4 ms·

Wireguard’s founder, Jason Donenfeld, reviewed Wireguard implementation in Pfsense/FreeBSD. The review was very negative, with numerous pointers to critical (so

by aborsy 5y ago

Wireguard’s founder, Jason Donenfeld, reviewed Wireguard implementation in Pfsense/FreeBSD. The review was very negative, with numerous pointers to critical (sometimes childish) security flaws. Why would someone use a router operating system with such strongly negative review from a respected security specialist? A minimal Linux installation is an option, if your firewall is simple.

erk__ 5y ago
The implementation got pulled from FreeBSD and a new implementation have been made by contributors including Donenfeld, though it will likely not end up in mainline FreeBSD before the next release.
hunta2097 5y ago
Shout out for Shorewall, i've been using it as my primary firewall-helper for nearly 20 years with 0 upgrade hassle. It's a perfect-balance of power and simplicity. It doesn't have a web interface but is just a nice way configure Linux' built-in networking features. It doesn't consume any extra resources and will run anywhere Linux does.
IntelMiner 5y ago
I've been quietly nibbling away at making my own "router distro" since PFsense's wireguard fiasco I never much liked PFsense as a project. It feels very convoluted, and the hardware they sell (I was an early adopter of the then-new SG1000 appliance) is laughably exaggerated in its capabilities But the Wireguard event is where they went from "incompetent" to "malicious" in my eyes I ordered a Rasberry Pi 4 compute module and this accompanying ethernet breakout kit after seeing a review from Jeff Geerling (Raspberry Pi accessory mad scientist) and am currently waiting for it to arrive https://www.dfrobot.com/product-2242.html https://www.dfrobot.com/product-2242.html I know I could just use something like OpenWRT, indeed I do have a lot of respect for the OpenWRT project. But I feel that the distro is more geared toward, well, routers. Devices with maybe 32 megs of flash storage and a slow MIPS CPU. Not a moderately powerful ARM machine with 8 gigs of RAM and gigabytes of SD or eMMC storage
- dsr_ 5y ago
  In 2014 I decided that what I wanted most out of my house router was ongoing software updates from the distro, and that I would be willing to pay more for the hardware in exchange. For seven years, then, I've had a mini-ITX x86-64 box with a small SSD, 4GB RAM, and 5 gigabit NICs running Debian Stable. It's been upgraded in place and I see no reason why the upgrade to Bullseye in a month or two won't go as smoothly. I think a Pi4 is roughly comparable in computation capacity, perhaps less so in I/O -- but what I've got is clearly overkill, anyway.
  - IntelMiner 5y ago
    That's effectively my current setup, some random Dell i3-4310 machine. But it's just overkill as hell for a basic router on a 100 megabit internet link The Pi one can apparently saturate a gigabit iperf test without issue, so it sounds like a great replacement and rainy day project
    - pak9rabid 5y ago
      These systems here make pretty bad ass router/firewalls: https://www.pcengines.ch/apu2.htm https://www.pcengines.ch/apu2.htm I've been using them for years w/out any issue. I just run standard Debian stable as well, with a few tweaks to make it more friendly for a read-only operating environment (to prevent wearing out the flash memory).
- jon_adler 5y ago
  I’m very happy with my Proxmox x86 host running OpenWRT x86 in a container. It works beautify. I love how fast it is to take a backup/snapshot to try out new configurations and rollback in case of issues. The same host runs plenty of other services like home assistant. I had pfSense working before OpenWRT but wanted wireguard so I made the switch.
- visualphoenix 5y ago
  I’ve been exploring this as well with the same hardware stack. Any interest in collaborating? If so, hit me up with the info in my profile.

by aborsy 5y ago

erk__ 5y ago

The implementation got pulled from FreeBSD and a new implementation have been made by contributors including Donenfeld, though it will likely not end up in mainline FreeBSD before the next release.

hunta2097 5y ago

Shout out for Shorewall, i've been using it as my primary firewall-helper for nearly 20 years with 0 upgrade hassle. It's a perfect-balance of power and simplicity. It doesn't have a web interface but is just a nice way configure Linux' built-in networking features. It doesn't consume any extra resources and will run anywhere Linux does.

IntelMiner 5y ago

I've been quietly nibbling away at making my own "router distro" since PFsense's wireguard fiasco I never much liked PFsense as a project. It feels very convoluted, and the hardware they sell (I was an early adopter of the then-new SG1000 appliance) is laughably exaggerated in its capabilities But the Wireguard event is where they went from "incompetent" to "malicious" in my eyes I ordered a Rasberry Pi 4 compute module and this accompanying ethernet breakout kit after seeing a review from Jeff Geerling (Raspberry Pi accessory mad scientist) and am currently waiting for it to arrive https://www.dfrobot.com/product-2242.html https://www.dfrobot.com/product-2242.html I know I could just use something like OpenWRT, indeed I do have a lot of respect for the OpenWRT project. But I feel that the distro is more geared toward, well, routers. Devices with maybe 32 megs of flash storage and a slow MIPS CPU. Not a moderately powerful ARM machine with 8 gigs of RAM and gigabytes of SD or eMMC storage

dsr_ 5y ago
In 2014 I decided that what I wanted most out of my house router was ongoing software updates from the distro, and that I would be willing to pay more for the hardware in exchange. For seven years, then, I've had a mini-ITX x86-64 box with a small SSD, 4GB RAM, and 5 gigabit NICs running Debian Stable. It's been upgraded in place and I see no reason why the upgrade to Bullseye in a month or two won't go as smoothly. I think a Pi4 is roughly comparable in computation capacity, perhaps less so in I/O -- but what I've got is clearly overkill, anyway.
- IntelMiner 5y ago
  That's effectively my current setup, some random Dell i3-4310 machine. But it's just overkill as hell for a basic router on a 100 megabit internet link The Pi one can apparently saturate a gigabit iperf test without issue, so it sounds like a great replacement and rainy day project
  - pak9rabid 5y ago
    These systems here make pretty bad ass router/firewalls: https://www.pcengines.ch/apu2.htm https://www.pcengines.ch/apu2.htm I've been using them for years w/out any issue. I just run standard Debian stable as well, with a few tweaks to make it more friendly for a read-only operating environment (to prevent wearing out the flash memory).
jon_adler 5y ago
I’m very happy with my Proxmox x86 host running OpenWRT x86 in a container. It works beautify. I love how fast it is to take a backup/snapshot to try out new configurations and rollback in case of issues. The same host runs plenty of other services like home assistant. I had pfSense working before OpenWRT but wanted wireguard so I made the switch.
visualphoenix 5y ago
I’ve been exploring this as well with the same hardware stack. Any interest in collaborating? If so, hit me up with the info in my profile.