6 ms·

I remember pfsense from them trying to merge bug ridden code into FreeBSD for Wireguard support. The creater of Wireguard said it was bad with buffer overruns

by Jonnax 5y ago

I remember pfsense from them trying to merge bug ridden code into FreeBSD for Wireguard support. The creater of Wireguard said it was bad with buffer overruns and they got angry for being called out. https://arstechnica.com/gadgets/2021/03/buffer-overruns-license-violations-and-bad-code-freebsd-13s-close-call/ https://arstechnica.com/gadgets/2021/03/buffer-overruns-lice... The software seems to be the default open source firewall / router network admins go to, but it seems like a ticking time bomb to me. They also seem to be pivoting to a closed source firewall / router project so this will result in less work going in.

btgeekboy 5y ago
Luckily, OPNsense is practically a drop-in replacement.
- IgorPartola 5y ago
  Can confirm. I recently set it up and ran into an issue with my ISP’s DHCP implementation. There was a pull request for PfSense from like 4 years ago that helped with the issue but remained open. The OPNSense developer I talked to merged a modified fix within a very short time and is even helping others test their broken PfSense systems.
- user3939382 5y ago
  You could also go with my solution for this use case, which is to use pf on OpenBSD. Firewalls don’t necessarily need a web interface.
  - bityard 5y ago
    Pfsense and opnsense do far more than just packet filtering
  - yabones 5y ago
    I've wanted to go that way for some time, the real problem is that it's basically impossible to hand that off to another net/sysadmin. Imagine walking onto a new job, and they hand you a yubikey and say "here's your keys, the old guy whiteboxed everything with Debian and BSD. Have fun!" Unfortunately, the only time CLI wins out in networking is when there's a cert to dangle in front of people. As much as I want to do things the "right" way, part of that equation is handing projects off to other people to maintain...
    - hyperpl 5y ago
      I would actually argue that having a few config files with good comments/documentation would be more clear than deeply nested web UIs. I switched to OpenBSD/pf from pfsense and I have more peace of mind needing to maintain a small handful of commented config files.
      - imiric 5y ago
        Could you share your config files or suggest a starting point for migrating from pfSense?
    - neatze 5y ago
      > "here's your keys, the old guy whiteboxed everything with Debian and BSD. Have fun!" Can you elaborate how GUI will be better ? At least with CLI and plain text configs I have "#" so all configs are self documented and committed to git repository.
    - kjs3 5y ago
      Unfortunately, the only time CLI wins out in networking is when there's a cert to dangle in front of people. I'm not sure what world you live in, but in the Cisco world I don't know anyone who does anything beyond the trivial in the various 'GUIs'. part of that equation is handing projects off to other people to maintain Yes, and I don't know anyone who would hire a Cisco engineer that wasn't fully conversant with the CLI. The idea that something we've been doing, successfully, for decades (handing a text Cisco config to the next engineer) is "basically impossible" is...interesting...and unsupportable in my experience. As is the implied "GUIs are always easier to understand and reason about".
  - beermonster 5y ago
    pfSense also allows for configuration of IPSec tunnels and VLANs etc etc. It’s not a WebUI for configuring pf
    - 1MachineElf 5y ago
      As does OpenBSD - VLANs and IPSec on the OpenBSD CLI are simpler than you think! Personally I think it's simpler and easier to use than even pfSense. Point is still valid through. Especially compared to some overly-complicated implementations, the pfSense web UI for VLAN and IPSec can be a better alternative.
  - pak9rabid 5y ago
    Linux + nftables (nft) also isn't a bad choice. I just replaced all my iptables scripts with nftables equivalents and it was actually a pretty enjoyable experience. Some highlights of nft over bash scripts with iptables commands: 1.) Your firewall scripts are now atomic (if using nft as your interpreter instead of bash), so either the entire ruleset gets applied, or nothing does. 2.) There's a nice declarative form of the nft syntax which I prefer (vs a more imperative style which we're all used to with pf (in the BSD world), or iptables)...both forms are executed atomically when the nft interpreter is used. 3.) The presence of an actual 'include' statement makes it possible to break your fw scripts up into multiple files, for better organization and readability. This also all gets executed atomically. Overall I found it to be an enjoyable experience.
  - btgeekboy 5y ago
    Of course. I wanted to move off of pfSense, but I wanted to roll my own. I tried to build something similar with NixOS but learning all the ins and outs of Nix got a bit overwhelming for a device whose config changes rarely. I ended up just grabbing OPNsense, installing it, copying my configs over, and it’s been a solid 48 hours since.
- Wronnay 5y ago
  Is there a way to import a pfSense Config into OPNsense? I would be happy to switch if I could import my existing settings...
  - technothrasher 5y ago
    Yup, backup on pfSense, then restore on OPNsense. Presto, it's that easy.
    - Wronnay 5y ago
      Doesn't seem like it is that easy anymore: https://github.com/opnsense/core/issues/2374 https://github.com/opnsense/core/issues/2374
andrewnicolalde 5y ago
Unfortunately this disqualified PfSense for me as well.
hpcjoe 5y ago
I've been using pfSense for many years, generally happy with it. The wireguard fiasco made sense to me when I saw some former colleagues involved (including 1 I hired at a previous gig, and one I interviewed before he joined the co). Instead of taking their loss, admitting they screwed up, they tried FUD. This ... was in line with what I experienced in the past. Extremely unprofessional. Thanks to them, several years ago I swore off FreeBSD. The tech may be ok/good, the baggage of personalities and egos is not worth it though. After seeing this, and at least the two of them associated with pfSense, I've now started looking for replacements for pfSense. I've been thinking of OPNsense, though the whole FreeBSD bit bugs me (code/OS is fine, personalities/egos less so). Linux "equivalents" sort of exist, though reading through the various fora for them suggests similar ego/personality issues. I'm not sure its bad enough to go back to dedicated firewall/router appliances (most are terrible and closed source). If there is a simple way to convert my pfSense config to a OPNsense config, this is likely to be the first step I take. I'd love to hear other people's experience converting away from pfSense.
- yjftsjthsd-h 5y ago
  I don't follow; why would you swear off FreeBSD because a derivative product misbehaved? Would you swear off all Linux distros because Ubuntu did something bad?
  - hpcjoe 5y ago
    The issue wasn't that the product misbehaved. The issue was the personalities/ethics of the people involved are grating/questionable at best. Having worked with them, I honestly question their judgements. Since one or more of these people are or have been core committers on FreeBSD, this makes me question that project's judgement.
- technothrasher 5y ago
  > If there is a simple way to convert my pfSense config to a OPNsense config There is. You just back up your pfSense config, and then restore it into OPNsense.
dpedu 5y ago
Pfsense is NOT open source. See https://news.ycombinator.com/item?id=25894420 https://news.ycombinator.com/item?id=25894420
vocatus_gate 5y ago
I switched to OPNSense (fork of pfSense) years ago and have been very happy with it. Consistent, reliable updates, and easy to understand interface.

by Jonnax 5y ago

btgeekboy 5y ago

Luckily, OPNsense is practically a drop-in replacement.

IgorPartola 5y ago
Can confirm. I recently set it up and ran into an issue with my ISP’s DHCP implementation. There was a pull request for PfSense from like 4 years ago that helped with the issue but remained open. The OPNSense developer I talked to merged a modified fix within a very short time and is even helping others test their broken PfSense systems.
user3939382 5y ago
You could also go with my solution for this use case, which is to use pf on OpenBSD. Firewalls don’t necessarily need a web interface.
- bityard 5y ago
  Pfsense and opnsense do far more than just packet filtering
- yabones 5y ago
  I've wanted to go that way for some time, the real problem is that it's basically impossible to hand that off to another net/sysadmin. Imagine walking onto a new job, and they hand you a yubikey and say "here's your keys, the old guy whiteboxed everything with Debian and BSD. Have fun!" Unfortunately, the only time CLI wins out in networking is when there's a cert to dangle in front of people. As much as I want to do things the "right" way, part of that equation is handing projects off to other people to maintain...
  - hyperpl 5y ago
    I would actually argue that having a few config files with good comments/documentation would be more clear than deeply nested web UIs. I switched to OpenBSD/pf from pfsense and I have more peace of mind needing to maintain a small handful of commented config files.
    - imiric 5y ago
      Could you share your config files or suggest a starting point for migrating from pfSense?
  - neatze 5y ago
    > "here's your keys, the old guy whiteboxed everything with Debian and BSD. Have fun!" Can you elaborate how GUI will be better ? At least with CLI and plain text configs I have "#" so all configs are self documented and committed to git repository.
  - kjs3 5y ago
    Unfortunately, the only time CLI wins out in networking is when there's a cert to dangle in front of people. I'm not sure what world you live in, but in the Cisco world I don't know anyone who does anything beyond the trivial in the various 'GUIs'. part of that equation is handing projects off to other people to maintain Yes, and I don't know anyone who would hire a Cisco engineer that wasn't fully conversant with the CLI. The idea that something we've been doing, successfully, for decades (handing a text Cisco config to the next engineer) is "basically impossible" is...interesting...and unsupportable in my experience. As is the implied "GUIs are always easier to understand and reason about".
- beermonster 5y ago
  pfSense also allows for configuration of IPSec tunnels and VLANs etc etc. It’s not a WebUI for configuring pf
  - 1MachineElf 5y ago
    As does OpenBSD - VLANs and IPSec on the OpenBSD CLI are simpler than you think! Personally I think it's simpler and easier to use than even pfSense. Point is still valid through. Especially compared to some overly-complicated implementations, the pfSense web UI for VLAN and IPSec can be a better alternative.
- pak9rabid 5y ago
  Linux + nftables (nft) also isn't a bad choice. I just replaced all my iptables scripts with nftables equivalents and it was actually a pretty enjoyable experience. Some highlights of nft over bash scripts with iptables commands: 1.) Your firewall scripts are now atomic (if using nft as your interpreter instead of bash), so either the entire ruleset gets applied, or nothing does. 2.) There's a nice declarative form of the nft syntax which I prefer (vs a more imperative style which we're all used to with pf (in the BSD world), or iptables)...both forms are executed atomically when the nft interpreter is used. 3.) The presence of an actual 'include' statement makes it possible to break your fw scripts up into multiple files, for better organization and readability. This also all gets executed atomically. Overall I found it to be an enjoyable experience.
- btgeekboy 5y ago
  Of course. I wanted to move off of pfSense, but I wanted to roll my own. I tried to build something similar with NixOS but learning all the ins and outs of Nix got a bit overwhelming for a device whose config changes rarely. I ended up just grabbing OPNsense, installing it, copying my configs over, and it’s been a solid 48 hours since.
Wronnay 5y ago
Is there a way to import a pfSense Config into OPNsense? I would be happy to switch if I could import my existing settings...
- technothrasher 5y ago
  Yup, backup on pfSense, then restore on OPNsense. Presto, it's that easy.
  - Wronnay 5y ago
    Doesn't seem like it is that easy anymore: https://github.com/opnsense/core/issues/2374 https://github.com/opnsense/core/issues/2374

andrewnicolalde 5y ago

Unfortunately this disqualified PfSense for me as well.

hpcjoe 5y ago

I've been using pfSense for many years, generally happy with it. The wireguard fiasco made sense to me when I saw some former colleagues involved (including 1 I hired at a previous gig, and one I interviewed before he joined the co). Instead of taking their loss, admitting they screwed up, they tried FUD. This ... was in line with what I experienced in the past. Extremely unprofessional. Thanks to them, several years ago I swore off FreeBSD. The tech may be ok/good, the baggage of personalities and egos is not worth it though. After seeing this, and at least the two of them associated with pfSense, I've now started looking for replacements for pfSense. I've been thinking of OPNsense, though the whole FreeBSD bit bugs me (code/OS is fine, personalities/egos less so). Linux "equivalents" sort of exist, though reading through the various fora for them suggests similar ego/personality issues. I'm not sure its bad enough to go back to dedicated firewall/router appliances (most are terrible and closed source). If there is a simple way to convert my pfSense config to a OPNsense config, this is likely to be the first step I take. I'd love to hear other people's experience converting away from pfSense.

yjftsjthsd-h 5y ago
I don't follow; why would you swear off FreeBSD because a derivative product misbehaved? Would you swear off all Linux distros because Ubuntu did something bad?
- hpcjoe 5y ago
  The issue wasn't that the product misbehaved. The issue was the personalities/ethics of the people involved are grating/questionable at best. Having worked with them, I honestly question their judgements. Since one or more of these people are or have been core committers on FreeBSD, this makes me question that project's judgement.
technothrasher 5y ago
> If there is a simple way to convert my pfSense config to a OPNsense config There is. You just back up your pfSense config, and then restore it into OPNsense.

dpedu 5y ago

Pfsense is NOT open source. See https://news.ycombinator.com/item?id=25894420 https://news.ycombinator.com/item?id=25894420

vocatus_gate 5y ago

I switched to OPNSense (fork of pfSense) years ago and have been very happy with it. Consistent, reliable updates, and easy to understand interface.