the Netgate stuff I was originally thinking of) I can switch to another platform (eg: Untangle, OpenBSD) if desired. But, for the forseeable future, OPNsense seems to be working just fine. <shrug>
- unethical_ban 5y ago
  What moved you off of Unifi? Did you move off entirely, or just for the gateway?
  - c0nsumer 5y ago
    I moved entirely. It was mostly the GW that I didn't like. The primary bug was when they changed the maximum SSID length from 32 (standard) to 31 and I could no longer edit my network. I also had a very frustrating ARP bug where ARP broadcasts wouldn't work across mesh'd APs (https://www.reddit.com/r/UNIFI/comments/ghs4bg/arp_for_client_on_meshed_ap_not_working_help/ https://www.reddit.com/r/UNIFI/comments/ghs4bg/arp_for_clien...). Then there was just some various other quirkyness/weirdness, and I happened to get out just before the big security breach was disclosed. I ended up going to a Ruckus R610 AP that I got via eBay running the Unleashed OS, and it's outstanding. Coverage is so good I no longer need my old AP + extra mesh'd one. For switching I'm just using an old TP-Link that I had laying around. UniFi seemed really neat at first, but then it just felt... overwraught. I don't need single-pane-of-glass monitoring of a ton of stuff for my home network. I don't want to run a management software server just for my home network. I do want something robust, but I don't want to worry about it, and I want to be able to piecemeal upgrade it. A small PC running OPNsense + a solid AP + just whatever for switching does exactly that. (I'm not a homelab-type person... If I want that I use VMs, or my employer's hardware. I want my home network to be a solid, reliable utility that requires little maintenance. I don't want to be tweaking my home network after my day job.)
mikey_p 5y ago
PHP is already written in C and can be quite secure when following best practices (as with any language), so I'm not sure why an additional PHP extension written in C would be a red flag? Note that Phalcon is a PHP extension (not a C extension) that provides new functionality available in the PHP runtime. This is roughly equivalent to a Ruby gem with a C extension, like Nokogiri.
McGlockenshire 5y ago
> I've can't even begin to imagine how insecure that awful combination of insecure by default languages is. Phalcon was at one point moderately well-regarded, though it's fallen out of favor for a wide variety of reasons, mostly the PHP development style moving on. I say this because as near as I can tell, Phalcon has had an entire single CVE in its entire decade plus of active development. Casual anti-PHP bigotry isn't just uninformed, its harmful.

beermonster 5y ago

Is it easy to migrate pfSense instances to OPNSense? How does security patching compare?

tw04 5y ago
Opnsense has been far more consistent with their upgrade releases. Migration is really a complete reinstall and rebuild of your rules. I took a backup of my physical pfsense box and restored it to a VM then reinstalled opnsense on the physical hardware. With the pf box running in a vm I could just reference it while creating new rules. I think someone made a script to load a pfsense backup onto an opnsense instance but I really think you’re better off with a clean slate.
- vocatus_gate 5y ago
  I did the same thing, pulled up my pfSense config in a VM side-by-side with the fresh OPNSense install and manually ported everything over. Kind of a pain, sure, but I felt better knowing it was a fresh build and everything was where it should be.

huy-nguyen 5y ago

I considered both and ended up just using pf on OpenBSD. Very simple config on top of a rock solid OS.

technofiend 5y ago
OpenBSD is also my go to. The only caveat I'll throw out is when I upgraded to gigabit internet I discovered OpenBSD on the protectli FW4B couldn't keep up. In fact in iperf benchmarks it pushed ~300 Mb/s to FreeBSD's 600 Mb/s. Considering all the work done on Linux's network stack I plan to try it next to see if I can squeeze any more out of the hardware. Just means anyone who wants to try OpenBSD should spec something a little more powerful than that appliance.
- flatiron 5y ago
  Makes sense. Open bsd focuses on code quality and security not performance. I bet a lot of DMA tricks are poo poo’d by openbsd
- pak9rabid 5y ago
  Linux + nftables isn't a bad combination. Certainly an improvement over the old iptables userspace.
- Lammy 5y ago
  I don’t know if it would fix your problem, but pf on FreeBSD is SMP-enabled unlike OpenBSD’s. You have to deal with using the “old” pf.conf syntax though.

AnIdiotOnTheNet 5y ago

I've been looking to replace the ancient, used, power hungry, overbuilt 2U rack server I'm currently using for PfSsense with something lighter (ditto my Proxmox server, incidentally). Last I used OPNsense it had issues with the NICs in whatever it was I put it on that caused it to frequently drop connections. Is there any recommended hardware for OPNsense?

hestefisk 5y ago
I have used a low power Qotom Intel-based mini pc with 4 NICs running Opnsense since version 18.x. I bought it off Amazon for 300 USD and it runs like a charm. It currently serves my 1Gbps fibre connection with significant amount of simultaneous workloads without a sweat. Only downside is in the older models the Qotom bios will not get past POST if no screen is plugged in, so you will need either a screen when you reboot or a stump VGA cable with a resistor built in. Apart from this, I can highly recommend it.
- radiowave 5y ago
  Seconded. These are my default choice for pfsense (and probably opnsense in the future). Only issue I've had is that if it's a J1900 Celeron CPU, ensure you have the machine set to boot via UEFI before installing. (IIRC there's an open issue for FreeBSD installations failing to legacy boot on J1900 boards.)
  - hestefisk 5y ago
    Good point. My current firewall is an older Celeron cpu and with 20+ devices hammering the 1Gbps fibre,I can hardly make it sweat.
tw04 5y ago
Stay away from Realtek and I’m sure you’ll be fine. Intel would be my first pick followed by Chelsio (for 10gb). Broadcom will be serviceable. In all cases I’d double check the individual chipset by doing a quick search on the forums whether you decide to go pf or opn.