6 ms·

Luckily, OPNsense is practically a drop-in replacement.

IgorPartola 5y ago
Can confirm. I recently set it up and ran into an issue with my ISP’s DHCP implementation. There was a pull request for PfSense from like 4 years ago that helped with the issue but remained open. The OPNSense developer I talked to merged a modified fix within a very short time and is even helping others test their broken PfSense systems.
user3939382 5y ago
You could also go with my solution for this use case, which is to use pf on OpenBSD. Firewalls don’t necessarily need a web interface.
- bityard 5y ago
  Pfsense and opnsense do far more than just packet filtering
- yabones 5y ago
  I've wanted to go that way for some time, the real problem is that it's basically impossible to hand that off to another net/sysadmin. Imagine walking onto a new job, and they hand you a yubikey and say "here's your keys, the old guy whiteboxed everything with Debian and BSD. Have fun!" Unfortunately, the only time CLI wins out in networking is when there's a cert to dangle in front of people. As much as I want to do things the "right" way, part of that equation is handing projects off to other people to maintain...
  - hyperpl 5y ago
    I would actually argue that having a few config files with good comments/documentation would be more clear than deeply nested web UIs. I switched to OpenBSD/pf from pfsense and I have more peace of mind needing to maintain a small handful of commented config files.
    - imiric 5y ago
      Could you share your config files or suggest a starting point for migrating from pfSense?
  - neatze 5y ago
    > "here's your keys, the old guy whiteboxed everything with Debian and BSD. Have fun!" Can you elaborate how GUI will be better ? At least with CLI and plain text configs I have "#" so all configs are self documented and committed to git repository.
  - kjs3 5y ago
    Unfortunately, the only time CLI wins out in networking is when there's a cert to dangle in front of people. I'm not sure what world you live in, but in the Cisco world I don't know anyone who does anything beyond the trivial in the various 'GUIs'. part of that equation is handing projects off to other people to maintain Yes, and I don't know anyone who would hire a Cisco engineer that wasn't fully conversant with the CLI. The idea that something we've been doing, successfully, for decades (handing a text Cisco config to the next engineer) is "basically impossible" is...interesting...and unsupportable in my experience. As is the implied "GUIs are always easier to understand and reason about".
- beermonster 5y ago
  pfSense also allows for configuration of IPSec tunnels and VLANs etc etc. It’s not a WebUI for configuring pf
  - 1MachineElf 5y ago
    As does OpenBSD - VLANs and IPSec on the OpenBSD CLI are simpler than you think! Personally I think it's simpler and easier to use than even pfSense. Point is still valid through. Especially compared to some overly-complicated implementations, the pfSense web UI for VLAN and IPSec can be a better alternative.
- pak9rabid 5y ago
  Linux + nftables (nft) also isn't a bad choice. I just replaced all my iptables scripts with nftables equivalents and it was actually a pretty enjoyable experience. Some highlights of nft over bash scripts with iptables commands: 1.) Your firewall scripts are now atomic (if using nft as your interpreter instead of bash), so either the entire ruleset gets applied, or nothing does. 2.) There's a nice declarative form of the nft syntax which I prefer (vs a more imperative style which we're all used to with pf (in the BSD world), or iptables)...both forms are executed atomically when the nft interpreter is used. 3.) The presence of an actual 'include' statement makes it possible to break your fw scripts up into multiple files, for better organization and readability. This also all gets executed atomically. Overall I found it to be an enjoyable experience.
- btgeekboy 5y ago
  Of course. I wanted to move off of pfSense, but I wanted to roll my own. I tried to build something similar with NixOS but learning all the ins and outs of Nix got a bit overwhelming for a device whose config changes rarely. I ended up just grabbing OPNsense, installing it, copying my configs over, and it’s been a solid 48 hours since.
Wronnay 5y ago
Is there a way to import a pfSense Config into OPNsense? I would be happy to switch if I could import my existing settings...
- technothrasher 5y ago
  Yup, backup on pfSense, then restore on OPNsense. Presto, it's that easy.
  - Wronnay 5y ago
    Doesn't seem like it is that easy anymore: https://github.com/opnsense/core/issues/2374 https://github.com/opnsense/core/issues/2374

Can confirm. I recently set it up and ran into an issue with my ISP’s DHCP implementation. There was a pull request for PfSense from like 4 years ago that helped with the issue but remained open. The OPNSense developer I talked to merged a modified fix within a very short time and is even helping others test their broken PfSense systems.

user3939382 5y ago

You could also go with my solution for this use case, which is to use pf on OpenBSD. Firewalls don’t necessarily need a web interface.

bityard 5y ago
Pfsense and opnsense do far more than just packet filtering
yabones 5y ago
I've wanted to go that way for some time, the real problem is that it's basically impossible to hand that off to another net/sysadmin. Imagine walking onto a new job, and they hand you a yubikey and say "here's your keys, the old guy whiteboxed everything with Debian and BSD. Have fun!" Unfortunately, the only time CLI wins out in networking is when there's a cert to dangle in front of people. As much as I want to do things the "right" way, part of that equation is handing projects off to other people to maintain...
- hyperpl 5y ago
  I would actually argue that having a few config files with good comments/documentation would be more clear than deeply nested web UIs. I switched to OpenBSD/pf from pfsense and I have more peace of mind needing to maintain a small handful of commented config files.
  - imiric 5y ago
    Could you share your config files or suggest a starting point for migrating from pfSense?
- neatze 5y ago
  > "here's your keys, the old guy whiteboxed everything with Debian and BSD. Have fun!" Can you elaborate how GUI will be better ? At least with CLI and plain text configs I have "#" so all configs are self documented and committed to git repository.
- kjs3 5y ago
  Unfortunately, the only time CLI wins out in networking is when there's a cert to dangle in front of people. I'm not sure what world you live in, but in the Cisco world I don't know anyone who does anything beyond the trivial in the various 'GUIs'. part of that equation is handing projects off to other people to maintain Yes, and I don't know anyone who would hire a Cisco engineer that wasn't fully conversant with the CLI. The idea that something we've been doing, successfully, for decades (handing a text Cisco config to the next engineer) is "basically impossible" is...interesting...and unsupportable in my experience. As is the implied "GUIs are always easier to understand and reason about".
beermonster 5y ago
pfSense also allows for configuration of IPSec tunnels and VLANs etc etc. It’s not a WebUI for configuring pf
- 1MachineElf 5y ago
  As does OpenBSD - VLANs and IPSec on the OpenBSD CLI are simpler than you think! Personally I think it's simpler and easier to use than even pfSense. Point is still valid through. Especially compared to some overly-complicated implementations, the pfSense web UI for VLAN and IPSec can be a better alternative.
pak9rabid 5y ago
Linux + nftables (nft) also isn't a bad choice. I just replaced all my iptables scripts with nftables equivalents and it was actually a pretty enjoyable experience. Some highlights of nft over bash scripts with iptables commands: 1.) Your firewall scripts are now atomic (if using nft as your interpreter instead of bash), so either the entire ruleset gets applied, or nothing does. 2.) There's a nice declarative form of the nft syntax which I prefer (vs a more imperative style which we're all used to with pf (in the BSD world), or iptables)...both forms are executed atomically when the nft interpreter is used. 3.) The presence of an actual 'include' statement makes it possible to break your fw scripts up into multiple files, for better organization and readability. This also all gets executed atomically. Overall I found it to be an enjoyable experience.
btgeekboy 5y ago
Of course. I wanted to move off of pfSense, but I wanted to roll my own. I tried to build something similar with NixOS but learning all the ins and outs of Nix got a bit overwhelming for a device whose config changes rarely. I ended up just grabbing OPNsense, installing it, copying my configs over, and it’s been a solid 48 hours since.

Wronnay 5y ago

Is there a way to import a pfSense Config into OPNsense? I would be happy to switch if I could import my existing settings...

technothrasher 5y ago
Yup, backup on pfSense, then restore on OPNsense. Presto, it's that easy.
- Wronnay 5y ago
  Doesn't seem like it is that easy anymore: https://github.com/opnsense/core/issues/2374 https://github.com/opnsense/core/issues/2374